@poetic-ai/poetic 1.42.0

package/dist/chunk-JRVNSWSQ.js

@@ -0,0 +1,2626 @@
+import {
+  PUBLIC_ROOT_SUMMARIES,
+  TIER_LABELS,
+  getCommandTier,
+  listPublicRootsByDomain,
+  listRootsByTier
+} from "./chunk-YESZJFK6.js";
+import {
+  parseProjectDependencySetupCommand,
+  runVerificationArgv,
+  runVerificationCommand
+} from "./chunk-D5RYINO7.js";
+import {
+  createCleanChildEnv
+} from "./chunk-6TZJRKNW.js";
+import {
+  abandonHostPublicationGenerationJournal,
+  attachOutstandingStatusPublicationMac,
+  beginHostPublicationGenerationJournal,
+  recoverHostPublicationGeneration,
+  syncHostPublicationGeneration
+} from "./chunk-PCAGC5MR.js";
+import {
+  QUICK_START_GUIDE_URL
+} from "./chunk-5EERLVZB.js";
+import {
+  execGit
+} from "./chunk-KNDYMVWN.js";
+import {
+  findNearestPoeticDir
+} from "./chunk-FD4ERYEG.js";
+import {
+  getProjectDataDir,
+  getStateDir
+} from "./chunk-UUH2RVKS.js";
+import {
+  POETIC_LOCAL_CI_APPROVE_ENTRYPOINT_SHA,
+  readEnv
+} from "./chunk-5DLKYTQX.js";
+
+// src/cli/utils/command-surface-help.ts
+function padCommand(name, width) {
+  return name.length >= width ? name : `${name}${" ".repeat(width - name.length)}`;
+}
+function renderOrdinaryHelp(version) {
+  const groups = listPublicRootsByDomain();
+  const lines = [
+    "Poetic - AI orchestration CLI for intelligent software development",
+    "",
+    "Usage: poetic [command] [options]",
+    "",
+    "Public commands:"
+  ];
+  for (const group of groups) {
+    lines.push("");
+    lines.push(`${group.domain}:`);
+    for (const root of group.roots) {
+      lines.push(`  ${padCommand(root, 12)} ${PUBLIC_ROOT_SUMMARIES[root]}`);
+    }
+  }
+  lines.push("");
+  lines.push("First-run journey:");
+  lines.push("  poetic init");
+  lines.push("  poetic init quickstart");
+  lines.push("  poetic provider setup --first-run");
+  lines.push("  poetic doctor");
+  lines.push(`  Guide: ${QUICK_START_GUIDE_URL}`);
+  lines.push("");
+  lines.push("Examples:");
+  lines.push("  poetic plan next");
+  lines.push('  poetic plan backlog add "Add JWT auth to the API"');
+  lines.push("  poetic run task --backlog-item <id>");
+  lines.push("  poetic run competition --backlog-item <id>");
+  lines.push('  poetic build "Ship a health endpoint"');
+  lines.push("");
+  lines.push("Run 'poetic <command> --help' for command-specific help.");
+  lines.push("Run 'poetic --help-full' for complete command reference (loads full CLI).");
+  lines.push("");
+  lines.push(`Version: ${version}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function describeCommand(program, name) {
+  if (!program) {
+    return PUBLIC_ROOT_SUMMARIES[name] ?? "";
+  }
+  const cmd = program.commands.find((c) => c.name() === name);
+  if (!cmd) {
+    return PUBLIC_ROOT_SUMMARIES[name] ?? "";
+  }
+  const raw = cmd.description() || "";
+  const firstLine = raw.split("\n")[0]?.trim() ?? "";
+  return firstLine;
+}
+function renderFullTieredHelp(program, version) {
+  const lines = [
+    "Poetic - AI orchestration CLI for intelligent software development",
+    "",
+    "Usage: poetic [command] [options]",
+    "",
+    "Complete command reference (Public / Advanced / Internal).",
+    "Hidden compatibility aliases remain callable but are omitted here.",
+    ""
+  ];
+  const sections = [
+    { tier: "default", heading: `${TIER_LABELS.default} commands` },
+    { tier: "operator", heading: `${TIER_LABELS.operator} commands` },
+    { tier: "power", heading: `${TIER_LABELS.power} commands` }
+  ];
+  for (const section of sections) {
+    const roots = listRootsByTier(section.tier);
+    if (roots.length === 0) continue;
+    lines.push(`${section.heading}:`);
+    if (section.tier === "default") {
+      for (const group of listPublicRootsByDomain()) {
+        lines.push(`  ${group.domain}`);
+        for (const root of group.roots) {
+          lines.push(`    ${padCommand(root, 12)} ${describeCommand(program, root)}`);
+        }
+      }
+    } else {
+      for (const root of roots) {
+        lines.push(`  ${padCommand(root, 18)} ${describeCommand(program, root)}`);
+      }
+    }
+    lines.push("");
+  }
+  lines.push("Global options:");
+  lines.push("  -q, --quiet          Suppress non-essential CLI diagnostics");
+  lines.push("  --no-color           Disable ANSI color output");
+  lines.push("  --no-auto-init       Skip automatic initialization check");
+  lines.push("  -h, --help           Display help");
+  lines.push("  -V, --version        Display version");
+  lines.push("");
+  lines.push("Run 'poetic <command> --help' for command-specific help.");
+  lines.push(`Version: ${version}`);
+  lines.push("");
+  for (const name of program.commands.map((c) => c.name())) {
+    if (name === "help") continue;
+    const hidden = program.commands.find((c) => c.name() === name)?._hidden;
+    if (hidden) continue;
+    if (getCommandTier(name) === void 0) {
+      lines.push(`Warning: unclassified visible command '${name}'`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/cli/utils/global-command-routing.ts
+var GLOBAL_FLAGS_WITHOUT_VALUES = /* @__PURE__ */ new Set([
+  "-q",
+  "--quiet",
+  "--no-color",
+  "-v",
+  "--verbose",
+  "--debug"
+]);
+var GLOBAL_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set([]);
+var FORWARDED_GLOBAL_FLAGS_WITHOUT_VALUES = /* @__PURE__ */ new Set(["-j", "--json"]);
+var FORWARDED_GLOBAL_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--output"]);
+var OPTIONAL_BOOLEAN_VALUE_FLAGS = /* @__PURE__ */ new Set(["--color"]);
+var BOOLEAN_FLAG_VALUES = /* @__PURE__ */ new Set(["true", "false"]);
+var CLEANUP_DRY_RUN_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "branches",
+  "external-temp",
+  "provider-temp",
+  "prune",
+  "prune-archives",
+  "remote",
+  "stale",
+  "state",
+  "variants",
+  "worktrees"
+]);
+var CLEANUP_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set(["doctor", "preview"]);
+function isInlineValueFlag(arg, flags) {
+  return Array.from(flags).some((flag) => arg.startsWith(`${flag}=`));
+}
+function resolveCliCommand(args) {
+  const forwardedGlobalArgs = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (!arg) {
+      continue;
+    }
+    if (arg === "--") {
+      return {
+        command: void 0,
+        commandIndex: -1,
+        commandArgs: [],
+        forwardedGlobalArgs
+      };
+    }
+    if (GLOBAL_FLAGS_WITHOUT_VALUES.has(arg)) {
+      continue;
+    }
+    if (OPTIONAL_BOOLEAN_VALUE_FLAGS.has(arg)) {
+      const next = args[i + 1];
+      if (next !== void 0 && BOOLEAN_FLAG_VALUES.has(next.toLowerCase())) {
+        i += 1;
+      }
+      continue;
+    }
+    if (FORWARDED_GLOBAL_FLAGS_WITHOUT_VALUES.has(arg)) {
+      forwardedGlobalArgs.push(arg);
+      continue;
+    }
+    if (GLOBAL_FLAGS_WITH_VALUES.has(arg)) {
+      i += 1;
+      continue;
+    }
+    if (FORWARDED_GLOBAL_FLAGS_WITH_VALUES.has(arg)) {
+      const next = args[i + 1];
+      if (next !== void 0) {
+        forwardedGlobalArgs.push(arg, next);
+        i += 1;
+        continue;
+      }
+      return {
+        command: arg,
+        commandIndex: i,
+        commandArgs: args.slice(i),
+        forwardedGlobalArgs
+      };
+    }
+    if (isInlineValueFlag(arg, GLOBAL_FLAGS_WITH_VALUES)) {
+      continue;
+    }
+    if (isInlineValueFlag(arg, OPTIONAL_BOOLEAN_VALUE_FLAGS)) {
+      continue;
+    }
+    if (isInlineValueFlag(arg, FORWARDED_GLOBAL_FLAGS_WITH_VALUES)) {
+      forwardedGlobalArgs.push(arg);
+      continue;
+    }
+    return {
+      command: arg,
+      commandIndex: i,
+      commandArgs: args.slice(i),
+      forwardedGlobalArgs
+    };
+  }
+  return {
+    command: void 0,
+    commandIndex: -1,
+    commandArgs: [],
+    forwardedGlobalArgs
+  };
+}
+function buildRoutedArgv(argv, route) {
+  if (route.commandIndex < 0) {
+    return [...argv];
+  }
+  return [
+    argv[0] ?? "node",
+    argv[1] ?? "poetic",
+    ...route.commandArgs,
+    ...route.forwardedGlobalArgs
+  ];
+}
+function isHelpOrVersionArg(arg) {
+  return arg === "--help" || arg === "-h" || arg === "--help-advanced" || arg.startsWith("--help-") || arg === "--version" || arg === "-V";
+}
+function isCleanupPreviewInvocation(args) {
+  const route = resolveCliCommand(args);
+  if (route.command !== "cleanup") {
+    return false;
+  }
+  const subcommand = route.commandArgs[1] && !route.commandArgs[1].startsWith("-") ? route.commandArgs[1] : void 0;
+  if (!subcommand) {
+    return false;
+  }
+  if (CLEANUP_READ_ONLY_SUBCOMMANDS.has(subcommand)) {
+    return true;
+  }
+  return CLEANUP_DRY_RUN_SUBCOMMANDS.has(subcommand) && !route.commandArgs.includes("--execute");
+}
+var READ_ONLY_PLAN_SUBCOMMANDS = /* @__PURE__ */ new Set(["inspect", "status", "next"]);
+function planNestedPositionals(commandArgs) {
+  const tokens = [];
+  for (let i = 1; i < commandArgs.length; i += 1) {
+    const arg = commandArgs[i];
+    if (!arg || arg === "--") {
+      break;
+    }
+    if (arg.startsWith("-")) {
+      continue;
+    }
+    tokens.push(arg);
+  }
+  return tokens;
+}
+function matchPlanNestedCommand(command, commandArgs, noun, verb) {
+  if (command !== "plan" && command !== "pl") {
+    return false;
+  }
+  const [nestedNoun, nestedVerb] = planNestedPositionals(commandArgs);
+  return nestedNoun === noun && nestedVerb === verb;
+}
+function isReadOnlyPlanInvocation(args) {
+  const route = resolveCliCommand(args);
+  if (route.command !== "plan" && route.command !== "pl") {
+    return false;
+  }
+  const [subcommand, nestedVerb] = planNestedPositionals(route.commandArgs);
+  if (subcommand !== void 0 && READ_ONLY_PLAN_SUBCOMMANDS.has(subcommand)) {
+    return true;
+  }
+  return subcommand === "task" && (nestedVerb === "list" || nestedVerb === "status") || subcommand === "sprint" && (nestedVerb === "status" || nestedVerb === "list") || subcommand === "backlog" && (nestedVerb === "list" || nestedVerb === "show");
+}
+var PROCESSES_VALUE_FLAGS = /* @__PURE__ */ new Set(["--kill", "--category", "--type"]);
+function processesPositionalAction(commandArgs) {
+  for (let i = 1; i < commandArgs.length; i += 1) {
+    const arg = commandArgs[i];
+    if (!arg || arg === "--") {
+      break;
+    }
+    if (arg.startsWith("--") && arg.includes("=")) {
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      if (PROCESSES_VALUE_FLAGS.has(arg)) {
+        i += 1;
+      }
+      continue;
+    }
+    return arg;
+  }
+  return void 0;
+}
+function hasProcessesMutatingFlag(commandArgs) {
+  const action = processesPositionalAction(commandArgs);
+  if (action === "cleanup" || action === "kill") {
+    return true;
+  }
+  return commandArgs.some(
+    (arg) => arg === "--cleanup" || arg === "-c" || arg === "--kill" || arg.startsWith("--kill=")
+  );
+}
+function processesInvocationArgs(args) {
+  const route = resolveCliCommand(args);
+  if (route.command !== "processes") {
+    return null;
+  }
+  return [...route.commandArgs, ...route.forwardedGlobalArgs];
+}
+function isObservationalProcessesHealthInvocation(args) {
+  const commandArgs = processesInvocationArgs(args);
+  if (!commandArgs || !commandArgs.includes("--health")) {
+    return false;
+  }
+  return !hasProcessesMutatingFlag(commandArgs);
+}
+function isObservationalProcessesJsonInvocation(args) {
+  const commandArgs = processesInvocationArgs(args);
+  if (!commandArgs) {
+    return false;
+  }
+  const hasJson = commandArgs.includes("--json") || commandArgs.includes("-j");
+  if (!hasJson) {
+    return false;
+  }
+  return !hasProcessesMutatingFlag(commandArgs);
+}
+function isDocumentedReadOnlyInvocation(args) {
+  if (isReadOnlyPlanInvocation(args)) {
+    return true;
+  }
+  if (isObservationalProcessesJsonInvocation(args)) {
+    return true;
+  }
+  const route = resolveCliCommand(args);
+  return route.command === "task" && route.commandArgs[1] === "list" || route.command === "config" && route.commandArgs[1] === "resolved";
+}
+function shouldOwnStartupCleanup(args, env = process.env) {
+  const routeArgs = args.filter((arg) => arg !== "--no-auto-init");
+  const routeEnv = { ...env };
+  delete routeEnv.POETIC_NO_AUTO_INIT;
+  return !isObservationalInvocation(routeArgs, routeEnv);
+}
+function isObservationalInvocation(args, env = process.env) {
+  if (env.POETIC_NO_AUTO_INIT === "1" || args.includes("--no-auto-init")) {
+    return true;
+  }
+  if (args.some(isHelpOrVersionArg)) {
+    return true;
+  }
+  const route = resolveCliCommand(args);
+  const command = route.command;
+  if (!command) {
+    return true;
+  }
+  if (isCleanupPreviewInvocation(args)) {
+    return true;
+  }
+  if (command === "context") {
+    return true;
+  }
+  if (isDocumentedReadOnlyInvocation(args)) {
+    return true;
+  }
+  return (command === "doctor" || command === "d") && !route.commandArgs.includes("--fix");
+}
+
+// src/cli/utils/startup-poetic-dir.ts
+import path from "path";
+function resolveStartupPoeticDir(options) {
+  const repoRoot = path.resolve(options.repoRoot);
+  const repoLocalPoeticDir = path.join(repoRoot, ".poetic");
+  if (!isObservationalInvocation(options.args, options.env)) {
+    return repoLocalPoeticDir;
+  }
+  return findNearestPoeticDir(repoRoot) ?? getProjectDataDir(repoRoot);
+}
+
+// src/core/ci/local-ci-paths.ts
+import { createHash } from "crypto";
+import path2 from "path";
+function getLocalCiStateRoot() {
+  return path2.join(getStateDir(), "local-ci");
+}
+function repoRootStateKey(repoRoot) {
+  return createHash("sha256").update(path2.resolve(repoRoot)).digest("hex").slice(0, 24);
+}
+function localCiRootMappingPath(repoRoot) {
+  return path2.join(getLocalCiStateRoot(), "roots", `${repoRootStateKey(repoRoot)}.json`);
+}
+function localCiSchedulingEnvelopePath(stateRoot, repositoryKey) {
+  return path2.join(stateRoot, repositoryKey, "scheduling-envelope.json");
+}
+
+// src/core/ci/local-ci-state.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import { access, link, mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
+import path3 from "path";
+import lockfile from "proper-lockfile";
+import { z } from "zod";
+
+// src/core/ci/local-ci-process.ts
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/core/ci/local-ci-state.ts
+var DEFAULT_LOCAL_CI_STATUS_CONTEXT = "Poetic Local CI";
+var DEFAULT_LOCAL_CI_MAX_CONCURRENT = 2;
+var LocalCiRunStatusSchema = z.enum([
+  "queued",
+  "running",
+  /**
+   * Validation passed; remote commit-status publication is not yet confirmed.
