@patronage/software-factory 1.0.0-alpha.23 → 1.0.0-alpha.24

package/dist/index.js

@@ -7,6 +7,7 @@ import path from "node:path";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
 import os, { homedir, tmpdir } from "node:os";
 import { setImmediate } from "node:timers";
@@ -17,15 +18,15 @@ import { parse } from "yaml";
 import { FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_STEP_NAME, GitHubApiError, mintInstallationToken, previewProofInventory, productionImpactTargetOutput, readVitestProfileDocument } from "@patronage/factory-ci";
 import { promisify } from "node:util";
 //#region package.json
-var version = "1.0.0-alpha.23";
+var version = "1.0.0-alpha.24";
 //#endregion
 //#region src/review-rungs.ts
-const EVIDENCE_REVIEW_RUNGS$1 = [
+const EVIDENCE_REVIEW_RUNGS = [
 	"independent-model",
 	"oracle",
 	"human"
 ];
-const RUNG_ORDER = Object.fromEntries(EVIDENCE_REVIEW_RUNGS$1.map((rung, index) => [rung, index]));
+const RUNG_ORDER = Object.fromEntries(EVIDENCE_REVIEW_RUNGS.map((rung, index) => [rung, index]));
 //#endregion
 //#region src/boundary-manifest.ts
 var boundary_manifest_exports = /* @__PURE__ */ __exportAll({
@@ -43,7 +44,7 @@ var boundary_manifest_exports = /* @__PURE__ */ __exportAll({
 const FACTORY_BOUNDARY_FENCE_LANG = "factory-boundary";
 const BOUNDARY_CLOSEOUT_DEFAULT_RUNG = "oracle";
 const rungMeetsMinimum = (rung, minimum) => RUNG_ORDER[rung] >= RUNG_ORDER[minimum];
-const rungSchema = z.enum(EVIDENCE_REVIEW_RUNGS$1);
+const rungSchema = z.enum(EVIDENCE_REVIEW_RUNGS);
 const BOUNDARY_TOPOLOGIES = [
 	"each-to-main",
 	"flagged",
@@ -358,7 +359,7 @@ const boundaryReviewProofSchema$1 = z.object({
 	}).passthrough(),
 	outcome: z.enum(["pass", "fail"]),
 	producer: z.string().min(1),
-	rung: z.enum(EVIDENCE_REVIEW_RUNGS$1),
+	rung: z.enum(EVIDENCE_REVIEW_RUNGS),
 	schemaVersion: z.literal(1),
 	sessionId: z.string().min(1).optional(),
 	specHash: z.object({
@@ -999,6 +1000,9 @@ function runInheritedTee(command, args, cwd, extraEnv = {}) {
 function currentHeadSha(cwd) {
 	return runCapture("git", ["rev-parse", "HEAD"], cwd).stdout.trim();
 }
+function repositoryRoot(cwd) {
+	return runCapture("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
+}
 function showFileAtRef(cwd, ref, absolutePath) {
 	const rel = path.relative(cwd, absolutePath);
 	const spec = rel.startsWith(".") ? rel : `./${rel}`;
@@ -1199,7 +1203,33 @@ const normalizeIssueComments = (value) => {
 const runGhCapture = (args, cwd = process.cwd(), acceptableExitCodes = [0]) => runCapture("gh", args, cwd, { acceptableExitCodes });
 const runGhJsonAt = (args, cwd) => JSON.parse(runGhCapture(args, cwd).stdout);
 const runGhJson = (args) => runGhJsonAt(args, process.cwd());
-z.object({ object: z.object({ sha: z.string().regex(/^[0-9a-f]{40}$/u) }) });
+const gitReferenceSchema = z.object({ object: z.object({ sha: z.string().regex(/^[0-9a-f]{40}$/u) }) });
+/** Read a branch tip from GitHub rather than a checkout's cached remote ref. */
+const fetchGitHubBranchTipSha = (repository, branch, cwd) => {
+	return gitReferenceSchema.parse(runGhJsonAt(["api", `/repos/${repository.owner}/${repository.name}/git/ref/heads/${encodeURIComponent(branch)}`], cwd)).object.sha;
+};
+const repositoryFileSchema = z.object({
+	content: z.string(),
+	encoding: z.literal("base64"),
+	type: z.literal("file")
+});
+/**
+* Read one file's content at an exact commit from GitHub.
+*
+* #922: the authoritative base policy is the profile GitHub serves at the base
+* tip. A checkout is candidate-controlled, so it is not an authority for it.
+* There is exactly one implementation on purpose — no local-first read with an
+* API fallback, which would let a checkout answer the authority's question.
+*
+* Throws for every failure — an absent path, a directory, a file too large for
+* the contents endpoint to inline, an unreachable or unauthorized API. The
+* caller decides what an unreadable authority means; it is never an absent one.
+*/
+const fetchGitHubFileAtRef = (repository, filePath, ref, cwd) => {
+	const encodedPath = filePath.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+	const response = repositoryFileSchema.parse(runGhJsonAt(["api", `/repos/${repository.owner}/${repository.name}/contents/${encodedPath}?ref=${encodeURIComponent(ref)}`], cwd));
+	return Buffer$1.from(response.content, "base64").toString("utf-8");
+};
 /**
 * Fetch and normalize the issue/PR comment thread for `<owner>/<repo>`.
 *
@@ -1260,15 +1290,15 @@ function matchesAnyGlob(patterns, file) {
 }
 //#endregion
 //#region src/diff-classification.ts
-const DIFF_CLASSIFICATIONS$1 = [
+const DIFF_CLASSIFICATIONS = [
 	"docs/process-only",
 	"trivial",
 	"non-trivial"
 ];
 //#endregion
 //#region src/required-check-policy.ts
-const EVIDENCE_CHECK_TYPES$1 = ["review", "verify"];
-const requiredCheckScopeSchema$1 = z.object({ classifications: z.array(z.enum(DIFF_CLASSIFICATIONS$1)).min(1) }).strict();
+const EVIDENCE_CHECK_TYPES = ["review", "verify"];
+const requiredCheckScopeSchema = z.object({ classifications: z.array(z.enum(DIFF_CLASSIFICATIONS)).min(1) }).strict();
 const requiredCheckInScope = ({ context, scope }) => {
 	if (!scope) return {
 		inScope: true,
@@ -1316,6 +1346,20 @@ const commandSchema = z.object({
 	]).default("full")
 });
 const conditionalReviewSchema = z.object({ paths: z.array(z.string().min(1).refine(isValidGlob, "must be a valid glob")).min(1) }).strict();
+/**
+* The `review` subtree: the repository-declared paths that additionally demand
+* a security review.
+*
+* Exported so the authoritative-base-policy reader (#922) can validate the
+* subtree WITHOUT the rest of the profile. That reader needs this fact and only
+* this fact, and it reads a profile committed on the base ref, which may sit at
+* the previous `schemaVersion` while a bump is in flight. Validating the whole
+* document there would refuse every open pull request in a repository for the
+* length of a schema bump, with no in-factory route to land the fix (the sf#489
+* class: a guardrail must not lock the operator out). One definition, two parse
+* scopes.
+*/
+const reviewPolicySchema = z.object({ conditional: z.array(conditionalReviewSchema).min(1) }).strict();
 const hqEndpointDeclarationSchema = z.intersection(z.string().url(), z.string().regex(/^https:\/\/[^/@\s]+(?:[/?#]|$)/u, "Must use HTTPS without embedded credentials"));
 const hqIngestConfigSchema = z.object({
 	enabled: z.boolean(),
@@ -1328,7 +1372,7 @@ const hqIngestConfigSchema = z.object({
 		}
 	}, "Must be an HTTPS origin without a path, query, fragment, or embedded credentials").describe("Repository-declared HQ origin (scheme and host only; the factory composes the ingest path). Credential delivery additionally requires exact-origin authorization in the operator user config hqAllowedOrigins list.")
 }).strict();
-const profileRequiredCheckScopeSchema = requiredCheckScopeSchema$1.extend({ classifications: z.array(z.enum(["docs/process-only", "non-trivial"])).min(1) }).strict();
+const profileRequiredCheckScopeSchema = requiredCheckScopeSchema.extend({ classifications: z.array(z.enum(["docs/process-only", "non-trivial"])).min(1) }).strict();
 const requiredCheckSchema = z.object({
 	name: z.string().min(1),
 	scope: profileRequiredCheckScopeSchema.optional()
@@ -1369,7 +1413,7 @@ const factoryProjectProfileSchema = z.object({
 			message: "requiredChecks entries must have distinct names."
 		});
 	}).optional(),
-	review: z.object({ conditional: z.array(conditionalReviewSchema).min(1) }).strict().optional(),
+	review: reviewPolicySchema.optional(),
 	schemaVersion: z.literal(6),
 	verification: z.object({ commands: z.array(commandSchema).min(1) })
 }).strict().superRefine((profile, context) => {
@@ -3765,7 +3809,7 @@ const qualifierIsMintable = (family, qualifier) => {
 	if (!QUALIFIER_PATTERN.test(qualifier)) return false;
 	const decoded = decodeQualifier(qualifier);
 	if (decoded === void 0 || demandQualifier(decoded) !== qualifier) return false;
-	if (family === "review-rung") return EVIDENCE_REVIEW_RUNGS$1.includes(decoded);
+	if (family === "review-rung") return EVIDENCE_REVIEW_RUNGS.includes(decoded);
 	if (family === "review-mode") return REVIEW_MODE_DEMAND_VALUES.includes(decoded);
 	return true;
 };
@@ -3928,8 +3972,64 @@ const authorizeDemandWaiver = ({ authenticatedLogin, session }) => {
 	} };
 };
 //#endregion
+//#region src/policy-resolution.ts
+const COMMIT_SHA_PATTERN$2 = /^[0-9a-f]{40}$/u;
+const digestSchema = z.string().regex(/^[0-9a-f]{64}$/u);
+/**
+* The authority resolved: the live tip of the PR's own base ref served a
+* parseable profile, and demand was resolved from the union of that policy and
+* the candidate's.
+*
+* Every identity field is REQUIRED. A cross-stage reader compares these digests
+* to decide whether two stages judged the same candidate under the same policy;
+* an `authoritative` record with a digest missing would read to that reader as
+* "nothing disagrees", which is a silent downgrade of exactly the demand this
+* record exists to protect. `reason` is forbidden here — a resolved authority
+* has nothing to explain.
