@patronage/software-factory 0.30.0-beta.1 → 0.30.0

package/dist/index.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
-import { t as __exportAll } from "./chunk-DrSxFLj_.js";
-import { createRequire } from "node:module";
+import { t as __exportAll } from "./chunk-pbuEa-1d.js";
 import { appendFileSync, constants, cpSync, createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { Command, InvalidArgumentError } from "commander";
@@ -18,7 +17,7 @@ import picomatch from "picomatch";
 import { promisify } from "node:util";
 import { parse } from "yaml";
 //#region package.json
-var version = "0.30.0-beta.1";
+var version = "0.30.0";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -931,12 +930,16 @@ const requiredCheckInScope = ({ context, scope }) => {
 //#region src/profile.ts
 const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
 /**
-* The shapes v4 replaced. Not loadable — {@link legacyProfileMigration} turns
-* an encounter with either into a per-field migration error rather than a
+* The shapes v5 replaced. Not loadable — {@link legacyProfileMigration} turns
+* an encounter with one into a per-field migration error rather than a
 * schema complaint about a shape the profile was never written in.
 */
-const LEGACY_PROFILE_SCHEMA_VERSIONS = [2, 3];
-const PROFILE_JSON_SCHEMA_DESCRIPTION = "Editor validation covers the profile input shape and straightforward cross-field constraints. Zod remains the load-time enforcement authority. The following invariants are enforced at load time, not by this schema: verification command names must be distinct; requiredChecks entries must have distinct names; and every review.conditional mode must also appear in review.modes.";
+const LEGACY_PROFILE_SCHEMA_VERSIONS = [
+	2,
+	3,
+	4
+];
+const PROFILE_JSON_SCHEMA_DESCRIPTION = "Editor validation covers the profile input shape and straightforward cross-field constraints. Zod remains the load-time enforcement authority: verification command names must be distinct and requiredChecks entries must have distinct names; these invariants are enforced at load time, not by this schema.";
 const globSchema = z.string().min(1).refine(isValidGlob, "must be a valid glob");
 const commandSchema = z.object({
 	command: z.string().min(1),
@@ -949,11 +952,7 @@ const commandSchema = z.object({
 		"full"
 	]).default("full")
 });
-const reviewModeSchema = z.enum(["correctness", "security"]);
-const conditionalReviewSchema = z.object({
-	modes: z.array(reviewModeSchema).min(1),
-	paths: z.array(z.string().min(1).refine(isValidGlob, "must be a valid glob")).min(1)
-}).strict();
+const conditionalReviewSchema = z.object({ paths: z.array(z.string().min(1).refine(isValidGlob, "must be a valid glob")).min(1) }).strict();
 const hqEndpointDeclarationSchema = z.intersection(z.string().url(), z.string().regex(/^https:\/\/[^/@\s]+(?:[/?#]|$)/u, "Must use HTTPS without embedded credentials"));
 const hqIngestConfigSchema = z.object({
 	enabled: z.boolean(),
@@ -967,22 +966,18 @@ const hqIngestConfigSchema = z.object({
 	}, "Must be an HTTPS origin without a path, query, fragment, or embedded credentials").describe("Repository-declared HQ origin (scheme and host only; the factory composes the ingest path). Credential delivery additionally requires exact-origin authorization in the operator user config hqAllowedOrigins list.")
 }).strict();
 const requiredCheckSchema = z.object({
-	checkType: z.enum(EVIDENCE_CHECK_TYPES$1),
 	name: z.string().min(1),
 	scope: requiredCheckScopeSchema$1.optional()
 }).strict();
 const factoryProjectProfileSchema = z.object({
 	$schema: z.string().min(1).optional(),
-	env: z.object({ required: z.array(z.string().regex(/^[A-Z_][A-Z0-9_]*$/u)) }).strict().optional(),
 	extensions: z.record(z.string(), z.unknown()).optional(),
 	hq: hqIngestConfigSchema.optional(),
-	project: z.object({ key: z.string().min(1) }).strict(),
 	proof: z.object({ classificationPolicy: z.object({
 		docsOnly: z.array(globSchema).default([]),
 		trivial: z.array(globSchema).default([])
 	}).strict() }).strict(),
 	repository: z.object({
-		defaultBranch: z.string().min(1),
 		name: z.string().min(1),
 		owner: z.string().min(1)
 	}).strict(),
@@ -993,12 +988,8 @@ const factoryProjectProfileSchema = z.object({
 			message: "requiredChecks entries must have distinct names."
 		});
 	}).optional(),
-	review: z.object({
-		conditional: z.array(conditionalReviewSchema).optional(),
-		defaultMaxCycles: z.number().int().positive(),
-		modes: z.array(reviewModeSchema).min(1)
-	}).strict(),
-	schemaVersion: z.literal(4),
+	review: z.object({ conditional: z.array(conditionalReviewSchema).min(1) }).strict().optional(),
+	schemaVersion: z.literal(5),
 	verification: z.object({ commands: z.array(commandSchema).min(1) })
 }).strict().superRefine((profile, context) => {
 	const commandNames = /* @__PURE__ */ new Set();
@@ -1019,8 +1010,7 @@ const factoryProjectProfileSchema = z.object({
 	const mappedChecks = /* @__PURE__ */ new Set();
 	for (const [commandIndex, command] of profile.verification.commands.entries()) {
 		if (!command.requiredCheck) continue;
-		const requiredCheck = requiredChecks.get(command.requiredCheck);
-		if (!requiredCheck) {
+		if (!requiredChecks.get(command.requiredCheck)) {
 			context.addIssue({
 				code: "custom",
 				message: `Verification command requiredCheck "${command.requiredCheck}" does not name a declared requiredChecks entry.`,
@@ -1033,16 +1023,6 @@ const factoryProjectProfileSchema = z.object({
 			});
 			continue;
 		}
-		if (requiredCheck.checkType !== "verify") context.addIssue({
-			code: "custom",
-			message: `Verification command requiredCheck "${command.requiredCheck}" must target a verify requiredCheck.`,
-			path: [
-				"verification",
-				"commands",
-				commandIndex,
-				"requiredCheck"
-			]
-		});
 		if (mappedChecks.has(command.requiredCheck)) context.addIssue({
 			code: "custom",
 			message: `Required check "${command.requiredCheck}" is mapped by more than one verification command.`,
@@ -1055,16 +1035,6 @@ const factoryProjectProfileSchema = z.object({
 		});
 		mappedChecks.add(command.requiredCheck);
 	}
-	for (const [scopeIndex, conditional] of (profile.review.conditional ?? []).entries()) for (const mode of conditional.modes) if (!profile.review.modes.includes(mode)) context.addIssue({
-		code: "custom",
-		message: `Conditional review mode "${mode}" must also be declared in review.modes.`,
-		path: [
-			"review",
-			"conditional",
-			scopeIndex,
-			"modes"
-		]
-	});
 }).meta({ description: PROFILE_JSON_SCHEMA_DESCRIPTION });
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
@@ -1127,11 +1097,35 @@ function v2MigrationLines(input, root) {
 	} catch {}
 	return lines;
 }
+function hasCorrectnessOnlyReview(review) {
+	const { modes } = review;
+	return Object.keys(review).length > 0 && Object.keys(review).every((field) => field === "conditional" || field === "defaultMaxCycles" || field === "modes") && Array.isArray(modes) && modes.length > 0 && modes.every((mode) => mode === "correctness") && (review.conditional === void 0 || Array.isArray(review.conditional) && review.conditional.length === 0);
+}
+const v4MigrationLines = (input) => {
+	const lines = [];
+	if (isRecord(input.project) && "key" in input.project) lines.push("project.key -> removed; current proof writers derive projectKey from repository.name");
+	if (isRecord(input.repository) && "defaultBranch" in input.repository) lines.push("repository.defaultBranch -> removed; commands resolve the live base from Git/GitHub or an explicit --base");
+	if (isRecord(input.env) && "required" in input.env) lines.push("env.required -> removed; the command that needs an environment value owns its fail-closed diagnostic");
+	if (isRecord(input.review)) {
+		const isCorrectnessOnlyReview = hasCorrectnessOnlyReview(input.review);
+		if ("defaultMaxCycles" in input.review) lines.push("review.defaultMaxCycles -> removed; the factory review cap is 5");
+		if ("modes" in input.review) lines.push("review.modes -> removed; correctness is always required");
+		if (isCorrectnessOnlyReview) lines.push("review -> removed; a correctness-only review has no v5 configuration, so delete the object");
+		if (Array.isArray(input.review.conditional)) {
+			for (const [index, conditional] of input.review.conditional.entries()) if (isRecord(conditional) && "modes" in conditional) lines.push(`review.conditional[${index}].modes -> removed; each retained conditional path list demands security review`);
+		}
+	}
+	if (Array.isArray(input.requiredChecks)) {
+		for (const [index, check] of input.requiredChecks.entries()) if (isRecord(check) && "checkType" in check) lines.push(`requiredChecks[${index}].checkType -> removed; external required checks are verify-type`);
+	}
+	return lines;
+};
 function legacyProfileMigration(input, root) {
 	if (!(isRecord(input) && typeof input.schemaVersion === "number" && LEGACY_PROFILE_SCHEMA_VERSIONS.includes(input.schemaVersion))) return;
 	const foundVersion = input.schemaVersion;
-	const lines = [`schemaVersion ${foundVersion} -> 4`];
+	const lines = [`schemaVersion ${foundVersion} -> 5`];
 	if (foundVersion === 2) lines.push(...v2MigrationLines(input, root));
+	lines.push(...v4MigrationLines(input));
 	return {
 		foundVersion,
 		lines
@@ -1198,7 +1192,7 @@ function hqLaneRefBaseUrlFromProfile(profile) {
 	return hqLaneRefBaseUrl(profile.hq.endpoint);
 }
 function formatLegacyProfileError(profilePath, foundVersion, migration) {
-	return [`Profile is invalid: ${profilePath}: schemaVersion ${foundVersion} is not supported; migrate to schemaVersion 4 (ADR 0023).`, ...migration.map((line) => `  ${line}`)].join("\n");
+	return [`Profile is invalid: ${profilePath}: schemaVersion ${foundVersion} is not supported; migrate to schemaVersion 5 (ADR 0023).`, ...migration.map((line) => `  ${line}`)].join("\n");
 }
 function formatProfileError(profilePath, error) {
 	return `Profile is invalid: ${profilePath}: ${error.issues.map((issue) => {
@@ -3798,6 +3792,7 @@ const authorizeDemandWaiver = ({ authenticatedLogin, session }) => {
 		...normalizedSession && normalizedSession !== "unknown" ? { session: normalizedSession } : {}
 	} };
 };
+const LEGACY_CLOSEOUT_SCHEMA_VERSION = 3;
 const MAX_CLOSEOUT_ROWS = 1e3;
 const IdentifierSchema = z.string().min(1).max(500);
 const NarrativeSchema = z.string().min(1).max(1e4);
@@ -3809,11 +3804,15 @@ const CloseoutLandingSpotSchema = z.enum([
 	"skill",
 	"ADR"
 ]);
-const CloseoutSourceSchema = z.object({
+const CurrentCloseoutSourceSchema = z.object({
+	detail: NarrativeSchema,
+	kind: z.literal("boundary-thermo-attestation")
+}).strict();
+const LegacyCloseoutSourceSchema = z.object({
 	detail: NarrativeSchema,
 	kind: z.enum(["interior-telemetry", "boundary-thermo-attestation"])
 }).strict();
-const CloseoutScopingSchema = z.object({
+const LegacyCloseoutScopingSchema = z.object({
 	epic: IdentifierSchema,
 	issueFilter: z.number().int().positive().optional(),
 	prFilter: z.number().int().positive().optional(),
@@ -3825,9 +3824,13 @@ const CloseoutScopingSchema = z.object({
 	}).strict()
 }).strict();
 const CloseoutBudgetSchema = z.object({
+	note: NarrativeSchema,
+	tier: z.literal("overseer")
+}).strict();
+const LegacyCloseoutBudgetSchema = z.object({
 	interiorSourcesConsumed: z.number().int().nonnegative(),
 	note: NarrativeSchema,
-	scoping: CloseoutScopingSchema.optional(),
+	scoping: LegacyCloseoutScopingSchema.optional(),
 	tier: z.literal("overseer")
 }).strict();
 const BoundaryThermoAttestationSchema = z.object({
@@ -3839,7 +3842,23 @@ const BoundaryThermoAttestationSchema = z.object({
 const CloseoutMetricRowSchema = z.object({
 	label: IdentifierSchema,
 	metric: IdentifierSchema,
-	source: CloseoutSourceSchema,
+	source: CurrentCloseoutSourceSchema,
+	unit: z.enum([
+		"count",
+		"boolean",
+		"text"
+	]),
+	value: z.union([
+		z.number(),
+		NarrativeSchema,
+		z.boolean(),
+		z.null()
+	])
+}).strict();
+const LegacyCloseoutMetricRowSchema = z.object({
+	label: IdentifierSchema,
+	metric: IdentifierSchema,
+	source: LegacyCloseoutSourceSchema,
 	unit: z.enum([
 		"tokens",
 		"usd",
@@ -3860,14 +3879,21 @@ const CloseoutLessonSchema = z.object({
 	landingSpot: CloseoutLandingSpotSchema,
 	lesson: NarrativeSchema,
 	rationale: NarrativeSchema.optional(),
-	source: CloseoutSourceSchema.optional()
+	source: CurrentCloseoutSourceSchema.optional()
+}).strict();
+const LegacyCloseoutLessonSchema = z.object({
+	id: IdentifierSchema,
+	landingSpot: CloseoutLandingSpotSchema,
+	lesson: NarrativeSchema,
+	rationale: NarrativeSchema.optional(),
+	source: LegacyCloseoutSourceSchema.optional()
 }).strict();
 const CloseoutBlindspotSchema = z.object({
 	id: IdentifierSchema,
 	note: NarrativeSchema,
 	reason: NarrativeSchema.optional()
 }).strict();
-const CloseoutLedgerRowSchema = z.object({
+const closeoutLedgerRowSchema = (schemaVersion) => z.object({
 	detail: NarrativeSchema.optional(),
 	epic: IdentifierSchema,
 	generatedAt: z.iso.datetime(),
@@ -3879,7 +3905,7 @@ const CloseoutLedgerRowSchema = z.object({
 		"lesson",
 		"blindspot"
 	]),
-	schemaVersion: z.literal(3),
+	schemaVersion: z.literal(schemaVersion),
 	source: NarrativeSchema,
 	unit: IdentifierSchema.optional(),
 	value: z.union([
@@ -3888,19 +3914,37 @@ const CloseoutLedgerRowSchema = z.object({
 		z.null()
 	])
 }).strict();
-/** Strict, bounded runtime transport contract emitted by factory:closeout. */
-const closeoutArtifactSchema = z.object({
+const CloseoutLedgerRowSchema = closeoutLedgerRowSchema(4);
+const LegacyCloseoutLedgerRowSchema = closeoutLedgerRowSchema(LEGACY_CLOSEOUT_SCHEMA_VERSION);
+const closeoutArtifactShape = (input) => z.object({
 	boundaryThermo: BoundaryThermoAttestationSchema,
-	budget: CloseoutBudgetSchema,
+	budget: input.budget,
 	couldNotSee: z.array(CloseoutBlindspotSchema).min(1).max(MAX_CLOSEOUT_ROWS),
 	epic: IdentifierSchema,
 	generatedAt: z.iso.datetime(),
-	ledgerRows: z.array(CloseoutLedgerRowSchema).max(MAX_CLOSEOUT_ROWS),
-	lessons: z.array(CloseoutLessonSchema).max(MAX_CLOSEOUT_ROWS),
-	metrics: z.array(CloseoutMetricRowSchema).max(MAX_CLOSEOUT_ROWS),
+	ledgerRows: z.array(input.ledgerRows).max(MAX_CLOSEOUT_ROWS),
+	lessons: z.array(input.lessons).max(MAX_CLOSEOUT_ROWS),
+	metrics: z.array(input.metrics).max(MAX_CLOSEOUT_ROWS),
 	repo: RepoSchema,
-	schemaVersion: z.literal(3)
+	schemaVersion: z.literal(input.schemaVersion)
 }).strict();
+/** Strict, bounded runtime transport contract emitted by factory:closeout. */
+const closeoutArtifactSchema = closeoutArtifactShape({
+	budget: CloseoutBudgetSchema,
+	ledgerRows: CloseoutLedgerRowSchema,
+	lessons: CloseoutLessonSchema,
+	metrics: CloseoutMetricRowSchema,
+	schemaVersion: 4
+});
+/** Reader-only compatibility for closeout artifacts written before #554. */
+const legacyCloseoutArtifactSchema = closeoutArtifactShape({
+	budget: LegacyCloseoutBudgetSchema,
+	ledgerRows: LegacyCloseoutLedgerRowSchema,
+	lessons: LegacyCloseoutLessonSchema,
+	metrics: LegacyCloseoutMetricRowSchema,
+	schemaVersion: LEGACY_CLOSEOUT_SCHEMA_VERSION
+});
+z.union([closeoutArtifactSchema, legacyCloseoutArtifactSchema]);
 //#endregion
 //#region src/retro-envelope.ts
 /**
@@ -5246,8 +5290,8 @@ const resolveFindingBlocking = (finding, disposition = "open") => {
 	return severity === "critical" || severity === "high" || severity === "unknown";
 };
 const DEFAULT_INTERIOR_REVIEW_CAP = 0;
-const resolveReviewLadderPolicy = (profile) => ({
-	gate: { cap: profile.review.defaultMaxCycles },
+const resolveReviewLadderPolicy = () => ({
+	gate: { cap: 5 },
 	interior: { cap: DEFAULT_INTERIOR_REVIEW_CAP }
 });
 //#endregion
@@ -7458,579 +7502,6 @@ function createFactoryCheckPublisher(output, dependencies = {}) {
 	};
 }
 //#endregion
-//#region src/interior-telemetry/codex-usage.ts
-const walkCodexJson = (value, visit) => {
-	if (!value || typeof value !== "object") return;
-	if (Array.isArray(value)) {
-		for (const entry of value) walkCodexJson(entry, visit);
-		return;
-	}
-	const record = value;
-	visit(record);
-	for (const entry of Object.values(record)) walkCodexJson(entry, visit);
-};
-const parseCodexJsonlEvents = (stdout) => stdout.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).flatMap((line) => {
-	try {
-		return [JSON.parse(line)];
-	} catch {
-		return [];
-	}
-});
-const integerValue = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
-const valueForKeys = (record, keys) => {
-	for (const key of keys) {
-		const value = integerValue(record[key]);
-		if (value !== void 0) return value;
-	}
-};
-const usageFromRecord = (record) => {
-	const inputTokens = valueForKeys(record, [
-		"input_tokens",
-		"inputTokens",
-		"prompt_tokens",
-		"promptTokens"
-	]);
-	const outputTokens = valueForKeys(record, [
-		"completion_tokens",
-		"completionTokens",
-		"output_tokens",
-		"outputTokens"
-	]);
-	const totalTokens = valueForKeys(record, [
-		"total_token_count",
-		"totalTokenCount",
-		"total_tokens",
-		"totalTokens"
-	]) ?? (inputTokens !== void 0 && outputTokens !== void 0 ? inputTokens + outputTokens : void 0);
-	if (totalTokens === void 0) return;
-	return {
-		cachedInputTokens: valueForKeys(record, [
-			"cached_input_tokens",
-			"cachedInputTokens",
-			"cacheReadTokens"
-		]) ?? null,
-		inputTokens: inputTokens ?? null,
-		outputTokens: outputTokens ?? null,
-		reasoningOutputTokens: valueForKeys(record, ["reasoning_output_tokens", "reasoningOutputTokens"]) ?? null,
-		source: "codex-json",
-		status: "available",
-		totalTokens
-	};
-};
-const isInteriorTurn = (record) => {
-	const role = typeof record.role === "string" ? record.role : "";
-	return (typeof record.type === "string" ? record.type : "").includes("agent") || role === "assistant";
-};
-const CODEX_TOOL_EVENT_TYPES = new Set([
-	"function_call",
-	"function_call_output",
-	"local_shell_call",
-	"local_shell_call_output",
-	"custom_tool_call",
-	"custom_tool_call_output",
-	"tool_call",
-	"tool_result"
-]);
-const isToolCall = (record) => {
-	const role = typeof record.role === "string" ? record.role : "";
-	const type = typeof record.type === "string" ? record.type : "";
-	return role === "tool" || type.includes("tool") || CODEX_TOOL_EVENT_TYPES.has(type);
-};
-const processCodexEvent = (event, metrics) => {
-	let turnCounted = false;
-	let toolCallCounted = false;
-	walkCodexJson(event, (record) => {
-		if (!turnCounted && isInteriorTurn(record)) {
-			metrics.interiorTurns += 1;
-			turnCounted = true;
-		}
-		if (!toolCallCounted && isToolCall(record)) {
-			metrics.toolCalls += 1;
-			toolCallCounted = true;
-		}
-	});
-};
-const parseCodexExecJsonContent = (output) => {
-	const events = parseCodexJsonlEvents(output);
-	if (events.length === 0) return {
-		interiorTurns: 0,
-		tokensByKind: {
-			missingReason: "codex-json-events-missing",
-			status: "unavailable"
-		},
-		toolCalls: 0
-	};
-	const metrics = {
-		interiorTurns: 0,
-		toolCalls: 0
-	};
-	const usageCandidates = [];
-	for (const event of events) {
-		processCodexEvent(event, metrics);
-		walkCodexJson(event, (record) => {
-			const usage = usageFromRecord(record);
-			if (usage) usageCandidates.push(usage);
-		});
-	}
-	return {
-		interiorTurns: metrics.interiorTurns,
-		tokensByKind: usageCandidates.at(-1) ?? {
-			missingReason: "codex-json-usage-not-emitted",
-			status: "unavailable"
-		},
-		toolCalls: metrics.toolCalls
-	};
-};
-const parseCodexExecJsonFile = (logPath) => {
-	try {
-		return parseCodexExecJsonContent(readFileSync(logPath, "utf-8"));
-	} catch {
-		return {
-			interiorTurns: 0,
-			tokensByKind: {
-				missingReason: "codex-log-missing-or-unreadable",
-				status: "unavailable"
-			},
-			toolCalls: 0
-		};
-	}
-};
-//#endregion
-//#region src/interior-telemetry/types.ts
-const ROLE_CLASSIFICATION_FALLBACK = "coder";
-const ROLE_CLASSIFICATION_FALLBACK_REASON = "ambiguous-driving-prompt-default-coder";
-//#endregion
-//#region src/interior-telemetry/cursor-store.ts
-const PREAMBLE_CLOSE_TAGS = ["</user_info>", "</git_status>"];
-const REVIEWER_MARKERS = [
-	"reviewer",
-	"review",
-	"findings",
-	"pr-review-proof"
-];
-/** Strong reviewer signals take precedence over incidental coder markers. */
-const STRONG_REVIEWER_MARKERS = [
-	"reviewer",
-	"findings",
-	"pr-review-proof"
-];
-const CODER_MARKERS = [
-	"implementation worker",
-	"coder",
-	"implement ",
-	"write the diff",
-	"write the code",
-	"you write the"
-];
-/**
-* Remove negated "write" phrasing before coder marker matching so prohibitions
-* like "do not write" / "never write" never count as coder signals.