+   * Distinct from `succeeded_pending` (awaiting attestation preconditions).
+   */
+  "publication_pending",
+  "succeeded_pending",
+  "succeeded",
+  "skipped",
+  "failed",
+  "superseded"
+]);
+var LocalCiLegacyRunStatusSchema = z.enum(["succeeded_manual", "merged", "merge_blocked"]);
+var LocalCiPersistedRunStatusSchema = z.union([
+  LocalCiRunStatusSchema,
+  LocalCiLegacyRunStatusSchema
+]);
+function normalizeLocalCiRunStatus(status) {
+  switch (status) {
+    case "succeeded_manual":
+    case "merged":
+    case "merge_blocked":
+      return "succeeded";
+    default:
+      return status;
+  }
+}
+var LocalCiPublicationTargetStatusSchema = z.enum(["succeeded", "succeeded_pending"]);
+var LocalCiPersistedPublicationTargetStatusSchema = z.enum(["succeeded", "succeeded_pending", "succeeded_manual"]).transform(
+  (status) => status === "succeeded_manual" ? "succeeded" : status
+);
+var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["queued", "running"]);
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+  "publication_pending",
+  "succeeded_pending",
+  "succeeded",
+  "skipped",
+  "failed",
+  "superseded"
+]);
+function isLocalCiActiveStatus(status) {
+  return ACTIVE_STATUSES.has(status);
+}
+function isLocalCiTerminalStatus(status) {
+  return TERMINAL_STATUSES.has(status);
+}
+var LocalCiCommandResultSchema = z.object({
+  command: z.string().min(1),
+  exitCode: z.number().int(),
+  output: z.string(),
+  id: z.string().min(1).optional(),
+  phase: z.string().min(1).optional(),
+  durationMs: z.number().int().nonnegative().optional()
+});
+var LocalCiFailingTestSchema = z.object({
+  /** Test file path when the identifier carried one (vitest/pytest/go path forms). */
+  file: z.string().min(1).optional(),
+  /** Failing test identifier (suite/test path, or raw name when no file parsed). */
+  test: z.string().min(1),
+  /** Verification phase of the failing step (e.g. 'verify'). */
+  phase: z.string().min(1)
+});
+var WorkerClaimPayloadSchema = z.object({
+  pid: z.number().int().positive(),
+  token: z.string().uuid(),
+  claimedAt: z.iso.datetime(),
+  /** Deterministic fingerprint of the authorized record generation; optional for legacy. */
+  generationKey: z.string().min(1).optional()
+});
+var CROSS_PROCESS_FS_LOCK_STALE_MS = 18e4;
+var CROSS_PROCESS_FS_LOCK_UPDATE_MS = 1e4;
+var PROPER_LOCKFILE_STALE_MIN_MS = 2e3;
+var PROPER_LOCKFILE_UPDATE_MIN_MS = 1e3;
+function resolveCrossProcessFsLockPolicy() {
+  const stale = Math.max(CROSS_PROCESS_FS_LOCK_STALE_MS, PROPER_LOCKFILE_STALE_MIN_MS);
+  const configuredUpdate = CROSS_PROCESS_FS_LOCK_UPDATE_MS;
+  const update = Math.max(Math.min(configuredUpdate, stale / 2), PROPER_LOCKFILE_UPDATE_MIN_MS);
+  return { stale, update };
+}
+var CROSS_PROCESS_FS_LOCK_OPTIONS = {
+  ...resolveCrossProcessFsLockPolicy(),
+  realpath: false,
+  retries: {
+    retries: 400,
+    minTimeout: 15,
+    maxTimeout: 100,
+    factor: 1.2
+  }
+};
+async function acquireFencedFsLock(lockTarget, options = CROSS_PROCESS_FS_LOCK_OPTIONS) {
+  let compromised = false;
+  const releaseUnderlying = await lockfile.lock(lockTarget, {
+    ...options,
+    // Mark ownership lost without asynchronously throwing into unrelated code.
+    onCompromised: () => {
+      compromised = true;
+    }
+  });
+  const lockfilePath = `${path3.resolve(lockTarget)}.lock`;
+  const ownerToken = randomUUID();
+  const ownerTokenPath = path3.join(lockfilePath, "owner.token");
+  try {
+    await writeFile(ownerTokenPath, `${ownerToken}
+`, { encoding: "utf8", mode: 384 });
+  } catch (error) {
+    compromised = true;
+    try {
+      await releaseUnderlying();
+    } catch {
+    }
+    throw error;
+  }
+  const assertOwned = async () => {
+    if (compromised) {
+      throw new Error("Local CI filesystem lock ownership was compromised.");
+    }
+    let raw;
+    try {
+      raw = await readFile(ownerTokenPath, "utf8");
+    } catch {
+      compromised = true;
+      throw new Error("Local CI filesystem lock ownership was lost.");
+    }
+    if (raw.trim() !== ownerToken) {
+      compromised = true;
+      throw new Error("Local CI filesystem lock ownership was superseded.");
+    }
+  };
+  const release = async () => {
+    if (compromised) {
+      return;
+    }
+    try {
+      const raw = await readFile(ownerTokenPath, "utf8");
+      if (raw.trim() !== ownerToken) {
+        compromised = true;
+        return;
+      }
+    } catch {
+      compromised = true;
+      return;
+    }
+    await unlink(ownerTokenPath).catch(() => void 0);
+    try {
+      await releaseUnderlying();
+    } catch {
+    }
+  };
+  return {
+    fence: {
+      assertOwned,
+      isOwned: () => !compromised
+    },
+    release
+  };
+}
+var LOCAL_CI_REPOSITORY_IDENTITY_MAX = 256;
+function parseLocalCiRepositoryIdentity(value) {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > LOCAL_CI_REPOSITORY_IDENTITY_MAX) return null;
+  if (/\s/.test(trimmed) || trimmed.includes("\\") || trimmed.includes("\0")) return null;
+  if (trimmed.startsWith("/") || trimmed.endsWith("/")) return null;
+  if (trimmed.includes("//")) return null;
+  const segments = trimmed.split("/");
+  if (segments.length < 2 || segments.length > 24) return null;
+  for (const segment of segments) {
+    if (!segment || segment === "." || segment === "..") return null;
+    if (!/^[A-Za-z0-9._~+-]+$/.test(segment)) return null;
+  }
+  return trimmed;
+}
+var LocalCiRepositoryIdentitySchema = z.string().refine((value) => parseLocalCiRepositoryIdentity(value) !== null, {
+  message: "Invalid local CI repository identity"
+});
+var OutstandingRemoteStatusPublicationSchema = z.object({
+  repository: LocalCiRepositoryIdentitySchema,
+  sha: z.string().regex(/^[a-f0-9]{40}$/i),
+  context: z.string().min(1).max(100),
+  state: z.enum(["failure", "success", "pending"]),
+  description: z.string().min(1).max(140),
+  /**
+   * Local status to apply once remote publication is confirmed. Required for
+   * success/pending remote states; omitted for failure (record is already failed).
+   * Legacy `succeeded_manual` normalizes to `succeeded` at read time.
+   */
+  targetStatus: LocalCiPersistedPublicationTargetStatusSchema.optional(),
+  /**
+   * Host-issued generation bound outside candidate-writable state.
+   * Optional on disk so legacy records still parse; the publisher fails closed
+   * when this is missing or does not match the host generation file.
+   */
+  generation: z.string().uuid().optional(),
+  /**
+   * Host-keyed HMAC over repository/sha/context/state/description/targetStatus
+   * and generation. Optional on disk so legacy records still parse; the
+   * publisher fails closed when this is missing or invalid and never publishes
+   * success.
+   */
+  mac: z.string().regex(/^[a-f0-9]{64}$/i).optional()
+}).superRefine((value, ctx) => {
+  if (value.state === "failure" && value.targetStatus !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Failure status publications must not carry a success targetStatus.",
+      path: ["targetStatus"]
+    });
+  }
+  if (value.state !== "failure" && value.targetStatus === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Success-path status publications require targetStatus.",
+      path: ["targetStatus"]
+    });
+  }
+});
+var FailurePublicationLeaseSchema = z.object({
+  /** Unique lease token; required for post-publish clear/readback authorization. */
+  token: z.string().uuid(),
+  /** Process that holds the in-flight remote publication. */
+  ownerPid: z.number().int().positive(),
+  /**
+   * Fingerprint of the record generation authorized for this remote write
+   * (same identity fields as record CAS, frozen at lease acquire).