+*/
+const authoritativePolicyResolutionSchema = z.object({
+	/** sha256 of the canonical base `review` subtree. */
+	basePolicyDigest: digestSchema,
+	/** The PR's own base ref, whose live tip is the authority. */
+	baseRefName: z.string().min(1),
+	/** sha256 of the canonical candidate `review` subtree. */
+	candidatePolicyDigest: digestSchema,
+	/** sha256 of the merged (base ∪ candidate) protected-path set. */
+	effectiveDigest: digestSchema,
+	/** The base-ref tip the base policy was read at. */
+	policyBaseSha: z.string().regex(COMMIT_SHA_PATTERN$2),
+	/**
+	* Whether the candidate's `review` subtree differs from the base's. The
+	* digests prove which policies were read; this says whether they agreed,
+	* which is the fact that explains a demand the candidate's own profile
+	* would not have produced.
+	*/
+	reviewPolicyChanged: z.boolean(),
+	status: z.literal("authoritative")
+}).strict();
+/**
+* The authority could not be read, and `reason` says why — required, because an
+* unresolved record with no reason is an unactionable refusal. `pr:ready`
+* refuses before it writes a proof, so a Slice A ready proof never carries one;
+* this member is the recorded form of that refusal for the stages that carry it
+* forward.
+*/
+const unresolvedPolicyResolutionSchema = z.object({
+	/** The base ref whose policy could not be read. */
+	baseRefName: z.string().min(1),
+	/** Why the authority is unresolved. */
+	reason: z.string().min(1),
+	status: z.literal("unresolved")
+}).strict();
+/** How a gate resolved the review policy it evaluated a candidate under. */
+const policyResolutionSchema = z.discriminatedUnion("status", [authoritativePolicyResolutionSchema, unresolvedPolicyResolutionSchema]);
+//#endregion
 //#region src/packages/review-prompt-sections/schema.ts
-const REVIEW_PROMPT_SECTION_PROVENANCES = ["prior-review-ledger", "issue-review-focus"];
+const REVIEW_PROMPT_SECTION_PROVENANCES = [
+	"coding-standards",
+	"prior-review-ledger",
+	"issue-review-focus"
+];
 const nonBlankString$2 = z.string().refine((value) => value.trim().length > 0, { message: "must not be blank" });
 const reviewPromptSectionSchema = z.object({
 	provenance: z.enum(REVIEW_PROMPT_SECTION_PROVENANCES),
@@ -4780,7 +4880,7 @@ const prReviewResultSchema = z.object({
 	]),
 	producer: nonBlankString$1.optional(),
 	promptSections: reviewPromptSectionsSchema.optional(),
-	rung: z.enum(EVIDENCE_REVIEW_RUNGS$1).optional(),
+	rung: z.enum(EVIDENCE_REVIEW_RUNGS).optional(),
 	sessionId: nonBlankString$1.optional(),
 	startedAt: parseableDateString,
 	summary: z.string().refine((value) => value.trim().length > 0 && value !== "<one sentence>", { message: "summary must not be blank or a placeholder" }),
@@ -4867,6 +4967,47 @@ const PR_REVIEW_PROOF_DESCRIPTOR = {
 	schemaVersion: 2
 };
 //#endregion
+//#region src/review-proof-applicability.ts
+const REVIEW_STATUS_VALUES = [
+	"not-required",
+	"current",
+	"stale",
+	"missing",
+	"blocked"
+];
+const reviewStatusSchema = z.enum(REVIEW_STATUS_VALUES);
+const isProofCurrent = ({ reviewedHeadSha, reviewedPatchId, headSha, patchId }) => evidenceFresh({
+	candidate: {
+		headSha,
+		patchId
+	},
+	recorded: {
+		headSha: reviewedHeadSha,
+		patchId: reviewedPatchId
+	},
+	rule: "patch-id-or-head-sha"
+});
+const reviewStatus = ({ blocked, required, reviewedHeadSha, reviewedPatchId, headSha, patchId }) => {
+	if (blocked) {
+		if ((reviewedHeadSha || reviewedPatchId) && !isProofCurrent({
+			headSha,
+			patchId,
+			reviewedHeadSha,
+			reviewedPatchId
+		})) return "stale";
+		return "blocked";
+	}
+	if (!required) return "not-required";
+	if (!(reviewedHeadSha || reviewedPatchId)) return "missing";
+	if (isProofCurrent({
+		headSha,
+		patchId,
+		reviewedHeadSha,
+		reviewedPatchId
+	})) return "current";
+	return "stale";
+};
+//#endregion
 //#region src/review-state.ts
 const reviewStateIssue = (message, field) => [{
 	code: "custom",
@@ -5783,24 +5924,12 @@ const closeoutArtifactSchema = z.object({
 }).strict();
 //#endregion
 //#region src/schemas.ts
-const EVIDENCE_CHECK_TYPES = ["review", "verify"];
-const EVIDENCE_REVIEW_RUNGS = [
-	"independent-model",
-	"oracle",
-	"human"
-];
-const DIFF_CLASSIFICATIONS = [
-	"docs/process-only",
-	"trivial",
-	"non-trivial"
-];
-const REVIEW_STATUS_VALUES$1 = [
-	"not-required",
-	"current",
-	"stale",
-	"missing",
-	"blocked"
-];
+const evidenceCheckTypeSchema = z.enum(EVIDENCE_CHECK_TYPES);
+const evidenceReviewRungSchema = z.enum(EVIDENCE_REVIEW_RUNGS);
+const diffClassificationSchema = z.enum(DIFF_CLASSIFICATIONS);
+const ladderStageSchema = z.enum(LADDER_STAGES);
+const ladderNextActionSchema = z.enum(LADDER_NEXT_ACTION_KINDS);
+const ladderForcedTransitionSchema = z.enum(LADDER_FORCED_TRANSITION_KINDS);
 const followUpActionSchema = z.object({
 	argv: z.array(z.string()),
 	command: z.string()
@@ -5808,7 +5937,7 @@ const followUpActionSchema = z.object({
 const evidenceShaSchema = z.string().regex(/^[0-9a-f]{7,40}$/u, { message: "must be a 7-40 char lowercase hex git SHA" });
 z.object({
 	check: z.string().min(1),
-	checkType: z.enum(EVIDENCE_CHECK_TYPES),
+	checkType: evidenceCheckTypeSchema,
 	findingsPointer: z.string().min(1).optional(),
 	headSha: evidenceShaSchema,
 	mergeBaseSha: evidenceShaSchema,
@@ -5818,7 +5947,7 @@ z.object({
 	policyVersion: z.string().min(1).optional(),
 	producer: z.string().min(1),
 	requestId: z.string().min(1).optional(),
-	rung: z.enum(EVIDENCE_REVIEW_RUNGS).optional(),
+	rung: evidenceReviewRungSchema.optional(),
 	schemaVersion: z.literal(1),
 	sessionId: z.string().trim().min(1).optional(),
 	timestamp: z.iso.datetime().optional()
@@ -5881,7 +6010,7 @@ z.object({
 	}).passthrough(),
 	outcome: z.enum(["pass", "fail"]),
 	producer: z.string().min(1),
-	rung: z.enum(EVIDENCE_REVIEW_RUNGS),
+	rung: evidenceReviewRungSchema,
 	schemaVersion: z.literal(1),
 	sessionId: z.string().min(1).optional(),
 	specHash: z.object({
@@ -5901,7 +6030,7 @@ const boundaryCheckProofSchema = z.object({
 		state: z.enum(["merged", "open"]),
 		wave: z.string().min(1)
 	})),
-	demandedRung: z.enum(EVIDENCE_REVIEW_RUNGS).optional(),
+	demandedRung: evidenceReviewRungSchema.optional(),
 	epicIssue: z.number().int().positive(),
 	manifestHash: z.object({
 		algo: z.literal("sha256"),
@@ -5913,7 +6042,7 @@ const boundaryCheckProofSchema = z.object({
 		commentId: z.union([z.string(), z.number()]).optional(),
 		commentUrl: z.string().optional(),
 		producer: z.string().min(1),
-		rung: z.enum(EVIDENCE_REVIEW_RUNGS),
+		rung: evidenceReviewRungSchema,
 		sessionId: z.string().min(1).optional(),
 		specHash: z.object({
 			algo: z.literal("sha256"),
@@ -5928,7 +6057,6 @@ const boundaryCheckProofSchema = z.object({
 	}).optional(),
 	status: z.enum(["ready", "blocked"])
 });
-const requiredCheckScopeSchema = z.object({ classifications: z.array(z.enum(DIFF_CLASSIFICATIONS)).min(1) }).strict();
 const readinessRepairSchema$1 = z.object({
 	action: z.string().min(1),
 	code: z.enum([
@@ -5942,7 +6070,7 @@ const reviewStateSchema$1 = z.object({
 	required: z.boolean(),
 	reviewedHeadSha: z.string().optional(),
 	reviewedPatchId: z.string().optional(),
-	status: z.enum(REVIEW_STATUS_VALUES$1)
+	status: reviewStatusSchema
 }).strict().superRefine((state, context) => {
 	for (const issue of reviewStateIssues(state)) context.addIssue(issue);
 });
@@ -5963,9 +6091,9 @@ const historicalHandledHumanCommentSchema = z.object({
 const managedReadinessLedgerSchema$1 = z.object({
 	baseSha: z.string().regex(/^[0-9a-f]{40}$/u),
 	blockingReasons: z.array(z.string()),
-	classification: z.enum(DIFF_CLASSIFICATIONS),
+	classification: diffClassificationSchema,
 	externalChecks: z.array(z.object({
-		checkType: z.enum(EVIDENCE_CHECK_TYPES),
+		checkType: evidenceCheckTypeSchema,
 		name: z.string().min(1),
 		reason: z.string().optional(),
 		scope: requiredCheckScopeSchema.optional(),
@@ -6038,25 +6166,9 @@ const managedReadinessLedgerSchema$1 = z.object({
 			gate: z.number().int().nonnegative(),
 			interior: z.number().int().nonnegative()
 		}),
-		forcedTransition: z.enum([
-			"gate-cap-exhausted",
-			"interior-cap-reached",
-			"interior-takeover"
-		]).optional(),
-		nextAction: z.enum([
-			"run-interior-cycle",
-			"advance-to-gate",
-			"run-gate-cycle",
-			"accept-nonblocking-findings",
-			"escalate-to-triage",
-			"ready-for-human"
-		]),
-		stage: z.enum([
-			"interior",
-			"interior-takeover",
-			"interior-complete",
-			"gate"
-		])
+		forcedTransition: ladderForcedTransitionSchema.optional(),
+		nextAction: ladderNextActionSchema,
+		stage: ladderStageSchema
 	}).optional(),
 	reviewRuns: z.array(prReviewResultSchema).optional(),
 	reviewTerminalState: z.enum([
@@ -6122,6 +6234,7 @@ z.object({
 	humanBlockingReasons: z.array(z.string()).default([]),
 	ledger: managedReadinessLedgerSchema$1,
 	notices: z.array(z.string().min(1)).optional(),
+	policyResolution: policyResolutionSchema.optional(),