-*/
-const NEGATED_WRITE_PATTERN = /\b(?:do not|does not|don't|never|no)\s+writ\w*/giu;
-const READ_ONLY_PATTERN = /\bread[\s-]?only\b/giu;
-const scrubNegatedCoderPhrasing = (text) => text.replace(NEGATED_WRITE_PATTERN, " ").replace(READ_ONLY_PATTERN, " ");
-const escapeRegex = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-/** Match markers on token boundaries so substrings like "preview" never hit "review". */
-const markerMatches = (text, marker) => {
-	const parts = marker.trim().split(/\s+/u).filter((part) => part.length > 0);
-	if (parts.length === 0) return false;
-	const pattern = parts.map(escapeRegex).join("\\s+");
-	return new RegExp(`(?<![a-z0-9])${pattern}(?![a-z0-9])`, "iu").test(text);
-};
-const VERDICT_MARKER = "PR-REVIEW-PROOF-END";
-const asBytes = (data) => {
-	if (Buffer.isBuffer(data)) return data;
-	if (data instanceof Uint8Array) return data;
-};
-const isJsonBlob = (data) => {
-	for (const byte of data) {
-		if (byte === 32 || byte === 9 || byte === 10 || byte === 13) continue;
-		return byte === 123;
-	}
-	return false;
-};
-const partText = (part) => {
-	if (typeof part === "string") return part;
-	if (!part || typeof part !== "object") return "";
-	const record = part;
-	if (typeof record.text === "string") return record.text;
-	if (typeof record.content === "string") return record.content;
-	return "";
-};
-const normalizeMessageContent = (content) => {
-	if (typeof content === "string") return content;
-	if (!Array.isArray(content)) return "";
-	return content.map(partText).join("");
-};
-const stripPreamble = (text) => {
-	let remainder = text;
-	for (const closeTag of PREAMBLE_CLOSE_TAGS) {
-		const index = remainder.indexOf(closeTag);
-		if (index !== -1) remainder = remainder.slice(index + closeTag.length);
-	}
-	return remainder.trim();
-};
-const classifyRoleFromDrivingPrompt = (drivingPrompt) => {
-	const normalized = drivingPrompt.toLowerCase();
-	const scrubbed = scrubNegatedCoderPhrasing(normalized);
-	const reviewerHits = REVIEWER_MARKERS.filter((marker) => markerMatches(normalized, marker));
-	const coderHits = CODER_MARKERS.filter((marker) => markerMatches(scrubbed, marker));
-	if (reviewerHits.length > 0 && coderHits.length === 0) return {
-		reason: `reviewer-markers:${reviewerHits.join(",")}`,
-		role: "reviewer"
-	};
-	if (coderHits.length > 0 && reviewerHits.length === 0) return {
-		reason: `coder-markers:${coderHits.join(",")}`,
-		role: "coder"
-	};
-	if (reviewerHits.length > 0 && coderHits.length > 0) {
-		if (markerMatches(scrubbed, "implementation worker")) return {
-			reason: "conflicting-markers-implementation-worker-priority",
-			role: "coder"
-		};
-		const strongReviewerHits = STRONG_REVIEWER_MARKERS.filter((marker) => markerMatches(normalized, marker));
-		if (strongReviewerHits.length > 0) return {
-			reason: `conflicting-markers-strong-reviewer-priority:${strongReviewerHits.join(",")}`,
-			role: "reviewer"
-		};
-	}
-	return {
-		reason: ROLE_CLASSIFICATION_FALLBACK_REASON,
-		role: ROLE_CLASSIFICATION_FALLBACK
-	};
-};
-const drivingPromptFromMessages = (messages) => {
-	const userMessages = messages.filter((message) => message.role === "user");
-	if (userMessages.length === 0) return "";
-	const afterPreamble = stripPreamble(normalizeMessageContent(userMessages[0]?.content));
-	if (afterPreamble.length > 0) return afterPreamble;
-	for (const message of userMessages.slice(1)) {
-		const text = normalizeMessageContent(message.content).trim();
-		if (text.length > 0) return text;
-	}
-	return "";
-};
-const parseStoreMessages = (storePath) => {
-	const require = createRequire(import.meta.url);
-	let DatabaseSync;
-	try {
-		({DatabaseSync} = require("node:sqlite"));
-	} catch {
-		throw new Error("node:sqlite requires Node >= 22.5.0 to read cursor store.db");
-	}
-	const db = new DatabaseSync(storePath, { readOnly: true });
-	try {
-		if (!db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='blobs'").get()) throw new Error("cursor store.db has no blobs table");
-		const rows = db.prepare("SELECT data FROM blobs").all();
-		const messages = [];
-		for (const row of rows) {
-			const data = asBytes(row.data);
-			if (!data || !isJsonBlob(data)) continue;
-			try {
-				const parsed = JSON.parse(Buffer.from(data).toString("utf-8"));
-				if (parsed && typeof parsed === "object") messages.push(parsed);
-			} catch {
-				continue;
-			}
-		}
-		return messages;
-	} finally {
-		db.close();
-	}
-};
-const metricsFromMessages = (messages) => {
-	let interiorTurns = 0;
-	let toolCalls = 0;
-	let verdictEmitted = false;
-	for (const message of messages) {
-		if (message.role === "assistant") {
-			interiorTurns += 1;
-			if (normalizeMessageContent(message.content).includes(VERDICT_MARKER)) verdictEmitted = true;
-		}
-		if (message.role === "tool") toolCalls += 1;
-	}
-	const classification = classifyRoleFromDrivingPrompt(drivingPromptFromMessages(messages));
-	return {
-		interiorTurns,
-		role: classification.role,
-		roleClassificationReason: classification.reason,
-		toolCalls,
-		verdictEmitted
-	};
-};
-const readChatMeta = (storePath) => {
-	const metaPath = path.join(path.dirname(storePath), "meta.json");
-	try {
-		const raw = readFileSync(metaPath, "utf-8");
-		const parsed = JSON.parse(raw);
-		const meta = {};
-		if (typeof parsed.cwd === "string") meta.cwd = parsed.cwd;
-		if (typeof parsed.createdAtMs === "number") meta.createdAtMs = parsed.createdAtMs;
-		return Object.keys(meta).length > 0 ? meta : void 0;
-	} catch {
-		return;
-	}
-};
-const chatIdFromStorePath = (storePath) => path.basename(path.dirname(storePath));
-const parseCursorStore = (storePath) => {
-	const metrics = metricsFromMessages(parseStoreMessages(storePath));
-	return {
-		chatId: chatIdFromStorePath(storePath),
-		meta: readChatMeta(storePath),
-		storePath,
-		...metrics
-	};
-};
-//#endregion
-//#region src/interior-telemetry/usage-csv.ts
-const COLUMN_ALIASES = {
-	cachedInputTokens: [
-		"Cache Read",
-		"cache read",
-		"cache_read",
-		"cachedInputTokens"
-	],
-	inputTokens: [
-		"Input",
-		"input",
-		"input_tokens",
-		"inputTokens",
-		"Input (w/ Cache Write)",
-		"Input (w/o Cache Write)"
-	],
-	outputTokens: [
-		"Output Tokens",
-		"output tokens",
-		"output_tokens",
-		"outputTokens"
-	],
-	totalTokens: [
-		"Total Tokens",
-		"total tokens",
-		"total_tokens",
-		"totalTokens"
-	]
-};
-const parseCsvCell = (value) => {
-	if (value === void 0) return null;
-	const trimmed = value.trim();
-	return trimmed.length === 0 ? null : trimmed;
-};
-const parseIntegerCell = (value) => {
-	const cell = parseCsvCell(value);
-	if (cell === null) return null;
-	const parsed = Math.trunc(Number(cell));
-	return Number.isInteger(parsed) && parsed >= 0 ? parsed : null;
-};
-const parseCsvLine = (line) => {
-	const fields = [];
-	let current = "";
-	let inQuotes = false;
-	for (let index = 0; index < line.length; index += 1) {
-		const char = line[index];
-		if (char === "\"") {
-			if (inQuotes && line[index + 1] === "\"") {
-				current += "\"";
-				index += 1;
-			} else inQuotes = !inQuotes;
-			continue;
-		}
-		if (char === "," && !inQuotes) {
-			fields.push(current);
-			current = "";
-			continue;
-		}
-		current += char;
-	}
-	fields.push(current);
-	return fields;
-};
-const headerIndex = (headers, aliases) => {
-	const normalized = headers.map((header) => header.trim());
-	for (const alias of aliases) {
-		const index = normalized.indexOf(alias);
-		if (index !== -1) return index;
-	}
-	return -1;
-};
-const headerIndices = (headers, aliases) => {
-	const normalized = headers.map((header) => header.trim());
-	const indices = [];
-	for (let index = 0; index < normalized.length; index += 1) {
-		const header = normalized[index];
-		if (header !== void 0 && aliases.some((alias) => alias === header)) indices.push(index);
-	}
-	return indices;
-};
-const aggregateColumn = (rows, columnIndex) => {
-	if (columnIndex === -1) return null;
-	let sum = 0;
-	let sawValue = false;
-	for (const row of rows) {
-		const value = parseIntegerCell(row[columnIndex]);
-		if (value !== null) {
-			sum += value;
-			sawValue = true;
-		}
-	}
-	return sawValue ? sum : null;
-};
-const aggregateColumns = (rows, columnIndices) => {
-	if (columnIndices.length === 0) return null;
-	let sum = 0;
-	let sawValue = false;
-	for (const row of rows) for (const columnIndex of columnIndices) {
-		const value = parseIntegerCell(row[columnIndex]);
-		if (value !== null) {
-			sum += value;
-			sawValue = true;
-		}
-	}
-	return sawValue ? sum : null;
-};
-const parseUsageCsvContent = (content) => {
-	const lines = content.split(/\r?\n/u).map((line) => line.trim()).filter((line) => line.length > 0);
-	if (lines.length < 2) return {
-		missingReason: "cursor-csv-empty-or-header-only",
-		status: "unavailable"
-	};
-	const headers = parseCsvLine(lines[0] ?? "");
-	const dataRows = lines.slice(1).map(parseCsvLine);
-	const inputIndices = headerIndices(headers, COLUMN_ALIASES.inputTokens);
-	const cachedIndex = headerIndex(headers, COLUMN_ALIASES.cachedInputTokens);
-	const outputIndex = headerIndex(headers, COLUMN_ALIASES.outputTokens);
-	const totalIndex = headerIndex(headers, COLUMN_ALIASES.totalTokens);
-	const inputTokens = aggregateColumns(dataRows, inputIndices);
-	const cachedInputTokens = aggregateColumn(dataRows, cachedIndex);
-	const outputTokens = aggregateColumn(dataRows, outputIndex);
-	const totalTokens = aggregateColumn(dataRows, totalIndex) ?? (inputTokens !== null && outputTokens !== null ? inputTokens + outputTokens : null);
-	if (totalTokens === null) return {
-		missingReason: "cursor-csv-no-total-tokens",
-		status: "unavailable"
-	};
-	return {
-		cachedInputTokens,
-		inputTokens,
-		outputTokens,
-		reasoningOutputTokens: null,
-		source: "cursor-csv",
-		status: "available",
-		totalTokens
-	};
-};
-const parseUsageCsvFile = (csvPath) => {
-	try {
-		return parseUsageCsvContent(readFileSync(csvPath, "utf-8"));
-	} catch {
-		return {
-			missingReason: "cursor-csv-missing-or-unreadable",
-			status: "unavailable"
-		};
-	}
-};
-//#endregion
-//#region src/interior-telemetry/extract.ts
-/**
-* Returns true when the store should be ingested under the given epic scope.
-* Absent/empty allowlists match everything (back-compat glob-all behavior).