+   */
+  generationKey: z.string().min(1),
+  claimedAt: z.iso.datetime()
+});
+var LocalCiRunRecordSchema = z.object({
+  schemaVersion: z.literal(1),
+  repoRoot: z.string().min(1),
+  repository: LocalCiRepositoryIdentitySchema,
+  sha: z.string().regex(/^[a-f0-9]{40}$/i),
+  branch: z.string().min(1),
+  remote: z.string().min(1),
+  statusContext: z.string().min(1).max(100),
+  maxConcurrent: z.number().int().min(1).max(8),
+  status: LocalCiPersistedRunStatusSchema,
+  commands: z.array(LocalCiCommandResultSchema),
+  /** Immutable branch-submission order; legacy records fall back to createdAt. */
+  submittedAt: z.iso.datetime().optional(),
+  createdAt: z.iso.datetime(),
+  updatedAt: z.iso.datetime(),
+  startedAt: z.iso.datetime().optional(),
+  queueWaitMs: z.number().int().nonnegative().optional(),
+  pid: z.number().int().positive().optional(),
+  worktreePath: z.string().min(1).optional(),
+  /** Count of automatic unresolved-trusted-base recovery requeues. */
+  recoveryAttempts: z.number().int().nonnegative().optional(),
+  error: z.string().min(1).optional(),
+  trustedBaseRef: z.string().min(1).optional(),
+  trustedBaseSha: z.string().regex(/^[a-f0-9]{40}$/i).optional(),
+  /** Open PR identity observed when the exact head/base pair was admitted. */
+  pullRequestNumber: z.number().int().positive().optional(),
+  /** Pre-validation hold: an intentional entrypoint change still needs exact-SHA approval. */
+  entrypointApprovalPending: z.boolean().optional(),
+  /**
+   * Authority-selected validation profile id (`full` or trusted-base profile).
+   * Optional for legacy records; missing means pre-profile runs (treat as full).
+   * Telemetry / runtime propagation only — never changes pass/fail by itself.
+   */
+  validationProfile: z.string().min(1).max(64).optional(),
+  /**
+   * Human-readable reason for {@link validationProfile}. Optional for legacy.
+   */
+  validationProfileReason: z.string().min(1).max(500).optional(),
+  /**
+   * Immediate failed predecessor whose successful release-gate slices may be
+   * reused once. Submission assigns this only on the first same-branch
+   * successor; the worker revalidates every retry invariant before use.
+   */
+  retryOfSha: z.string().regex(/^[a-f0-9]{40}$/i).optional(),
+  /** Successor SHA that atomically claimed this failed run's one retry slot. */
+  retryClaimedBySha: z.string().regex(/^[a-f0-9]{40}$/i).optional(),
+  /** Durable provenance for an accepted or attempted release-gate slice retry. */
+  gateRetry: z.object({
+    sourceSha: z.string().regex(/^[a-f0-9]{40}$/i),
+    manifestDigest: z.string().regex(/^[a-f0-9]{64}$/),
+    rerunLabels: z.array(z.string().min(1).max(120)).min(1).max(200),
+    reusedLabels: z.array(z.string().min(1).max(120)).min(1).max(200),
+    applied: z.boolean().optional()
+  }).optional(),
+  /**
+   * Structured failing tests parsed from a failed test-phase command's captured
+   * output. Telemetry only — never consulted by pass/fail decisions.
+   */
+  failingTests: z.array(LocalCiFailingTestSchema).optional(),
+  /** True when failingTests hit the retention cap and dropped further entries. */
+  failingTestsTruncated: z.boolean().optional(),
+  /**
+   * Cross-machine verdict reuse provenance. Present only when this run skipped
+   * local compute because an identical executed tree had already passed the
+   * same suite under an equivalent authenticated toolchain.
+   *
+   * Recorded so a reused run is never mistaken for one validated on this
+   * machine: `poetic ci status` must be able to say the compute was reused and
+   * name the producing machine and verdict ref. Telemetry/provenance only —
+   * never consulted by pass/fail decisions.
+   */
+  verdictReuse: z.object({
+    /** Verdict ref that authorized the skip. */
+    ref: z.string().min(1).max(300),
+    /** Executed tree the verdict attests to (field name retained). */
+    mergeTree: z.string().min(1).max(64),
+    /** Machine that originally produced the verdict (provenance only). */
+    producer: z.string().min(1).max(32),
+    /** Completion time of the ORIGINAL validating run. */
+    originallyCompletedAt: z.string().min(1).max(64)
+  }).optional(),
+  /**
+   * Outstanding remote status publication (failure or success-path). Present
+   * until exact-context readback confirms the remote state; blocks terminal
+   * retention deletion. Success-path records use status `publication_pending`
+   * until publication is confirmed.
+   */
+  outstandingRemoteStatusPublication: OutstandingRemoteStatusPublicationSchema.optional(),
+  /**
+   * In-flight remote status publication lease (historical field name). Blocks
+   * fresh-generation establishment while ownerPid is alive; recoverable when
+   * the owner is dead.
+   */
+  failurePublicationLease: FailurePublicationLeaseSchema.optional()
+}).transform((record) => ({
+  ...record,
+  status: normalizeLocalCiRunStatus(record.status)
+}));
+function hasOutstandingRemoteStatusPublication(record) {
+  return record.outstandingRemoteStatusPublication !== void 0;
+}
+function isPublicationPending(record) {
+  return record.status === "publication_pending";
+}
+function outstandingStatusPublicationMatchesRecord(record, obligation) {
+  return obligation.repository === record.repository && obligation.sha.toLowerCase() === record.sha.toLowerCase();
+}
+function hasLiveFailurePublicationLease(record) {
+  const lease = record.failurePublicationLease;
+  if (!lease) return false;
+  return processIsAlive(lease.ownerPid);
+}
+function resolveFailurePublicationClaimedAt(currentUpdatedAt, candidateClaimedAt) {
+  const currentMs = Date.parse(currentUpdatedAt);
+  const candidateMs = Date.parse(candidateClaimedAt);
+  if (!Number.isFinite(currentMs)) {
+    return Number.isFinite(candidateMs) ? new Date(candidateMs).toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+  }
+  const floorMs = currentMs + 1;
+  if (!Number.isFinite(candidateMs)) {
+    return new Date(floorMs).toISOString();
+  }
+  return new Date(Math.max(candidateMs, floorMs)).toISOString();
+}
+function createFailurePublicationLease(current, claimedAt) {
+  const resolvedClaimedAt = resolveFailurePublicationClaimedAt(
+    current.updatedAt,
+    claimedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  );
+  const postAcquisitionGeneration = {
+    ...current,
+    updatedAt: resolvedClaimedAt,
+    // Lease attached below; field is not part of the generation fingerprint.
+    failurePublicationLease: void 0
+  };
+  const lease = FailurePublicationLeaseSchema.parse({
+    token: randomUUID(),
+    ownerPid: process.pid,
+    generationKey: localCiRecordGenerationKey(postAcquisitionGeneration),
+    claimedAt: resolvedClaimedAt
+  });
+  const leased = {
+    ...postAcquisitionGeneration,
+    failurePublicationLease: lease
+  };
+  return { lease, leased };
+}
+function matchesFailurePublicationLease(record, lease) {
+  const current = record.failurePublicationLease;
+  if (!current) return false;
+  if (current.token !== lease.token || current.generationKey !== lease.generationKey || current.ownerPid !== lease.ownerPid || current.claimedAt !== lease.claimedAt) {
+    return false;
+  }
+  return localCiRecordGenerationKey(record) === lease.generationKey;
+}
+function isSameLocalCiRecordGeneration(current, expected) {
+  return localCiRecordGenerationKey(current) === localCiRecordGenerationKey(expected);
+}
+function localCiRecordGenerationKey(record) {
+  const obligation = record.outstandingRemoteStatusPublication;
+  const material = [
+    record.repository,
+    record.sha.toLowerCase(),
+    record.status,
+    record.submittedAt ?? record.createdAt,
+    record.createdAt,
+    record.updatedAt,
+    obligation ? [
+      obligation.repository,
+      obligation.sha.toLowerCase(),
+      obligation.context,
+      obligation.state,
+      obligation.description,
+      obligation.targetStatus ?? "",
+      obligation.mac ?? ""
+    ].join("\0") : ""
+  ].join("\0");
+  return createHash2("sha256").update(material).digest("hex");
+}
+function createOutstandingStatusPublication(record, input) {
+  if (input.state === "failure" && input.targetStatus !== void 0) {
+    throw new Error("Failure status publications must not carry a success targetStatus.");
+  }
+  if (input.state !== "failure" && input.targetStatus === void 0) {
+    throw new Error("Success-path status publications require targetStatus.");
+  }
+  const parsed = OutstandingRemoteStatusPublicationSchema.parse({
+    repository: record.repository,
+    sha: record.sha.toLowerCase(),
+    context: record.statusContext,
+    state: input.state,
+    description: input.description.slice(0, 140),
+    ...input.targetStatus !== void 0 ? { targetStatus: input.targetStatus } : {}
+  });
+  return OutstandingRemoteStatusPublicationSchema.parse(
+    attachOutstandingStatusPublicationMac(parsed)
+  );
+}
+function createOutstandingFailureStatusPublication(record, description) {
+  return createOutstandingStatusPublication(record, {
+    state: "failure",
+    description
+  });
+}
+var DEFAULT_LOCAL_CI_MAX_TERMINAL_RECORDS = 50;
+function resolveMaxTerminalRecords(value) {
+  if (value !== void 0 && Number.isInteger(value) && value >= 0) {
+    return value;
+  }
+  return DEFAULT_LOCAL_CI_MAX_TERMINAL_RECORDS;
+}
+function compareRecordsNewestFirst(a, b) {
+  const byCreated = b.createdAt.localeCompare(a.createdAt);
+  if (byCreated !== 0) return byCreated;
+  return b.sha.localeCompare(a.sha);
+}
+function submissionTime(record) {
+  return record.submittedAt ?? record.createdAt;
+}
+function compareSubmissionsNewestFirst(a, b) {
+  const bySubmitted = submissionTime(b).localeCompare(submissionTime(a));
+  if (bySubmitted !== 0) return bySubmitted;
+  return b.sha.localeCompare(a.sha);
+}
+function createQueuedRun(input) {
+  const timestamp = (input.now ?? /* @__PURE__ */ new Date()).toISOString();
+  const repository = parseLocalCiRepositoryIdentity(input.repository);
+  if (!repository) {
+    throw new Error(`Invalid local CI repository identity: ${input.repository}`);
+  }
+  return LocalCiRunRecordSchema.parse({
+    schemaVersion: 1,
+    repoRoot: path3.resolve(input.repoRoot),
+    repository,
+    sha: input.sha.toLowerCase(),
+    branch: input.branch,
+    remote: input.remote,
+    statusContext: input.statusContext ?? DEFAULT_LOCAL_CI_STATUS_CONTEXT,
+    maxConcurrent: input.maxConcurrent ?? DEFAULT_LOCAL_CI_MAX_CONCURRENT,
+    retryOfSha: input.retryOfSha?.toLowerCase(),
+    status: "queued",
+    commands: [],
+    submittedAt: timestamp,
+    createdAt: timestamp,
+    updatedAt: timestamp
+  });
+}
+function repoStateKey(repository) {
+  const identity = parseLocalCiRepositoryIdentity(repository) ?? repository.trim();
+  const readable = identity.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+  const digest = createHash2("sha256").update(identity).digest("hex").slice(0, 12);
+  return `${readable || "repository"}-${digest}`;
+}
+function stateReadError(filePath, cause) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new Error(`Invalid local CI state at ${filePath}: ${detail}`, { cause });
+}
+function isNodeErrorCode(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function isPathUnderRoot(root, candidatePath) {
+  const resolvedRoot = path3.resolve(root);
+  const resolvedCandidate = path3.resolve(candidatePath);
+  const relative = path3.relative(resolvedRoot, resolvedCandidate);
+  return relative !== "" && !relative.startsWith("..") && !path3.isAbsolute(relative);
+}
+var LocalCiStateStore = class {
+  constructor(root, hooks = {}) {
+    this.root = root;
+    this.hooks = hooks;
+  }
+  root;
+  hooks;
+  repositoryDirectory(repository) {
+    return path3.join(this.root, repoStateKey(repository));
+  }
+  filePath(repository, sha) {
+    return path3.join(this.repositoryDirectory(repository), `${sha.toLowerCase()}.json`);
+  }
+  logPath(repository, sha) {
+    return path3.join(this.repositoryDirectory(repository), `${sha.toLowerCase()}.log`);
+  }
+  workerClaimPath(repository, sha) {
+    return path3.join(this.repositoryDirectory(repository), `${sha.toLowerCase()}.worker.lock`);
+  }
+  /**
+   * Synthetic proper-lockfile target for worker-claim mutations (never created).
+   * Distinct from the claim payload path and from the record JSON path.
+   */
+  workerClaimMutexTarget(repository, sha) {
+    return path3.join(
+      this.repositoryDirectory(repository),
+      `${sha.toLowerCase()}.worker.claim.mutex`
+    );
+  }
+  /**
+   * Serialize claim create/stale-reclaim, transfer, and release for one SHA.
+   *
+   * Lock order (mandatory, never reverse):
+   * 1. record mutation lock (when proving authorized generation)
+   * 2. claim mutation lock
+   *
+   * claimWorker nests claim under record. transfer/release take claim only and
+   * must never acquire the record lock while holding claim.