 	profileBlobSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	profilePath: z.string().min(1).optional(),
 	repairs: z.array(readinessRepairSchema$1).default([]),
@@ -9687,10 +9800,10 @@ const recognizeCatchUpCandidate = ({ base, cwd }) => {
 //#endregion
 //#region src/pr-readiness/external-evidence.ts
 var external_evidence_exports = /* @__PURE__ */ __exportAll({
-	EVIDENCE_CHECK_TYPES: () => EVIDENCE_CHECK_TYPES$1,
+	EVIDENCE_CHECK_TYPES: () => EVIDENCE_CHECK_TYPES,
 	EVIDENCE_DIR: () => EVIDENCE_DIR,
 	EVIDENCE_ENVELOPE_SCHEMA_VERSION: () => 1,
-	EVIDENCE_REVIEW_RUNGS: () => EVIDENCE_REVIEW_RUNGS$1,
+	EVIDENCE_REVIEW_RUNGS: () => EVIDENCE_REVIEW_RUNGS,
 	boundFailingCheckNames: () => boundFailingCheckNames,
 	evaluateRequiredChecks: () => evaluateRequiredChecks,
 	evidenceBindingFresh: () => evidenceBindingFresh,
@@ -9699,13 +9812,13 @@ var external_evidence_exports = /* @__PURE__ */ __exportAll({
 	loadEvidenceEnvelopes: () => loadEvidenceEnvelopes,
 	parseEvidenceEnvelope: () => parseEvidenceEnvelope,
 	requiredCheckInScope: () => requiredCheckInScope,
-	requiredCheckScopeSchema: () => requiredCheckScopeSchema$1,
+	requiredCheckScopeSchema: () => requiredCheckScopeSchema,
 	resolveAuthoringSessionIds: () => resolveAuthoringSessionIds
 });
 const shaSchema$4 = z.string().regex(/^[0-9a-f]{7,40}$/u, { message: "must be a 7-40 char lowercase hex git SHA" });
 const evidenceEnvelopeSchema = z.object({
 	check: z.string().min(1),
-	checkType: z.enum(EVIDENCE_CHECK_TYPES$1),
+	checkType: z.enum(EVIDENCE_CHECK_TYPES),
 	findingsPointer: z.string().min(1).optional(),
 	headSha: shaSchema$4,
 	mergeBaseSha: shaSchema$4,
@@ -9715,7 +9828,7 @@ const evidenceEnvelopeSchema = z.object({
 	policyVersion: z.string().min(1).optional(),
 	producer: z.string().min(1),
 	requestId: z.string().min(1).optional(),
-	rung: z.enum(EVIDENCE_REVIEW_RUNGS$1).optional(),
+	rung: z.enum(EVIDENCE_REVIEW_RUNGS).optional(),
 	schemaVersion: z.literal(1),
 	sessionId: z.string().trim().min(1).optional(),
 	timestamp: z.iso.datetime().optional()
@@ -10207,21 +10320,29 @@ const readExchange = async (request, url, init, timeoutMs) => {
 async function requestGitHubJson(request, url, init, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) {
 	return (await readExchange(request, url, init, timeoutMs)).json;
 }
-/** Mint one repository-scoped installation token for the Patronage Factory App. */
-const mintFactoryInstallationToken = (repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) => mintInstallationToken({
+/**
+* Mint one repository-scoped installation token for the Patronage Factory App.
+*
+* `budget.transportAttempts` is the caller's, not this function's: a proof
+* registration must survive a stale keep-alive socket, while a best-effort
+* publish with a fallback must give up at once. Omitted, it stays at the
+* package default of three.
+*/
+const mintFactoryInstallationToken = (repository, config, request, now, budget = {}) => mintInstallationToken({
 	credentials: config,
 	owner: repository.owner,
 	repo: repository.repo
 }, {
 	fetch: request,
 	now: () => now,
-	timeoutMs
+	timeoutMs: budget.timeoutMs ?? 5e3,
+	...budget.transportAttempts === void 0 ? {} : { transportAttempts: budget.transportAttempts }
 });
 const resolveFactoryAppToken = async (input, dependencies, request, timeoutMs) => {
 	if (dependencies.token) return dependencies.token;
 	const config = dependencies.githubApp ?? tryUserConfig()?.config.githubApp;
 	if (!config) throw new Error("The Patronage Factory GitHub App is required for App-owned GitHub requests.");
-	return mintFactoryInstallationToken(input, config, request, (dependencies.now ?? Date.now)(), timeoutMs);
+	return mintFactoryInstallationToken(input, config, request, (dependencies.now ?? Date.now)(), { timeoutMs });
 };
 const factoryAppInit = (input, token) => ({
 	...input.body === void 0 ? {} : { body: JSON.stringify(input.body) },
@@ -10272,7 +10393,7 @@ const outcomeFor = (value) => {
 	if (isOutcome(value.outcome)) return value.outcome;
 	return value.schemaVersion === 1 ? "passed" : "aborted";
 };
-const asClassification = (value) => DIFF_CLASSIFICATIONS$1.includes(value) ? value : "unknown";
+const asClassification = (value) => DIFF_CLASSIFICATIONS.includes(value) ? value : "unknown";
 /**
 * Project a local pr:verify proof onto the durable check-run payload. Accepts
 * `unknown` because the publisher is handed an opaque proof value; anything
@@ -10402,8 +10523,16 @@ Re-verify only if the tree changes: a new commit, an amend, or a rebase.
 * had grown a second copy of it. What stays here is what is this repository's:
 * where the credentials come from (`user-config`), and the publish timeout the
 * rest of these calls are bound by. Nothing is cached, as before.
+*
+* Retry budget is the caller's. The fire-and-forget publisher passes one
+* attempt because it already has a commit-status fallback (#938). The
+* confirmation read-back leaves the default, because it has no fallback and
+* a stale keep-alive is the class #923 covers.
 */
-const installationToken = (repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) => mintFactoryInstallationToken(repository, config, request, now, timeoutMs);
+const installationToken = (repository, config, request, now, budget = {}) => mintFactoryInstallationToken(repository, config, request, now, {
+	timeoutMs: budget.timeoutMs ?? 5e3,
+	...budget.transportAttempts === void 0 ? {} : { transportAttempts: budget.transportAttempts }
+});
 function verifyOutput(proof) {
 	const value = proof;
 	const commands = value.executedCommands?.length ?? 0;
@@ -10491,7 +10620,10 @@ async function postFactoryCheckRun({ config, deadlineMs, dependencies, detailsUr
 	const request = dependencies.fetch ?? fetch;
 	const timeoutMs = dependencies.timeoutMs ?? 5e3;
 	try {
-		const token = await installationToken(input, config, request, (dependencies.now ?? Date.now)(), timeoutMs);
+		const token = await installationToken(input, config, request, (dependencies.now ?? Date.now)(), {
+			timeoutMs,
+			transportAttempts: 1
+		});
 		return await requestGitHubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/check-runs`, {
 			body: JSON.stringify(checkRunRequestBody(input, detailsUrl)),
 			headers: {
@@ -10582,7 +10714,7 @@ async function resolveDetailsUrlSafely(input, dependencies, onDiagnostic) {
 async function servedFactoryCheckRun(input, config, dependencies) {
 	const request = dependencies.fetch ?? fetch;
 	const timeoutMs = dependencies.timeoutMs ?? 5e3;
-	const token = await installationToken(input, config, request, (dependencies.now ?? Date.now)(), timeoutMs);
+	const token = await installationToken(input, config, request, (dependencies.now ?? Date.now)(), { timeoutMs });
 	const query = new URLSearchParams({
 		app_id: String(config.appId),
 		check_name: FACTORY_CHECK_NAMES[input.gate],
@@ -11817,6 +11949,204 @@ function createDemandWaiveCommand(_output, action = runDemandWaive) {
 const resolveApplicableReviewModes = (profile, changedFiles) => {
 	return (profile.review?.conditional ?? []).some((scope) => changedFiles.some((file) => matchesAnyGlob(scope.paths, file))) ? ["correctness", "security"] : ["correctness"];
 };
+const compareStrings = (left, right) => {
+	if (left === right) return 0;
+	return left < right ? -1 : 1;
+};
+/**
+* The `review` subtree as one comparable string.
+*
+* Groups are anonymous in schema v6 (`paths` only, `additionalProperties:
+* false`), so a group has no identity beyond its path list. Paths are sorted
+* inside each group and groups are sorted by their path list, so a pure
+* reordering is the same policy and only a real change reads as a change.
+* `undefined` (no `review` object at all) canonicalizes to `null`, which is
+* distinct from every declared policy including an empty one.
+*/
+const canonicalReviewPolicy = (review) => {
+	if (review === void 0) return JSON.stringify(null);
+	const groups = review.conditional.map((group) => ({ paths: [...group.paths].toSorted(compareStrings) }));
+	return JSON.stringify({ conditional: groups.toSorted((left, right) => compareStrings(JSON.stringify(left.paths), JSON.stringify(right.paths))) });
+};
+/** Every protected path a policy declares, across all of its groups. */
+const reviewPolicyPaths = (review) => (review?.conditional ?? []).flatMap((group) => group.paths);
+/**
+* Resolve review demand from the base policy and the candidate policy.
+*
+* Two terms, both decided:
+*
+* 1. The merge rule is the UNION of the flattened protected-path sets, matched
+*    by the same globs as before. Policy may add demand; it can never remove
+*    demand the base established for this candidate.
+* 2. Self-protection: a candidate whose `review` subtree differs from the
+*    base's demands a security review whatever else it touches. It is scoped
+*    to `review` and not to the whole profile deliberately — widening it would
+*    make every `verification.commands` edit owe a security review.