-*/
-const chatMatchesEpicScope = (metrics, scope) => {
-	const chatIds = scope.chatIds ?? [];
-	const cwds = scope.cwds ?? [];
-	if (chatIds.length === 0 && cwds.length === 0) return true;
-	if (new Set(chatIds).has(metrics.chatId)) return true;
-	const cwd = metrics.meta?.cwd;
-	if (cwd !== void 0 && new Set(cwds).has(cwd)) return true;
-	return false;
-};
-const UNAVAILABLE_CURSOR_TOKENS = {
-	missingReason: "cursor-usage-csv-not-provided",
-	status: "unavailable"
-};
-/** Lane CSV has no per-chat breakdown; tokens attach to one cursor row only. */
-const UNAVAILABLE_LANE_LEVEL_CURSOR_TOKENS = {
-	missingReason: "cursor-csv-is-lane-level-tokens-attributed-once",
-	status: "unavailable"
-};
-const discoverStoreDbPaths = (rootDir) => {
-	const storePaths = [];
-	const visit = (currentPath) => {
-		let entries;
-		try {
-			entries = readdirSync(currentPath);
-		} catch {
-			return;
-		}
-		for (const entry of entries) {
-			const fullPath = path.join(currentPath, entry);
-			let stats;
-			try {
-				stats = statSync(fullPath);
-			} catch {
-				continue;
-			}
-			if (stats.isFile() && entry === "store.db") {
-				storePaths.push(fullPath);
-				continue;
-			}
-			if (stats.isDirectory()) visit(fullPath);
-		}
-	};
-	visit(rootDir);
-	return storePaths.toSorted();
-};
-const extractInteriorTelemetry = (options) => {
-	const rows = [];
-	const cursorTokens = options.usageCsvPath ? parseUsageCsvFile(options.usageCsvPath) : UNAVAILABLE_CURSOR_TOKENS;
-	if (options.chatsDir) {
-		const storePaths = discoverStoreDbPaths(options.chatsDir);
-		let cursorTokensAttributed = false;
-		for (const storePath of storePaths) {
-			let metrics;
-			try {
-				metrics = parseCursorStore(storePath);
-			} catch {
-				continue;
-			}
-			if (options.epicChatScope && !chatMatchesEpicScope(metrics, options.epicChatScope)) continue;
-			let tokensByKind = cursorTokens;
-			if (cursorTokensAttributed && cursorTokens.status === "available") tokensByKind = UNAVAILABLE_LANE_LEVEL_CURSOR_TOKENS;
-			else if (cursorTokens.status === "available") cursorTokensAttributed = true;
-			rows.push({
-				engine: "cursor",
-				interiorTurns: metrics.interiorTurns,
-				lane: options.lane,
-				role: metrics.role,
-				source: {
-					chatId: metrics.chatId,
-					kind: "cursor-store",
-					path: storePath
-				},
-				tokensByKind,
-				toolCalls: metrics.toolCalls,
-				verdictEmitted: metrics.verdictEmitted
-			});
-		}
-	}
-	if (options.codexLogPath) {
-		const codexMetrics = parseCodexExecJsonFile(options.codexLogPath);
-		rows.push({
-			engine: "codex",
-			interiorTurns: codexMetrics.interiorTurns,
-			lane: options.lane,
-			role: "coder",
-			source: {
-				kind: "codex-exec",
-				path: options.codexLogPath
-			},
-			tokensByKind: codexMetrics.tokensByKind,
-			toolCalls: codexMetrics.toolCalls,
-			verdictEmitted: false
-		});
-	}
-	return rows;
-};
-//#endregion
 //#region src/interior-telemetry/pricing-snapshot.ts
 /** Human-readable provenance tag, embedded in data-gap messages so an unpriced
 * block names the exact snapshot that lacked its model. */
@@ -8760,6 +8231,54 @@ function createBoundaryCheckCommand(output, action) {
 		if (record.status !== "ready") throw new Error(`boundary:check refused: ${record.blockingReasons.join("; ")}`);
 	}));
 }
+//#endregion
+//#region src/checkout-repository.ts
+function normalizeRepositoryIdentity(repository) {
+	return {
+		name: repository.name.replace(/\.git$/iu, "").toLowerCase(),
+		owner: repository.owner.toLowerCase()
+	};
+}
+const GITHUB_HOSTNAME = "github.com";
+const SCP_GITHUB_REMOTE_PATTERN = /^(?:[^@\s]+@)?github\.com:(?<path>[^\s]+)$/iu;
+function githubRepositoryPath(remoteUrl) {
+	const scpPath = SCP_GITHUB_REMOTE_PATTERN.exec(remoteUrl)?.groups?.path;
+	if (scpPath) return scpPath;
+	try {
+		const url = new URL(remoteUrl);
+		if (url.hostname.toLowerCase() !== GITHUB_HOSTNAME) return;
+		return url.pathname.replace(/^\//u, "");
+	} catch {
+		return;
+	}
+}
+function parseCheckoutRepository(remoteUrl) {
+	const segments = githubRepositoryPath(remoteUrl.trim())?.split("/") ?? [];
+	const [owner, rawName] = segments;
+	const name = rawName?.replace(/\.git$/u, "");
+	if (!(owner && name) || segments.length !== 2) throw new Error(`Could not derive a GitHub repository from checkout origin ${remoteUrl}; configure origin as a github.com owner/repository remote.`);
+	return normalizeRepositoryIdentity({
+		name,
+		owner
+	});
+}
+function checkoutRepository(cwd) {
+	let remoteUrl;
+	try {
+		remoteUrl = runCapture("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], cwd).stdout;
+	} catch {
+		throw new Error("Could not read checkout origin; repository routing must be rooted in trusted checkout configuration.");
+	}
+	return parseCheckoutRepository(remoteUrl);
+}
+const repositorySlug = (repository) => {
+	const normalized = normalizeRepositoryIdentity(repository);
+	return `${normalized.owner}/${normalized.name}`;
+};
 var CloseoutValidationError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -8802,18 +8321,8 @@ const boundaryThermoStatus = (attestation) => {
 };
 //#endregion
 //#region src/epic-closeout/gather.ts
-const BUDGET_NOTE = "bounded aggregation of pre-captured telemetry; no per-commit forensic dig";
-const hasInteriorInputs = (opts) => Boolean(opts.chatsDir ?? opts.usageCsvPath ?? opts.codexLogPath);
+const BUDGET_NOTE = "bounded closeout report: trace diagnostics scan plus boundary-thermo attestation; no per-commit forensic dig";
 function gatherCloseoutInputs(opts) {
-	const hasEpicChatAllowlist = (opts.epicChatScope?.chatIds?.length ?? 0) > 0 || (opts.epicChatScope?.cwds?.length ?? 0) > 0;
-	const scopedByEpicIssueSet = Boolean(opts.chatsDir) && hasEpicChatAllowlist;
-	const interiorRows = hasInteriorInputs(opts) ? extractInteriorTelemetry({
-		chatsDir: opts.chatsDir,
-		codexLogPath: opts.codexLogPath,
-		...opts.epicChatScope === void 0 ? {} : { epicChatScope: opts.epicChatScope },
-		lane: opts.lane,
-		usageCsvPath: opts.usageCsvPath
-	}) : [];
 	const diagnostics = scanFactoryTraceDiagnostics({
 		filters: {
 			repo: opts.repo,
@@ -8826,114 +8335,15 @@ function gatherCloseoutInputs(opts) {
 	});
 	return {
 		budget: {
-			interiorSourcesConsumed: interiorRows.length,
 			note: BUDGET_NOTE,
-			scoping: {
-				epic: opts.epic,
-				issueFilter: opts.issue,
-				prFilter: opts.pr,
-				repo: opts.repo,
-				scopedByEpicIssueSet,
-				window: {
-					from: opts.from,
-					to: opts.to
-				}
-			},
 			tier: "overseer"
 		},
-		diagnostics,
-		interiorRows
+		diagnostics
 	};
 }
 //#endregion
-//#region src/epic-closeout/row-identity.ts
-const interiorRowDisambig = (row) => row.source.chatId ?? path.basename(row.source.path);
-//#endregion
-//#region src/epic-closeout/metric-rows.ts
-const INTERIOR_TOTAL_TOOL_CALLS_METRIC = "interior.total-tool-calls";
-const INTERIOR_TOTAL_TURNS_METRIC = "interior.total-turns";
-const interiorSourceDetail = (row) => row.source.chatId ?? row.source.path;
-const interiorPrefix = (row) => {
-	const disambig = interiorRowDisambig(row);
-	return `interior.${row.lane}.${row.role}.${row.engine}.${disambig}`;
-};
-function buildMetricRows(input) {
-	const rows = [];
-	let totalInteriorTurns = 0;
-	let totalInteriorToolCalls = 0;
-	for (const interior of input.interiorRows) {
-		const prefix = interiorPrefix(interior);
-		const sourceDetail = interiorSourceDetail(interior);
-		rows.push({
-			label: `${interior.lane} ${interior.role} ${interior.engine} interior turns`,
-			metric: `${prefix}.turns`,
-			source: {
-				detail: sourceDetail,
-				kind: "interior-telemetry"
-			},
-			unit: "count",
-			value: interior.interiorTurns
-		}, {
-			label: `${interior.lane} ${interior.role} ${interior.engine} tool calls`,
-			metric: `${prefix}.tool-calls`,
-			source: {
-				detail: sourceDetail,
-				kind: "interior-telemetry"
-			},
-			unit: "count",
-			value: interior.toolCalls
-		}, {
-			label: `${interior.lane} ${interior.role} ${interior.engine} verdict emitted`,
-			metric: `${prefix}.verdict-emitted`,
-			source: {
-				detail: sourceDetail,
-				kind: "interior-telemetry"
-			},
-			unit: "boolean",
-			value: interior.verdictEmitted
-		});
-		if (interior.tokensByKind.status === "available") rows.push({
-			label: `${interior.lane} ${interior.role} ${interior.engine} total tokens`,
-			metric: `${prefix}.total-tokens`,
-			source: {
-				detail: `${sourceDetail};tokensSource=${interior.tokensByKind.source}`,
-				kind: "interior-telemetry"
-			},
-			unit: "tokens",
-			value: interior.tokensByKind.totalTokens
-		});
-		totalInteriorTurns += interior.interiorTurns;
-		totalInteriorToolCalls += interior.toolCalls;
-	}
-	if (input.interiorRows.length > 0) {
-		const interiorPaths = [...new Set(input.interiorRows.map((row) => interiorSourceDetail(row)))].join(",");
-		rows.push({
-			label: "Interior total turns",
-			metric: INTERIOR_TOTAL_TURNS_METRIC,
-			source: {
-				detail: interiorPaths,
-				kind: "interior-telemetry"
-			},
-			unit: "count",
-			value: totalInteriorTurns
-		}, {
-			label: "Interior total tool calls",
-			metric: INTERIOR_TOTAL_TOOL_CALLS_METRIC,
-			source: {
-				detail: interiorPaths,
-				kind: "interior-telemetry"
-			},
-			unit: "count",
-			value: totalInteriorToolCalls
-		});
-	}
-	return rows.toSorted((left, right) => left.metric.localeCompare(right.metric));
-}
-//#endregion
 //#region src/epic-closeout/report.ts
-const INTERIOR_TURN_ATTENTION = 3;
 const ROW_LIMIT_BLINDSPOT_ID = "closeout-row-limit";
-const SUMMARY_METRICS = new Set([INTERIOR_TOTAL_TOOL_CALLS_METRIC, INTERIOR_TOTAL_TURNS_METRIC]);
 const boundaryThermoSource = (owner) => ({
 	detail: `deep thermo owner: ${owner} (#559 boundary-thermo attestation)`,
 	kind: "boundary-thermo-attestation"
@@ -8984,76 +8394,31 @@ const assertMetricSources = (metrics) => {
 	for (const metric of metrics) if (!metric.source.detail.trim()) throw new CloseoutValidationError(`metric ${metric.metric} is missing source.detail`);
 };
 const boundCloseoutRows = (input) => {
-	const summaries = input.interiorMetrics.filter((metric) => SUMMARY_METRICS.has(metric.metric));
-	const details = input.interiorMetrics.filter((metric) => !SUMMARY_METRICS.has(metric.metric));
-	const retainedAlways = [...summaries, ...input.boundaryMetrics];
+	const retainedAlways = [...input.boundaryMetrics];
 	let remaining = Math.max(0, MAX_CLOSEOUT_ROWS - retainedAlways.length - 1);
 	const blindspots = input.blindspots.filter((blindspot) => blindspot.id !== ROW_LIMIT_BLINDSPOT_ID).slice(0, remaining);
 	remaining -= blindspots.length;
 	const lessons = input.lessons.slice(0, remaining);
 	remaining -= lessons.length;
-	const metrics = [...details.slice(0, remaining), ...retainedAlways].toSorted((left, right) => left.metric.localeCompare(right.metric));
+	const metrics = [...retainedAlways].toSorted((left, right) => left.metric.localeCompare(right.metric));
 	const omittedBlindspots = input.blindspots.length - blindspots.length;
 	const omittedLessons = input.lessons.length - lessons.length;
-	const omittedMetrics = input.interiorMetrics.length + input.boundaryMetrics.length - metrics.length;
+	const omittedMetrics = input.boundaryMetrics.length - metrics.length;
 	return {
 		blindspots: [...blindspots, {
 			id: ROW_LIMIT_BLINDSPOT_ID,
-			note: `Closeout omitted ${omittedMetrics} metric row(s), ${omittedLessons} lesson row(s), and ${omittedBlindspots} blindspot row(s) to keep the strict artifact and ledger within ${MAX_CLOSEOUT_ROWS} rows; aggregate interior totals and boundary-thermo metrics are retained.`
+			note: `Closeout omitted ${omittedMetrics} metric row(s), ${omittedLessons} lesson row(s), and ${omittedBlindspots} blindspot row(s) to keep the strict artifact and ledger within ${MAX_CLOSEOUT_ROWS} rows; boundary-thermo metrics are retained.`
 		}],
 		lessons,
 		metrics
 	};
 };
-const epicScopingBlindspotNote = (scoping) => {
-	const filters = [];
-	if (scoping.issueFilter !== void 0) filters.push(`issue=${scoping.issueFilter}`);
-	if (scoping.prFilter !== void 0) filters.push(`pr=${scoping.prFilter}`);
-	const filterSuffix = filters.length > 0 ? ` + ${filters.join(" + ")} filter(s)` : "";
-	const narrowNote = filters.length > 0 ? " Supplied trace filter(s) narrow the scan but do not guarantee epic-exact attribution." : "";
-	const windowRepoScope = `date window (${scoping.window.from}..${scoping.window.to}) + repo ${scoping.repo}${filterSuffix}`;
-	if (scoping.scopedByEpicIssueSet) return `Cursor-store interior telemetry was scoped to this epic's lanes via the chat/cwd allowlist; codex-exec logs are operator-supplied and not chat-filtered. Interior telemetry remains scoped by ${windowRepoScope}, NOT by the epic's child-issue set, so rows in this window may include concurrent non-epic factory work; closeout does not resolve child issues (bounded, no network).${narrowNote}`;
-	return `Telemetry is scoped by ${windowRepoScope}, NOT by the epic's child-issue set. Interior rows in this window may include concurrent non-epic factory work; closeout does not resolve child issues (bounded, no network).${narrowNote}`;
-};
 const DOLLAR_PRICING_DEFERRED_BLINDSPOT = {
 	id: "dollar-pricing-deferred-to-cost-analysis-skill",
-	note: "Dollar pricing is intentionally deferred to the patronage-software-factory-cost-analysis skill (canonical PRICES/TIERS). This closeout reports token volumes only, to avoid forking that registry."
+	note: "Native token families are harvested in the separate retro envelope. Pricing policy remains with the patronage-software-factory-cost-analysis skill (canonical PRICES/TIERS), so this boundary-thermo closeout neither reports token volume nor prices it."
 };
 const deriveBlindspots = (input, boundaryThermo) => {
 	const blindspots = [BASELINE_BLINDSPOT, DOLLAR_PRICING_DEFERRED_BLINDSPOT];
-	if (input.budget.scoping) blindspots.push({
-		id: "epic-scoping-is-window-not-child-issue-set",
-		note: epicScopingBlindspotNote(input.budget.scoping)
-	});
-	else blindspots.push({
-		id: "epic-scoping-is-window-not-child-issue-set",
-		note: epicScopingBlindspotNote({
-			epic: String(input.epic),
-			issueFilter: void 0,
-			prFilter: void 0,
-			repo: input.repo,
-			scopedByEpicIssueSet: false,
-			window: {
-				from: "unknown",
-				to: "unknown"
-			}
-		})
-	});
-	if (input.interiorRows.length === 0) blindspots.push({
-		id: "no-interior-telemetry",
-		note: "no interior telemetry collected for this epic"
-	});
-	const unavailableByReason = /* @__PURE__ */ new Map();
-	for (const row of input.interiorRows) if (row.tokensByKind.status === "unavailable") {
-		const reason = row.tokensByKind.missingReason;
-		unavailableByReason.set(reason, (unavailableByReason.get(reason) ?? 0) + 1);
-	}
-	const aggregatedUnavailable = [...unavailableByReason.entries()].map(([missingReason, count]) => ({
-		id: `interior-tokens-unavailable-${missingReason}`,
-		note: `token capture unavailable for ${count} interior row(s): ${missingReason}`,
-		reason: missingReason
-	})).toSorted((left, right) => left.id.localeCompare(right.id));
-	blindspots.push(...aggregatedUnavailable);
 	if (isBoundaryThermoTripwireTripped(boundaryThermo)) blindspots.push({
 		id: BOUNDARY_THERMO_NOWHERE_BLINDSPOT_ID,
 		note: `TRIPWIRE (#559 'thermo nowhere'): this wave/epic closed with zero boundary-thermo runs and no waiver. Deep thermo owner: ${boundaryThermo.owner}. A wave closing with zero boundary-thermo runs is flagged; run the deep Oracle/Fable thermo at the boundary or record an explicit waiver.`,
@@ -9072,43 +8437,6 @@ const deriveLessons = (input, boundaryThermo) => {
 		rationale: waiverRationale,
 		source: boundaryThermoSource(boundaryThermo.owner)
 	});
-	for (const row of input.interiorRows) {
-		const disambig = interiorRowDisambig(row);
-		if (row.interiorTurns >= INTERIOR_TURN_ATTENTION) lessons.push({
-			id: `interior-turn-cap-${row.lane}-${row.role}-${row.engine}-${disambig}`,
-			landingSpot: "profile",
-			lesson: `interior loop hit/near the cap on ${row.lane}/${row.role}; consider tightening the brief or raising review signal`,
-			rationale: `interiorTurns=${row.interiorTurns} >= cap ${INTERIOR_TURN_ATTENTION}`,
-			source: {
-				detail: row.source.chatId ?? row.source.path,
-				kind: "interior-telemetry"
-			}
-		});
-	}
-	const unavailableLessonCounts = /* @__PURE__ */ new Map();
-	for (const row of input.interiorRows) {
-		if (row.tokensByKind.status !== "unavailable") continue;
-		const { missingReason } = row.tokensByKind;
-		const key = `${row.engine}\0${missingReason}`;
-		const existing = unavailableLessonCounts.get(key);
-		if (existing) existing.count += 1;
-		else unavailableLessonCounts.set(key, {
-			count: 1,
-			engine: row.engine,
-			missingReason
-		});
-	}
-	const aggregatedTokenLessons = [...unavailableLessonCounts.values()].map(({ count, engine, missingReason }) => ({
-		id: `wire-token-export-${engine}-${missingReason}`,
-		landingSpot: "CLI",
-		lesson: `token volume capture missing for ${count} ${engine} interior row(s); wire usage export so closeout can report its token volume (dollar pricing stays in the patronage-software-factory-cost-analysis skill)`,
-		rationale: missingReason,
-		source: {
-			detail: `${count} row(s)`,
-			kind: "interior-telemetry"
-		}
-	})).toSorted((left, right) => left.id.localeCompare(right.id));
-	lessons.push(...aggregatedTokenLessons);
 	if (input.lessons) lessons.push(...input.lessons);
 	return lessons;
 };
@@ -9120,7 +8448,7 @@ const buildLedgerRows = (input) => {
 		key: metric.metric,
 		repo: input.repo,
 		rowType: "metric",
-		schemaVersion: 3,
+		schemaVersion: 4,
 		source: flattenSource(metric.source),
 		unit: metric.unit,
 		value: ledgerValue(metric.value)
@@ -9133,7 +8461,7 @@ const buildLedgerRows = (input) => {
 		landingSpot: lesson.landingSpot,
 		repo: input.repo,
 		rowType: "lesson",
-		schemaVersion: 3,
+		schemaVersion: 4,
 		source: lesson.source ? flattenSource(lesson.source) : "derived",
 		value: lesson.lesson
 	});
@@ -9144,7 +8472,7 @@ const buildLedgerRows = (input) => {
 		key: blindspot.id,
 		repo: input.repo,
 		rowType: "blindspot",
-		schemaVersion: 3,
+		schemaVersion: 4,
 		source: "derived",
 		value: blindspot.note
 	});
@@ -9156,9 +8484,8 @@ function buildEpicCloseoutReport(input) {
 	const epic = String(input.epic);
 	const generatedAt = input.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
 	const boundaryThermo = resolveBoundaryThermo(input.boundaryThermo);
-	const interiorMetrics = buildMetricRows({ interiorRows: input.interiorRows });
 	const boundaryMetrics = boundaryThermoMetrics(boundaryThermo);
-	let metrics = [...interiorMetrics, ...boundaryMetrics];
+	let metrics = [...boundaryMetrics];
 	let couldNotSee = deriveBlindspots(input, boundaryThermo);
 	if (couldNotSee.length === 0) throw new CloseoutValidationError("closeout must include a non-empty 'what this closeout could not see' section");
 	let lessons = deriveLessons(input, boundaryThermo);
@@ -9166,7 +8493,6 @@ function buildEpicCloseoutReport(input) {
 		const { blindspots: boundedBlindspots, lessons: boundedLessons, metrics: boundedMetrics } = boundCloseoutRows({
 			blindspots: couldNotSee,
 			boundaryMetrics,
-			interiorMetrics,
 			lessons
 		});
 		couldNotSee = boundedBlindspots;
@@ -9196,7 +8522,7 @@ function buildEpicCloseoutReport(input) {
 		lessons,
 		metrics,
 		repo: input.repo,
-		schemaVersion: 3
+		schemaVersion: 4
 	};
 	return closeoutArtifactSchema.parse(artifact);
 }
@@ -9704,7 +9030,7 @@ function renderCloseoutMarkdown(artifact) {
 	const ledgerLines = [
 		"## HQ ledger row-set",
 		"",
-		`${artifact.ledgerRows.length} append-ready rows emitted to the sibling \`${sanitizeEpicFilename(artifact.epic)}.json\` (schemaVersion 3) for the HQ lessons ledger (#433).`,
+		`${artifact.ledgerRows.length} append-ready rows emitted to the sibling \`${sanitizeEpicFilename(artifact.epic)}.json\` (schemaVersion 4) for the HQ lessons ledger (#433).`,
 		""
 	];
 	return [
@@ -9748,532 +9074,88 @@ function writeCloseoutArtifact(opts) {
 	};
 }
 //#endregion
-//#region src/epic-structure.ts
-/**
-* Producer-side `epic-structure` v1 emitter (epic #132, lane #135).