+   *
+   * Uses fenced proper-lockfile ownership (owner.token) so a resumed predecessor
+   * after stale reclaim cannot unlock/remove a successor's lock path.
+   */
+  async withWorkerClaimMutationLock(repository, sha, fn) {
+    const lockTarget = this.workerClaimMutexTarget(repository, sha);
+    await mkdir(path3.dirname(lockTarget), { recursive: true, mode: 448 });
+    const acquired = await acquireFencedFsLock(lockTarget, this.resolveFsLockOptions());
+    try {
+      if (this.hooks.afterClaimLockAcquired) {
+        await this.hooks.afterClaimLockAcquired();
+      }
+      await acquired.fence.assertOwned();
+      return await fn(acquired.fence);
+    } finally {
+      await acquired.release();
+    }
+  }
+  /**
+   * Run `fn` while holding the exclusive per-record mutation lock.
+   * Non-reentrant for the same lock class.
+   *
+   * Locks the stable record JSON path without creating it (`realpath: false`).
+   * May nest the claim mutation lock inside (record → claim only).
+   *
+   * Fenced with owner.token: assert ownership before state-changing writes and
+   * across await boundaries; release is a no-op if superseded.
+   */
+  async withRecordMutationLock(repository, sha, fn) {
+    const lockTarget = this.filePath(repository, sha);
+    await mkdir(path3.dirname(lockTarget), { recursive: true, mode: 448 });
+    const acquired = await acquireFencedFsLock(lockTarget, this.resolveFsLockOptions());
+    try {
+      if (this.hooks.afterRecordLockAcquired) {
+        await this.hooks.afterRecordLockAcquired();
+      }
+      await acquired.fence.assertOwned();
+      return await fn(acquired.fence);
+    } finally {
+      await acquired.release();
+    }
+  }
+  /** Shared lock options; test hooks may override floors-respecting timings. */
+  resolveFsLockOptions() {
+    const overrides = this.hooks.lockOptions;
+    if (!overrides) return CROSS_PROCESS_FS_LOCK_OPTIONS;
+    const base = resolveCrossProcessFsLockPolicy();
+    const stale = Math.max(overrides.stale ?? base.stale, PROPER_LOCKFILE_STALE_MIN_MS);
+    const configuredUpdate = overrides.update ?? base.update;
+    const update = Math.max(Math.min(configuredUpdate, stale / 2), PROPER_LOCKFILE_UPDATE_MIN_MS);
+    return {
+      ...CROSS_PROCESS_FS_LOCK_OPTIONS,
+      stale,
+      update
+    };
+  }
+  async readUnlocked(repository, sha) {
+    const filePath = this.filePath(repository, sha);
+    try {
+      const raw = await readFile(filePath, "utf8");
+      return LocalCiRunRecordSchema.parse(JSON.parse(raw));
+    } catch (error) {
+      throw stateReadError(filePath, error);
+    }
+  }
+  /**
+   * Write a run record under an already-held record mutation fence.
+   *
+   * Awaits (mkdir, temp write) may outlive a predecessor's stale window; re-assert
+   * the fence immediately before the final rename that publishes the record so a
+   * superseded holder cannot overwrite successor state.
+   */
+  async writeRecordUnlocked(record, fence) {
+    const parsed = LocalCiRunRecordSchema.parse(record);
+    const filePath = this.filePath(parsed.repository, parsed.sha);
+    await mkdir(path3.dirname(filePath), { recursive: true, mode: 448 });
+    const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(parsed, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+    const attemptId = beginHostPublicationGenerationJournal(parsed);
+    try {
+      await fence.assertOwned();
+      await rename(temporary, filePath);
+    } catch (error) {
+      abandonHostPublicationGenerationJournal(parsed, attemptId);
+      await unlink(temporary).catch(() => void 0);
+      throw error;
+    }
+    syncHostPublicationGeneration(parsed, attemptId);
+    return parsed;
+  }
+  /**
+   * Acquire exclusive worker ownership for the authorized record generation.
+   *
+   * Lock order: record mutation lock, then claim mutation lock (never reverse).
+   * Under the record lock, re-read the on-disk record and require
+   * {@link isSameLocalCiRecordGeneration} with `authorized`. If the disk
+   * generation differs, return null without touching the claim (prevents a
+   * stale launcher from superseding a fresher claim after the fact).
+   *
+   * Under the claim mutex (only after generation proof):
+   * - same-generation live claim → coalesce (return null)
+   * - different older claim generation → supersede even if child PID is live
+   * - legacy payload (no generationKey) + live pid → do not steal
+   * - legacy/dead payload → reclaimable
+   */
+  async claimWorker(authorized) {
+    const repository = authorized.repository;
+    const normalizedSha = authorized.sha.toLowerCase();
+    const generationKey = localCiRecordGenerationKey(authorized);
+    return this.withRecordMutationLock(repository, normalizedSha, async (recordFence) => {
+      await recordFence.assertOwned();
+      let onDisk;
+      try {
+        onDisk = await this.readUnlocked(repository, normalizedSha);
+      } catch {
+        return null;
+      }
+      await recordFence.assertOwned();
+      if (!isSameLocalCiRecordGeneration(onDisk, authorized)) {
+        return null;
+      }
+      return this.withWorkerClaimMutationLock(repository, normalizedSha, async (claimFence) => {
+        await claimFence.assertOwned();
+        const filePath = this.workerClaimPath(repository, normalizedSha);
+        await mkdir(path3.dirname(filePath), { recursive: true, mode: 448 });
+        await claimFence.assertOwned();
+        try {
+          const current = WorkerClaimPayloadSchema.parse(
+            JSON.parse(await readFile(filePath, "utf8"))
+          );
+          await claimFence.assertOwned();
+          const currentGeneration = current.generationKey;
+          if (currentGeneration === generationKey) {
+            if (processIsAlive(current.pid)) {
+              return null;
+            }
+            await claimFence.assertOwned();
+            await unlink(filePath).catch((unlinkError) => {
+              if (!isNodeErrorCode(unlinkError, "ENOENT")) throw unlinkError;
+            });
+          } else if (currentGeneration === void 0) {
+            if (processIsAlive(current.pid)) {
+              return null;
+            }
+            await claimFence.assertOwned();
+            await unlink(filePath).catch((unlinkError) => {
+              if (!isNodeErrorCode(unlinkError, "ENOENT")) throw unlinkError;
+            });
+          } else {
+            await claimFence.assertOwned();
+            await unlink(filePath).catch((unlinkError) => {
+              if (!isNodeErrorCode(unlinkError, "ENOENT")) throw unlinkError;
+            });
+          }
+        } catch (readError) {
+          if (isNodeErrorCode(readError, "ENOENT")) {
+          } else {
+            await claimFence.assertOwned();
+            await unlink(filePath).catch((unlinkError) => {
+              if (!isNodeErrorCode(unlinkError, "ENOENT")) throw unlinkError;
+            });
+          }
+        }
+        const claim = WorkerClaimPayloadSchema.parse({
+          pid: process.pid,
+          token: randomUUID(),
+          claimedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          generationKey
+        });
+        const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(claim)}
+`, {
+          encoding: "utf8",
+          mode: 384
+        });
+        try {
+          await claimFence.assertOwned();
+          await link(temporary, filePath);
+          await unlink(temporary).catch(() => void 0);
+          return {
+            ...claim,
+            generationKey,
+            filePath,
+            repository,
+            sha: normalizedSha
+          };
+        } catch (error) {
+          await unlink(temporary).catch(() => void 0);
+          if (isNodeErrorCode(error, "EEXIST")) return null;
+          throw error;
+        }
+      });
+    });
+  }
+  /**
+   * Transfer claim ownership to a spawned worker PID. Token + generation must
+   * still match under the claim mutex; a superseded claim cannot transfer.
+   */
+  async transferWorkerClaim(claim, pid) {
+    if (!Number.isInteger(pid) || pid <= 0) {
+      throw new Error("transferWorkerClaim requires a positive integer pid.");
+    }
+    return this.withWorkerClaimMutationLock(claim.repository, claim.sha, async (fence) => {
+      await fence.assertOwned();
+      let current;
+      try {
+        current = WorkerClaimPayloadSchema.parse(
+          JSON.parse(await readFile(claim.filePath, "utf8"))
+        );
+      } catch (error) {
+        throw new Error(
+          `Local CI worker claim missing during transfer at ${claim.filePath}: ${error instanceof Error ? error.message : String(error)}`,
+          { cause: error }
+        );
+      }
+      await fence.assertOwned();
+      if (current.token !== claim.token) {
+        throw new Error("Local CI worker claim ownership changed.");
+      }
+      if (current.generationKey !== claim.generationKey) {
+        throw new Error("Local CI worker claim generation changed.");
+      }
+      const transferred = WorkerClaimPayloadSchema.parse({
+        ...current,
+        pid,
+        generationKey: claim.generationKey
+      });
+      const temporary = `${claim.filePath}.${process.pid}.${randomUUID()}.tmp`;
+      await writeFile(temporary, `${JSON.stringify(transferred)}
+`, {
+        encoding: "utf8",
+        mode: 384
+      });
+      await fence.assertOwned();
+      try {
+        await rename(temporary, claim.filePath);
+      } catch (error) {
+        await unlink(temporary).catch(() => void 0);
+        throw error;
+      }
+      return {
+        ...transferred,
+        generationKey: claim.generationKey,
+        filePath: claim.filePath,
+        repository: claim.repository,
+        sha: claim.sha
+      };
+    });
+  }
+  /**
+   * Release a claim only when on-disk owner pid (and optional generation) still
+   * match. Serialized under the claim mutex so release cannot unlink a
+   * generation-superseded successor.
+   *
+   * When `generationKey` is supplied, require exact equality with the on-disk
+   * claim's generationKey (including refusing when the on-disk key is undefined
+   * legacy) so new cleanup cannot delete a legacy claim on PID reuse.
+   */
+  async releaseWorkerClaim(repository, sha, pid, generationKey) {
+    const normalizedSha = sha.toLowerCase();
+    await this.withWorkerClaimMutationLock(repository, normalizedSha, async (fence) => {
+      await fence.assertOwned();
+      const filePath = this.workerClaimPath(repository, normalizedSha);
+      try {
+        const current = WorkerClaimPayloadSchema.parse(
+          JSON.parse(await readFile(filePath, "utf8"))
+        );
+        await fence.assertOwned();
+        if (current.pid !== pid) return;
+        if (generationKey !== void 0 && current.generationKey !== generationKey) {
+          return;
+        }
+        await fence.assertOwned();
+        await unlink(filePath);
+      } catch (error) {
+        if (!isNodeErrorCode(error, "ENOENT")) throw error;
+      }
+    });
+  }
+  rootMappingPath(repoRoot) {
+    return path3.join(this.root, "roots", `${repoRootStateKey(repoRoot)}.json`);
+  }
+  async registerRepositoryRoot(repository, repoRoot) {
+    const filePath = this.rootMappingPath(repoRoot);
+    await mkdir(path3.dirname(filePath), { recursive: true, mode: 448 });
+    await writeFile(
+      filePath,
+      `${JSON.stringify({ repository, repoRoot: path3.resolve(repoRoot) }, null, 2)}
+`,
+      { encoding: "utf8", mode: 384 }
+    );
+  }
+  async repositoryForRoot(repoRoot) {
+    const filePath = this.rootMappingPath(repoRoot);
+    try {
+      const value = z.object({
+        repository: LocalCiRepositoryIdentitySchema,
+        repoRoot: z.string().min(1)
+      }).parse(JSON.parse(await readFile(filePath, "utf8")));
+      return path3.resolve(value.repoRoot) === path3.resolve(repoRoot) ? value.repository : null;
+    } catch (error) {
+      if (isNodeErrorCode(error, "ENOENT")) return null;
+      throw stateReadError(filePath, error);
+    }
+  }
+  async create(record) {
+    const parsed = LocalCiRunRecordSchema.parse(record);
+    const filePath = this.filePath(parsed.repository, parsed.sha);
+    return this.withRecordMutationLock(parsed.repository, parsed.sha, async (fence) => {
+      await fence.assertOwned();
+      await mkdir(path3.dirname(filePath), { recursive: true, mode: 448 });
+      const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+      await writeFile(temporary, `${JSON.stringify(parsed, null, 2)}
+`, {
+        encoding: "utf8",
+        mode: 384
+      });
+      try {
+        await fence.assertOwned();
+        await access(filePath);
+        await unlink(temporary).catch(() => void 0);
+        return {
+          created: false,
+          record: await this.readUnlocked(parsed.repository, parsed.sha),
+          filePath
+        };
+      } catch (error) {
+        if (!isNodeErrorCode(error, "ENOENT")) {
+          await unlink(temporary).catch(() => void 0);
+          throw error;
+        }
+      }
+      const attemptId = beginHostPublicationGenerationJournal(parsed);
+      try {
+        await fence.assertOwned();
+        await link(temporary, filePath);
+        await unlink(temporary).catch(() => void 0);
+      } catch (error) {
+        abandonHostPublicationGenerationJournal(parsed, attemptId);
+        await unlink(temporary).catch(() => void 0);
+        if (!isNodeErrorCode(error, "EEXIST")) throw error;
+        return {
+          created: false,
+          record: await this.readUnlocked(parsed.repository, parsed.sha),
+          filePath
+        };
+      }
+      syncHostPublicationGeneration(parsed, attemptId);
+      return { created: true, record: parsed, filePath };
+    });
+  }
+  async read(repository, sha) {
+    return this.readUnlocked(repository, sha);
+  }
+  /**
+   * Read the durable record and apply any leftover host-generation journal
+   * under the per-record mutation lock so a concurrent writer cannot activate
+   * a newer obligation that this reader then retires.