+*
+* The demand is not scoped by classification. A docs-only candidate that
+* touches a protected path still owes the security review: classification
+* scopes verification work, not review authority.
+*/
+const resolveAuthoritativeReviewDemand = ({ basePolicy, candidatePolicy, changedFiles }) => {
+	const baseCanonical = canonicalReviewPolicy(basePolicy);
+	const candidateCanonical = canonicalReviewPolicy(candidatePolicy);
+	const reviewPolicyChanged = baseCanonical !== candidateCanonical;
+	const candidatePaths = reviewPolicyPaths(candidatePolicy);
+	const effectivePaths = [...new Set([...reviewPolicyPaths(basePolicy), ...candidatePaths])].toSorted(compareStrings);
+	const candidateOwned = new Set(candidatePaths);
+	const baseOnlyMatchedPaths = effectivePaths.filter((protectedPath) => !candidateOwned.has(protectedPath) && changedFiles.some((file) => matchesAnyGlob([protectedPath], file)));
+	const candidateAloneDemandsSecurity = changedFiles.some((file) => matchesAnyGlob(candidatePaths, file));
+	const securityApplies = reviewPolicyChanged || candidateAloneDemandsSecurity || baseOnlyMatchedPaths.length > 0;
+	return {
+		baseOnlyMatchedPaths,
+		basePolicyDigest: sha256Hex(baseCanonical),
+		candidateAloneDemandsSecurity,
+		candidatePolicyDigest: sha256Hex(candidateCanonical),
+		effectiveDigest: sha256Hex(JSON.stringify(effectivePaths)),
+		effectivePaths,
+		reviewModes: securityApplies ? ["correctness", "security"] : ["correctness"],
+		reviewPolicyChanged
+	};
+};
+/**
+* Why the security demand rose, when the candidate's own profile would not have
+* produced it. `undefined` when the candidate's own policy already demanded the
+* review, or when nothing demanded it — an operator learns nothing from being
+* told their own profile did what they wrote it to do.
+*/
+const baseDerivedSecurityNotice = ({ baseRefName, demand }) => {
+	if (!demand.reviewModes.includes("security") || demand.candidateAloneDemandsSecurity) return;
+	return `Security review is demanded by the base policy, not by this candidate's own profile: ${[...demand.baseOnlyMatchedPaths.length > 0 ? [`${baseRefName} protects ${demand.baseOnlyMatchedPaths.join(", ")}, and this candidate changes a file it matches`] : [], ...demand.reviewPolicyChanged ? [`this candidate's review policy differs from the one ${baseRefName} declares`] : []].join("; ")}. Policy may add review demand; it cannot remove demand the base established (#922).`;
+};
+const defaultBaseReviewPolicyAuthority = () => ({
+	branchTipSha: ({ branch, cwd, repository }) => fetchGitHubBranchTipSha(repository, branch, cwd),
+	profileContentAtRef: ({ cwd, profilePath, ref, repository }) => fetchGitHubFileAtRef(repository, profilePath, ref, cwd)
+});
+const failureText = (error) => error instanceof Error ? error.message : String(error);
+/**
+* The base document, read at exactly the scope of the fact being read — and no
+* wider, but no narrower either.
+*
+* NARROW, because the reader needs the `review` subtree and nothing else. It
+* does NOT pin `schemaVersion` to the CLI's own constant. A base profile one
+* version behind still answers the question it is being asked, which is what
+* lets the pull request that bumps the schema — and every pull request open
+* beside it — reach `pr:ready` at all.
+*
+* BOUNDED, because `review` is optional and "no protected paths" is a real,
+* demand-lowering answer. A schema that accepted any JSON object would read
+* `{}`, a truncated write, or an unrelated JSON file at that path as a valid
+* statement that the base protects nothing — a degrade-to-no-base-demand path,
+* which is the failure this whole change exists to close. So the document must
+* be RECOGNIZABLE as a factory profile before its `review` subtree is trusted:
+* `schemaVersion` must be a positive integer, and `repository` must be present
+* (the caller then checks it against the trusted checkout).
+*
+* Nothing about the refusal relaxes: unreadable JSON, a non-object document,
+* and a `review` value that violates the review shape all still refuse.
+*/
+const baseReviewDocumentSchema = z.object({
+	repository: z.object({
+		name: z.string().min(1),
+		owner: z.string().min(1)
+	}).strict(),
+	review: reviewPolicySchema.optional(),
+	schemaVersion: z.number().int().positive()
+});
+const parseBaseReviewPolicy = (content) => {
+	let document;
+	try {
+		document = JSON.parse(content);
+	} catch (error) {
+		return {
+			ok: false,
+			reason: `it is not valid JSON (${failureText(error)})`
+		};
+	}
+	const parsed = baseReviewDocumentSchema.safeParse(document);
+	if (!parsed.success) return {
+		ok: false,
+		reason: parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")
+	};
+	return {
+		ok: true,
+		policy: parsed.data.review,
+		repository: parsed.data.repository
+	};
+};
+/**
+* Read the review policy the PR's base ref actually declares, at its live tip.
+*
+* The base ref name comes from GitHub, the repository from the trusted
+* checkout, and the tip from GitHub's ref API — never from the candidate
+* profile and never from a caller-supplied ref, both of which the candidate
+* controls. Every failure returns `unresolved` with a reason; the caller
+* refuses on it. An absent or unparseable profile at the base tip is a
+* refusal, never "no base demand".
+*/
+const readAuthoritativeBasePolicy = ({ authority, baseRefName, crossRepository, cwd, profilePath, repository }) => {
+	if (crossRepository !== false) return {
+		baseRefName,
+		kind: "unresolved",
+		reason: crossRepository === true ? `this pull request is opened from a fork, so its base repository is not the trusted checkout repository ${repositorySlug(repository)}, and base policy must never be resolved from a candidate-controlled fork.` : `GitHub did not state whether this pull request comes from a fork (isCrossRepository was ${JSON.stringify(crossRepository)}), and an unstated answer is not a "no": base policy must never be resolved from a repository that may be a candidate-controlled fork.`
+	};
+	let policyBaseSha;
+	try {
+		policyBaseSha = authority.branchTipSha({
+			branch: baseRefName,
+			cwd,
+			repository
+		});
+	} catch (error) {
+		return {
+			baseRefName,
+			kind: "unresolved",
+			reason: `the live tip of ${baseRefName} could not be read from GitHub: ${failureText(error)}`
+		};
+	}
+	let content;
+	try {
+		content = authority.profileContentAtRef({
+			cwd,
+			profilePath,
+			ref: policyBaseSha,
+			repository
+		});
+	} catch (error) {
+		return {
+			baseRefName,
+			kind: "unresolved",
+			reason: `${profilePath} could not be read at base tip ${policyBaseSha}: ${failureText(error)}`
+		};
+	}
+	const parsed = parseBaseReviewPolicy(content);
+	if (!parsed.ok) return {
+		baseRefName,
+		kind: "unresolved",
+		reason: `${profilePath} at base tip ${policyBaseSha} does not carry a readable review policy: ${parsed.reason}`
+	};
+	if (repositorySlug(parsed.repository) !== repositorySlug(repository)) return {
+		baseRefName,
+		kind: "unresolved",
+		reason: `${profilePath} at base tip ${policyBaseSha} declares repository ${repositorySlug(parsed.repository)}, which is not the trusted checkout repository ${repositorySlug(repository)}.`
+	};
+	return {
+		baseRefName,
+		kind: "resolved",
+		policy: parsed.policy,
+		policyBaseSha
+	};
+};
+/** The policy identity a gate records once the authority resolved (#922). */
+const authoritativePolicyResolution = ({ base, demand }) => ({
+	basePolicyDigest: demand.basePolicyDigest,
+	baseRefName: base.baseRefName,
+	candidatePolicyDigest: demand.candidatePolicyDigest,
+	effectiveDigest: demand.effectiveDigest,
+	policyBaseSha: base.policyBaseSha,
+	reviewPolicyChanged: demand.reviewPolicyChanged,
+	status: "authoritative"
+});
 /**
 * Convert schema-v5 profile requiredChecks into the executable evidence
 * demands consumed by readiness and its preflight presentation. Schema-v5
@@ -11866,7 +12196,7 @@ const defaultFetchClosingPullRequests = ({ issue, owner, repo }) => {
 		`issue=${issue}`
 	]).data?.repository?.issue?.closedByPullRequestsReferences?.nodes ?? [];
 };
-const defaultFetchIssueBody = ({ issue, owner, repo }) => runGhJson([
+const defaultFetchIssueBody$1 = ({ issue, owner, repo }) => runGhJson([
 	"issue",
 	"view",
 	String(issue),
@@ -11891,7 +12221,7 @@ const wrapperBoundaryNotices = ({ epic, manifest }) => {
 * closed: an absent, unparseable, or unmatched manifest binds nothing and
 * names its refusal. The boundary issue may be the work issue itself (#789).