-*
-* `psf epic:publish-structure` reads a planner's ephemeral `dag.yml` (never
-* committed — see epic #132 / ADR 0018), validates the graph fail-closed, and
-* POSTs an `epic-structure` v1 event to HQ's `/api/ingest` boundary. This
-* module is the pure core: parse-to-IR validation, the wire mapping, and the
-* deterministic content-addressed eventId. All I/O (stdin/file read, fetch)
-* lives in the command wrapper.
-*
-* WIRE PARITY (do not fork the schema): the emitted payload is the exact shape
-* HQ's `EpicGraphSchema` accepts (`software-factory-hq/src/contracts/
-* epic-schemas.ts`) and is built by hand the same way `seed-dev.ts` builds it
-* — no re-declared zod twin. HQ's `epic-structure-parity.test.ts` imports
-* {@link buildEpicStructureEvent} and runs its output through the real
-* `EpicGraphSchema`, so any drift (field, enum, bound, strictness) fails CI.
-*
-* The `dag.yml` schema itself is documented with the epic skill (lane #137);
-* this module is the executable contract, not a second source of truth.
-*/
-const EPIC_STRUCTURE_SCHEMA_VERSION = 1;
-/**
-* DAG-node PLANNING statuses — the planning-plane vocabulary a planner authors
-* on a `dag.yml` node. Carried forward by ADR 0018 §4 and defined by the epic
-* skill (`reference/epic-artifacts.md`) and both `CONTEXT.md` glossaries.
-*
-* A DAG node is a unit of *plan*; an HQ lane is a unit of *runtime execution*.
-* These are two planes with two vocabularies and must not be conflated — the
-* producer validates and emits ONLY planning statuses:
-*
-*   - `open`              authored, not yet done
-*   - `closed`            done (a PR merged, or otherwise resolved)
-*   - `satisfied-on-main` already true on main without a dedicated PR
-*   - `parked`            real node, scope still moving — relabeled off
-*                         `ready-for-agent`, never closed
-*
-* HQ's `DagNodeSchema` (`software-factory-hq/src/contracts/epic-schemas.ts`)
-* accepts this planning vocabulary on ingest AND overlays a runtime LANE status
-* onto a node once a lane is linked (`syncNodesWithLanes` /
-* `projectEpicMembership`) — the overlay is HQ-internal; the producer never
-* emits a lane status. HQ's `epic-structure-parity.test.ts` fails CI if the
-* producer emits any status HQ won't accept.
-*/
-const EPIC_STRUCTURE_NODE_STATUSES = [
-	"open",
-	"closed",
-	"satisfied-on-main",
-	"parked"
-];
-/**
-* Fail-closed validation error carrying every offending node/edge diagnostic.
-*/
-var EpicStructureValidationError = class extends Error {
-	diagnostics;
-	constructor(diagnostics) {
-		super(`epic:publish-structure refused: dag graph is invalid\n${diagnostics.map((line) => `  - ${line}`).join("\n")}`);
-		this.name = "EpicStructureValidationError";
-		this.diagnostics = diagnostics;
-	}
+//#region src/commands/closeout.ts
+const formatUtcDate = (date) => date.toISOString().slice(0, 10);
+const nonEmptyRepoRoot = (value) => {
+	if (value.trim() === "") throw new InvalidArgumentError("--repo-root requires a non-empty path");
+	return value;
 };
-const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const nonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
-const isPositiveInteger = (value) => typeof value === "number" && Number.isInteger(value) && value > 0;
-const slugify = (value) => value.trim().toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "") || "epic";
-const laneIdFor = (repo, issue) => `lane-${repo}-issue-${issue}`;
-const validateNodes = (rawNodes, diagnostics) => {
-	const nodes = [];
-	const slugs = /* @__PURE__ */ new Set();
-	for (const [index, raw] of rawNodes.entries()) {
-		if (!isPlainObject(raw)) {
-			diagnostics.push(`node[${index}]: expected a mapping`);
-			continue;
-		}
-		const label = nonEmptyString(raw.slug) ? `"${raw.slug}"` : `node[${index}]`;
-		if (!nonEmptyString(raw.slug)) diagnostics.push(`node[${index}]: missing required \`slug\``);
-		else if (slugs.has(raw.slug)) diagnostics.push(`node ${label}: duplicate slug`);
-		else slugs.add(raw.slug);
-		if (!nonEmptyString(raw.title)) diagnostics.push(`node ${label}: missing required \`title\``);
-		const external = raw.external === true;
-		if (!external && !isPositiveInteger(raw.issue)) diagnostics.push(`node ${label}: \`issue\` number is required — non-external nodes must carry a minted issue (this runs post-ratification); set \`external: true\` to exempt an adoption/upstream node`);
-		let status = "open";
-		if (raw.status === void 0) status = "open";
-		else if (EPIC_STRUCTURE_NODE_STATUSES.includes(raw.status)) status = raw.status;
-		else diagnostics.push(`node ${label}: \`status\` must be one of ${EPIC_STRUCTURE_NODE_STATUSES.join(", ")} (DAG-node planning statuses, not HQ lane statuses)`);
-		if (raw.laneId !== void 0 && !nonEmptyString(raw.laneId)) diagnostics.push(`node ${label}: \`laneId\` must be a non-empty string`);
-		nodes.push({
-			external,
-			...isPositiveInteger(raw.issue) ? { issue: raw.issue } : {},
-			...nonEmptyString(raw.laneId) ? { laneId: raw.laneId } : {},
-			slug: nonEmptyString(raw.slug) ? raw.slug : `node[${index}]`,
-			status,
-			title: nonEmptyString(raw.title) ? raw.title : ""
-		});
-	}
+const codexThreadIdsForCloseout = (env = process.env) => {
+	const threadId = normalizeSessionId(env.CODEX_THREAD_ID);
+	return threadId === void 0 ? [] : [threadId];
+};
+const resolveRetroSubject = (issue, pr) => {
+	if (issue !== void 0) return { issueNumber: issue };
+	if (pr !== void 0) return { prNumber: pr };
+};
+const tokenFamilySummary = (tokenFamilies) => {
+	const available = [];
+	const unavailable = [];
+	for (const family of ["claude", "gpt"]) if (tokenFamilies[family] === void 0) unavailable.push(family);
+	else available.push(family);
 	return {
-		nodes,
-		slugs
+		available,
+		unavailable
 	};
 };
-const validateEdges = (rawEdges, slugs, diagnostics) => {
-	const edges = [];
-	for (const [index, raw] of rawEdges.entries()) {
-		if (!isPlainObject(raw)) {
-			diagnostics.push(`edge[${index}]: expected a mapping`);
-			continue;
-		}
-		if (raw.type !== "depends-on") continue;
-		if (!nonEmptyString(raw.from) || !nonEmptyString(raw.to)) {
-			diagnostics.push(`edge[${index}]: depends-on edge requires string \`from\` and \`to\``);
-			continue;
-		}
-		if (!slugs.has(raw.from)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`from\` references unknown slug "${raw.from}"`);
-		if (!slugs.has(raw.to)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`to\` references unknown slug "${raw.to}"`);
-		if (raw.from === raw.to) diagnostics.push(`edge ${raw.from} -> ${raw.to}: self-dependency (cycle)`);
-		edges.push({
-			from: raw.from,
-			to: raw.to
-		});
-	}
-	return edges;
+const reportLocalCloseoutOutcome = (output, input) => {
+	const harvest = tokenFamilySummary(input.retro.envelope.tokenFamilies);
+	output.stdout.write(`local artifacts: ${input.paths.markdownPath}, ${input.paths.jsonPath}, and ${input.retro.envelopePath}\n`);
+	output.stdout.write(`boundary thermo input: runs=${input.boundaryThermo.runs}, owner=${input.boundaryThermo.owner}, waived=${input.boundaryThermo.waived}${input.boundaryThermo.waiverRationale === void 0 ? "" : `, waiver rationale=${input.boundaryThermo.waiverRationale}`}\n`);
+	if (harvest.unavailable.length > 0) output.stderr.write(`harvest data unavailable: ${harvest.available.length === 0 ? "no token families were recorded" : `missing ${harvest.unavailable.join(" and ")} token family data`}; recorded gaps: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
+	else if (input.retro.envelope.dataGaps.length > 0) output.stderr.write(`retro-envelope data gaps recorded: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
 };
-/**
-* Detects a dependency cycle over the depends-on edges and returns the offending
-* cycle path (`a -> b -> a`) if one exists, else undefined. Only edges whose
-* endpoints both resolve to known slugs are walked, so unknown-slug diagnostics
-* are reported independently and never masquerade as cycles.
-*/
-const findCycle = (slugs, edges) => {
-	const adjacency = /* @__PURE__ */ new Map();
-	for (const { from, to } of edges) if (slugs.has(from) && slugs.has(to)) {
-		const list = adjacency.get(from) ?? [];
-		list.push(to);
-		adjacency.set(from, list);
-	}
-	const UNVISITED = 0;
-	const IN_STACK = 1;
-	const DONE = 2;
-	const state = /* @__PURE__ */ new Map();
-	const stack = [];
-	const walk = (node) => {
-		state.set(node, IN_STACK);
-		stack.push(node);
-		for (const next of adjacency.get(node) ?? []) {
-			const marker = state.get(next) ?? UNVISITED;
-			if (marker === IN_STACK) {
-				const start = stack.indexOf(next);
-				return [...stack.slice(start), next];
-			}
-			if (marker === UNVISITED) {
-				const found = walk(next);
-				if (found) return found;
-			}
-		}
-		stack.pop();
-		state.set(node, DONE);
-	};
-	for (const slug of slugs) if ((state.get(slug) ?? UNVISITED) === UNVISITED) {
-		const found = walk(slug);
-		if (found) return found;
+const reportRetroHqDeliveryOutcome = (output, outcome) => {
+	output.stderr.write(`advisory HQ handoff ${outcome} for the retro envelope; local closeout success does not depend on HQ.\n`);
+};
+const reportArtifactHqHandoffOutcome = (output, outcome) => {
+	output.stderr.write(`advisory HQ handoff ${outcome} for the closeout artifact; local closeout success does not depend on HQ.\n`);
+};
+const handoffCloseoutToHq = async (input) => {
+	const epicIssue = Number(input.artifact.epic);
+	let artifactOutcome = "deferred";
+	try {
+		artifactOutcome = await deferProjectHqIngest({
+			cwd: input.repoRoot,
+			kind: "epic-closeout",
+			payload: input.artifact,
+			payloadPath: input.written.jsonPath,
+			...Number.isSafeInteger(epicIssue) && epicIssue > 0 ? { subject: { issueNumber: epicIssue } } : {}
+		}, input.hq);
+	} catch {
+		artifactOutcome = "held";
 	}
+	try {
+		reportArtifactHqHandoffOutcome(input.output, artifactOutcome);
+	} catch {}
+	const retroSubject = resolveRetroSubject(input.options.issue, input.options.pr);
+	let outcome = "held";
+	try {
+		outcome = await deferProjectHqIngest({
+			cwd: input.repoRoot,
+			kind: "retro-envelope",
+			payload: input.retro.envelope,
+			payloadPath: input.retro.envelopePath,
+			...retroSubject === void 0 ? {} : { subject: retroSubject }
+		}, input.hq);
+	} catch {}
+	try {
+		reportRetroHqDeliveryOutcome(input.output, outcome);
+	} catch {}
 };
-const resolveEpicId = (epic) => {
-	if (typeof epic === "number") return String(epic);
-	if (nonEmptyString(epic)) return epic.trim();
-};
-/**
-* Validates a dag document fail-closed. Throws {@link
-* EpicStructureValidationError} with a diagnostic per offending node/edge.
-*/
-const validateDagDocument = (input) => {
-	const doc = input.document;
-	const diagnostics = [];
-	if (!isPlainObject(doc)) throw new EpicStructureValidationError(["dag document must be a YAML/JSON mapping with `epic` and `nodes`"]);
-	const epicId = resolveEpicId(doc.epic);
-	if (epicId === void 0) diagnostics.push("dag document requires a top-level `epic` id");
-	const repo = input.repo ?? (nonEmptyString(doc.repo) ? doc.repo.trim() : void 0);
-	if (repo === void 0) diagnostics.push("repo is required — pass `--repo <name>` or set `repo:` in the dag document (needed for the epic record and lane-id derivation)");
-	const rawNodes = Array.isArray(doc.nodes) ? doc.nodes : void 0;
-	if (rawNodes === void 0 || rawNodes.length === 0) diagnostics.push("dag document requires a non-empty `nodes` array");
-	const { nodes, slugs } = validateNodes(rawNodes ?? [], diagnostics);
-	const edges = validateEdges(Array.isArray(doc.edges) ? doc.edges : [], slugs, diagnostics);
-	const cycle = findCycle(slugs, edges);
-	if (cycle) diagnostics.push(`dependency cycle detected: ${cycle.join(" -> ")}`);
-	if (diagnostics.length > 0 || epicId === void 0 || repo === void 0) throw new EpicStructureValidationError(diagnostics);
-	return {
-		boundary: slugify(input.boundary ?? (nonEmptyString(doc.boundary) ? doc.boundary : `epic-${epicId}`)),
-		edges,
-		epicId,
-		name: input.name ?? (nonEmptyString(doc.name) ? doc.name.trim() : `Epic ${epicId}`),
-		nodes,
-		repo
-	};
-};
-/**
-* Builds the wire payload with deterministic ordering (nodes by slug, edges by
-* from then to) so re-emission of the same graph is byte-stable regardless of
-* the planner's source ordering — the basis for the content-addressed eventId.
-*/
-const buildEpicStructurePayload = (dag) => {
-	const nodes = dag.nodes.map((node) => {
-		const laneId = node.laneId ?? (node.issue === void 0 ? void 0 : laneIdFor(dag.repo, node.issue));
-		return {
-			epicId: dag.epicId,
-			...laneId === void 0 ? {} : { laneId },
-			slug: node.slug,
-			status: node.status,
-			title: node.title
-		};
-	}).toSorted((a, b) => a.slug.localeCompare(b.slug));
-	return {
-		edges: dag.edges.map((edge) => ({
-			epicId: dag.epicId,
-			from: edge.from,
-			to: edge.to,
-			type: "depends-on"
-		})).toSorted((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to)),
-		epics: [{
-			id: dag.epicId,
-			name: dag.name,
-			repo: dag.repo
-		}],
-		nodes
-	};
-};
-/** Stable, key-sorted JSON for content hashing (values already ordered). */
-const stableStringify = (value) => {
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (isPlainObject(value)) return `{${Object.keys(value).toSorted().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
-	return JSON.stringify(value ?? null);
-};
-/**
-* Deterministic eventId = `epic-structure-<boundary>-<sha256(payload)[0:16]>`.
-* Re-emitting identical graph content yields the same eventId (HQ dedups →
-* 200/duplicate); an amendment changes the content hash → a new eventId that
-* supersedes the prior structure wholesale (HQ keeps the latest). This mirrors
-* seed-dev's fixed-eventId idempotency, content-addressed instead of literal.
-*/
-const epicStructureEventId = (boundary, payload) => `epic-structure-${slugify(boundary)}-${createHash("sha256").update(stableStringify(payload)).digest("hex").slice(0, 16)}`;
-/**
-* Validates and builds the full `epic-structure` v1 ingest event, ready to POST
-* to `/api/ingest`. Throws {@link EpicStructureValidationError} fail-closed.
-*/
-const buildEpicStructureEvent = (input) => {
-	const dag = validateDagDocument(input);
-	const payload = buildEpicStructurePayload(dag);
-	return {
-		eventId: epicStructureEventId(dag.boundary, payload),
-		kind: "epic-structure",
-		observedAt: input.observedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-		payload,
-		schemaVersion: 1
-	};
-};
-/** The prod HQ worker is reachable at `hq.patronage.com` and its frozen
-* `-v1.*.workers.dev` alias. Emitting there without an Access service token is
-* fail-closed. */
-const isProductionHqUrl = (url) => url.includes("hq.patronage.com") || /-v1\.[^/]*\.workers\.dev/iu.test(url);
-/**
-* POSTs the event to HQ ingest. Fail-closed: a production URL without a
-* Cloudflare Access service token is refused before any request; a 401/403 is
-* surfaced with actionable guidance; any non-2xx throws.