+   */
+  async readAndRecover(repository, sha) {
+    return this.withRecordMutationLock(repository, sha, async (fence) => {
+      await fence.assertOwned();
+      const current = await this.readUnlocked(repository, sha);
+      await fence.assertOwned();
+      recoverHostPublicationGeneration(current);
+      return current;
+    });
+  }
+  async save(record) {
+    const parsed = LocalCiRunRecordSchema.parse(record);
+    return this.withRecordMutationLock(parsed.repository, parsed.sha, async (fence) => {
+      await fence.assertOwned();
+      return this.writeRecordUnlocked(parsed, fence);
+    });
+  }
+  /**
+   * Conditional save (CAS): write `next` only when the on-disk record still
+   * matches `expected` generation (status, createdAt, updatedAt, obligation).
+   * Cross-process safe under the per-record mutation lock.
+   */
+  async compareAndSave(expected, next) {
+    const expectedParsed = LocalCiRunRecordSchema.parse(expected);
+    const nextParsed = LocalCiRunRecordSchema.parse(next);
+    if (expectedParsed.repository !== nextParsed.repository || expectedParsed.sha.toLowerCase() !== nextParsed.sha.toLowerCase()) {
+      throw new Error("compareAndSave requires expected and next to share repository/sha.");
+    }
+    if (this.hooks.beforeCompareAndSave) {
+      await this.hooks.beforeCompareAndSave(expectedParsed, nextParsed);
+    }
+    return this.withRecordMutationLock(
+      expectedParsed.repository,
+      expectedParsed.sha,
+      async (fence) => {
+        await fence.assertOwned();
+        return this.compareAndWriteUnlocked(expectedParsed, nextParsed, fence);
+      }
+    );
+  }
+  /**
+   * CAS write under an already-held record mutation fence.
+   *
+   * Re-asserts ownership after the generation read and immediately before the
+   * final record rename (via {@link writeRecordUnlocked}). A predecessor that
+   * suspends after its first assertion and resumes after reclaim must fail closed
+   * rather than overwrite successor state.
+   */
+  async compareAndWriteUnlocked(expected, next, fence) {
+    await fence.assertOwned();
+    let current;
+    try {
+      current = await this.readUnlocked(expected.repository, expected.sha);
+    } catch {
+      return { applied: false, record: expected };
+    }
+    await fence.assertOwned();
+    if (!isSameLocalCiRecordGeneration(current, expected)) {
+      return { applied: false, record: current };
+    }
+    if (this.hooks.afterCompareAndWriteRead) {
+      await this.hooks.afterCompareAndWriteRead(current);
+      await fence.assertOwned();
+    }
+    const saved = await this.writeRecordUnlocked(next, fence);
+    return { applied: true, record: saved };
+  }
+  /**
+   * Hold the per-record mutation lock for a multi-step exclusive section
+   * (e.g. remote failure publish + readback + clear). Nested save/compareAndSave
+   * /deleteRetentionCandidates deadlock — use only the unlocked helpers provided
+   * to `fn`.
+   *
+   * Callers that await (remote publish/readback) must re-assert fence ownership
+   * before any further state change. Fail closed if ownership is lost.
+   */
+  async withExclusiveRecordAccess(repository, sha, fn) {
+    return this.withRecordMutationLock(repository, sha, async (fence) => {
+      await fence.assertOwned();
+      return fn({
+        read: async () => {
+          await fence.assertOwned();
+          const record = await this.readUnlocked(repository, sha);
+          await fence.assertOwned();
+          return record;
+        },
+        writeIfSameGeneration: async (expected, next) => {
+          await fence.assertOwned();
+          return this.compareAndWriteUnlocked(expected, next, fence);
+        },
+        assertOwned: () => fence.assertOwned()
+      });
+    });
+  }
+  /**
+   * Persist a spawned worker PID only when the on-disk generation still matches
+   * `expected` (the generation that authorized the spawn). Used after requeue CAS
+   * so a concurrent same-SHA resubmit is never overwritten with a stale PID/save.
+   */
+  async assignWorkerPid(expected, pid) {
+    if (!Number.isInteger(pid) || pid <= 0) {
+      throw new Error("assignWorkerPid requires a positive integer pid.");
+    }
+    const next = {
+      ...expected,
+      pid,
+      status: "queued",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return this.compareAndSave(expected, next);
+  }
+  async list(repository) {
+    const directory = this.repositoryDirectory(repository);
+    let entries;
+    try {
+      const { readdir } = await import("fs/promises");
+      entries = await readdir(directory);
+    } catch (error) {
+      if (isNodeErrorCode(error, "ENOENT")) return [];
+      throw error;
+    }
+    const records = [];
+    for (const entry of entries.filter((value) => value.endsWith(".json")).sort()) {
+      const sha = entry.slice(0, -".json".length);
+      if (!/^[a-f0-9]{40}$/i.test(sha)) continue;
+      records.push(await this.read(repository, sha));
+    }
+    return records.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+  }
+  async listQueuedForBranch(repository, branch) {
+    const records = await this.list(repository);
+    return records.filter((record) => record.branch === branch && record.status === "queued").sort(compareSubmissionsNewestFirst);
+  }
+  async supersedeOlderQueued(input) {
+    const newerSha = input.newerSha.toLowerCase();
+    const updatedAt = (input.now ?? /* @__PURE__ */ new Date()).toISOString();
+    const queued = await this.listQueuedForBranch(input.repository, input.branch);
+    const newerRecord = queued.find((record) => record.sha === newerSha);
+    const superseded = [];
+    for (const candidate of queued) {
+      if (candidate.sha === newerSha) continue;
+      if (newerRecord) {
+        const ordering = compareSubmissionsNewestFirst(candidate, newerRecord);
+        if (ordering <= 0) continue;
+      }
+      let current;
+      try {
+        current = await this.read(input.repository, candidate.sha);
+      } catch {
+        continue;
+      }
+      if (current.status !== "queued") continue;
+      if (current.branch !== input.branch) continue;
+      const next = {
+        ...current,
+        status: "superseded",
+        updatedAt
+      };
+      const saved = await this.save(next);
+      superseded.push(saved);
+    }
+    return superseded;
+  }
+  /**
+   * Count consecutive terminal `failed` runs for a branch, newest submission
+   * first. A success-family terminal run (validation passed) resets the count;
+   * active runs and `superseded`/`skipped` runs carry no validation verdict and
+   * are ignored. Derived from on-disk records on every call so the count cannot
+   * drift; the terminal retention window (newest-first, obligations held)
+   * always preserves enough history for this small threshold.
+   */
+  async countConsecutiveTerminalFailures(repository, branch) {
+    const records = await this.list(repository);
+    const sameBranch = records.filter((record) => record.branch === branch).sort(compareSubmissionsNewestFirst);
+    const failedShas = [];
+    for (const record of sameBranch) {
+      if (isLocalCiActiveStatus(record.status)) continue;
+      if (record.status === "superseded" || record.status === "skipped") continue;
+      if (record.status === "failed") {
+        failedShas.push(record.sha);
+        continue;
+      }
+      break;
+    }
+    return { count: failedShas.length, failedShas };
+  }
+  async hasNewerSubmission(input) {
+    const sha = input.sha.toLowerCase();
+    const submittedAt = input.submittedAt ?? input.createdAt;
+    const records = await this.list(input.repository);
+    const sameBranch = records.filter((record) => record.branch === input.branch);
+    for (const record of sameBranch) {
+      const candidateSubmittedAt = submissionTime(record);
+      if (record.sha === sha && candidateSubmittedAt === submittedAt) continue;
+      if (candidateSubmittedAt > submittedAt) return true;
+      if (candidateSubmittedAt === submittedAt && record.sha !== sha) {
+        if (record.sha.localeCompare(sha) > 0) return true;
+      }
+    }
+    return false;
+  }
+  async toRetentionCandidate(record) {
+    const recordPath = this.filePath(record.repository, record.sha);
+    const logPath = this.logPath(record.repository, record.sha);
+    let logExists = false;
+    try {
+      await access(logPath);
+      logExists = true;
+    } catch {
+      logExists = false;
+    }
+    return { record, recordPath, logPath, logExists };
+  }
+  /**
+   * Select terminal records to preserve vs delete under a global terminal cap.
+   *
+   * Active (queued/running) records are always preserved and never count toward
+   * the terminal cap. Records with an outstanding remote-status publication or
+   * retained-worktree cleanup obligation are always preserved and never count
+   * toward the terminal cap.
+   * Among remaining terminal records, keep the newest globally up to
+   * `maxTerminalRecords` (default {@link DEFAULT_LOCAL_CI_MAX_TERMINAL_RECORDS});
+   * older free terminals are deletable regardless of historical branch count.