 */
-const resolveWaveDemand = ({ baseRefName, epic, fetchClosingPullRequests = defaultFetchClosingPullRequests, fetchIssueBody = defaultFetchIssueBody, headRefName, owner, pr, repo }) => {
+const resolveWaveDemand = ({ baseRefName, epic, fetchClosingPullRequests = defaultFetchClosingPullRequests, fetchIssueBody = defaultFetchIssueBody$1, headRefName, owner, pr, repo }) => {
 	const parsed = parseBoundaryManifest(fetchIssueBody({
 		issue: epic,
 		owner,
@@ -12152,47 +12482,6 @@ function hqIngestCredentialCheck({ env, resolve = defaultSecretReferenceProbe, r
 	};
 }
 //#endregion
-//#region src/review-proof-applicability.ts
-const REVIEW_STATUS_VALUES = [
-	"not-required",
-	"current",
-	"stale",
-	"missing",
-	"blocked"
-];
-const reviewStatusSchema = z.enum(REVIEW_STATUS_VALUES);
-const isProofCurrent = ({ reviewedHeadSha, reviewedPatchId, headSha, patchId }) => evidenceFresh({
-	candidate: {
-		headSha,
-		patchId
-	},
-	recorded: {
-		headSha: reviewedHeadSha,
-		patchId: reviewedPatchId
-	},
-	rule: "patch-id-or-head-sha"
-});
-const reviewStatus = ({ blocked, required, reviewedHeadSha, reviewedPatchId, headSha, patchId }) => {
-	if (blocked) {
-		if ((reviewedHeadSha || reviewedPatchId) && !isProofCurrent({
-			headSha,
-			patchId,
-			reviewedHeadSha,
-			reviewedPatchId
-		})) return "stale";
-		return "blocked";
-	}
-	if (!required) return "not-required";
-	if (!(reviewedHeadSha || reviewedPatchId)) return "missing";
-	if (isProofCurrent({
-		headSha,
-		patchId,
-		reviewedHeadSha,
-		reviewedPatchId
-	})) return "current";
-	return "stale";
-};
-//#endregion
 //#region src/admission-preflight.ts
 const errorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
 const resolveCandidate = ({ base, cwd, verifyProof }) => {
@@ -13963,10 +14252,10 @@ const managedReadinessLedgerSchema = z.object({
 		"non-trivial"
 	]),
 	externalChecks: z.array(z.object({
-		checkType: z.enum(EVIDENCE_CHECK_TYPES$1),
+		checkType: z.enum(EVIDENCE_CHECK_TYPES),
 		name: z.string().min(1),
 		reason: z.string().optional(),
-		scope: requiredCheckScopeSchema$1.optional(),
+		scope: requiredCheckScopeSchema.optional(),
 		scopeReason: z.string().min(1),
 		status: z.enum([
 			"satisfied",
@@ -15422,6 +15711,7 @@ const prReadyProofSchema = z.object({
 	humanBlockingReasons: z.array(z.string()).default([]),
 	ledger: managedReadinessLedgerSchema,
 	notices: z.array(z.string().min(1)).optional(),
+	policyResolution: policyResolutionSchema.optional(),
 	profileBlobSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	profilePath: z.string().min(1).optional(),
 	repairs: z.array(readinessRepairSchema).default([]),
@@ -15444,6 +15734,7 @@ const PR_VIEW_JSON_FIELDS = [
 	"body",
 	"headRefName",
 	"headRefOid",
+	"isCrossRepository",
 	"isDraft",
 	"mergeStateStatus",
 	"mergeable",
@@ -15647,6 +15938,20 @@ async function runPrReady(args, dependencies = {}) {
 		const policyProfile = committedPolicy.profile;
 		if (repositorySlug(policyProfile.repository) !== checkoutRepositorySlug) throw new Error(`Committed readiness profile repository ${repositorySlug(policyProfile.repository)} does not match trusted checkout repository ${checkoutRepositorySlug}.`);
 		const committedProfilePath = checkoutRelativeProfilePath(cwd, profilePath);
+		const basePolicyReading = readAuthoritativeBasePolicy({
+			authority: dependencies.basePolicy ?? defaultBaseReviewPolicyAuthority(),
+			baseRefName: pr.baseRefName,
+			crossRepository: pr.isCrossRepository,
+			cwd,
+			profilePath: committedProfilePath,
+			repository
+		});
+		if (basePolicyReading.kind === "unresolved") throw new Error(`pr:ready could not read the authoritative review policy from the live tip of base ref ${basePolicyReading.baseRefName}: ${basePolicyReading.reason} Review demand is resolved from the base policy as well as the candidate's, so an unreadable base authority refuses admission rather than falling back to the candidate's own profile. Restore ${committedProfilePath} on ${basePolicyReading.baseRefName}, or re-run once GitHub is reachable.`);
+		const authoritativeReview = resolveAuthoritativeReviewDemand({
+			basePolicy: basePolicyReading.policy,
+			candidatePolicy: policyProfile.review,
+			changedFiles: files
+		});
 		const verifyProofPath = path.resolve(cwd, args.verifyProof ?? ".factory-memory/pr-verify.json");
 		const reviewProofPath = path.resolve(cwd, args.reviewProof ?? ".factory-memory/pr-review.json");
 		const verifyProofRead = tryReadProof(readPrVerifyProof, verifyProofPath);
@@ -15655,11 +15960,10 @@ async function runPrReady(args, dependencies = {}) {
 			recorded: { patchId: verifyProofRead.proof.patchId },
 			rule: "patch-id"
 		}) ? verifyProofRead.proof.classification : "non-trivial";
-		const demands = resolveCandidateDemands({
+		const { ladderPolicy, requiredChecks } = resolveCandidateDemands({
 			changedFiles: files,
 			profile: policyProfile
 		});
-		const { ladderPolicy } = demands;
 		const waveDemand = args.epic === void 0 ? void 0 : resolveWaveDemand({
 			baseRefName: pr.baseRefName,
 			epic: args.epic,
@@ -15693,7 +15997,7 @@ async function runPrReady(args, dependencies = {}) {
 			args,
 			cwd,
 			recordedAuthoringSession: verifyProofRead.proof?.authoringSession,
-			requiredChecks: demands.requiredChecks
+			requiredChecks
 		});
 		const output = path.resolve(cwd, args.output ?? ".factory-memory/pr-ready.json");
 		const externalCheckState = statusCheckState(pr.statusCheckRollup, isFactoryReadyCheck);
@@ -15729,7 +16033,7 @@ async function runPrReady(args, dependencies = {}) {
 			prTitle: pr.title,
 			requiredChecks: externalCheckState,
 			reviewDecision: pr.reviewDecision,
-			reviewModes: demands.reviewModes,
+			reviewModes: authoritativeReview.reviewModes,
 			reviewProof,
 			unresolvedReviewThreads: pr.unresolvedReviewThreads,
 			verificationProof: verification.verificationProof,
@@ -15768,8 +16072,13 @@ async function runPrReady(args, dependencies = {}) {
 		if (evaluation.status === "ready") followUp = arming?.outcome === "not-armed" ? readyRedispatch() : void 0;
 		else if (undraftRepair && evaluation.humanBlockingReasons.length === 0) followUp = prUndraftFollowUp(args.pr);
 		else if (!pendingExternalChecksOnly) followUp = prVerifyFollowUp(authoringSession);
+		const basePolicyNotice = baseDerivedSecurityNotice({
+			baseRefName: basePolicyReading.baseRefName,
+			demand: authoritativeReview
+		});
 		const notices = [
 			...evaluation.notices,
+			...basePolicyNotice && evaluation.ledger.reviews.security ? [basePolicyNotice] : [],
 			...arming ? [armingNotice(arming)] : [],
 			...waveDemand?.notices ?? [],
 			...evaluation.status === "ready" && !boundary ? ["No boundary wave authorized this candidate, so nothing was armed: pr:ready admits it but schedules no merge. Re-run with --epic <issue> to resolve the wave demand and arm. That issue can be the work issue itself, carrying its own fence; do not file a second boundary issue for one candidate."] : [],
@@ -15784,6 +16093,10 @@ async function runPrReady(args, dependencies = {}) {
 			humanBlockingReasons: evaluation.humanBlockingReasons,
 			ledger: evaluation.ledger,
 			...notices.length > 0 ? { notices } : {},
+			policyResolution: authoritativePolicyResolution({
+				base: basePolicyReading,
+				demand: authoritativeReview
+			}),
 			profileBlobSha: committedPolicy.blobSha,
 			profilePath: committedProfilePath,
 			repairs: evaluation.repairs,
@@ -15930,7 +16243,7 @@ const reviewFindingsFileSchema = z.object({
 	patchId: nonBlankString,
 	producer: nonBlankString.optional(),
 	reviews: z.array(findingsReviewSchema),
-	rung: z.enum(EVIDENCE_REVIEW_RUNGS$1).optional(),
+	rung: z.enum(EVIDENCE_REVIEW_RUNGS).optional(),
 	schemaVersion: z.union([z.literal(1), z.literal(2)]),
 	sessionId: nonBlankString
 }).strict().superRefine((file, context) => {
@@ -15981,40 +16294,92 @@ const parseReviewFindingsFile = (findingsPath, cwd = process.cwd()) => {
 	}
 };
 //#endregion
-//#region src/review-ladder-trace.ts
-const eventTime = () => (/* @__PURE__ */ new Date()).toISOString();
-const buildReviewLadderStageTraceEvent = ({ createdAt = eventTime(), event, headSha, identity, patchId }) => {
-	const trace = {
-		createdAt,
-		cycle: event.cycle,
-		engine: event.engine,
-		eventId: `review-ladder-stage-${crypto.randomUUID()}`,
-		eventType: "review-ladder-stage",
-		findingsSummary: event.findingsSummary,
-		observedAt: createdAt,
-		repo: identity.repo,
-		schemaVersion: 1,
-		stage: event.stage,
-		typeVersion: 1
-	};
-	if (event.cyclesToClean !== void 0) trace.cyclesToClean = event.cyclesToClean;
-	if (event.forcedTransition !== void 0) trace.forcedTransition = event.forcedTransition;
-	if (event.model !== void 0) trace.model = event.model;
-	if (event.session !== void 0) trace.session = event.session;
-	if (event.usage !== void 0) trace.usage = event.usage;
-	if (headSha !== void 0) trace.headSha = headSha;
-	if (patchId !== void 0) trace.patchId = patchId;
-	if (typeof identity.issue === "number") trace.issue = identity.issue;
-	if (typeof identity.pr === "number") trace.pr = identity.pr;
-	if (identity.threadId !== void 0) trace.threadId = identity.threadId;
-	if (identity.workerId !== void 0) trace.workerId = identity.workerId;
-	return trace;
-};
-const appendReviewLadderStageTraceEvent = ({ createdAt, event, headSha, identity, mirror, patchId, repoRoot }) => appendFactoryTraceEvent(repoRoot, buildReviewLadderStageTraceEvent({
-	createdAt,
-	event,
-	headSha,
-	identity,
+//#region src/issue-body-sections.ts
+const HEADING_PATTERN = /^#{2,6}\s+(?<title>.+?)\s*$/u;
+const FENCE_PATTERN = /^\s*(?<fence>`{3,}|~{3,})(?<rest>.*)$/u;
+/**
+* Extracts the body of a markdown section (heading depth `##`–`######`,
+* case-insensitive title match) from an issue body. Duplicate sections
+* resolve to the first occurrence.
+*
+* The scan is fence-aware: heading-like lines inside fenced code blocks
+* (``` or ~~~, including indented and language-tagged fences) neither start
+* nor terminate a section. Fences are matched by marker character (backtick
+* vs. tilde) and require a closing fence with at least as many marker
+* characters as the opener, per CommonMark; an unclosed fence extends to the
+* end of the body.
