@pourkit/cli 0.0.0-next-20260604153710 → 0.0.0-next-20260604225844

package/dist/cli.js

@@ -430,7 +430,9 @@ var init_github_client = __esm({
 });
 
 // execution/execution-provider.ts
+import { mkdtempSync } from "fs";
 import { writeFile } from "fs/promises";
+import { tmpdir } from "os";
 import { dirname as dirname3, join as join7 } from "path";
 async function writeExecutionArtifacts(worktreePath, artifacts) {
   for (const artifact of artifacts) {
@@ -898,13 +900,19 @@ var SerenaConfigSchema = z.object({
   dataDir: z.string().default(".pourkit/serena/"),
   autoStart: z.boolean().default(false)
 }).strict();
+var SecurityConfigSchema = z.object({
+  secretLikeContentDetection: z.object({
+    enabled: z.boolean().default(true)
+  }).strict().default({})
+}).strict();
 var PourkitConfigSchema = z.object({
   targets: z.array(TargetSchema).min(1),
   labels: LabelsSchema,
   sandbox: SandboxSchema,
   checks: ChecksSchema,
   cleanup: CleanupConfigSchema.optional(),
-  serena: SerenaConfigSchema.default({})
+  serena: SerenaConfigSchema.default({}),
+  security: SecurityConfigSchema.default({})
 }).strict();
 var removedFieldReplacements = {
   "config.implementor": "targets[].strategy.implement.builder",
@@ -1151,6 +1159,7 @@ function parseConfig(raw) {
       issueListLimit: data.checks.issueListLimit ?? 50
     },
     serena,
+    security: data.security,
     cleanup: {
       enabled: data.cleanup?.enabled ?? true,
       worktreeRetentionDays: data.cleanup?.worktreeRetentionDays ?? 14,
@@ -1169,13 +1178,13 @@ function getVerificationCommands(target) {
   return target.strategy.verify?.commands ?? [];
 }
 async function loadRepoConfig(repoRoot2, configFileName = "pourkit.config.ts") {
-  const { existsSync: existsSync13 } = await import("fs");
+  const { existsSync: existsSync14 } = await import("fs");
   const { mkdir: mkdir5, writeFile: writeFile3, rm } = await import("fs/promises");
   const { join: pjoin, basename } = await import("path");
   const { pathToFileURL: pathToFileURL2 } = await import("url");
   const { build } = await import("esbuild");
   const configPath = pjoin(repoRoot2, configFileName);
-  if (!existsSync13(configPath)) {
+  if (!existsSync14(configPath)) {
     throw new Error(
       `No config file found at ${configPath}. Create a ${configFileName} that exports a default PourkitConfig.`
     );
@@ -5013,6 +5022,7 @@ async function completeIssueRun(options) {
         baseRef: `origin/${effectiveBaseBranch}`,
         title: prTitle,
         body: finalBody,
+        secretLikeContentDetectionEnabled: isSecretLikeContentDetectionEnabled(config),
         logger
       });
       if (executionResult.worktreePath) {
@@ -5053,6 +5063,7 @@ async function completeIssueRun(options) {
           baseRef: `origin/${effectiveBaseBranch}`,
           title: prTitle,
           body: finalBody,
+          secretLikeContentDetectionEnabled: isSecretLikeContentDetectionEnabled(config),
           logger
         });
         await execCapture("git", ["push", "-u", "origin", branchName], {
@@ -5233,7 +5244,14 @@ function getRefactorArtifactDir(artifactPath) {
   return artifactPath.replace(/\/reviewers\//, "/refactors/").replace(/\/[^/]+$/, "");
 }
 async function finalizeWorktreeCommit(options) {
-  const { worktreePath, baseRef, title, body, logger } = options;
+  const {
+    worktreePath,
+    baseRef,
+    title,
+    body,
+    secretLikeContentDetectionEnabled,
+    logger
+  } = options;
   await syncRemoteBaseRef(worktreePath, baseRef, logger);
   try {
     await execCapture("git", ["merge-base", "--is-ancestor", baseRef, "HEAD"], {
@@ -5260,6 +5278,7 @@ async function finalizeWorktreeCommit(options) {
     worktreePath,
     title,
     body,
+    enabled: secretLikeContentDetectionEnabled,
     logger
   });
   await execCapture("git", ["commit", "--no-verify", "-m", title, "-m", body], {
@@ -5269,7 +5288,10 @@ async function finalizeWorktreeCommit(options) {
   });
 }
 async function guardFinalCommitContent(options) {
-  const { worktreePath, title, body, logger } = options;
+  const { worktreePath, title, body, enabled, logger } = options;
+  if (!enabled) {
+    return;
+  }
   const stagedDiff = await execCapture("git", ["diff", "--cached"], {
     cwd: worktreePath,
     logger,
@@ -5285,7 +5307,17 @@ async function guardFinalCommitContent(options) {
   ]);
 }
 async function guardFinalPublishContent(options) {
-  const { worktreePath, baseRef, title, body, logger } = options;
+  const {
+    worktreePath,
+    baseRef,
+    title,
+    body,
+    secretLikeContentDetectionEnabled,
+    logger
+  } = options;
+  if (!secretLikeContentDetectionEnabled) {
+    return;
+  }
   const finalDiff = await execCapture("git", ["diff", `${baseRef}...HEAD`], {
     cwd: worktreePath,
     logger,
@@ -5315,6 +5347,9 @@ function assertNoSecretLikeContent(inputs) {
     `Secret-like content detected before finalization (${summary}). Redact it before committing, pushing, or creating a PR.`
   );
 }
+function isSecretLikeContentDetectionEnabled(config) {
+  return config.security?.secretLikeContentDetection.enabled !== false;
+}
 function findSecretLikeContent(source, content) {
   const findings = [];
   const patterns = [
@@ -6044,15 +6079,16 @@ async function runIssueCreateCommand(args, issueProvider, logger) {
 // commands/prd-run.ts
 import {
   cpSync,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync8,
-  mkdtempSync,
-  readFileSync as readFileSync11,
+  mkdtempSync as mkdtempSync2,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync12,
   rmSync as rmSync3
 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 import { dirname as dirname7, join as join15, relative as relative2 } from "path";
-import { tmpdir } from "os";
+import { tmpdir as tmpdir2 } from "os";
 