+   */
+  async selectTerminalRetention(repository, options) {
+    const records = await this.list(repository);
+    if (records.length === 0) {
+      return { preserve: [], deletable: [] };
+    }
+    const activeRecords = records.filter((record) => isLocalCiActiveStatus(record.status));
+    const terminalRecords = records.filter((record) => isLocalCiTerminalStatus(record.status)).sort(compareRecordsNewestFirst);
+    const obligationHeld = terminalRecords.filter(
+      (record) => hasOutstandingRemoteStatusPublication(record) || record.worktreePath !== void 0
+    );
+    const freeTerminals = terminalRecords.filter(
+      (record) => !hasOutstandingRemoteStatusPublication(record) && record.worktreePath === void 0
+    );
+    const maxTerminal = resolveMaxTerminalRecords(options?.maxTerminalRecords);
+    const preserveTerminals = [...obligationHeld, ...freeTerminals.slice(0, maxTerminal)];
+    const deletableRecords = freeTerminals.slice(maxTerminal);
+    const preserveRecords = [...activeRecords, ...preserveTerminals];
+    const [preserve, deletable] = await Promise.all([
+      Promise.all(preserveRecords.map((record) => this.toRetentionCandidate(record))),
+      Promise.all(deletableRecords.map((record) => this.toRetentionCandidate(record)))
+    ]);
+    return { preserve, deletable };
+  }
+  async deleteRetentionCandidates(candidates) {
+    const deletedRecords = [];
+    const deletedLogs = [];
+    const rootResolved = path3.resolve(this.root);
+    for (const candidate of candidates) {
+      const selected = candidate.record;
+      const recordPath = this.filePath(selected.repository, selected.sha);
+      const logPath = this.logPath(selected.repository, selected.sha);
+      if (!isPathUnderRoot(rootResolved, recordPath) || !isPathUnderRoot(rootResolved, logPath)) {
+        continue;
+      }
+      const deleted = await this.withRecordMutationLock(
+        selected.repository,
+        selected.sha,
+        async (fence) => {
+          await fence.assertOwned();
+          let current;
+          try {
+            current = await this.readUnlocked(selected.repository, selected.sha);
+          } catch {
+            return false;
+          }
+          await fence.assertOwned();
+          if (isLocalCiActiveStatus(current.status)) return false;
+          if (!isLocalCiTerminalStatus(current.status)) return false;
+          if (hasOutstandingRemoteStatusPublication(current)) return false;
+          if (current.worktreePath !== void 0) return false;
+          if (current.repository !== selected.repository || current.sha !== selected.sha || current.status !== selected.status || current.updatedAt !== selected.updatedAt || current.createdAt !== selected.createdAt) {
+            return false;
+          }
+          if (this.hooks.afterRetentionDeleteCheck) {
+            await this.hooks.afterRetentionDeleteCheck(current);
+            await fence.assertOwned();
+            try {
+              current = await this.readUnlocked(selected.repository, selected.sha);
+            } catch {
+              return false;
+            }
+            await fence.assertOwned();
+            if (isLocalCiActiveStatus(current.status)) return false;
+            if (!isLocalCiTerminalStatus(current.status)) return false;
+            if (hasOutstandingRemoteStatusPublication(current)) return false;
+            if (current.worktreePath !== void 0) return false;
+            if (current.repository !== selected.repository || current.sha !== selected.sha || current.status !== selected.status || current.updatedAt !== selected.updatedAt || current.createdAt !== selected.createdAt) {
+              return false;
+            }
+          }
+          await fence.assertOwned();
+          try {
+            await unlink(recordPath);
+            deletedRecords.push(recordPath);
+          } catch (error) {
+            if (!isNodeErrorCode(error, "ENOENT")) throw error;
+          }
+          await fence.assertOwned();
+          try {
+            await unlink(logPath);
+            deletedLogs.push(logPath);
+          } catch (error) {
+            if (!isNodeErrorCode(error, "ENOENT")) throw error;
+          }
+          return true;
+        }
+      );
+      void deleted;
+    }
+    return { deletedRecords, deletedLogs };
+  }
+};
+function selectCommandsForLocalCi(input) {
+  const candidates = input.explicit?.length ? input.explicit : input.resolved.map((entry) => entry.command);
+  const seen = /* @__PURE__ */ new Set();
+  const commands = [];
+  for (const candidate of candidates) {
+    const command = candidate.trim();
+    if (!command || seen.has(command)) continue;
+    seen.add(command);
+    commands.push(command);
+  }
+  return commands;
+}
+
+// src/core/ci/local-ci-runtime.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  link as link2,
+  mkdir as mkdir2,
+  mkdtemp,
+  readFile as readFile2,
+  rename as rename2,
+  rm,
+  stat,
+  unlink as unlink2,
+  writeFile as writeFile2
+} from "fs/promises";
+import os from "os";
+import path5 from "path";
+import { setTimeout as delay } from "timers/promises";
+import { execa } from "execa";
+import { z as z2 } from "zod";
+
+// src/core/project/validation-authority.ts
+import { readFileSync } from "fs";
+import path4 from "path";
+var AUTHORITY_EXACT_PATHS = /* @__PURE__ */ new Set([
+  ".poetic/config/poetic.config.jsonc",
+  "poetic.config.jsonc",
+  "package.json",
+  "pyproject.toml",
+  "setup.py",
+  "setup.cfg",
+  "tox.ini",
+  "pytest.ini",
+  "go.mod",
+  "cargo.toml",
+  "pom.xml",
+  "gradle.properties",
+  "package.swift",
+  "pubspec.yaml",
+  "gemfile",
+  "rakefile",
+  "composer.json",
+  "makefile",
+  "cmakelists.txt",
+  "cmakepresets.json",
+  "meson.build",
+  "deno.json",
+  "deno.jsonc",
+  "turbo.json",
+  "justfile",
+  "taskfile.yml",
+  "taskfile.yaml"
+]);
+var AUTHORITY_PREFIXES = [".githooks/", ".poetic/config/", ".poetic/guard/"];
+var POETIC_SOURCE_AUTHORITY_PREFIXES = [
+  "src/core/ci/",
+  "src/core/project/",
+  "src/core/verification/",
+  "scripts/release/"
+];
+var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh", "fish"]);
+var PYTHON_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python2", "python3", "pypy", "pypy3"]);
+var LANGUAGE_INTERPRETERS = /* @__PURE__ */ new Set([
+  "node",
+  "nodejs",
+  "deno",
+  "bun",
+  "ruby",
+  "perl",
+  "php",
+  "lua",
+  "luajit",
+  "raku",
+  "racket",
+  "julia",
+  ...PYTHON_INTERPRETERS
+]);
+var DIRECT_TEST_RUNNERS = /* @__PURE__ */ new Set([
+  "pytest",
+  "py.test",
+  "unittest",
+  "nose",
+  "nose2",
+  "vitest",
+  "jest",
+  "mocha",
+  "ava",
+  "tap",
+  "rspec",
+  "phpunit",
+  "prove",
+  "bats",
+  "cram"
+]);
+function normalize(filePath) {
+  return filePath.replace(/\\/g, "/").replace(/^\.\//, "").toLowerCase();
+}
+function normalizeRepoRelativePath(filePath) {
+  const raw = filePath.trim();
+  if (!raw || raw.includes("\0")) return null;
+  if (raw.startsWith("/") || raw.startsWith("\\")) return null;
+  if (raw.startsWith("\\\\")) return null;
+  if (/^[a-zA-Z]:/.test(raw)) return null;
+  let withForward = raw.replace(/\\/g, "/");
+  if (withForward.startsWith("/")) return null;
+  if (withForward.startsWith("//")) return null;
+  if (/^[a-zA-Z]:/.test(withForward)) return null;
+  withForward = withForward.replace(/^\.\//, "");
+  if (withForward.length === 0) return null;
+  const hadTrailingSlash = withForward.endsWith("/") && withForward.length > 1;
+  const segments = withForward.split("/");
+  for (const segment of segments) {
+    if (segment === "..") return null;
+  }
+  const cleaned = segments.filter((segment) => segment.length > 0 && segment !== ".").join("/");
+  if (!cleaned || cleaned === ".") return null;
+  const result = `${cleaned}${hadTrailingSlash ? "/" : ""}`;
+  if (result === ".." || result.startsWith("../") || result.includes("/../") || result.endsWith("/..")) {
+    return null;
+  }
+  return result;
+}
+function normalizeAuthorityPath(filePath) {
+  const normalized = normalizeRepoRelativePath(filePath);
+  return normalized === null ? null : normalized.toLowerCase();
+}
+function commandReferencedPaths(commands) {
+  const paths = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    if (opaqueCommandReason(command)) continue;
+    for (const raw of command.split(/\s+/)) {
+      const token = raw.replace(/^['"]|['"]$/g, "").replace(/[;,]$/, "");
+      if (!token || token.startsWith("-") || token.includes("://")) continue;
+      if (token.startsWith("./") || token.includes("/") || /\.[a-z0-9]{1,8}$/i.test(token)) {
+        const normalized = normalize(token);
+        if (!normalized.startsWith("../") && !path4.isAbsolute(token)) paths.add(normalized);
+      }
+    }
+  }
+  return [...paths];
+}
+function isPoeticSourceCheckout(projectRoot) {
+  if (!projectRoot) return false;
+  try {
+    const manifest = JSON.parse(readFileSync(path4.join(projectRoot, "package.json"), "utf8"));
+    return manifest.name === "@poetic-ai/poetic";
+  } catch {
+    return false;
+  }
+}
+function opaqueCommandReason(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return "empty verification command";
+  if (/['"]/.test(trimmed) || /\\/.test(trimmed)) {
+    return `opaque quoted or escaped shell tokens: ${trimmed}`;
+  }
+  if (/[\n|&;`$<>()]/.test(trimmed)) {
+    return `opaque shell composition: ${trimmed}`;
+  }
+  if (parseProjectDependencySetupCommand(trimmed)) {
+    return null;
+  }
+  const tokens = trimmed.split(/\s+/).filter(Boolean);
+  const head = (tokens[0] ?? "").toLowerCase();
+  const headBase = head.includes("/") ? head.split("/").pop() ?? head : head;
+  if (SHELL_INTERPRETERS.has(headBase)) {
+    return `opaque shell interpreter: ${trimmed}`;
+  }
+  if (PYTHON_INTERPRETERS.has(headBase)) {
+    for (let index = 1; index < tokens.length; index += 1) {
+      const token = tokens[index] ?? "";
+      if (token === "-m") {
+        return `opaque interpreter module: ${trimmed}`;
+      }
+      if (token && !token.startsWith("-")) break;
+    }
+    return `opaque interpreter: ${trimmed}`;
+  }
+  if (head === "npm" || head === "pnpm" || head === "yarn" || head === "bun") {
+    const verb = (tokens[1] ?? "").toLowerCase();
+    if (verb === "ci" || verb === "install") {
+      return `opaque package-manager install variant: ${trimmed}`;
+    }
+    if (verb === "run" || verb === "test" || verb === "start" || verb === "exec") {
+      return `opaque package-manager script: ${trimmed}`;
+    }
+    if (head === "yarn" && verb && !verb.startsWith("-")) {
+      return `opaque package-manager script: ${trimmed}`;
+    }
+    if (verb === "run-script") {
+      return `opaque package-manager script: ${trimmed}`;
+    }
+  }
+  if (head === "npx" || head === "pnpx" || head === "bunx") {
+    return `opaque package-manager launcher: ${trimmed}`;
+  }
+  if (head === "make" || head === "just" || head === "task" || head === "turbo" || head === "nx") {
+    return `opaque task-runner command: ${trimmed}`;
+  }
+  if (headBase === "go" && (tokens[1] ?? "").toLowerCase() === "test") {
+    return `opaque test runner: ${trimmed}`;
+  }
+  if (headBase === "dotnet" && (tokens[1] ?? "").toLowerCase() === "test") {
+    return `opaque test runner: ${trimmed}`;
+  }
+  if (headBase === "cargo" && (tokens[1] ?? "").toLowerCase() === "test") {
+    return `opaque test runner: ${trimmed}`;
+  }
+  if (DIRECT_TEST_RUNNERS.has(headBase)) {
+    return `opaque test runner: ${trimmed}`;
+  }
+  if (LANGUAGE_INTERPRETERS.has(headBase)) {
+    return `opaque interpreter: ${trimmed}`;
+  }
+  return `opaque unresolved command: ${trimmed}`;
+}
+function staticAuthorityPaths(poeticSourceCheckout) {
+  const paths = /* @__PURE__ */ new Set([...AUTHORITY_EXACT_PATHS, ...AUTHORITY_PREFIXES]);
+  if (poeticSourceCheckout) {
+    for (const prefix of POETIC_SOURCE_AUTHORITY_PREFIXES) paths.add(prefix);
+  }
+  return [...paths].sort();
+}
+function resolveProjectVerificationAuthority(trustedCommands, options = {}) {
+  const poeticSourceCheckout = isPoeticSourceCheckout(options.projectRoot);
+  const pathSet = new Set(staticAuthorityPaths(poeticSourceCheckout));
+  for (const referenced of commandReferencedPaths(trustedCommands)) {
+    pathSet.add(referenced);
+  }
+  const normalizedAdditional = [];
+  for (const raw of options.additionalAuthorityPaths ?? []) {
+    const normalized = normalizeAuthorityPath(raw);
+    if (!normalized) continue;
+    pathSet.add(normalized);
+    normalizedAdditional.push(normalized);
+  }
+  const reasons = [];
+  for (const command of trustedCommands) {