+*/
+const sectionBody = (body, heading) => {
+	const lines = body.split(/\r?\n/u);
+	const target = heading.toLowerCase();
+	let openFence;
+	let startIndex = -1;
+	for (const [index, line] of lines.entries()) {
+		const fence = FENCE_PATTERN.exec(line)?.groups;
+		const marker = fence?.fence;
+		if (openFence) {
+			if (marker && marker[0] === openFence.char && marker.length >= openFence.length && (fence?.rest ?? "").trim() === "") openFence = void 0;
+			continue;
+		}
+		if (marker) {
+			openFence = {
+				char: marker[0],
+				length: marker.length
+			};
+			continue;
+		}
+		const title = HEADING_PATTERN.exec(line)?.groups?.title;
+		if (title === void 0) continue;
+		if (startIndex === -1) {
+			if (title.toLowerCase() === target) startIndex = index;
+			continue;
+		}
+		return lines.slice(startIndex + 1, index).join("\n").trim();
+	}
+	if (startIndex === -1) return;
+	return lines.slice(startIndex + 1).join("\n").trim();
+};
+//#endregion
+//#region src/review-focus.ts
+const REVIEW_FOCUS_SECTION = "Review focus";
+const reviewFocusFromIssueBody = (body) => {
+	return sectionBody(body, "Review focus") || void 0;
+};
+//#endregion
+//#region src/review-ladder-trace.ts
+const eventTime = () => (/* @__PURE__ */ new Date()).toISOString();
+const buildReviewLadderStageTraceEvent = ({ createdAt = eventTime(), event, headSha, identity, patchId }) => {
+	const trace = {
+		createdAt,
+		cycle: event.cycle,
+		engine: event.engine,
+		eventId: `review-ladder-stage-${crypto.randomUUID()}`,
+		eventType: "review-ladder-stage",
+		findingsSummary: event.findingsSummary,
+		observedAt: createdAt,
+		repo: identity.repo,
+		schemaVersion: 1,
+		stage: event.stage,
+		typeVersion: 1
+	};
+	if (event.cyclesToClean !== void 0) trace.cyclesToClean = event.cyclesToClean;
+	if (event.forcedTransition !== void 0) trace.forcedTransition = event.forcedTransition;
+	if (event.model !== void 0) trace.model = event.model;
+	if (event.session !== void 0) trace.session = event.session;
+	if (event.usage !== void 0) trace.usage = event.usage;
+	if (headSha !== void 0) trace.headSha = headSha;
+	if (patchId !== void 0) trace.patchId = patchId;
+	if (typeof identity.issue === "number") trace.issue = identity.issue;
+	if (typeof identity.pr === "number") trace.pr = identity.pr;
+	if (identity.threadId !== void 0) trace.threadId = identity.threadId;
+	if (identity.workerId !== void 0) trace.workerId = identity.workerId;
+	return trace;
+};
+const appendReviewLadderStageTraceEvent = ({ createdAt, event, headSha, identity, mirror, patchId, repoRoot }) => appendFactoryTraceEvent(repoRoot, buildReviewLadderStageTraceEvent({
+	createdAt,
+	event,
+	headSha,
+	identity,
 	patchId
 }), { mirror });
 const tryAppendReviewLadderStageTraceEvent = (input) => {
@@ -16128,15 +16493,189 @@ function emitLadderStageTrace({ cwd, evaluation, headSha, issue, patchId, profil
 	else console.error(`review-ladder-stage trace event not written: ${traceResult.errorMessage}`);
 }
 //#endregion
+//#region src/review-contract.ts
+const REVIEW_FOOTER_INSTRUCTIONS = `Do not print a machine-readable footer in your chat response. Instead, write your findings to the typed findings file at the path given in your dispatch/task instructions (the file pr:review reads via --findings <path>). The file must be valid JSON matching review-findings-file.ts's schema (schemaVersion 1):
+{
+  "schemaVersion": 1,
+  "model": "<your model identifier>",
+  "sessionId": "<this session's id>",
+  "patchId": "<the stable patch-id from Review scope above>",
+  "reviews": [
+    {
+      "kind": "correctness" or "security" (this review's mode, matching the mode-floor instructions below),
+      "outcome": "passed" or "failed",
+      "issuesFlagged": an integer count of actionable findings (must equal findings.length),
+      "summary": one concise sentence; use "No actionable findings." only when issuesFlagged is 0,
+      "findings": [] when issuesFlagged is 0, otherwise an array of objects with title, body, and optional file, line, priority, category, blockingAfterCap, citedSpan, prescribedAction, and supersedes fields
+    }
+  ]
+}
+Use category "correctness", "safety", "coordination", or "maintainability"; set blockingAfterCap true for correctness, safety, or coordination findings. citedSpan must be the exact code text the finding is about, quoted verbatim from the diff (identity is derived from this, not from the title, so quote precisely). prescribedAction must be a concise, standalone statement of the required fix (identity is derived from this text too). If this finding is a restatement of a prior finding shown in the prior review ledger below, set supersedes to {"title": "<exact prior title>", "file": "<its file>"} instead of minting a new title for the same theme.`;
+//#endregion
+//#region src/review-prompt.ts
+const reviewScope = ({ base, changedFiles: files, headSha, patchId, profile }) => `Review scope:
+- Repository: ${profile.repository.owner}/${profile.repository.name}
+- Base ref: ${base}
+- Head SHA: ${headSha}
+- Stable patch-id: ${patchId}
+- Changed files:
+${files.length > 0 ? files.map((file) => `  - ${file}`).join("\n") : "  - None"}
+
+Required constraints:
+- Review only the PR-owned diff against ${base} and the changed files listed above.
+- Prefer git diff, git grep, and file-specific reads.
+- Do not inspect ignored generated output such as dist, build, coverage, or sourcemaps.
+- Do not rerun broad build or verification commands. If pr:verify proof already exists, treat build verification as out of scope for this review runner.
+- Do not request elevated or unsandboxed approvals.
+- When you flag a finding, report every other instance of the same class in this diff in the same response, and include a one-line coverage note.
+
+${REVIEW_FOOTER_INSTRUCTIONS}`;
+const MODE_FLOOR_FILES = {
+	correctness: "correctness.md",
+	security: "security/SKILL.md"
+};
+const reviewPromptsDir = path.join(import.meta.dirname, "review-prompts");
+const modeFloorCache = /* @__PURE__ */ new Map();
+const securityReferenceFiles = (changedFiles) => {
+	const references = /* @__PURE__ */ new Set();
+	for (const file of changedFiles) {
+		if (/^\.github\/(?:actions|workflows)\//u.test(file)) references.add("security/references/github-workflows.md");
+		if (/\.(?:[cm]?[jt]sx?)$/u.test(file)) references.add("security/references/javascript-typescript.md");
+		if (/\.py(?:i)?$/u.test(file)) references.add("security/references/python.md");
+	}
+	return [...references];
+};
+function modeFloorInstructions(kind, changedFiles = []) {
+	const referenceFiles = kind === "security" ? securityReferenceFiles(changedFiles) : [];
+	const cacheKey = `${kind}:${referenceFiles.join(",")}`;
+	const cached = modeFloorCache.get(cacheKey);
+	if (cached !== void 0) return cached;
+	const text = [MODE_FLOOR_FILES[kind], ...referenceFiles].map((file) => readFileSync(path.join(reviewPromptsDir, file), "utf-8")).map((contents) => contents.replace(/\n+$/u, "")).join("\n\n---\n\n");
+	modeFloorCache.set(cacheKey, text);
+	return text;
+}
+const CODING_STANDARDS_FILE = "CODING_STANDARDS.md";
+const readCodingStandardsAtHead = ({ cwd, git, headSha }) => {
+	let root;
+	try {
+		root = (git?.repositoryRoot ?? repositoryRoot)(cwd);
+	} catch {
+		return;
+	}
+	return (git?.showFileAtRef ?? showFileAtRef)(root, headSha, path.join(root, CODING_STANDARDS_FILE));
+};
+const codingStandardsSegment = ({ contents, headSha }) => {
+	const text = contents?.replace(/\n+$/u, "");
+	if (!text?.trim()) return;
+	const source = `${CODING_STANDARDS_FILE} at head ${headSha}`;
+	return {
+		section: {
+			provenance: "coding-standards",
+			source,
+			text
+		},
+		text: `Repository coding standards (source: ${source}, appended verbatim). Check the diff against these rules:
+${text}`
+	};
+};
+const issueFocusSegment = (focus) => ({
+	section: {
+		provenance: "issue-review-focus",
+		source: `issue #${focus.issueNumber} "${REVIEW_FOCUS_SECTION}" section`,
+		text: focus.text
+	},
+	text: `Per-issue review focus (source: issue #${focus.issueNumber} "${REVIEW_FOCUS_SECTION}" section, appended verbatim):
+${focus.text}`
+});
+const priorLedgerEntryLine = (entry) => {
+	const location = entry.file ? ` (${entry.file})` : "";
+	const reference = entry.reference ? ` — ${entry.reference}` : "";
+	return `- [${entry.disposition}] "${entry.title}"${location}${reference} (flagged ${entry.flagCount}x)`;
+};
+const priorLedgerSegment = (entries) => ({
+	section: {
+		provenance: "prior-review-ledger",
+		source: "persisted pr:review disposition ledger (prior cycles, #233)",
+		text: entries.map(priorLedgerEntryLine).join("\n")
+	},
+	text: `Prior review ledger (source: persisted pr:review disposition ledger from earlier cycles on this PR; already adjudicated — do not re-litigate):
+${entries.map(priorLedgerEntryLine).join("\n")}
+
+Do not re-raise any of the findings above under a new title: they are already adjudicated (waived, filed as a follow-up, or fixed in this thread). If new evidence genuinely supersedes one of them, say so explicitly and name the exact prior finding (its title and file) that it supersedes, rather than minting an unrelated title for the same underlying theme.`
+});
+const assembleReviewPrompt = ({ base, changedFiles, cwd = process.cwd(), headSha, issueFocus, kind, patchId, priorLedgerEntries, profile }, dependencies = {}) => {
+	if (!resolveApplicableReviewModes(profile, changedFiles).includes(kind)) throw new Error(`${kind} review mode does not apply to the changed files.`);
+	const priorLedger = priorLedgerEntries ? nonOpenLadderFindings(priorLedgerEntries) : [];
+	const optionalSegments = {
+		"coding-standards": codingStandardsSegment({
+			contents: kind === "correctness" ? readCodingStandardsAtHead({
+				cwd,
+				git: dependencies.git,
+				headSha
+			}) : void 0,
+			headSha
+		}),
+		"issue-review-focus": issueFocus ? issueFocusSegment(issueFocus) : void 0,
+		"prior-review-ledger": priorLedger.length > 0 ? priorLedgerSegment(priorLedger) : void 0
+	};
+	const segments = [
+		{ text: reviewScope({
+			base,
+			changedFiles,
+			headSha,
+			patchId,
+			profile
+		}) },
+		{ text: modeFloorInstructions(kind, changedFiles) },
+		...REVIEW_PROMPT_SECTION_PROVENANCES.flatMap((provenance) => {
+			const segment = optionalSegments[provenance];