-*/
-const publishEpicStructure = async (args) => {
-	if (!args.accessServiceToken && isProductionHqUrl(args.url)) throw new Error(`epic:publish-structure refusing to publish to production ${args.url} without a Cloudflare Access service token: set CF-Access-Client-Id and CF-Access-Client-Secret`);
-	const doFetch = args.fetchImpl ?? globalThis.fetch;
-	const requestInit = args.accessServiceToken ? buildCloudflareAccessRequestInit(args.accessServiceToken, {
-		body: JSON.stringify(args.event),
-		headers: { "content-type": "application/json" },
-		method: "POST",
-		...args.signal ? { signal: args.signal } : {}
-	}) : {
-		body: JSON.stringify(args.event),
-		headers: { "content-type": "application/json" },
-		method: "POST",
-		...args.signal ? { signal: args.signal } : {}
-	};
-	let response;
-	try {
-		const normalizedUrl = args.url.replace(/\/+$/u, "");
-		response = await doFetch(normalizedUrl.endsWith("/api/ingest") ? normalizedUrl : `${normalizedUrl}/api/ingest`, requestInit);
-	} catch {
-		throw new Error(`epic:publish-structure could not reach HQ ingest at ${args.url}: request failed. Check the endpoint and network; redirects are refused to protect Cloudflare Access credentials.`);
-	}
-	const text = await response.text();
-	if (response.status === 401 || response.status === 403) throw new Error(`epic:publish-structure rejected by Cloudflare Access or HQ ingest (${response.status}): set valid CF-Access-Client-Id and CF-Access-Client-Secret service-token inputs. Response: ${text}`);
-	if (response.status < 200 || response.status >= 300) throw new Error(`epic:publish-structure failed: HQ ingest returned ${response.status} ${text}`);
-	let duplicate = false;
-	try {
-		duplicate = JSON.parse(text).duplicate === true;
-	} catch {
-		duplicate = response.status === 200;
-	}
-	return {
-		duplicate,
-		eventId: args.event.eventId,
-		status: response.status
-	};
-};
-//#endregion
-//#region src/commands/epic-publish-structure.ts
-const STDIN = "-";
-/** Reads a dag.yml source path, or stdin when `source` is `-`. */
-const readSource = (source) => {
-	const fd = source === STDIN ? 0 : source;
-	try {
-		return readFileSync(fd, "utf-8");
-	} catch (error) {
-		const cause = error instanceof Error ? error.message : String(error);
-		throw new Error(`epic:publish-structure could not read ${source === STDIN ? "stdin" : source} (${cause})`, { cause: error });
-	}
-};
-/** Parses a dag.yml/JSON document read from `readSource`. */
-const parseDocument = (raw, source) => {
-	if (raw.trim() === "") throw new Error(`epic:publish-structure received empty input from ${source === STDIN ? "stdin" : source}`);
-	try {
-		return parse(raw);
-	} catch (error) {
-		const cause = error instanceof Error ? error.message : String(error);
-		throw new Error(`epic:publish-structure could not parse YAML: ${cause}`, { cause: error });
-	}
-};
-/**
-* Reads and validates a dag.yml/JSON source into a full `epic-structure` v1
-* event, ready to POST or dry-run print. Shared with `factory:closeout`'s
-* terminal-snapshot re-emission (issue #392) so both commands build the exact
-* same wire event from the exact same source format — one current contract,
-* not a forked parser.
-*/
-const buildEvent = (source, options = {}) => {
-	return buildEpicStructureEvent({
-		document: parseDocument(readSource(source), source),
-		...options.boundary ? { boundary: options.boundary } : {},
-		...options.name ? { name: options.name } : {},
-		...options.repo ? { repo: options.repo } : {}
-	});
-};
-function createEpicPublishStructureCommand(output, deps = {}) {
-	const env = deps.env ?? process.env;
-	return new Command("epic:publish-structure").description("Emit-only: read a planner's ephemeral dag.yml (or - for stdin), validate the graph fail-closed (YAML parses, required fields, edges reference known slugs, acyclic, issue numbers on every non-external node), and POST an epic-structure v1 event to HQ ingest. Idempotent by a content-addressed eventId (re-emission of an amendment supersedes the prior structure). Production auth uses the CF-Access-Client-Id and CF-Access-Client-Secret environment inputs. URL: --url or HQ_INGEST_URL. The dag.yml schema is documented with the epic skill (#137).").argument("[source]", "path to dag.yml, or - for stdin", STDIN).option("--url <url>", "HQ ingest base URL (default: HQ_INGEST_URL env). The command POSTs to <url>/api/ingest").option("--boundary <slug>", "boundary slug for the eventId namespace (default: dag `boundary:`, else `epic-<id>`)").option("--repo <name>", "repository name for the epic record and lane-id derivation (default: dag `repo:`)").option("--name <title>", "epic display name (default: dag `name:`)").option("--dry-run", "validate and build the event, print it, and exit without POSTing").option("--json", "print the built event / publish result as JSON").action(async (source, options) => {
-		const event = buildEvent(source, options);
-		if (options.dryRun) {
-			output.stdout.write(options.json ? `${JSON.stringify(event, null, 2)}\n` : `epic:publish-structure OK (dry-run) — eventId ${event.eventId}, ${event.payload.nodes.length} node(s), ${event.payload.edges.length} edge(s)\n`);
-			return;
-		}
-		const url = options.url ?? env.HQ_INGEST_URL;
-		if (!url) throw new Error("epic:publish-structure requires an HQ ingest URL: pass --url or set HQ_INGEST_URL");
-		const clientId = env[CF_ACCESS_CLIENT_ID_ENV];
-		const clientSecret = env[CF_ACCESS_CLIENT_SECRET_ENV];
-		const result = await publishEpicStructure({
-			...clientId && clientSecret ? { accessServiceToken: {
-				clientId,
-				clientSecret
-			} } : {},
-			event,
-			fetchImpl: deps.fetchImpl,
-			url
-		});
-		output.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `epic:publish-structure ${result.duplicate ? "no-op (duplicate)" : "accepted"} — eventId ${result.eventId} [HTTP ${result.status}]\n`);
-	});
-}
-//#endregion
-//#region src/commands/closeout.ts
-const formatUtcDate = (date) => date.toISOString().slice(0, 10);
-const nonEmptyRepoRoot = (value) => {
-	if (value.trim() === "") throw new InvalidArgumentError("--repo-root requires a non-empty path");
-	return value;
-};
-const codexThreadIdsForCloseout = (env = process.env) => {
-	const threadId = normalizeSessionId(env.CODEX_THREAD_ID);
-	return threadId === void 0 ? [] : [threadId];
-};
-const resolveRetroSubject = (issue, pr) => {
-	if (issue !== void 0) return { issueNumber: issue };
-	if (pr !== void 0) return { prNumber: pr };
-};
-const tokenFamilySummary = (tokenFamilies) => {
-	const available = [];
-	const unavailable = [];
-	for (const family of ["claude", "gpt"]) if (tokenFamilies[family] === void 0) unavailable.push(family);
-	else available.push(family);
-	return {
-		available,
-		unavailable
-	};
-};
-const reportLocalCloseoutOutcome = (output, input) => {
-	const harvest = tokenFamilySummary(input.retro.envelope.tokenFamilies);
-	output.stdout.write(`local artifacts: ${input.paths.markdownPath}, ${input.paths.jsonPath}, and ${input.retro.envelopePath}\n`);
-	output.stdout.write(`boundary thermo input: runs=${input.boundaryThermo.runs}, owner=${input.boundaryThermo.owner}, waived=${input.boundaryThermo.waived}${input.boundaryThermo.waiverRationale === void 0 ? "" : `, waiver rationale=${input.boundaryThermo.waiverRationale}`}\n`);
-	if (harvest.unavailable.length > 0) output.stderr.write(`harvest data unavailable: ${harvest.available.length === 0 ? "no token families were recorded" : `missing ${harvest.unavailable.join(" and ")} token family data`}; recorded gaps: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
-	else if (input.retro.envelope.dataGaps.length > 0) output.stderr.write(`retro-envelope data gaps recorded: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
-};
-const reportRetroHqDeliveryOutcome = (output, outcome) => {
-	output.stderr.write(`advisory HQ handoff ${outcome} for the retro envelope; local closeout success does not depend on HQ.\n`);
-};
-const reportArtifactHqHandoffOutcome = (output, outcome) => {
-	output.stderr.write(`advisory HQ handoff ${outcome} for the closeout artifact; local closeout success does not depend on HQ.\n`);
-};
-const reportStructureReemissionOutcome = (output, outcome, detail) => {
-	output.stderr.write(`advisory HQ epic-structure re-emission ${outcome}${detail ? ` (${detail})` : ""}; local closeout success does not depend on HQ.\n`);
-};
-const DEFAULT_STRUCTURE_REEMISSION_TIMEOUT_MS = 5e3;
-const withTimeout = async (operation, timeoutMs, message) => {
-	const raceAbort = new AbortController();
-	const fetchAbort = new AbortController();
-	const settleTimeout = async () => {
-		try {
-			await setTimeout$1(Math.max(0, timeoutMs), void 0, { signal: raceAbort.signal });
-		} catch {}
-		return { status: "timed-out" };
-	};
-	const settleOperation = async () => ({
-		status: "fulfilled",
-		value: await operation(fetchAbort.signal)
-	});
-	try {
-		const result = await Promise.race([settleOperation(), settleTimeout()]);
-		if (result.status === "timed-out") {
-			fetchAbort.abort();
-			throw new Error(message);
-		}
-		return result.value;
-	} finally {
-		raceAbort.abort();
-	}
-};
-const bareRepoName = (ownerRepo) => {
-	const separatorIndex = ownerRepo.lastIndexOf("/");
-	return separatorIndex === -1 ? ownerRepo : ownerRepo.slice(separatorIndex + 1);
-};
-const structureIdentityMismatch = (event, expected) => {
-	const expectedRepo = bareRepoName(expected.repo);
-	const { epics } = event.payload;
-	if (epics.length === 0) return;
-	if (epics.every((epic) => epic.id !== expected.epic)) return `dag epic id(s) [${epics.map((epic) => epic.id).join(", ")}] do not include --epic ${expected.epic}`;
-	if (epics.every((epic) => epic.repo !== expectedRepo)) return `dag repo(s) [${epics.map((epic) => epic.repo).join(", ")}] do not include --repo ${expected.repo} (bare "${expectedRepo}")`;
-};
-const reemitEpicStructureAtCloseout = async (input) => {
-	if (input.dagSource === void 0) return;
-	const build = input.buildEvent ?? buildEvent;
-	const publish = input.publish ?? publishEpicStructure;
-	const url = input.url ?? input.env.HQ_INGEST_URL;
-	if (!url) {
-		reportStructureReemissionOutcome(input.output, "skipped", "no HQ ingest URL: pass --structure-url or set HQ_INGEST_URL");
-		return;
-	}
-	let event;
-	try {
-		event = build(input.dagSource);
-	} catch (error) {
-		reportStructureReemissionOutcome(input.output, "failed", error instanceof Error ? error.message : String(error));
-		return;
-	}
-	const mismatch = structureIdentityMismatch(event, {
-		epic: input.expectedEpic,
-		repo: input.expectedRepo
-	});
-	if (mismatch !== void 0) {
-		reportStructureReemissionOutcome(input.output, "failed", mismatch);
-		return;
-	}
-	const clientId = input.env[CF_ACCESS_CLIENT_ID_ENV];
-	const clientSecret = input.env[CF_ACCESS_CLIENT_SECRET_ENV];
-	const timeoutMs = input.timeoutMs ?? DEFAULT_STRUCTURE_REEMISSION_TIMEOUT_MS;
-	try {
-		const result = await withTimeout((signal) => publish({
-			...clientId && clientSecret ? { accessServiceToken: {
-				clientId,
-				clientSecret
-			} } : {},
-			event,
-			fetchImpl: input.fetchImpl,
-			signal,
-			url
-		}), timeoutMs, `epic-structure re-emission exceeded its ${timeoutMs}ms advisory deadline`);
-		reportStructureReemissionOutcome(input.output, result.duplicate ? "duplicate" : "accepted", `eventId ${result.eventId}`);
-	} catch (error) {
-		reportStructureReemissionOutcome(input.output, "failed", error instanceof Error ? error.message : String(error));
-	}
-};
-const handoffCloseoutToHq = async (input) => {
-	const epicIssue = Number(input.artifact.epic);
-	let artifactOutcome = "deferred";
-	try {
-		artifactOutcome = await deferProjectHqIngest({
-			cwd: input.repoRoot,
-			kind: "epic-closeout",
-			payload: input.artifact,
-			payloadPath: input.written.jsonPath,
-			...Number.isSafeInteger(epicIssue) && epicIssue > 0 ? { subject: { issueNumber: epicIssue } } : {}
-		}, input.hq);
-	} catch {
-		artifactOutcome = "held";
-	}
-	try {
-		reportArtifactHqHandoffOutcome(input.output, artifactOutcome);
-	} catch {}
-	const retroSubject = resolveRetroSubject(input.options.issue, input.options.pr);
-	let outcome = "held";
-	try {
-		outcome = await deferProjectHqIngest({
-			cwd: input.repoRoot,
-			kind: "retro-envelope",
-			payload: input.retro.envelope,
-			payloadPath: input.retro.envelopePath,
-			...retroSubject === void 0 ? {} : { subject: retroSubject }
-		}, input.hq);
-	} catch {}
-	try {
-		reportRetroHqDeliveryOutcome(input.output, outcome);
-	} catch {}
-};
-const defaultTraceWindow = () => {
-	const to = /* @__PURE__ */ new Date();
-	const from = new Date(to);
-	from.setUTCDate(from.getUTCDate() - 30);
-	return {
-		from: formatUtcDate(from),
-		to: formatUtcDate(to)
-	};
+const defaultTraceWindow = () => {
+	const to = /* @__PURE__ */ new Date();
+	const from = new Date(to);
+	from.setUTCDate(from.getUTCDate() - 30);
+	return {
+		from: formatUtcDate(from),
+		to: formatUtcDate(to)
+	};
 };
 function createCloseoutCommand(output, dependencies = {}) {
 	const buildRetroGate = dependencies.buildRetroEnvelope ?? buildAndPersistRetroEnvelope;
 	const persistArtifact = dependencies.writeArtifact ?? writeCloseoutArtifact;
-	return new Command("factory:closeout").description("Emit an epic-close metrics + lessons closeout (markdown + HQ-ledger JSON)").requiredOption("--epic <id>", "epic identifier").option("--repo <owner/repo>", "repository", DEFAULT_FACTORY_REPOSITORY).option("--repo-root <path>", "consumer repo root for trace shards and output", nonEmptyRepoRoot, ".").option("--out-dir <path>", "output directory under repo root", ".factory-memory/closeouts").option("--from <YYYY-MM-DD>", "trace diagnostics scan window start — surfaces malformed trace shards only, no metrics (default: today minus 30 days UTC)").option("--to <YYYY-MM-DD>", "trace diagnostics scan window end (default: today UTC)").option("--lane <name>", "interior telemetry lane label", "epic-closeout").option("--chats-dir <path>", "Cursor chats directory for interior telemetry").option("--usage-csv <path>", "Cursor usage CSV for interior telemetry").option("--codex-log <path>", "Codex exec JSON log for interior telemetry").option("--epic-chat-id <id>", "allowlist a Cursor chatId for epic interior scoping (repeatable)", (value, previous) => [...previous, value], []).option("--epic-chat-cwd <path>", "allowlist a worktree cwd for epic interior scoping (repeatable)", (value, previous) => [...previous, value], []).option("--issue <n>", "optional issue-number filter for the trace diagnostics scan", Number.parseInt).option("--pr <n>", "optional pull-request-number filter for the trace diagnostics scan", Number.parseInt).option("--json", "print the artifact JSON to stdout").option("--dry-run", "run aggregation without writing files; print intended output paths").option("--boundary-thermo-runs <n>", "deep boundary-thermo run count for this wave/epic (default: 0 → tripwire)", (value) => sanitizeBoundaryThermoRuns(value)).option("--boundary-thermo-owner <name>", "named owner of the boundary-thermo gate (default: epic-closeout orchestrator)").option("--boundary-thermo-waived", "record an explicit waiver for zero boundary-thermo runs").option("--boundary-thermo-waiver <text>", "waiver rationale when --boundary-thermo-waived is set").option("--structure-dag <path>", "path to a terminal dag.yml/JSON document (or - for stdin) to re-emit as the closeout epic-structure snapshot, via the same builder epic:publish-structure uses. Advisory and idempotent by content-addressed eventId. Omit to skip re-emission entirely — closeout never fabricates a structure snapshot that was never authored.").option("--structure-url <url>", "HQ ingest base URL for the closeout structure re-emission (default: HQ_INGEST_URL env)").action(withGateTiming({
+	return new Command("factory:closeout").description("Emit an epic-close metrics + lessons closeout (markdown + HQ-ledger JSON)").requiredOption("--epic <id>", "epic identifier").option("--repo-root <path>", "consumer repo root for trace shards and output", nonEmptyRepoRoot, ".").option("--out-dir <path>", "output directory under repo root", ".factory-memory/closeouts").option("--from <YYYY-MM-DD>", "trace diagnostics scan window start — surfaces malformed trace shards only, no metrics (default: today minus 30 days UTC)").option("--to <YYYY-MM-DD>", "trace diagnostics scan window end (default: today UTC)").option("--issue <n>", "optional issue-number filter for the trace diagnostics scan", Number.parseInt).option("--pr <n>", "optional pull-request-number filter for the trace diagnostics scan", Number.parseInt).option("--json", "print the artifact JSON to stdout").option("--dry-run", "run aggregation without writing files; print intended output paths").option("--boundary-thermo-runs <n>", "deep boundary-thermo run count for this wave/epic (default: 0 → tripwire)", (value) => sanitizeBoundaryThermoRuns(value)).option("--boundary-thermo-owner <name>", "named owner of the boundary-thermo gate (default: epic-closeout orchestrator)").option("--boundary-thermo-waived", "record an explicit waiver for zero boundary-thermo runs").option("--boundary-thermo-waiver <text>", "waiver rationale when --boundary-thermo-waived is set").action(withGateTiming({
 		gate: "factory:closeout",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.repoRoot),
 		shouldRecord: (options) => options.dryRun !== true,
@@ -10283,25 +9165,15 @@ function createCloseoutCommand(output, dependencies = {}) {
 		const from = options.from ?? defaults.from;
 		const to = options.to ?? defaults.to;
 		const repoRoot = resolveCwdOption(options.repoRoot);
-		const epicChatIds = options.epicChatId ?? [];
-		const epicChatCwds = options.epicChatCwd ?? [];
-		const epicChatScope = epicChatIds.length > 0 || epicChatCwds.length > 0 ? {
-			...epicChatIds.length > 0 ? { chatIds: epicChatIds } : {},
-			...epicChatCwds.length > 0 ? { cwds: epicChatCwds } : {}
-		} : void 0;
+		const repo = repositorySlug(checkoutRepository(repoRoot));
 		const gathered = gatherCloseoutInputs({
-			chatsDir: options.chatsDir,
-			codexLogPath: options.codexLog,
 			epic: options.epic,
-			...epicChatScope === void 0 ? {} : { epicChatScope },
 			from,
 			issue: options.issue,
-			lane: options.lane,
 			pr: options.pr,
-			repo: options.repo,
+			repo,
 			repoRoot,
-			to,
-			usageCsvPath: options.usageCsv
+			to
 		});
 		if (gathered.diagnostics.length > 0) output.stderr.write(`factory:closeout trace diagnostics: ${gathered.diagnostics.length}\n`);
 		const artifact = buildEpicCloseoutReport({
@@ -10313,8 +9185,7 @@ function createCloseoutCommand(output, dependencies = {}) {
 			},
 			budget: gathered.budget,
 			epic: options.epic,
-			interiorRows: gathered.interiorRows,
-			repo: options.repo
+			repo
 		});
 		if (options.json) output.stdout.write(`${JSON.stringify(artifact, null, 2)}\n`);
 		const paths = closeoutArtifactPaths({
@@ -10332,11 +9203,11 @@ function createCloseoutCommand(output, dependencies = {}) {
 			repoRoot
 		});
 		const retro = buildRetroGate({
-			codexThreadIds: codexThreadIdsForCloseout(),
+			codexThreadIds: codexThreadIdsForCloseout(dependencies.env),
 			epic: options.epic,
 			...options.issue === void 0 ? {} : { issue: options.issue },
 			...options.pr === void 0 ? {} : { pr: options.pr },
-			repo: options.repo,
+			repo,
 			repoRoot
 		});
 		reportLocalCloseoutOutcome(output, {
@@ -10353,18 +9224,6 @@ function createCloseoutCommand(output, dependencies = {}) {
 			retro,
 			written
 		});
-		await reemitEpicStructureAtCloseout({
-			buildEvent: dependencies.buildEpicStructureEvent,
-			dagSource: options.structureDag,
-			env: dependencies.env ?? process.env,
-			expectedEpic: options.epic,
-			expectedRepo: options.repo,
-			fetchImpl: dependencies.structureFetch,
-			output,
-			publish: dependencies.publishEpicStructure,
-			timeoutMs: dependencies.structureTimeoutMs,
-			url: options.structureUrl
-		});
 		output.stdout.write(`wrote ${written.markdownPath} and ${written.jsonPath}\n`);
 	}));
 }
@@ -10431,54 +9290,6 @@ function createConfigCommand(output, deps = {}) {
 	return config;
 }
 //#endregion
-//#region src/checkout-repository.ts
-function normalizeRepositoryIdentity(repository) {
-	return {
-		name: repository.name.replace(/\.git$/iu, "").toLowerCase(),
-		owner: repository.owner.toLowerCase()
-	};
-}
-const GITHUB_HOSTNAME = "github.com";
-const SCP_GITHUB_REMOTE_PATTERN = /^(?:[^@\s]+@)?github\.com:(?<path>[^\s]+)$/iu;
-function githubRepositoryPath(remoteUrl) {
-	const scpPath = SCP_GITHUB_REMOTE_PATTERN.exec(remoteUrl)?.groups?.path;
-	if (scpPath) return scpPath;
-	try {
-		const url = new URL(remoteUrl);
-		if (url.hostname.toLowerCase() !== GITHUB_HOSTNAME) return;
-		return url.pathname.replace(/^\//u, "");
-	} catch {
-		return;
-	}
-}
-function parseCheckoutRepository(remoteUrl) {
-	const segments = githubRepositoryPath(remoteUrl.trim())?.split("/") ?? [];
-	const [owner, rawName] = segments;
-	const name = rawName?.replace(/\.git$/u, "");
-	if (!(owner && name) || segments.length !== 2) throw new Error(`Could not derive a GitHub repository from checkout origin ${remoteUrl}; configure origin as a github.com owner/repository remote.`);
-	return normalizeRepositoryIdentity({
-		name,
-		owner
-	});
-}
-function checkoutRepository(cwd) {
-	let remoteUrl;
-	try {
-		remoteUrl = runCapture("git", [
-			"remote",
-			"get-url",
-			"origin"
-		], cwd).stdout;
-	} catch {
-		throw new Error("Could not read checkout origin; repository routing must be rooted in trusted checkout configuration.");
-	}
-	return parseCheckoutRepository(remoteUrl);
-}
-const repositorySlug = (repository) => {
-	const normalized = normalizeRepositoryIdentity(repository);
-	return `${normalized.owner}/${normalized.name}`;
-};
-//#endregion
 //#region src/candidate-identity.ts
 var CandidateIdentityError = class extends Error {
 	constructor(message) {
@@ -10684,23 +9495,18 @@ const bindingRefusalReason = (name) => `Required check "${name}" has no passing,
 /**
 * The `evidence:emit` invocation that would satisfy a specific demanded check.