+    const reason = opaqueCommandReason(command);
+    if (reason) reasons.push(reason);
+  }
+  const assertedComplete = options.authorityPathsComplete === true && normalizedAdditional.length > 0;
+  return {
+    paths: [...pathSet].sort(),
+    complete: reasons.length === 0 || assertedComplete,
+    reasons
+  };
+}
+
+// src/core/ci/local-ci-change-set.ts
+var InvalidGitRawDiffPathEncodingError = class extends Error {
+  invalidPathBytes;
+  constructor(invalidPathBytes) {
+    super("Changed path is not valid UTF-8; exact Git path identity required.");
+    this.name = "InvalidGitRawDiffPathEncodingError";
+    this.invalidPathBytes = invalidPathBytes;
+  }
+};
+var RAW_META_RE = /^:([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}|0{40}) ([0-9a-f]{40}|0{40}) ([A-Z])(\d*)$/i;
+function decodeStrictUtf8Path(part) {
+  const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+  try {
+    return decoder.decode(part);
+  } catch {
+    throw new InvalidGitRawDiffPathEncodingError(Buffer.from(part));
+  }
+}
+function splitNulFields(stdout) {
+  if (stdout.length === 0) return [];
+  const parts = [];
+  let start = 0;
+  for (let i = 0; i < stdout.length; i++) {
+    if (stdout[i] === 0) {
+      parts.push(stdout.subarray(start, i));
+      start = i + 1;
+    }
+  }
+  if (parts.length > 0 && parts[parts.length - 1].length === 0) {
+    parts.pop();
+  }
+  return parts;
+}
+function parseGitRawDiffChangeSet(stdout) {
+  if (stdout.length === 0) {
+    return { complete: true, entries: [] };
+  }
+  if (stdout[stdout.length - 1] !== 0) {
+    return {
+      complete: false,
+      reason: "Malformed raw diff: nonempty -z output lacks final NUL terminator",
+      entries: []
+    };
+  }
+  let parts;
+  try {
+    parts = splitNulFields(stdout);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { complete: false, reason, entries: [] };
+  }
+  const entries = [];
+  let index = 0;
+  while (index < parts.length) {
+    const metaBuf = parts[index];
+    if (!metaBuf || metaBuf.length === 0) {
+      return {
+        complete: false,
+        reason: "Malformed raw diff: empty metadata field",
+        entries
+      };
+    }
+    let meta;
+    try {
+      meta = decodeStrictUtf8Path(metaBuf);
+    } catch (error) {
+      if (error instanceof InvalidGitRawDiffPathEncodingError) {
+        return {
+          complete: false,
+          reason: "Raw diff metadata is not valid UTF-8",
+          entries
+        };
+      }
+      throw error;
+    }
+    const match = RAW_META_RE.exec(meta);
+    if (!match) {
+      return {
+        complete: false,
+        reason: `Malformed raw diff metadata: ${meta.slice(0, 120)}`,
+        entries
+      };
+    }
+    const oldMode = match[1].toLowerCase();
+    const newMode = match[2].toLowerCase();
+    const status = match[5].toUpperCase();
+    if (match[6] && match[6].length > 0) {
+      return {
+        complete: false,
+        reason: `Raw diff status carries rename/copy score under --no-renames: ${status}${match[6]}`,
+        entries
+      };
+    }
+    index += 1;
+    const pathBuf = parts[index];
+    if (!pathBuf || pathBuf.length === 0) {
+      return {
+        complete: false,
+        reason: "Malformed raw diff: missing path after metadata",
+        entries
+      };
+    }
+    let pathText;
+    try {
+      pathText = decodeStrictUtf8Path(pathBuf);
+    } catch (error) {
+      if (error instanceof InvalidGitRawDiffPathEncodingError) {
+        return {
+          complete: false,
+          reason: "Changed path is not valid UTF-8; exact Git path identity required.",
+          entries
+        };
+      }
+      throw error;
+    }
+    entries.push({
+      path: pathText,
+      status,
+      oldMode,
+      newMode
+    });
+    index += 1;
+  }
+  return { complete: true, entries };
+}
+function changeSetPathsMatchNameOnly(changedFiles, changeSet) {
+  if (!changeSet.complete) return false;
+  if (changedFiles.length !== changeSet.entries.length) return false;
+  const nameOnly = [...changedFiles].sort();
+  const raw = changeSet.entries.map((entry) => entry.path).sort();
+  for (let i = 0; i < nameOnly.length; i += 1) {
+    if (nameOnly[i] !== raw[i]) return false;
+  }
+  return true;
+}
+
+// src/core/ci/local-ci-profile.ts
+var LOCAL_CI_FULL_VALIDATION_PROFILE = "full";
+var LOCAL_CI_VALIDATION_PROFILE_REASON_MAX = 500;
+var LOCAL_CI_MAX_VALIDATION_PROFILES = 8;
+var LOCAL_CI_MAX_PROFILE_INCLUDE_PATHS = 32;
+var LOCAL_CI_MAX_PROFILE_EXTENSIONS = 16;
+var PROFILE_ID_RE = /^[a-z][a-z0-9_-]{0,31}$/;
+var PROFILE_EXTENSION_RE = /^\.[A-Za-z0-9_+.-]{1,32}$/;
+function boundLocalCiValidationProfileReason(reason) {
+  if (reason.length <= LOCAL_CI_VALIDATION_PROFILE_REASON_MAX) return reason;
+  return reason.slice(0, LOCAL_CI_VALIDATION_PROFILE_REASON_MAX);
+}
+function full(reason) {
+  return {
+    validationProfile: LOCAL_CI_FULL_VALIDATION_PROFILE,
+    reason: boundLocalCiValidationProfileReason(reason)
+  };
+}
+function resolveLocalCiValidationProfiles(raw) {
+  if (!Array.isArray(raw)) return [];
+  const profiles = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const entry of raw) {
+    if (profiles.length >= LOCAL_CI_MAX_VALIDATION_PROFILES) break;
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry;
+    if (typeof record.id !== "string") continue;
+    const id = record.id.trim();
+    if (!PROFILE_ID_RE.test(id) || id === LOCAL_CI_FULL_VALIDATION_PROFILE) continue;
+    if (seenIds.has(id)) {
+      return [];
+    }
+    const include = normalizeIncludeList(record.include);
+    if (include.length === 0) continue;
+    const extensions = normalizeExtensionList(record.extensions);
+    if (extensions.length === 0) continue;
+    seenIds.add(id);
+    profiles.push({ id, include, extensions });
+  }
+  if (profilesHaveOverlappingIncludes(profiles)) {
+    return [];
+  }
+  return profiles;
+}
+function normalizeIncludeList(value) {
+  if (!Array.isArray(value)) return [];
+  const paths = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (typeof entry !== "string") continue;
+    if (paths.length >= LOCAL_CI_MAX_PROFILE_INCLUDE_PATHS) break;
+    const normalized = normalizeRepoRelativePath(entry);
+    if (!normalized || seen.has(normalized)) continue;
+    seen.add(normalized);
+    paths.push(normalized);
+  }
+  return paths;
+}
+function normalizeExtensionList(value) {
+  if (!Array.isArray(value)) return [];
+  const extensions = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (typeof entry !== "string") continue;
+    if (extensions.length >= LOCAL_CI_MAX_PROFILE_EXTENSIONS) break;
+    const trimmed = entry.trim();
+    if (!PROFILE_EXTENSION_RE.test(trimmed) || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    extensions.push(trimmed);
+  }
+  return extensions;
+}
+function profilesHaveOverlappingIncludes(profiles) {
+  for (let i = 0; i < profiles.length; i += 1) {
+    for (let j = i + 1; j < profiles.length; j += 1) {
+      const a = profiles[i];
+      const b = profiles[j];
+      for (const includeA of a.include) {
+        for (const includeB of b.include) {
+          if (includesOverlap(includeA, includeB)) return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function includesOverlap(a, b) {
+  if (a === b) return true;
+  const aPrefix = a.endsWith("/");
+  const bPrefix = b.endsWith("/");
+  if (aPrefix && bPrefix) {
+    return a.startsWith(b) || b.startsWith(a);
+  }
+  if (aPrefix) {
+    return b === a.slice(0, -1) || b.startsWith(a);
+  }
+  if (bPrefix) {
+    return a === b.slice(0, -1) || a.startsWith(b);
+  }
+  return false;
+}
+function pathMatchesInclude(filePath, include) {
+  if (include.endsWith("/")) {
+    return filePath === include.slice(0, -1) || filePath.startsWith(include);
+  }
+  return filePath === include;
+}
+function fileExtension(filePath) {
+  const base = filePath.includes("/") ? filePath.slice(filePath.lastIndexOf("/") + 1) : filePath;
+  const dot = base.lastIndexOf(".");
+  if (dot <= 0 || dot === base.length - 1) return null;
+  return base.slice(dot);
+}
+function gitPathIsSafeRepoRelativeLiteral(filePath) {
+  const safeForm = normalizeRepoRelativePath(filePath);
+  return safeForm !== null && safeForm === filePath;
+}
+function entryMatchesProfile(entry, profile) {
+  if (!gitPathIsSafeRepoRelativeLiteral(entry.path)) return false;
+  const extension = fileExtension(entry.path);
+  if (!extension || !profile.extensions.includes(extension)) return false;
+  return profile.include.some((include) => pathMatchesInclude(entry.path, include));
+}
+function changePathIntersectsAuthority(filePath, authorityPaths) {
+  const folded = normalizeAuthorityPath(filePath);
+  if (!folded) return true;
+  for (const auth of authorityPaths) {
+    if (auth.endsWith("/")) {
+      if (folded === auth.slice(0, -1) || folded.startsWith(auth)) return true;
+    } else if (folded === auth || folded.startsWith(`${auth}/`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function entryIsRegularAddOrModify(entry) {
+  if (entry.status !== "A" && entry.status !== "M") return false;
+  if (entry.newMode !== "100644") return false;
+  if (entry.status === "A") {
+    return entry.oldMode === "000000";
+  }
+  return entry.oldMode === "100644";
+}
+function selectLocalCiValidationProfile(input) {
+  if (!input.trusted) {
+    return full("Authority is not trusted; full validation required.");
+  }
+  if (!input.verificationAuthority.complete) {
+    return full("Verification authority is incomplete; full validation required.");
+  }
+  if (input.changedFiles.length === 0) {
+    return full("Change set is empty; full validation required.");
+  }
+  if (!input.changeSet.complete) {
+    return full(
+      input.changeSet.reason || "Raw change-set metadata is incomplete; full validation required."
+    );
+  }
+  if (!changeSetPathsMatchNameOnly(input.changedFiles, input.changeSet)) {
+    return full("Name-only and raw change-set paths disagree; full validation required.");
+  }
+  if (input.profiles.length === 0) {
+    return full("No trusted-base validation profiles configured; full validation required.");
+  }
+  for (const entry of input.changeSet.entries) {
+    if (!entryIsRegularAddOrModify(entry)) {
+      return full(
+        `Change ${entry.status} ${entry.oldMode}->${entry.newMode} on ${entry.path} is not a regular A/M 100644 edit; full validation required.`
+      );
+    }
+    if (changePathIntersectsAuthority(entry.path, input.verificationAuthority.paths)) {
+      return full(
+        `Change path intersects validation authority (${entry.path}); full validation required.`
+      );
+    }
+  }
+  let selectedId;
+  for (const entry of input.changeSet.entries) {
+    const matches = input.profiles.filter((profile) => entryMatchesProfile(entry, profile));
+    if (matches.length === 0) {
+      return full(`No validation profile matches ${entry.path}; full validation required.`);
+    }
+    if (matches.length > 1) {
+      return full(
+        `Ambiguous validation profiles for ${entry.path}: ${matches.map((p) => p.id).join(", ")}; full validation required.`
+      );
+    }
+    const id = matches[0].id;
+    if (selectedId === void 0) {
+      selectedId = id;
+    } else if (selectedId !== id) {
+      return full(`Mixed validation profiles (${selectedId} vs ${id}); full validation required.`);
+    }
+  }
+  if (!selectedId) {
+    return full("Unable to select a validation profile; full validation required.");
+  }
+  return {
+    validationProfile: selectedId,
+    reason: boundLocalCiValidationProfileReason(
+      `All changes match trusted-base validation profile '${selectedId}'.`
+    )
+  };
+}
+function resolveLocalCiValidationProfileEnv(value) {
+  if (typeof value !== "string") return LOCAL_CI_FULL_VALIDATION_PROFILE;
+  const trimmed = value.trim();
+  if (!trimmed) return LOCAL_CI_FULL_VALIDATION_PROFILE;
+  if (trimmed === LOCAL_CI_FULL_VALIDATION_PROFILE) return LOCAL_CI_FULL_VALIDATION_PROFILE;
+  if (!PROFILE_ID_RE.test(trimmed)) return LOCAL_CI_FULL_VALIDATION_PROFILE;
+  return trimmed;
+}
+
+// src/core/ci/local-ci-runtime.ts
+var SlotRecordSchema = z2.object({
+  pid: z2.number().int().positive(),
+  token: z2.string().uuid(),
+  acquiredAt: z2.iso.datetime()
+});
+var RepositoryIdSchema = z2.string().refine((value) => parseLocalCiRepositoryIdentity(value) !== null, {
+  message: "Invalid local CI repository identity"
+});
+var Sha40Schema = z2.string().regex(/^[a-f0-9]{40}$/i);
+var MaxConcurrentSchema = z2.number().int().min(1).max(8);
+var TARGET_VALIDATION_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "COLORTERM",