+			return segment ? [segment] : [];
+		})
+	];
+	return {
+		prompt: segments.map((segment) => segment.text).join("\n\n"),
+		sections: segments.flatMap((segment) => segment.section ? [segment.section] : [])
+	};
+};
+//#endregion
 //#region src/pr-review.ts
+const DEFAULT_ASSEMBLED_REVIEW_PROMPT_PATH = ".factory-memory/pr-review-prompt.json";
+const MISSING_ASSEMBLED_PROMPT_NOTICE = "pr:review notice: assembled review prompt not found at .factory-memory/pr-review-prompt.json; accepting findings without promptSections.";
+const STALE_ASSEMBLED_PROMPT_NOTICE = "pr:review notice: assembled review prompt patch-id does not match the candidate; accepting findings without promptSections.";
+const UNREADABLE_ASSEMBLED_PROMPT_NOTICE = "pr:review notice: assembled review prompt at .factory-memory/pr-review-prompt.json is unreadable; accepting findings without promptSections.";
+const ASSEMBLE_NO_KIND_NOTICE = "pr:review --assemble: no review kind applies; prompt not written.";
+const ASSEMBLE_FAITHFUL_MERGE_NOTICE = "pr:review --assemble: faithful-merge; prompt not written.";
+const ASSEMBLED_REVIEW_PROMPT_SCHEMA_VERSION = 1;
+const assembledReviewPromptKindSchema = z.object({
+	kind: z.enum(["correctness", "security"]),
+	prompt: z.string().min(1),
+	sections: z.array(reviewPromptSectionSchema)
+});
+const assembledReviewPromptArtifactSchema = z.object({
+	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+	patchId: z.string().regex(/^[0-9a-f]{40,64}$/u),
+	reviews: z.array(assembledReviewPromptKindSchema),
+	schemaVersion: z.literal(ASSEMBLED_REVIEW_PROMPT_SCHEMA_VERSION)
+});
 const defaultPrReviewGit = () => ({
 	changedFiles,
 	currentHeadSha,
 	isAncestor,
 	recognizeCatchUp: recognizeCatchUpCandidate,
+	repositoryRoot,
+	showFileAtRef,
 	stablePatchId: runStablePatchId,
 	statusPorcelain
 });
+const defaultFetchIssueBody = ({ issue, owner, repo }) => runGhJson([
+	"issue",
+	"view",
+	String(issue),
+	"--repo",
+	`${owner}/${repo}`,
+	"--json",
+	"body"
+]).body;
 const assertReviewCycleInWindow = (cycle, maxCycles) => {
 	if (cycle < 1 || cycle > maxCycles) throw new Error(`--cycle must be between 1 and ${maxCycles}.`);
 };
@@ -16231,7 +16770,99 @@ const assertReviewOutcomes = (proof, policy, cycle, maxCycles) => {
 	console.error(cycle >= maxCycles ? `Review cycle limit reached (${cycle}/${maxCycles}). Stop and request human direction before rerunning.` : `Fix ${state.openFindings} actionable finding(s) before rerunning pr:review as cycle ${cycle + 1}/${maxCycles}.`);
 	throw new Error("pr:review found actionable review findings.");
 };
+const loadIssueFocus = (issue, profile, fetchIssueBody) => {
+	const text = reviewFocusFromIssueBody(fetchIssueBody({
+		issue,
+		owner: profile.repository.owner,
+		repo: profile.repository.name
+	}));
+	return text === void 0 ? void 0 : {
+		issueNumber: issue,
+		text
+	};
+};
+const assembleGitDependencies = (git) => git.repositoryRoot !== void 0 && git.showFileAtRef !== void 0 ? {
+	repositoryRoot: git.repositoryRoot,
+	showFileAtRef: git.showFileAtRef
+} : void 0;
+const writeAssembledReviewPrompt = ({ args, cwd, fetchIssueBody, files, git, headSha, kinds, output, patchId, profile }) => {
+	const priorLedger = priorLedgerFor(priorLadderStateFor({
+		base: args.base,
+		cwd,
+		headSha,
+		isAncestor: (ancestor, descendant) => git.isAncestor(cwd, ancestor, descendant),
+		output
+	}));
+	const issueFocus = args.issue === void 0 ? void 0 : loadIssueFocus(args.issue, profile, fetchIssueBody);
+	const assembleGit = assembleGitDependencies(git);
+	const assembledReviews = kinds.map((kind) => {
+		const assembled = assembleReviewPrompt({
+			base: args.base,
+			changedFiles: files,
+			cwd,
+			headSha,
+			...issueFocus === void 0 ? {} : { issueFocus },
+			kind,
+			patchId,
+			priorLedgerEntries: priorLedger,
+			profile
+		}, assembleGit === void 0 ? {} : { git: assembleGit });
+		return {
+			kind,
+			prompt: assembled.prompt,
+			sections: assembled.sections
+		};
+	});
+	const artifactPath = path.resolve(cwd, DEFAULT_ASSEMBLED_REVIEW_PROMPT_PATH);
+	const existing = readAssembledReviewPrompt(artifactPath);
+	writeProofJson({
+		headSha,
+		patchId,
+		reviews: existing.status === "ok" && existing.artifact.patchId === patchId && existing.artifact.headSha === headSha ? [...new Map([...existing.artifact.reviews, ...assembledReviews].map((review) => [review.kind, review])).values()] : assembledReviews,
+		schemaVersion: ASSEMBLED_REVIEW_PROMPT_SCHEMA_VERSION
+	}, artifactPath);
+	console.log(`pr:review assembled prompt written to ${artifactPath}`);
+	return artifactPath;
+};
+const readAssembledReviewPrompt = (artifactPath) => {
+	if (!existsSync(artifactPath)) return { status: "missing" };
+	try {
+		return {
+			artifact: assembledReviewPromptArtifactSchema.parse(JSON.parse(readFileSync(artifactPath, "utf-8"))),
+			status: "ok"
+		};
+	} catch {
+		return { status: "unreadable" };
+	}
+};
+const promptSectionsFromAssembledArtifact = ({ cwd, patchId }) => {
+	const read = readAssembledReviewPrompt(path.resolve(cwd, DEFAULT_ASSEMBLED_REVIEW_PROMPT_PATH));
+	if (read.status === "missing") {
+		console.error(MISSING_ASSEMBLED_PROMPT_NOTICE);
+		return;
+	}
+	if (read.status === "unreadable") {
+		console.error(UNREADABLE_ASSEMBLED_PROMPT_NOTICE);
+		return;
+	}
+	if (read.artifact.patchId !== patchId) {
+		console.error(STALE_ASSEMBLED_PROMPT_NOTICE);
+		return;
+	}
+	return new Map(read.artifact.reviews.flatMap((review) => review.sections.length > 0 ? [[review.kind, review.sections]] : []));
+};
+const withAssembledPromptSections = (reviews, sectionsByKind) => {
+	if (sectionsByKind === void 0) return reviews;
+	return reviews.map((review) => {
+		const promptSections = sectionsByKind.get(review.kind);
+		return promptSections === void 0 ? review : {
+			...review,
+			promptSections
+		};
+	});
+};
 async function runPrReview(args, dependencies = {}) {
+	if (args.assemble === true && args.findings !== void 0) throw new Error("--assemble and --findings cannot be combined; they are sequential steps.");
 	const cwd = path.resolve(args.cwd ?? process.cwd());
 	const git = dependencies.git ?? defaultPrReviewGit();
 	const files = git.changedFiles(cwd, args.base);
@@ -16268,6 +16899,40 @@ async function runPrReview(args, dependencies = {}) {
 	const startedAt = /* @__PURE__ */ new Date();
 	const findingsFile = args.findings ? parseReviewFindingsFile(args.findings, cwd) : void 0;
 	const kinds = enabledKinds(profile, args.mode, files, findingsFile?.reviews.map((review) => review.kind) ?? []);
+	if (args.assemble === true) {
+		const assembleProof = () => emptyProof({
+			base: args.base,
+			cycle: args.cycle,
+			files,
+			headSha,
+			maxCycles,
+			patchId
+		});
+		if (kinds.length === 0) {
+			console.log(ASSEMBLE_NO_KIND_NOTICE);
+			return assembleProof();
+		}
+		if ((git.recognizeCatchUp ?? recognizeCatchUpCandidate)({
+			base: args.base,
+			cwd
+		}).recognized) {
+			console.log(ASSEMBLE_FAITHFUL_MERGE_NOTICE);
+			return assembleProof();
+		}
+		writeAssembledReviewPrompt({
+			args,
+			cwd,
+			fetchIssueBody: dependencies.fetchIssueBody ?? defaultFetchIssueBody,
+			files,
+			git,
+			headSha,
+			kinds,
+			output,
+			patchId,
+			profile
+		});
+		return assembleProof();
+	}
 	const mintNotRequiredProof = (reviewRequirement) => {
 		const proof = emptyProof({
 			base: args.base,
@@ -16335,7 +17000,10 @@ async function runPrReview(args, dependencies = {}) {
 	const priorLedger = priorLedgerFor(priorLadder);
 	const declaredDispositions = declaredDispositionsFor(args.dispositions, cwd);
 	assertDeclaredDispositionsMatch(priorLedger, declaredDispositions);
-	const reviews = reviewResults(findingsFile, kinds, startedAt, /* @__PURE__ */ new Date());
+	const reviews = withAssembledPromptSections(reviewResults(findingsFile, kinds, startedAt, /* @__PURE__ */ new Date()), promptSectionsFromAssembledArtifact({
+		cwd,
+		patchId
+	}));
 	const runs = reviews.map((review) => ({ review }));
 	const { evaluation, ladder } = ladderStateForRun({
 		cycle: args.cycle,
@@ -17070,7 +17738,7 @@ function assertForegroundGate({ gate, env = process.env }) {
 //#endregion
 //#region src/commands/pr-review.ts
 function createPrReviewCommand(output, action) {
-	return markCwdOptionDefault(new Command("pr:review").description("Validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", collectCwdOption).option("--cycle <number>", "review cycle number", positiveInteger$1("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--findings <path>", "typed clean-session findings JSON file").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace", positiveInteger$1("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:review").description("Assemble a factory-owned review prompt, or validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", collectCwdOption).option("--cycle <number>", "review cycle number", positiveInteger$1("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--assemble", "write the factory-owned review prompt for a clean session; do not validate findings").option("--findings <path>", "typed clean-session findings JSON file").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace; --assemble also loads Review focus from this issue", positiveInteger$1("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
 		gate: "pr:review",
 		resolveCycle: (options) => options.cycle,
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
@@ -17083,6 +17751,7 @@ function createPrReviewCommand(output, action) {
 			"all"
 		].includes(options.mode)) throw new Error("--mode requires correctness, security, or all");
 		const args = {
+			...options.assemble === true ? { assemble: true } : {},
 			base: options.base,
 			cwd: resolveCwdOption(options.cwd),
 			cycle: options.cycle,
@@ -17399,171 +18068,6 @@ function formatScratchFileCheckSummary(check) {
 	return "Scratch files: not checked (no readable worktree path)";
 }
 //#endregion
-//#region src/issue-body-sections.ts
-const HEADING_PATTERN = /^#{2,6}\s+(?<title>.+?)\s*$/u;
-const FENCE_PATTERN = /^\s*(?<fence>`{3,}|~{3,})(?<rest>.*)$/u;
-/**
-* Extracts the body of a markdown section (heading depth `##`–`######`,
-* case-insensitive title match) from an issue body. Duplicate sections
-* resolve to the first occurrence.