 *
-* Every flag here is one the command requires today: `--check`, `--check-type`,
-* `--outcome`, and `--producer` all fail closed when omitted, and a review-type
-* envelope additionally MUST carry a rung (ADR 0014 §3), so the rung flag
-* appears only for review checks and never for verify checks, which must not
-* carry one. `--cwd` and `--base` are left off deliberately: their defaults
+* Every flag here is one the current verify-only writer requires: `--check`,
+* `--outcome`, and `--producer`. `--cwd` and `--base` are left off deliberately: their defaults
 * (`.` and `origin/main`) are already what a lane in its own checkout wants,
 * and the default output path is {@link EVIDENCE_DIR}, which is where this
 * evaluation just looked. Only `--producer` is left as a placeholder, because
 * the producing identity is the caller's to name.
 */
-const evidenceEmitInvocation = (check) => [
+const evidenceEmitInvocation = (check) => check.checkType === "review" ? "review-type requiredChecks are historical-only; current profiles cannot declare or emit them" : [
 	"patronage-factory evidence:emit",
 	`--check "${check.name}"`,
-	`--check-type ${check.checkType}`,
 	"--outcome pass",
-	"--producer <id>",
-	...check.checkType === "review" ? ["--rung <rung>"] : []
+	"--producer <id>"
 ].join(" ");
 /**
 * The refusal when a demanded check has no envelope at all.
@@ -10901,7 +9707,7 @@ function buildEvidenceEnvelope(args, dependencies = {}) {
 	const sessionId = resolveEmitSessionId(args.sessionId, env);
 	const parsed = parseEvidenceEnvelope({
 		check: args.check,
-		checkType: args.checkType,
+		checkType: "verify",
 		headSha,
 		mergeBaseSha: merge,
 		outcome: args.outcome,
@@ -10912,11 +9718,7 @@ function buildEvidenceEnvelope(args, dependencies = {}) {
 		...args.findingsPointer ? { findingsPointer: args.findingsPointer } : {},
 		...args.policyVersion ? { policyVersion: args.policyVersion } : {},
 		...sessionId ? { sessionId } : {},
-		...args.requestId ? { requestId: args.requestId } : {},
-		...args.checkType === "review" ? {
-			...args.rung ? { rung: args.rung } : {},
-			...args.model ? { model: args.model } : {}
-		} : {}
+		...args.requestId ? { requestId: args.requestId } : {}
 	});
 	if (!parsed.ok) throw new Error(`Refusing to emit an invalid evidence envelope: ${parsed.error}`);
 	return parsed.envelope;
@@ -11657,7 +10459,7 @@ function runPrVerify(args, dependencies = {}) {
 		mode: resolvedMode,
 		patchId,
 		profilePath,
-		projectKey: profile.project.key,
+		projectKey: profile.repository.name,
 		repository,
 		startedAt
 	};
@@ -11740,7 +10542,7 @@ function runPrVerify(args, dependencies = {}) {
 		const baselineFullProofs = resolvedMode === "docs-only" ? baselineFullProofsForDocsOnly({
 			previousProof,
 			profilePath,
-			projectKey: profile.project.key,
+			projectKey: profile.repository.name,
 			repository
 		}) : void 0;
 		const proof = buildPrVerifyProof({
@@ -11755,7 +10557,6 @@ function runPrVerify(args, dependencies = {}) {
 			runEvidenceEmit({
 				base: args.base,
 				check: command.requiredCheck,
-				checkType: "verify",
 				cwd,
 				outcome: "pass",
 				policyVersion: "patronage-factory/pr-verify/v1",
@@ -11932,23 +10733,24 @@ function createDemandWaiveCommand(_output, action = runDemandWaive) {
 /**
 * Resolve the review modes demanded by a candidate's changed files.
 *
-* Modes keep their first-declared profile order. A mode with no conditional
-* rule is unconditional. A conditional mode is demanded when any rule that
-* names it matches any changed file.
+* Correctness is structural factory policy. Security is additionally demanded
+* when any repository-declared security path matches the candidate.
 */
 const resolveApplicableReviewModes = (profile, changedFiles) => {
-	const conditional = profile.review.conditional ?? [];
-	const conditionalModes = new Set(conditional.flatMap((scope) => scope.modes));
-	const seen = /* @__PURE__ */ new Set();
-	return profile.review.modes.filter((mode) => {
-		if (seen.has(mode)) return false;
-		seen.add(mode);
-		return !conditionalModes.has(mode) || conditional.some((scope) => scope.modes.includes(mode) && changedFiles.some((file) => matchesAnyGlob(scope.paths, file)));
-	});
+	return (profile.review?.conditional ?? []).some((scope) => changedFiles.some((file) => matchesAnyGlob(scope.paths, file))) ? ["correctness", "security"] : ["correctness"];
 };
+/**
+* Convert schema-v5 profile requiredChecks into the executable evidence
+* demands consumed by readiness and its preflight presentation. Schema-v5
+* checks are verify-only; no other module should reintroduce that policy.
+*/
+const resolveProfileRequiredChecks = (profile) => (profile.requiredChecks ?? []).map((check) => ({
+	...check,
+	checkType: "verify"
+}));
 const resolveCandidateDemands = ({ changedFiles, profile }) => ({
-	ladderPolicy: resolveReviewLadderPolicy(profile),
-	requiredChecks: profile.requiredChecks ?? [],
+	ladderPolicy: resolveReviewLadderPolicy(),
+	requiredChecks: resolveProfileRequiredChecks(profile),
 	reviewModes: resolveApplicableReviewModes(profile, changedFiles)
 });
 /**
@@ -12383,7 +11185,7 @@ const verifyProofCheck = ({ candidate, candidateError, preread, verifyProofPath
 * modes; currency and acceptance come from the same identity and
 * terminal-state helpers `pr:publish` uses.
 */
-const reviewProofCheck = ({ candidate, candidateError, profile, proof, reviewModes }) => {
+const reviewProofCheck = ({ candidate, candidateError, proof, reviewModes }) => {
 	const name = "admission:review-proof";
 	if (!candidate) return {
 		message: `Review proof state is unknown: no git candidate is resolvable here (${candidateError ?? "unknown error"}).`,
@@ -12402,7 +11204,7 @@ const reviewProofCheck = ({ candidate, candidateError, profile, proof, reviewMod
 		reviewedHeadSha: proof?.headSha,
 		reviewedPatchId: proof?.patchId
 	});
-	const terminal = proof ? resolveReviewTerminalStateAcrossReviewsForPolicy(proof, resolveReviewLadderPolicy(profile)) : void 0;
+	const terminal = proof ? resolveReviewTerminalStateAcrossReviewsForPolicy(proof, resolveReviewLadderPolicy()) : void 0;
 	const accepted = status === "current" && (terminal === "clean" || terminal === "accepted-with-findings");
 	return {
 		message: accepted ? `pr:review proof is current for this candidate (${terminal}) across ${reviewModes.join(", ")}.` : `pr:review proof is ${status}${terminal ? ` (${terminal})` : ""}; ${reviewModes.join(", ")} review(s) are required. Have an independent clean session write findings and pass them to pr:publish --findings <path>.`,
@@ -12422,7 +11224,7 @@ const requiredCheckMessage = (outcome) => {
 * independence stay exactly one implementation.
 */
 const requiredCheckChecks = ({ candidate, candidateError, cwd, profile, verifyProof }) => {
-	const requiredChecks = profile.requiredChecks ?? [];
+	const requiredChecks = resolveProfileRequiredChecks(profile);
 	if (requiredChecks.length === 0) return [{
 		message: "Profile declares no requiredChecks; no external evidence envelope (including a preview-deploy proof) is demanded.",
 		name: "admission:required-checks",
@@ -12479,9 +11281,8 @@ const admissionPreflightChecks = ({ base = "origin/main", cwd, env = process.env
 		reviewProofCheck({
 			candidate,
 			candidateError,
-			profile,
 			proof: reviewProof,
-			reviewModes: candidate ? resolveApplicableReviewModes(profile, candidate.files) : profile.review.modes
+			reviewModes: candidate ? resolveApplicableReviewModes(profile, candidate.files) : ["correctness"]
 		}),
 		...requiredCheckChecks({
 			candidate,
@@ -12751,7 +11552,6 @@ async function doctorProjectProfile(input = {}) {
 	}, input.hqRetroReadbackDependencies)]);
 	const checks = [
 		...buildProfileChecks(profile, cwd, {
-			env,
 			userConfig: userConfig.loaded?.config,
 			userConfigCheck: userConfig.check
 		}),
@@ -12770,9 +11570,8 @@ async function doctorProjectProfile(input = {}) {
 		checks,
 		ok: checks.every((check) => check.status !== "error"),
 		profilePath: path,
-		projectKey: profile.project.key,
+		projectKey: profile.repository.name,
 		repository: {
-			defaultBranch: profile.repository.defaultBranch,
 			name: profile.repository.name,
 			owner: profile.repository.owner
 		},
@@ -12811,12 +11610,12 @@ function resolveDoctorUserConfig(env, provided) {
 function buildProfileChecks(profile, cwd, userConfigInput) {
 	return [
 		{
-			message: `Loaded schema version ${profile.schemaVersion} profile for ${profile.project.key}.`,
+			message: `Loaded schema version ${profile.schemaVersion} profile for ${profile.repository.name}.`,
 			name: "profile",
 			status: "ok"
 		},
 		{
-			message: `${profile.repository.owner}/${profile.repository.name} uses ${profile.repository.defaultBranch}.`,
+			message: `${profile.repository.owner}/${profile.repository.name} repository identity loaded.`,
 			name: "repository",
 			status: "ok"
 		},
@@ -12825,31 +11624,16 @@ function buildProfileChecks(profile, cwd, userConfigInput) {
 			name: "verification",
 			status: "ok"
 		},
-		requiredEnvironmentCheck(profile, userConfigInput.env),
 		{
-			message: `${profile.review.modes.join(", ")} review modes configured with ${profile.review.defaultMaxCycles} cycle cap.`,
+			message: `Correctness review is structural with a 5-cycle cap; ${profile.review?.conditional?.length ?? 0} security path group(s) configured.`,
 			name: "review-policy",
 			status: "ok"
 		},
-		reviewLadderCheck(profile),
+		reviewLadderCheck(),
 		userConfigInput.userConfigCheck,
-		githubAppCheck(userConfigInput.userConfig),
-		gitRemoteCheck(profile, cwd)
-	];
-}
-function requiredEnvironmentCheck(profile, env) {
-	const required = profile.env?.required ?? [];
-	const unset = required.filter((name) => !env[name]);
-	if (unset.length > 0) return {
-		message: `Required environment variables are unset: ${unset.join(", ")}.`,
-		name: "environment",
-		status: "error"
-	};
-	return {
-		message: required.length === 0 ? "No required environment variables declared." : `${required.length} required environment variable name(s) are set.`,
-		name: "environment",
-		status: "ok"
-	};
+		githubAppCheck(userConfigInput.userConfig),
+		gitRemoteCheck(profile, cwd)
+	];
 }
 function githubAppCheck(userConfig) {
 	const app = userConfig?.githubApp;
@@ -12864,85 +11648,440 @@ function githubAppCheck(userConfig) {
 		status: "warning"
 	};
 	return {
-		message: `Patronage Factory GitHub App id ${app.appId} is configured${app.installationId ? ` for installation ${app.installationId}` : " with repository installation discovery"}.`,
-		name: "github-app",
-		status: "ok"
+		message: `Patronage Factory GitHub App id ${app.appId} is configured${app.installationId ? ` for installation ${app.installationId}` : " with repository installation discovery"}.`,
+		name: "github-app",
+		status: "ok"
+	};
+}
+function reviewLadderCheck() {
+	return {
+		message: `Review ladder: gate cap ${resolveReviewLadderPolicy().gate.cap}.`,
+		name: "review-ladder",
+		status: "ok"
+	};
+}
+function gitRemoteCheck(profile, cwd) {
+	const origin = readGitOrigin(cwd);
+	if (!origin) return {
+		message: "No git origin remote was available for this working directory.",
+		name: "git-origin",
+		status: "warning"
+	};
+	if (repositoryUrlMatches(origin, profile)) return {
+		message: `Git origin matches ${profile.repository.owner}/${profile.repository.name}.`,
+		name: "git-origin",
+		status: "ok"
+	};
+	return {
+		message: `Git origin ${origin} does not match ${profile.repository.owner}/${profile.repository.name}.`,
+		name: "git-origin",
+		status: "warning"
+	};
+}
+function readGitOrigin(cwd) {
+	try {
+		return execFileSync("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], {
+			cwd,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+function repositoryUrlMatches(origin, profile) {
+	const normalized = origin.replace(/\.git$/u, "");
+	const repoPath = `${profile.repository.owner}/${profile.repository.name}`;
+	return normalized.endsWith(`github.com:${repoPath}`) || normalized.endsWith(`github.com/${repoPath}`) || normalized.endsWith(repoPath);
+}
+//#endregion
+//#region src/commands/doctor.ts
+function createDoctorCommand(output) {
+	return new Command("doctor").description("Validate a project profile without mutating GitHub or local files").option("--base <ref>", "base branch or ref for --preflight", "origin/main").option("--cwd <path>", "working directory to validate", ".").option("--json", "print the doctor report as JSON").option("--preflight", "also list the pre-checkable admission requirements for the current candidate (read-only; never blocks); findings-file shape and wave membership have no read-only pre-check").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
+		const report = await doctorProjectProfile({
+			base: options.base,
+			cwd: resolveCwdOption(options.cwd),
+			preflight: options.preflight,
+			profilePath: options.profile
+		});
+		if (options.json) output.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+		else output.stdout.write(formatHumanReport(report));
+		if (!report.ok) process.exitCode = 1;
+	});
+}
+function formatHumanReport(report) {
+	return [
+		`Profile: ${report.projectKey} (schema ${report.schemaVersion})`,
+		`Repository: ${report.repository.owner}/${report.repository.name}`,
+		`Path: ${report.profilePath}`,
+		"",
+		...report.checks.map((check) => `[${check.status}] ${check.name}: ${check.message}`),
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/epic-structure.ts
+/**
+* Producer-side `epic-structure` v1 emitter (epic #132, lane #135).