+  "SHELL",
+  "XDG_CACHE_HOME",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_STATE_HOME"
+];
+var SchedulingEnvelopeSchema = z2.object({
+  schemaVersion: z2.literal(1),
+  maxConcurrent: MaxConcurrentSchema,
+  updatedFromBaseSha: Sha40Schema,
+  updatedAt: z2.iso.datetime()
+});
+var UNPARSABLE_SLOT_LOCK_STALE_MS = 10 * 60 * 1e3;
+var DEFAULT_ENVELOPE_BASE_SHA = "0".repeat(40);
+function createLocalCiDetachedChildEnv(overrides = {}) {
+  const env = createCleanChildEnv(overrides);
+  const ghToken = process.env.GH_TOKEN;
+  const githubToken = process.env.GITHUB_TOKEN;
+  if (typeof ghToken === "string" && ghToken.length > 0) {
+    env.GH_TOKEN = ghToken;
+  }
+  if (typeof githubToken === "string" && githubToken.length > 0) {
+    env.GITHUB_TOKEN = githubToken;
+  }
+  const approvedEntrypointSha = readEnv(POETIC_LOCAL_CI_APPROVE_ENTRYPOINT_SHA).value;
+  delete env.POETIC_LOCAL_CI_APPROVE_ENTRYPOINT_SHA;
+  if (/^[a-f0-9]{40}$/i.test(approvedEntrypointSha ?? "")) {
+    env.POETIC_LOCAL_CI_APPROVE_ENTRYPOINT_SHA = approvedEntrypointSha;
+  }
+  return env;
+}
+function createLocalCiTargetValidationEnv(source = process.env, options = {}) {
+  const env = {};
+  for (const key of TARGET_VALIDATION_ENV_KEYS) {
+    const value = source[key];
+    if (typeof value === "string" && value.length > 0) {
+      env[key] = value;
+    }
+  }
+  env.CI = "1";
+  env.npm_config_script_shell = "/bin/sh";
+  const nodeExtraCaCerts = source.NODE_EXTRA_CA_CERTS;
+  if (typeof nodeExtraCaCerts === "string" && nodeExtraCaCerts.length > 0) {
+    env.NODE_EXTRA_CA_CERTS = nodeExtraCaCerts;
+  }
+  if (options.trustedBaseSha !== void 0) {
+    env.POETIC_RELEASE_GATE_TRUSTED_BASE = Sha40Schema.parse(options.trustedBaseSha).toLowerCase();
+  }
+  env.POETIC_LOCAL_CI_PROFILE = resolveLocalCiValidationProfileEnv(options.validationProfile);
+  if (options.gateRetry !== void 0) {
+    env.POETIC_GATE_RETRY_MANIFEST_DIGEST = options.gateRetry.manifestDigest;
+    env.POETIC_GATE_RETRY_LABELS = JSON.stringify(options.gateRetry.rerunLabels);
+    env.POETIC_GATE_REUSED_LABELS = JSON.stringify(options.gateRetry.reusedLabels);
+  }
+  return env;
+}
+function isNodeErrorCode2(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function normalizeMaxConcurrent(value) {
+  return MaxConcurrentSchema.parse(value);
+}
+function defaultSchedulingEnvelope(now) {
+  return {
+    schemaVersion: 1,
+    maxConcurrent: DEFAULT_LOCAL_CI_MAX_CONCURRENT,
+    updatedFromBaseSha: DEFAULT_ENVELOPE_BASE_SHA,
+    updatedAt: (now ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function readSchedulingEnvelope(input) {
+  const stateRoot = input.stateRoot ?? getLocalCiStateRoot();
+  const filePath = localCiSchedulingEnvelopePath(stateRoot, repoStateKey(input.repository));
+  try {
+    const raw = await readFile2(filePath, "utf8");
+    return SchedulingEnvelopeSchema.parse(JSON.parse(raw));
+  } catch {
+    return defaultSchedulingEnvelope();
+  }
+}
+async function writeSchedulingEnvelope(input) {
+  const repository = parseLocalCiRepositoryIdentity(RepositoryIdSchema.parse(input.repository));
+  if (!repository) {
+    throw new Error(`Invalid local CI repository identity: ${input.repository}`);
+  }
+  const envelope = SchedulingEnvelopeSchema.parse({
+    schemaVersion: 1,
+    maxConcurrent: input.maxConcurrent,
+    updatedFromBaseSha: input.updatedFromBaseSha.toLowerCase(),
+    updatedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString()
+  });
+  const stateRoot = input.stateRoot ?? getLocalCiStateRoot();
+  const filePath = localCiSchedulingEnvelopePath(stateRoot, repoStateKey(repository));
+  await mkdir2(path5.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    await writeFile2(temporary, `${JSON.stringify(envelope, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+    await rename2(temporary, filePath);
+  } catch (error) {
+    await unlink2(temporary).catch(() => void 0);
+    throw error;
+  }
+  return envelope;
+}
+async function resolveEffectiveMaxConcurrent(input) {
+  if (input.maxConcurrent !== void 0) {
+    return normalizeMaxConcurrent(input.maxConcurrent);
+  }
+  const envelope = await readSchedulingEnvelope({
+    repository: input.repository,
+    stateRoot: input.stateRoot
+  });
+  return envelope.maxConcurrent;
+}
+async function acquireLocalCiSlot(input) {
+  const stateRoot = input.stateRoot ?? getLocalCiStateRoot();
+  const effectiveCap = await resolveEffectiveMaxConcurrent({
+    repository: input.repository,
+    stateRoot,
+    maxConcurrent: input.maxConcurrent
+  });
+  const slotsDirectory = path5.join(stateRoot, repoStateKey(input.repository), "slots");
+  await mkdir2(slotsDirectory, { recursive: true, mode: 448 });
+  const token = randomUUID2();
+  const deadline = Date.now() + (input.timeoutMs ?? 6 * 60 * 60 * 1e3);
+  while (Date.now() < deadline) {
+    for (let slot = 0; slot < effectiveCap; slot += 1) {
+      const filePath = path5.join(slotsDirectory, `${slot}.lock`);
+      const payload = `${JSON.stringify({
+        pid: process.pid,
+        token,
+        acquiredAt: (/* @__PURE__ */ new Date()).toISOString()
+      })}
+`;
+      const temporary = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
+      try {
+        try {
+          await writeFile2(temporary, payload, { encoding: "utf8", mode: 384 });
+          await link2(temporary, filePath);
+        } catch (error) {
+          await unlink2(temporary).catch(() => void 0);
+          throw error;
+        }
+        await unlink2(temporary).catch(() => void 0);
+        return {
+          slot,
+          maxConcurrent: effectiveCap,
+          async release() {
+            try {
+              const current = SlotRecordSchema.parse(JSON.parse(await readFile2(filePath, "utf8")));
+              if (current.token === token && current.pid === process.pid) await unlink2(filePath);
+            } catch (error) {
+              if (!isNodeErrorCode2(error, "ENOENT")) {
+                throw error;
+              }
+            }
+          }
+        };
+      } catch (error) {
+        if (!isNodeErrorCode2(error, "EEXIST")) {
+          throw error;
+        }
+        try {
+          const current = SlotRecordSchema.parse(JSON.parse(await readFile2(filePath, "utf8")));
+          if (!processIsAlive(current.pid)) await unlink2(filePath);
+        } catch (readError) {
+          if (isNodeErrorCode2(readError, "ENOENT")) {
+            continue;
+          }
+          try {
+            const metadata = await stat(filePath);
+            if (Date.now() - metadata.mtimeMs > UNPARSABLE_SLOT_LOCK_STALE_MS) {
+              await unlink2(filePath).catch((unlinkError) => {
+                if (!isNodeErrorCode2(unlinkError, "ENOENT")) throw unlinkError;
+              });
+            }
+          } catch (statError) {
+            if (!isNodeErrorCode2(statError, "ENOENT")) throw statError;
+          }
+        }
+      }
+    }
+    await delay(input.pollMs ?? 2e3);
+  }
+  throw new Error("Timed out waiting for a local CI execution slot.");
+}
+async function createLocalCiWorktree(repoRoot, sha) {
+  const parent = await mkdtemp(path5.join(os.tmpdir(), "poetic-local-ci-"));
+  const worktreePath = path5.join(parent, "worktree");
+  const result = await execGit(["worktree", "add", "--detach", worktreePath, sha], {
+    cwd: repoRoot
+  });
+  if (result.exitCode !== 0) {
+    await rm(parent, { recursive: true, force: true });
+    throw new Error(`Unable to create local CI worktree: ${result.stderr || result.stdout}`);
+  }
+  return worktreePath;
+}
+async function removeLocalCiWorktree(repoRoot, worktreePath) {
+  const resolved = path5.resolve(worktreePath);
+  const temporaryRoot = path5.resolve(os.tmpdir());
+  if (!resolved.startsWith(`${temporaryRoot}${path5.sep}poetic-local-ci-`)) {
+    throw new Error(`Refusing to remove non-local-CI worktree path: ${resolved}`);
+  }
+  const removal = await execGit(["worktree", "remove", "--force", resolved], { cwd: repoRoot });
+  await execGit(["worktree", "prune"], { cwd: repoRoot });
+  await rm(path5.dirname(resolved), { recursive: true, force: true });
+  if (removal.exitCode !== 0 && !/not a working tree|is not a working tree/i.test(removal.stderr)) {
+    throw new Error(`Unable to unregister local CI worktree: ${removal.stderr || removal.stdout}`);
+  }
+}
+async function pruneLocalCiWorktrees(repoRoot) {
+  const result = await execGit(["worktree", "prune"], { cwd: repoRoot });
+  if (result.exitCode !== 0) {
+    throw new Error(`Unable to prune local CI worktrees: ${result.stderr || result.stdout}`);
+  }
+}
+var DEFAULT_LOCAL_CI_COMMAND_TIMEOUT_MS = 60 * 60 * 1e3;
+async function runLocalCiVerificationCommand(command, cwd, options) {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_LOCAL_CI_COMMAND_TIMEOUT_MS;
+  const env = createLocalCiTargetValidationEnv(process.env, {
+    trustedBaseSha: options?.trustedBaseSha,
+    validationProfile: options?.validationProfile ?? LOCAL_CI_FULL_VALIDATION_PROFILE,
+    gateRetry: options?.gateRetry
+  });
+  const setup = parseProjectDependencySetupCommand(command);
+  const result = setup ? await runVerificationArgv(setup.file, setup.args, {
+    cwd,
+    timeoutMs,
+    env,
+    // Argv already constrained by parseProjectDependencySetupCommand;
+    // verify safety rejects install verbs, so mark structured setup explicitly.
+    dependencySetup: true
+  }) : await runVerificationCommand(command, {
+    cwd,
+    timeoutMs,
+    env
+  });
+  const output = String(result.all ?? [result.stdout, result.stderr].filter(Boolean).join("\n"));
+  return { exitCode: result.exitCode ?? 1, output: output.slice(-1e5) };
+}
+async function resolveCanonicalMainRepoRoot(cwd) {
+  const result = await execGit(["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+    cwd
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Unable to resolve canonical repository root from ${cwd}: ${result.stderr || result.stdout}`
+    );
+  }
+  const commonDir = result.stdout.trim();
+  if (!commonDir) {
+    throw new Error(`git rev-parse returned an empty --git-common-dir for ${cwd}`);
+  }
+  const candidate = path5.dirname(commonDir);
+  const validation = await execGit(["rev-parse", "--path-format=absolute", "--show-toplevel"], {
+    cwd: candidate
+  });
+  if (validation.exitCode !== 0) {
+    throw new Error(
+      `Resolved candidate repository root ${candidate} (from ${cwd}) is not a valid working tree: ${validation.stderr || validation.stdout}`
+    );
+  }
+  const topLevel = validation.stdout.trim();
+  if (!topLevel || path5.resolve(topLevel) !== path5.resolve(candidate)) {
+    throw new Error(
+      `Resolved candidate repository root ${candidate} (from ${cwd}) does not match its own working-tree root ${topLevel}; unsupported git topology (e.g. separate-git-dir or submodule).`
+    );
+  }
+  return candidate;
+}
+function keepMacAwakeForCurrentProcess() {
+  if (process.platform !== "darwin") return;
+  const child = execa("caffeinate", ["-i", "-w", String(process.pid)], {
+    reject: false,
+    stdio: "ignore"
+  });
+  child.unref();
+  void child.catch(() => void 0);
+}
+
+export {
+  getLocalCiStateRoot,
+  localCiRootMappingPath,
+  processIsAlive,
+  normalizeAuthorityPath,
+  resolveProjectVerificationAuthority,
+  parseGitRawDiffChangeSet,
+  LOCAL_CI_FULL_VALIDATION_PROFILE,
+  boundLocalCiValidationProfileReason,
+  resolveLocalCiValidationProfiles,
+  selectLocalCiValidationProfile,
+  DEFAULT_LOCAL_CI_STATUS_CONTEXT,
+  DEFAULT_LOCAL_CI_MAX_CONCURRENT,
+  hasOutstandingRemoteStatusPublication,
+  isPublicationPending,
+  outstandingStatusPublicationMatchesRecord,
+  hasLiveFailurePublicationLease,
+  createFailurePublicationLease,
+  matchesFailurePublicationLease,
+  createOutstandingStatusPublication,
+  createOutstandingFailureStatusPublication,
+  DEFAULT_LOCAL_CI_MAX_TERMINAL_RECORDS,
+  createQueuedRun,
+  LocalCiStateStore,
+  selectCommandsForLocalCi,
+  createLocalCiDetachedChildEnv,
+  writeSchedulingEnvelope,
+  acquireLocalCiSlot,
+  createLocalCiWorktree,
+  removeLocalCiWorktree,
+  pruneLocalCiWorktrees,
+  runLocalCiVerificationCommand,
+  resolveCanonicalMainRepoRoot,
+  keepMacAwakeForCurrentProcess,
+  renderOrdinaryHelp,
+  renderFullTieredHelp,
+  resolveCliCommand,
+  buildRoutedArgv,
+  matchPlanNestedCommand,
+  isObservationalProcessesHealthInvocation,
+  isObservationalProcessesJsonInvocation,
+  shouldOwnStartupCleanup,
+  isObservationalInvocation,
+  resolveStartupPoeticDir
+};
+//# sourceMappingURL=chunk-JRVNSWSQ.js.map