-*
-* The scan is fence-aware: heading-like lines inside fenced code blocks
-* (``` or ~~~, including indented and language-tagged fences) neither start
-* nor terminate a section. Fences are matched by marker character (backtick
-* vs. tilde) and require a closing fence with at least as many marker
-* characters as the opener, per CommonMark; an unclosed fence extends to the
-* end of the body.
-*/
-const sectionBody = (body, heading) => {
-	const lines = body.split(/\r?\n/u);
-	const target = heading.toLowerCase();
-	let openFence;
-	let startIndex = -1;
-	for (const [index, line] of lines.entries()) {
-		const fence = FENCE_PATTERN.exec(line)?.groups;
-		const marker = fence?.fence;
-		if (openFence) {
-			if (marker && marker[0] === openFence.char && marker.length >= openFence.length && (fence?.rest ?? "").trim() === "") openFence = void 0;
-			continue;
-		}
-		if (marker) {
-			openFence = {
-				char: marker[0],
-				length: marker.length
-			};
-			continue;
-		}
-		const title = HEADING_PATTERN.exec(line)?.groups?.title;
-		if (title === void 0) continue;
-		if (startIndex === -1) {
-			if (title.toLowerCase() === target) startIndex = index;
-			continue;
-		}
-		return lines.slice(startIndex + 1, index).join("\n").trim();
-	}
-	if (startIndex === -1) return;
-	return lines.slice(startIndex + 1).join("\n").trim();
-};
-//#endregion
-//#region src/review-focus.ts
-const REVIEW_FOCUS_SECTION = "Review focus";
-const reviewFocusFromIssueBody = (body) => {
-	return sectionBody(body, "Review focus") || void 0;
-};
-//#endregion
-//#region src/review-contract.ts
-const REVIEW_FOOTER_INSTRUCTIONS = `Do not print a machine-readable footer in your chat response. Instead, write your findings to the typed findings file at the path given in your dispatch/task instructions (the file pr:review reads via --findings <path>). The file must be valid JSON matching review-findings-file.ts's schema (schemaVersion 1):
-{
-  "schemaVersion": 1,
-  "model": "<your model identifier>",
-  "sessionId": "<this session's id>",
-  "patchId": "<the stable patch-id from Review scope above>",
-  "reviews": [
-    {
-      "kind": "correctness" or "security" (this review's mode, matching the mode-floor instructions below),
-      "outcome": "passed" or "failed",
-      "issuesFlagged": an integer count of actionable findings (must equal findings.length),
-      "summary": one concise sentence; use "No actionable findings." only when issuesFlagged is 0,
-      "findings": [] when issuesFlagged is 0, otherwise an array of objects with title, body, and optional file, line, priority, category, blockingAfterCap, citedSpan, prescribedAction, and supersedes fields
-    }
-  ]
-}
-Use category "correctness", "safety", "coordination", or "maintainability"; set blockingAfterCap true for correctness, safety, or coordination findings. citedSpan must be the exact code text the finding is about, quoted verbatim from the diff (identity is derived from this, not from the title, so quote precisely). prescribedAction must be a concise, standalone statement of the required fix (identity is derived from this text too). If this finding is a restatement of a prior finding shown in the prior review ledger below, set supersedes to {"title": "<exact prior title>", "file": "<its file>"} instead of minting a new title for the same theme.`;
-//#endregion
-//#region src/review-prompt.ts
-const reviewScope = ({ base, changedFiles: files, headSha, patchId, profile }) => `Review scope:
-- Repository: ${profile.repository.owner}/${profile.repository.name}
-- Base ref: ${base}
-- Head SHA: ${headSha}
-- Stable patch-id: ${patchId}
-- Changed files:
-${files.length > 0 ? files.map((file) => `  - ${file}`).join("\n") : "  - None"}
-
-Required constraints:
-- Review only the PR-owned diff against ${base} and the changed files listed above.
-- Prefer git diff, git grep, and file-specific reads.
-- Do not inspect ignored generated output such as dist, build, coverage, or sourcemaps.
-- Do not rerun broad build or verification commands. If pr:verify proof already exists, treat build verification as out of scope for this review runner.
-- Do not request elevated or unsandboxed approvals.
-- When you flag a finding, report every other instance of the same class in this diff in the same response, and include a one-line coverage note.
-
-${REVIEW_FOOTER_INSTRUCTIONS}`;
-const MODE_FLOOR_FILES = {
-	correctness: "correctness.md",
-	security: "security/SKILL.md"
-};
-const reviewPromptsDir = path.join(import.meta.dirname, "review-prompts");
-const modeFloorCache = /* @__PURE__ */ new Map();
-const securityReferenceFiles = (changedFiles) => {
-	const references = /* @__PURE__ */ new Set();
-	for (const file of changedFiles) {
-		if (/^\.github\/(?:actions|workflows)\//u.test(file)) references.add("security/references/github-workflows.md");
-		if (/\.(?:[cm]?[jt]sx?)$/u.test(file)) references.add("security/references/javascript-typescript.md");
-		if (/\.py(?:i)?$/u.test(file)) references.add("security/references/python.md");
-	}
-	return [...references];
-};
-function modeFloorInstructions(kind, changedFiles = []) {
-	const referenceFiles = kind === "security" ? securityReferenceFiles(changedFiles) : [];
-	const cacheKey = `${kind}:${referenceFiles.join(",")}`;
-	const cached = modeFloorCache.get(cacheKey);
-	if (cached !== void 0) return cached;
-	const text = [MODE_FLOOR_FILES[kind], ...referenceFiles].map((file) => readFileSync(path.join(reviewPromptsDir, file), "utf-8")).map((contents) => contents.replace(/\n+$/u, "")).join("\n\n---\n\n");
-	modeFloorCache.set(cacheKey, text);
-	return text;
-}
-const issueFocusSegment = (focus) => ({
-	section: {
-		provenance: "issue-review-focus",
-		source: `issue #${focus.issueNumber} "${REVIEW_FOCUS_SECTION}" section`,
-		text: focus.text
-	},
-	text: `Per-issue review focus (source: issue #${focus.issueNumber} "${REVIEW_FOCUS_SECTION}" section, appended verbatim):
-${focus.text}`
-});
-const priorLedgerEntryLine = (entry) => {
-	const location = entry.file ? ` (${entry.file})` : "";
-	const reference = entry.reference ? ` — ${entry.reference}` : "";
-	return `- [${entry.disposition}] "${entry.title}"${location}${reference} (flagged ${entry.flagCount}x)`;
-};
-const priorLedgerSegment = (entries) => ({
-	section: {
-		provenance: "prior-review-ledger",
-		source: "persisted pr:review disposition ledger (prior cycles, #233)",
-		text: entries.map(priorLedgerEntryLine).join("\n")
-	},
-	text: `Prior review ledger (source: persisted pr:review disposition ledger from earlier cycles on this PR; already adjudicated — do not re-litigate):
-${entries.map(priorLedgerEntryLine).join("\n")}
-
-Do not re-raise any of the findings above under a new title: they are already adjudicated (waived, filed as a follow-up, or fixed in this thread). If new evidence genuinely supersedes one of them, say so explicitly and name the exact prior finding (its title and file) that it supersedes, rather than minting an unrelated title for the same underlying theme.`
-});
-const assembleReviewPrompt = ({ base, changedFiles, headSha, issueFocus, kind, patchId, priorLedgerEntries, profile }) => {
-	if (!resolveApplicableReviewModes(profile, changedFiles).includes(kind)) throw new Error(`${kind} review mode does not apply to the changed files.`);
-	const priorLedger = priorLedgerEntries ? nonOpenLadderFindings(priorLedgerEntries) : [];
-	const optionalSegments = {
-		"issue-review-focus": issueFocus ? issueFocusSegment(issueFocus) : void 0,
-		"prior-review-ledger": priorLedger.length > 0 ? priorLedgerSegment(priorLedger) : void 0
-	};
-	const segments = [
-		{ text: reviewScope({
-			base,
-			changedFiles,
-			headSha,
-			patchId,
-			profile
-		}) },
-		{ text: modeFloorInstructions(kind, changedFiles) },
-		...REVIEW_PROMPT_SECTION_PROVENANCES.flatMap((provenance) => {
-			const segment = optionalSegments[provenance];
-			return segment ? [segment] : [];
-		})
-	];
-	return {
-		prompt: segments.map((segment) => segment.text).join("\n\n"),
-		sections: segments.flatMap((segment) => segment.section ? [segment.section] : [])
-	};
-};
-//#endregion
 //#region src/index.ts
 function createProgram(options = {}) {
 	const factoryCliInvocation = options.factoryCliInvocation ? FactoryCliInvocationSchema.parse(options.factoryCliInvocation) : defaultFactoryCliInvocation(import.meta.filename);