+*
+* `psf epic:publish-structure` reads a planner's ephemeral `dag.yml` (never
+* committed — see epic #132 / ADR 0018), validates the graph fail-closed, and
+* POSTs an `epic-structure` v1 event to HQ's `/api/ingest` boundary. This
+* module is the pure core: parse-to-IR validation, the wire mapping, and the
+* deterministic content-addressed eventId. All I/O (stdin/file read, fetch)
+* lives in the command wrapper.
+*
+* WIRE PARITY (do not fork the schema): the emitted payload is the exact shape
+* HQ's `EpicGraphSchema` accepts (`software-factory-hq/src/contracts/
+* epic-schemas.ts`) and is built by hand the same way `seed-dev.ts` builds it
+* — no re-declared zod twin. HQ's `epic-structure-parity.test.ts` imports
+* {@link buildEpicStructureEvent} and runs its output through the real
+* `EpicGraphSchema`, so any drift (field, enum, bound, strictness) fails CI.
+*
+* The `dag.yml` schema itself is documented with the epic skill (lane #137);
+* this module is the executable contract, not a second source of truth.
+*/
+const EPIC_STRUCTURE_SCHEMA_VERSION = 1;
+/**
+* DAG-node PLANNING statuses — the planning-plane vocabulary a planner authors
+* on a `dag.yml` node. Carried forward by ADR 0018 §4 and defined by the epic
+* skill (`reference/epic-artifacts.md`) and both `CONTEXT.md` glossaries.
+*
+* A DAG node is a unit of *plan*; an HQ lane is a unit of *runtime execution*.
+* These are two planes with two vocabularies and must not be conflated — the
+* producer validates and emits ONLY planning statuses:
+*
+*   - `open`              authored, not yet done
+*   - `closed`            done (a PR merged, or otherwise resolved)
+*   - `satisfied-on-main` already true on main without a dedicated PR
+*   - `parked`            real node, scope still moving — relabeled off
+*                         `ready-for-agent`, never closed
+*
+* HQ's `DagNodeSchema` (`software-factory-hq/src/contracts/epic-schemas.ts`)
+* accepts this planning vocabulary on ingest AND overlays a runtime LANE status
+* onto a node once a lane is linked (`syncNodesWithLanes` /
+* `projectEpicMembership`) — the overlay is HQ-internal; the producer never
+* emits a lane status. HQ's `epic-structure-parity.test.ts` fails CI if the
+* producer emits any status HQ won't accept.
+*/
+const EPIC_STRUCTURE_NODE_STATUSES = [
+	"open",
+	"closed",
+	"satisfied-on-main",
+	"parked"
+];
+/**
+* Fail-closed validation error carrying every offending node/edge diagnostic.
+*/
+var EpicStructureValidationError = class extends Error {
+	diagnostics;
+	constructor(diagnostics) {
+		super(`epic:publish-structure refused: dag graph is invalid\n${diagnostics.map((line) => `  - ${line}`).join("\n")}`);
+		this.name = "EpicStructureValidationError";
+		this.diagnostics = diagnostics;
+	}
+};
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const nonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
+const isPositiveInteger = (value) => typeof value === "number" && Number.isInteger(value) && value > 0;
+const slugify = (value) => value.trim().toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "") || "epic";
+const laneIdFor = (repo, issue) => `lane-${repo}-issue-${issue}`;
+const validateNodes = (rawNodes, diagnostics) => {
+	const nodes = [];
+	const slugs = /* @__PURE__ */ new Set();
+	for (const [index, raw] of rawNodes.entries()) {
+		if (!isPlainObject(raw)) {
+			diagnostics.push(`node[${index}]: expected a mapping`);
+			continue;
+		}
+		const label = nonEmptyString(raw.slug) ? `"${raw.slug}"` : `node[${index}]`;
+		if (!nonEmptyString(raw.slug)) diagnostics.push(`node[${index}]: missing required \`slug\``);
+		else if (slugs.has(raw.slug)) diagnostics.push(`node ${label}: duplicate slug`);
+		else slugs.add(raw.slug);
+		if (!nonEmptyString(raw.title)) diagnostics.push(`node ${label}: missing required \`title\``);
+		const external = raw.external === true;
+		if (!external && !isPositiveInteger(raw.issue)) diagnostics.push(`node ${label}: \`issue\` number is required — non-external nodes must carry a minted issue (this runs post-ratification); set \`external: true\` to exempt an adoption/upstream node`);
+		let status = "open";
+		if (raw.status === void 0) status = "open";
+		else if (EPIC_STRUCTURE_NODE_STATUSES.includes(raw.status)) status = raw.status;
+		else diagnostics.push(`node ${label}: \`status\` must be one of ${EPIC_STRUCTURE_NODE_STATUSES.join(", ")} (DAG-node planning statuses, not HQ lane statuses)`);
+		if (raw.laneId !== void 0 && !nonEmptyString(raw.laneId)) diagnostics.push(`node ${label}: \`laneId\` must be a non-empty string`);
+		nodes.push({
+			external,
+			...isPositiveInteger(raw.issue) ? { issue: raw.issue } : {},
+			...nonEmptyString(raw.laneId) ? { laneId: raw.laneId } : {},
+			slug: nonEmptyString(raw.slug) ? raw.slug : `node[${index}]`,
+			status,
+			title: nonEmptyString(raw.title) ? raw.title : ""
+		});
+	}
+	return {
+		nodes,
+		slugs
+	};
+};
+const validateEdges = (rawEdges, slugs, diagnostics) => {
+	const edges = [];
+	for (const [index, raw] of rawEdges.entries()) {
+		if (!isPlainObject(raw)) {
+			diagnostics.push(`edge[${index}]: expected a mapping`);
+			continue;
+		}
+		if (raw.type !== "depends-on") continue;
+		if (!nonEmptyString(raw.from) || !nonEmptyString(raw.to)) {
+			diagnostics.push(`edge[${index}]: depends-on edge requires string \`from\` and \`to\``);
+			continue;
+		}
+		if (!slugs.has(raw.from)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`from\` references unknown slug "${raw.from}"`);
+		if (!slugs.has(raw.to)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`to\` references unknown slug "${raw.to}"`);
+		if (raw.from === raw.to) diagnostics.push(`edge ${raw.from} -> ${raw.to}: self-dependency (cycle)`);
+		edges.push({
+			from: raw.from,
+			to: raw.to
+		});
+	}
+	return edges;
+};
+/**
+* Detects a dependency cycle over the depends-on edges and returns the offending
+* cycle path (`a -> b -> a`) if one exists, else undefined. Only edges whose
+* endpoints both resolve to known slugs are walked, so unknown-slug diagnostics
+* are reported independently and never masquerade as cycles.
+*/
+const findCycle = (slugs, edges) => {
+	const adjacency = /* @__PURE__ */ new Map();
+	for (const { from, to } of edges) if (slugs.has(from) && slugs.has(to)) {
+		const list = adjacency.get(from) ?? [];
+		list.push(to);
+		adjacency.set(from, list);
+	}
+	const UNVISITED = 0;
+	const IN_STACK = 1;
+	const DONE = 2;
+	const state = /* @__PURE__ */ new Map();
+	const stack = [];
+	const walk = (node) => {
+		state.set(node, IN_STACK);
+		stack.push(node);
+		for (const next of adjacency.get(node) ?? []) {
+			const marker = state.get(next) ?? UNVISITED;
+			if (marker === IN_STACK) {
+				const start = stack.indexOf(next);
+				return [...stack.slice(start), next];
+			}
+			if (marker === UNVISITED) {
+				const found = walk(next);
+				if (found) return found;
+			}
+		}
+		stack.pop();
+		state.set(node, DONE);
+	};
+	for (const slug of slugs) if ((state.get(slug) ?? UNVISITED) === UNVISITED) {
+		const found = walk(slug);
+		if (found) return found;
+	}
+};
+const resolveEpicId = (epic) => {
+	if (typeof epic === "number") return String(epic);
+	if (nonEmptyString(epic)) return epic.trim();
+};
+/**
+* Validates a dag document fail-closed. Throws {@link
+* EpicStructureValidationError} with a diagnostic per offending node/edge.
+*/
+const validateDagDocument = (input) => {
+	const doc = input.document;
+	const diagnostics = [];
+	if (!isPlainObject(doc)) throw new EpicStructureValidationError(["dag document must be a YAML/JSON mapping with `epic` and `nodes`"]);
+	const epicId = resolveEpicId(doc.epic);
+	if (epicId === void 0) diagnostics.push("dag document requires a top-level `epic` id");
+	const repo = nonEmptyString(doc.repo) ? doc.repo.trim() : void 0;
+	if (repo === void 0) diagnostics.push("repo is required in the dag document — set top-level `repo:` (needed for the epic record and lane-id derivation)");
+	const rawNodes = Array.isArray(doc.nodes) ? doc.nodes : void 0;
+	if (rawNodes === void 0 || rawNodes.length === 0) diagnostics.push("dag document requires a non-empty `nodes` array");
+	const { nodes, slugs } = validateNodes(rawNodes ?? [], diagnostics);
+	const edges = validateEdges(Array.isArray(doc.edges) ? doc.edges : [], slugs, diagnostics);
+	const cycle = findCycle(slugs, edges);
+	if (cycle) diagnostics.push(`dependency cycle detected: ${cycle.join(" -> ")}`);
+	if (diagnostics.length > 0 || epicId === void 0 || repo === void 0) throw new EpicStructureValidationError(diagnostics);
+	return {
+		boundary: slugify(nonEmptyString(doc.boundary) ? doc.boundary : `epic-${epicId}`),
+		edges,
+		epicId,
+		name: nonEmptyString(doc.name) ? doc.name.trim() : `Epic ${epicId}`,
+		nodes,
+		repo
 	};
-}
-function reviewLadderCheck(profile) {
+};
+/**
+* Builds the wire payload with deterministic ordering (nodes by slug, edges by
+* from then to) so re-emission of the same graph is byte-stable regardless of
+* the planner's source ordering — the basis for the content-addressed eventId.
+*/
+const buildEpicStructurePayload = (dag) => {
+	const nodes = dag.nodes.map((node) => {
+		const laneId = node.laneId ?? (node.issue === void 0 ? void 0 : laneIdFor(dag.repo, node.issue));
+		return {
+			epicId: dag.epicId,
+			...laneId === void 0 ? {} : { laneId },
+			slug: node.slug,
+			status: node.status,
+			title: node.title
+		};
+	}).toSorted((a, b) => a.slug.localeCompare(b.slug));
 	return {
-		message: `Review ladder: gate cap ${resolveReviewLadderPolicy(profile).gate.cap}.`,
-		name: "review-ladder",
-		status: "ok"
-	};
-}
-function gitRemoteCheck(profile, cwd) {
-	const origin = readGitOrigin(cwd);
-	if (!origin) return {
-		message: "No git origin remote was available for this working directory.",
-		name: "git-origin",
-		status: "warning"
-	};
-	if (repositoryUrlMatches(origin, profile)) return {
-		message: `Git origin matches ${profile.repository.owner}/${profile.repository.name}.`,
-		name: "git-origin",
-		status: "ok"
+		edges: dag.edges.map((edge) => ({
+			epicId: dag.epicId,
+			from: edge.from,
+			to: edge.to,
+			type: "depends-on"
+		})).toSorted((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to)),
+		epics: [{
+			id: dag.epicId,
+			name: dag.name,
+			repo: dag.repo
+		}],
+		nodes
 	};
+};
+/** Stable, key-sorted JSON for content hashing (values already ordered). */
+const stableStringify = (value) => {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (isPlainObject(value)) return `{${Object.keys(value).toSorted().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	return JSON.stringify(value ?? null);
+};
+/**
+* Deterministic eventId = `epic-structure-<boundary>-<sha256(payload)[0:16]>`.
+* Re-emitting identical graph content yields the same eventId (HQ dedups →
+* 200/duplicate); an amendment changes the content hash → a new eventId that
+* supersedes the prior structure wholesale (HQ keeps the latest). This mirrors
+* seed-dev's fixed-eventId idempotency, content-addressed instead of literal.
+*/
+const epicStructureEventId = (boundary, payload) => `epic-structure-${slugify(boundary)}-${createHash("sha256").update(stableStringify(payload)).digest("hex").slice(0, 16)}`;
+/**
+* Validates and builds the full `epic-structure` v1 ingest event, ready to POST
+* to `/api/ingest`. Throws {@link EpicStructureValidationError} fail-closed.
+*/
+const buildEpicStructureEvent = (input) => {
+	const dag = validateDagDocument(input);
+	const payload = buildEpicStructurePayload(dag);
 	return {
-		message: `Git origin ${origin} does not match ${profile.repository.owner}/${profile.repository.name}.`,
-		name: "git-origin",
-		status: "warning"
+		eventId: epicStructureEventId(dag.boundary, payload),
+		kind: "epic-structure",
+		observedAt: input.observedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		payload,
+		schemaVersion: 1
 	};
-}
-function readGitOrigin(cwd) {
+};
+/** The prod HQ worker is reachable at `hq.patronage.com` and its frozen
+* `-v1.*.workers.dev` alias. Emitting there without an Access service token is
+* fail-closed. */
+const isProductionHqUrl = (url) => url.includes("hq.patronage.com") || /-v1\.[^/]*\.workers\.dev/iu.test(url);
+/**
+* POSTs the event to HQ ingest. Fail-closed: a production URL without a
+* Cloudflare Access service token is refused before any request; a 401/403 is
+* surfaced with actionable guidance; any non-2xx throws.
+*/
+const publishEpicStructure = async (args) => {
+	if (!args.accessServiceToken && isProductionHqUrl(args.url)) throw new Error(`epic:publish-structure refusing to publish to production ${args.url} without a Cloudflare Access service token: set CF-Access-Client-Id and CF-Access-Client-Secret`);
+	const doFetch = args.fetchImpl ?? globalThis.fetch;
+	const requestInit = args.accessServiceToken ? buildCloudflareAccessRequestInit(args.accessServiceToken, {
+		body: JSON.stringify(args.event),
+		headers: { "content-type": "application/json" },
+		method: "POST",
+		...args.signal ? { signal: args.signal } : {}
+	}) : {
+		body: JSON.stringify(args.event),
+		headers: { "content-type": "application/json" },
+		method: "POST",
+		...args.signal ? { signal: args.signal } : {}
+	};
+	let response;
 	try {
-		return execFileSync("git", [
-			"remote",
-			"get-url",
-			"origin"
-		], {
-			cwd,
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
+		const normalizedUrl = args.url.replace(/\/+$/u, "");
+		response = await doFetch(normalizedUrl.endsWith("/api/ingest") ? normalizedUrl : `${normalizedUrl}/api/ingest`, requestInit);
 	} catch {
-		return null;
+		throw new Error(`epic:publish-structure could not reach HQ ingest at ${args.url}: request failed. Check the endpoint and network; redirects are refused to protect Cloudflare Access credentials.`);
 	}
-}
-function repositoryUrlMatches(origin, profile) {
-	const normalized = origin.replace(/\.git$/u, "");
-	const repoPath = `${profile.repository.owner}/${profile.repository.name}`;
-	return normalized.endsWith(`github.com:${repoPath}`) || normalized.endsWith(`github.com/${repoPath}`) || normalized.endsWith(repoPath);
-}
+	const text = await response.text();
+	if (response.status === 401 || response.status === 403) throw new Error(`epic:publish-structure rejected by Cloudflare Access or HQ ingest (${response.status}): set valid CF-Access-Client-Id and CF-Access-Client-Secret service-token inputs. Response: ${text}`);
+	if (response.status < 200 || response.status >= 300) throw new Error(`epic:publish-structure failed: HQ ingest returned ${response.status} ${text}`);
+	let duplicate = false;
+	try {
+		duplicate = JSON.parse(text).duplicate === true;
+	} catch {
+		duplicate = response.status === 200;
+	}
+	return {
+		duplicate,
+		eventId: args.event.eventId,
+		status: response.status
+	};
+};
 //#endregion
-//#region src/commands/doctor.ts
-function createDoctorCommand(output) {
-	return new Command("doctor").description("Validate a project profile without mutating GitHub or local files").option("--base <ref>", "base branch or ref for --preflight", "origin/main").option("--cwd <path>", "working directory to validate", ".").option("--json", "print the doctor report as JSON").option("--preflight", "also list the pre-checkable admission requirements for the current candidate (read-only; never blocks); findings-file shape and wave membership have no read-only pre-check").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
-		const report = await doctorProjectProfile({
-			base: options.base,
-			cwd: resolveCwdOption(options.cwd),
-			preflight: options.preflight,
-			profilePath: options.profile
+//#region src/commands/epic-publish-structure.ts
+const STDIN = "-";
+/** Reads a dag.yml source path, or stdin when `source` is `-`. */
+const readSource = (source) => {
+	const fd = source === STDIN ? 0 : source;
+	try {
+		return readFileSync(fd, "utf-8");
+	} catch (error) {
+		const cause = error instanceof Error ? error.message : String(error);
+		throw new Error(`epic:publish-structure could not read ${source === STDIN ? "stdin" : source} (${cause})`, { cause: error });
+	}
+};
+/** Parses a dag.yml/JSON document read from `readSource`. */
+const parseDocument = (raw, source) => {
+	if (raw.trim() === "") throw new Error(`epic:publish-structure received empty input from ${source === STDIN ? "stdin" : source}`);
+	try {
+		return parse(raw);
+	} catch (error) {
+		const cause = error instanceof Error ? error.message : String(error);
+		throw new Error(`epic:publish-structure could not parse YAML: ${cause}`, { cause: error });
+	}
+};
+/**
+* Reads and validates a dag.yml/JSON source into a full `epic-structure` v1
+* event, ready to POST or dry-run print. Required event identity lives in the
+* document; the command does not patch authored structure with override flags.
+*/
+const buildEvent = (source) => {
+	return buildEpicStructureEvent({ document: parseDocument(readSource(source), source) });
+};
+function createEpicPublishStructureCommand(output, deps = {}) {
+	const env = deps.env ?? process.env;
+	return new Command("epic:publish-structure").description("Emit-only: read a planner's ephemeral dag.yml (or - for stdin), validate the graph fail-closed (YAML parses, required fields, edges reference known slugs, acyclic, issue numbers on every non-external node), and POST an epic-structure v1 event to HQ ingest. Idempotent by a content-addressed eventId (re-emission of an amendment supersedes the prior structure). Production auth uses the CF-Access-Client-Id and CF-Access-Client-Secret environment inputs. URL: --url or HQ_INGEST_URL. The dag.yml schema is documented with the epic skill (#137).").argument("[source]", "path to dag.yml, or - for stdin", STDIN).option("--url <url>", "HQ ingest base URL (default: HQ_INGEST_URL env). The command POSTs to <url>/api/ingest").option("--dry-run", "validate and build the event, print it, and exit without POSTing").option("--json", "print the built event / publish result as JSON").action(async (source, options) => {
+		const event = buildEvent(source);
+		if (options.dryRun) {
+			output.stdout.write(options.json ? `${JSON.stringify(event, null, 2)}\n` : `epic:publish-structure OK (dry-run) — eventId ${event.eventId}, ${event.payload.nodes.length} node(s), ${event.payload.edges.length} edge(s)\n`);
+			return;
+		}
+		const url = options.url ?? env.HQ_INGEST_URL;
+		if (!url) throw new Error("epic:publish-structure requires an HQ ingest URL: pass --url or set HQ_INGEST_URL");
+		const clientId = env[CF_ACCESS_CLIENT_ID_ENV];
+		const clientSecret = env[CF_ACCESS_CLIENT_SECRET_ENV];
+		const result = await publishEpicStructure({
+			...clientId && clientSecret ? { accessServiceToken: {
+				clientId,
+				clientSecret
+			} } : {},
+			event,
+			fetchImpl: deps.fetchImpl,
+			url
 		});
-		if (options.json) output.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-		else output.stdout.write(formatHumanReport(report));
-		if (!report.ok) process.exitCode = 1;
+		output.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `epic:publish-structure ${result.duplicate ? "no-op (duplicate)" : "accepted"} — eventId ${result.eventId} [HTTP ${result.status}]\n`);
 	});
 }
-function formatHumanReport(report) {
-	return [
-		`Profile: ${report.projectKey} (schema ${report.schemaVersion})`,
-		`Repository: ${report.repository.owner}/${report.repository.name} default ${report.repository.defaultBranch}`,
-		`Path: ${report.profilePath}`,
-		"",
-		...report.checks.map((check) => `[${check.status}] ${check.name}: ${check.message}`),
-		""
-	].join("\n");
-}
 //#endregion
 //#region src/commands/evidence-emit.ts
 const readStdin = () => {
@@ -12957,6 +12096,15 @@ const readStdin = () => {
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("evidence:emit stdin must be a JSON object of field values");
 	return parsed;
 };
+const RETIRED_STDIN_FIELDS = [
+	"checkType",
+	"rung",
+	"model"
+];
+function rejectRetiredStdinFields(input) {
+	const found = RETIRED_STDIN_FIELDS.filter((field) => field in input);
+	if (found.length > 0) throw new Error(`evidence:emit stdin no longer accepts ${found.join(", ")}; external evidence is verify-only. Remove ${found.join(", ")} from the JSON payload and emit the check with --check, --outcome, and --producer.`);
+}
 const stringField = (value, name) => {
 	if (value === void 0) return;
 	if (typeof value !== "string" || value.trim() === "") throw new Error(`evidence:emit ${name} must be a non-empty string`);
@@ -12966,10 +12114,6 @@ const requireField = (value, name) => {
 	if (value === void 0) throw new Error(`evidence:emit requires ${name} (flag or stdin field)`);
 	return value;
 };
-const asCheckType = (value) => {
-	if (!EVIDENCE_CHECK_TYPES$1.includes(value)) throw new Error(`evidence:emit --check-type must be one of: ${EVIDENCE_CHECK_TYPES$1.join(", ")}`);
-	return value;
-};
 const asOutcome = (value) => {
 	if (value !== "pass" && value !== "fail") throw new Error("evidence:emit --outcome must be \"pass\" or \"fail\"");
 	return value;
@@ -12978,48 +12122,25 @@ function optionalString(key, flagValue, stdinValue) {
 	const resolved = stringField(flagValue, `--${key}`) ?? stringField(stdinValue, key);
 	return resolved ? { [key]: resolved } : {};
 }
-const findRequiredCheckInProfile = ({ check, cwd, profilePath }) => {
-	if (profilePath === void 0) return;
-	return loadProjectProfile({
-		cwd,
-		profilePath
-	}).profile.requiredChecks?.find((entry) => entry.name === check);
-};
-const resolveCheckType = ({ explicitCheckType, requiredCheck }) => {
-	if (explicitCheckType !== void 0 && requiredCheck !== void 0 && explicitCheckType !== requiredCheck.checkType) throw new Error(`evidence:emit --check-type "${explicitCheckType}" conflicts with the profile's requiredChecks declaration for "${requiredCheck.name}" (checkType "${requiredCheck.checkType}")`);
-	return explicitCheckType ?? requiredCheck?.checkType;
-};
-const asRung = (value) => {
-	if (!EVIDENCE_REVIEW_RUNGS$1.includes(value)) throw new Error(`evidence:emit --rung must be one of: ${EVIDENCE_REVIEW_RUNGS$1.join(", ")}`);
-	return value;
-};
-function createEvidenceEmitCommand(output, action = runEvidenceEmit) {
-	return new Command("evidence:emit").description("Build, validate, and write an external-evidence envelope (ADR 0014)").option("--cwd <path>", "repository working directory", ".").option("--base <ref>", "base branch or ref for the three-way binding", "origin/main").option("--check <name>", "declared requiredChecks name this evidence satisfies").option("--check-type <type>", `one of: ${EVIDENCE_CHECK_TYPES$1.join(", ")}`).option("--outcome <pass|fail>", "the check outcome").option("--producer <id>", "the producing identity (recorded, not gated)").option("--rung <rung>", `review-type only: ${EVIDENCE_REVIEW_RUNGS$1.join(", ")}`).option("--model <model>", "review-type only: the concrete model").option("--policy-version <version>", "canonical prompt / Warden rules version").option("--session-id <id>", "producer session id (independence join key)").option("--request-id <id>", "producer request id (join key)").option("--findings-pointer <ref>", "pointer to findings (never embedded)").option("--profile <path>", "path to the project profile JSON file (accepted for a uniform consumer-wrapper flag set; when the profile declares a requiredChecks entry matching --check, its checkType fills --check-type if omitted)").option("--output <path>", "write the envelope to a specific path").option("--stdin", "merge JSON field values from stdin (flags win)").option("--json", "print the written envelope as JSON").action((options) => {
+function createEvidenceEmitCommand(output, action = runEvidenceEmit, readInput = readStdin) {
+	return new Command("evidence:emit").description("Build, validate, and write an external-evidence envelope (ADR 0014)").option("--cwd <path>", "repository working directory", ".").option("--base <ref>", "base branch or ref for the three-way binding", "origin/main").option("--check <name>", "declared requiredChecks name this evidence satisfies").option("--outcome <pass|fail>", "the check outcome").option("--producer <id>", "the producing identity (recorded, not gated)").option("--policy-version <version>", "canonical prompt / Warden rules version").option("--session-id <id>", "producer session id (independence join key)").option("--request-id <id>", "producer request id (join key)").option("--findings-pointer <ref>", "pointer to findings (never embedded)").option("--profile <path>", "path to the project profile JSON file (accepted for a uniform consumer-wrapper flag set and loaded strictly when supplied)").option("--output <path>", "write the envelope to a specific path").option("--stdin", "merge JSON field values from stdin (flags win)").option("--json", "print the written envelope as JSON").action((options) => {
 		const cwd = resolveCwdOption(options.cwd);
-		const fromStdin = options.stdin ? readStdin() : {};
+		const fromStdin = options.stdin ? readInput() : {};
+		rejectRetiredStdinFields(fromStdin);
 		const check = requireField(stringField(options.check, "--check") ?? stringField(fromStdin.check, "check"), "--check");
-		const requiredCheck = findRequiredCheckInProfile({
-			check,
+		if (options.profile !== void 0) loadProjectProfile({
 			cwd,
 			profilePath: options.profile
 		});
-		const checkType = asCheckType(requireField(resolveCheckType({
-			explicitCheckType: stringField(options.checkType, "--check-type") ?? stringField(fromStdin.checkType, "checkType"),
-			requiredCheck
-		}), "--check-type"));
 		const outcome = asOutcome(requireField(stringField(options.outcome, "--outcome") ?? stringField(fromStdin.outcome, "outcome"), "--outcome"));
 		const producer = requireField(stringField(options.producer, "--producer") ?? stringField(fromStdin.producer, "producer"), "--producer");
-		const rungValue = stringField(options.rung, "--rung") ?? stringField(fromStdin.rung, "rung");
 		const result = action({
 			base: options.base,
 			check,
-			checkType,
 			cwd,
 			outcome,
 			producer,
 			...options.profile ? { profilePath: options.profile } : {},
-			...rungValue ? { rung: asRung(rungValue) } : {},
-			...optionalString("model", options.model, fromStdin.model),
 			...optionalString("policyVersion", options.policyVersion, fromStdin.policyVersion),
 			...optionalString("sessionId", options.sessionId, fromStdin.sessionId),
 			...optionalString("requestId", options.requestId, fromStdin.requestId),
@@ -13032,89 +12153,6 @@ function createEvidenceEmitCommand(output, action = runEvidenceEmit) {
 	});
 }
 //#endregion
-//#region src/lane-threads.ts
-const LANE_THREADS_PATH = ".factory-memory/lane-threads";
-const laneThreadEntrySchema = z.object({
-	agent: z.string().min(1),
-	branch: z.string().min(1).optional(),
-	dispatchedAt: z.iso.datetime(),
-	issue: z.number().int().positive(),
-	model: z.string().min(1),
-	threadId: z.string().min(1)
-}).strict();
-const laneThreadFilename = /^(?<issue>\d+)\.json$/u;
-function issueFromFilename(file) {
-	return Number(laneThreadFilename.exec(file)?.groups?.issue ?? "");
-}
-function readLaneThreads(cwd) {
-	const directory = path.join(cwd, LANE_THREADS_PATH);
-	let files;
-	try {
-		files = readdirSync(directory).filter((file) => laneThreadFilename.test(file)).toSorted((left, right) => issueFromFilename(left) - issueFromFilename(right));
-	} catch (error) {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	}
-	return files.map((file) => {
-		const entry = laneThreadEntrySchema.parse(JSON.parse(readFileSync(path.join(directory, file), "utf-8")));
-		const issue = issueFromFilename(file);
-		if (entry.issue !== issue) throw new Error(`Lane thread file ${file} contains issue ${entry.issue}; expected ${issue}.`);
-		return entry;
-	});
-}
-function writeLaneThread(cwd, entry) {
-	const parsed = laneThreadEntrySchema.parse(entry);
-	const directory = path.join(cwd, LANE_THREADS_PATH);
-	const file = path.join(directory, `${parsed.issue}.json`);
-	const temporary = path.join(directory, `${parsed.issue}.${process.pid}.${randomUUID()}.tmp`);
-	mkdirSync(directory, { recursive: true });
-	try {
-		writeFileSync(temporary, `${JSON.stringify(parsed, null, 2)}\n`, "utf-8");
-		renameSync(temporary, file);
-	} finally {
-		rmSync(temporary, { force: true });
-	}
-}
-//#endregion
-//#region src/commands/guard.ts
-function resolveGuardCwd(command) {
-	return resolveCwdOption(command.optsWithGlobals().cwd ?? ".");
-}
-function createGuardCommand(output) {
-	const guard = new Command("guard").description("Factory worker safety guards").option("--cwd <path>", "working directory").enablePositionalOptions();
-	guard.command("worker-checkout").description("Refuse branch creation or tracked-file mutation in the control/primary checkout").option("--cwd <path>", "working directory to check").action((_options, command) => {
-		assertWorkerCheckoutAllowed({
-			cwd: resolveGuardCwd(command),
-			operation: "create a branch or mutate tracked files"
-		});
-		output.stdout.write("Worker checkout guard: OK\n");
-	});
-	guard.command("no-stash").description("Refuse `git stash` in a linked/shared worktree (stash reflog is shared across worktrees)").option("--cwd <path>", "working directory to check").action((_options, command) => {
-		assertNoSharedStash({
-			args: ["stash"],
-			command: "git",
-			cwd: resolveGuardCwd(command)
-		});
-		output.stdout.write("Stash guard: OK\n");
-	});
-	const laneThread = guard.command("lane-thread").description("Record or read lane-to-agent-thread identities");
-	laneThread.command("append").requiredOption("--agent <kind>", "agent kind").option("--branch <branch>", "lane branch").option("--cwd <path>", "working directory").option("--dispatched-at <timestamp>", "ISO dispatch timestamp").requiredOption("--issue <number>", "lane issue number", Number).requiredOption("--model <model>", "agent model").requiredOption("--thread-id <id>", "agent thread or session id").action((options, command) => {
-		writeLaneThread(resolveGuardCwd(command), {
-			agent: options.agent,
-			branch: options.branch,
-			dispatchedAt: options.dispatchedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-			issue: options.issue,
-			model: options.model,
-			threadId: options.threadId
-		});
-		output.stdout.write("Lane thread recorded.\n");
-	});
-	laneThread.command("read").option("--cwd <path>", "working directory").action((_options, command) => {
-		output.stdout.write(`${JSON.stringify(readLaneThreads(resolveGuardCwd(command)), null, 2)}\n`);
-	});
-	return guard;
-}
-//#endregion
 //#region src/hq-flush.ts
 /**
 * Spools holding this repository's evidence under an earlier key of its own
@@ -14014,7 +13052,7 @@ const proofInputs = (input, epoch) => {
 };
 const gateCapMismatchBlockers = (input) => {
 	if (!input.reviewProof || input.ladderPolicy === void 0 || input.reviewProof.maxReviewCycles === input.ladderPolicy.gate.cap) return [];
-	return [{ reason: `Review proof window (${input.reviewProof.maxReviewCycles ?? "unset"}) does not equal review.defaultMaxCycles (${input.ladderPolicy.gate.cap}); regenerate pr:review against the current profile.` }];
+	return [{ reason: `Review proof window (${input.reviewProof.maxReviewCycles ?? "unset"}) does not equal the factory review cap (${input.ladderPolicy.gate.cap}); regenerate pr:review.` }];
 };
 const reviewGateFor = ({ epoch, input, reviewModes }) => {
 	const correctnessRequired = reviewModes.includes("correctness");
@@ -15307,7 +14345,7 @@ const assertReviewCycleInWindow = (cycle, maxCycles) => {
 * alone would not demand it. Real review evidence is never discarded (#339).
 */
 function enabledKinds(profile, mode, files = [], suppliedFindingsKinds = []) {
-	const profileModes = new Set(profile.review.modes);
+	const profileModes = new Set(["correctness", ...(profile.review?.conditional?.length ?? 0) > 0 ? ["security"] : []]);
 	const configuredKinds = (mode === "all" ? [...profileModes] : [mode]).filter((kind) => profileModes.has(kind));
 	if (configuredKinds.length === 0) throw new Error(`No configured review mode matches ${mode}.`);
 	const applicableKinds = new Set(resolveApplicableReviewModes(profile, files));
@@ -15414,9 +14452,8 @@ async function runPrReview(args, dependencies = {}) {
 		cwd,
 		profilePath: args.profilePath
 	});
-	const ladderPolicy = resolveReviewLadderPolicy(profile);
-	const maxCycles = args.maxCycles ?? ladderPolicy.gate.cap;
-	if (maxCycles !== ladderPolicy.gate.cap) throw new Error(`--max-cycles must equal review.defaultMaxCycles (${ladderPolicy.gate.cap}).`);
+	const ladderPolicy = resolveReviewLadderPolicy();
+	const maxCycles = ladderPolicy.gate.cap;
 	assertReviewCycleInWindow(args.cycle, maxCycles);
 	const { headSha, patchId } = createCandidateIdentityResolver({
 		cwd,
@@ -15734,9 +14771,9 @@ async function ensureVerifyProof({ args, cwd, dependencies, headSha, verifyProof
 	};
 }
 const reviewNotRequired = (proof) => proof.reviewRequirement?.status === "not-required";
-async function ensureReviewProof({ args, cwd, dependencies, currentReviewIdentity, profile, reviewProofPath }) {
+async function ensureReviewProof({ args, cwd, dependencies, currentReviewIdentity, reviewProofPath }) {
 	const proof = readOptionalReviewProof(cwd, reviewProofPath);
-	const ladderPolicy = resolveReviewLadderPolicy(profile);
+	const ladderPolicy = resolveReviewLadderPolicy();
 	const terminalFor = (candidate) => resolveReviewTerminalStateAcrossReviewsForPolicy(candidate, ladderPolicy);
 	const terminal = proof ? terminalFor(proof) : void 0;
 	const identityStatus = proof ? reviewStatus({
@@ -16005,7 +15042,6 @@ async function runPrPublish(args, dependencies = {}) {
 		}),
 		cwd,
 		dependencies,
-		profile,
 		reviewProofPath
 	});
 	const pr = fetchPr();
@@ -16177,7 +15213,7 @@ function assertForegroundGate({ gate, env = process.env }) {
 //#endregion
 //#region src/commands/pr-review.ts
 function createPrReviewCommand(output, action) {
-	return new Command("pr:review").description("Validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", ".").option("--cycle <number>", "review cycle number", positiveInteger("--cycle"), 1).option("--max-cycles <number>", "authorized review-cycle window end", positiveInteger("--max-cycles")).option("--mode <mode>", "correctness, security, or all", "all").option("--findings <path>", "typed clean-session findings JSON file").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace", positiveInteger("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
+	return new Command("pr:review").description("Validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", ".").option("--cycle <number>", "review cycle number", positiveInteger("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--findings <path>", "typed clean-session findings JSON file").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace", positiveInteger("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
 		gate: "pr:review",
 		resolveCycle: (options) => options.cycle,
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
@@ -16189,7 +15225,6 @@ function createPrReviewCommand(output, action) {
 			"security",
 			"all"
 		].includes(options.mode)) throw new Error("--mode requires correctness, security, or all");
-		if (typeof options.maxCycles === "number" && options.cycle > options.maxCycles) throw new Error("--cycle must be less than or equal to --max-cycles");
 		const args = {
 			base: options.base,
 			cwd: resolveCwdOption(options.cwd),
@@ -16197,7 +15232,6 @@ function createPrReviewCommand(output, action) {
 			dispositions: options.dispositions,
 			findings: options.findings,
 			issue: options.issue,
-			maxCycles: options.maxCycles,
 			mode: options.mode,
 			output: options.output,
 			profilePath: options.profile,
@@ -16471,7 +15505,6 @@ function createProgram(options = {}) {
 	program.name("patronage-factory").description("Shared Patronage software factory CLI").version(version);
 	program.addCommand(createDoctorCommand(output));
 	program.addCommand(createConfigCommand(output));
-	program.addCommand(createGuardCommand(output));
 	program.addCommand(createEvidenceEmitCommand(output));
 	program.addCommand(createHqFlushCommand(output));
 	program.addCommand(createBoundaryCheckCommand(output, options.actions?.boundaryCheck));