 // prd-run/planning-manifest.ts
 import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync9 } from "fs";
@@ -6678,7 +6714,8 @@ var PrdRunRecordSchema = z3.object({
     "branch-state",
     "git",
     "queue",
-    "final-review"
+    "final-review",
+    "reconciliation"
   ]).optional(),
   targetName: z3.string().min(1).optional(),
   prdBranch: z3.string().min(1).optional(),
@@ -6735,6 +6772,14 @@ var PrdRunRecordSchema = z3.object({
     autoMerge: z3.boolean().optional(),
     changedPaths: z3.array(z3.string()).optional()
   }).strict().optional(),
+  reconciliation: z3.object({
+    status: z3.enum(["succeeded", "blocked"]),
+    targetName: z3.string().min(1),
+    prdBranch: z3.string().min(1),
+    mergeBase: z3.string().min(1).optional(),
+    diagnostics: z3.array(z3.string()).optional(),
+    reconciledAt: z3.string().min(1).optional()
+  }).strict().optional(),
   scopeChanges: z3.array(
     z3.object({
       issueNumber: z3.number().int().positive(),
@@ -6820,6 +6865,300 @@ function getRecordPath(repoRoot2, prdRef) {
   );
 }
 
+// prd-run/evidence-packet.ts
+import { z as z4 } from "zod";
+var PRD_REF_REGEX2 = /^PRD-\d{3,4}$/;
+var StageSchema = z4.enum(["prdFinalReview", "prdReconciliation"]);
+var EvidencePacketSchema = z4.object({
+  prdRef: z4.string().regex(PRD_REF_REGEX2),
+  prdBranch: z4.string().min(1),
+  mergeBase: z4.string().min(6),
+  planningManifestPath: z4.string().min(1),
+  planningManifestFacts: z4.object({
+    parentPrdIssueUrl: z4.string().min(1),
+    childIssueCount: z4.number().int().nonnegative()
+  }),
+  stage: StageSchema,
+  stageReceipts: z4.record(z4.string(), z4.unknown())
+}).strict();
+function buildEvidencePacket(input) {
+  const requiredFields = [
+    "prdRef",
+    "prdBranch",
+    "mergeBase",
+    "planningManifestPath",
+    "stage"
+  ];
+  for (const field of requiredFields) {
+    const value = input[field];
+    if (typeof value !== "string" || value.trim().length === 0) {
+      throw new Error(
+        `Evidence Packet construction failed: "${field}" is required and must be a non-empty string.`
+      );
+    }
+  }
+  if (!input.planningManifestFacts || typeof input.planningManifestFacts.parentPrdIssueUrl !== "string" || input.planningManifestFacts.parentPrdIssueUrl.trim().length === 0) {
+    throw new Error(
+      'Evidence Packet construction failed: "planningManifestFacts.parentPrdIssueUrl" is required and must be a non-empty string.'
+    );
+  }
+  if (typeof input.planningManifestFacts.childIssueCount !== "number" || !Number.isInteger(input.planningManifestFacts.childIssueCount) || input.planningManifestFacts.childIssueCount < 0) {
+    throw new Error(
+      'Evidence Packet construction failed: "planningManifestFacts.childIssueCount" is required and must be a non-negative integer.'
+    );
+  }
+  if (!PRD_REF_REGEX2.test(input.prdRef.trim())) {
+    throw new Error(
+      `Evidence Packet construction failed: "prdRef" must match PRD-\\d{3,4} format, got "${input.prdRef}".`
+    );
+  }
+  const stageResult = StageSchema.safeParse(input.stage);
+  if (!stageResult.success) {
+    throw new Error(
+      `Evidence Packet construction failed: "stage" must be one of "prdFinalReview" or "prdReconciliation", got "${input.stage}".`
+    );
+  }
+  if (stageResult.data === "prdFinalReview") {
+    const hasMergeBaseReceipt = "mergeBase" in input.stageReceipts;
+    const hasFinalReviewRef = "finalReviewRef" in input.stageReceipts;
+    if (!hasMergeBaseReceipt && !hasFinalReviewRef) {
+      throw new Error(
+        "Evidence Packet construction failed: Final Review stage receipts must include at minimum a mergeBase or finalReviewRef receipt."
+      );
+    }
+  }
+  if (stageResult.data === "prdReconciliation") {
+    if (!("finalReviewReceipt" in input.stageReceipts)) {
+      throw new Error(
+        "Evidence Packet construction failed: Reconciliation stage receipts must include at minimum a finalReviewReceipt."
+      );
+    }
+  }
+  const mergeBase = input.mergeBase.trim();
+  if (mergeBase.length < 6) {
+    throw new Error(
+      `Evidence Packet construction failed: "mergeBase" must be a non-empty commit SHA with at least 6 characters, got "${mergeBase}".`
+    );
+  }
+  const packet = {
+    prdRef: input.prdRef.trim(),
+    prdBranch: input.prdBranch.trim(),
+    mergeBase,
+    planningManifestPath: input.planningManifestPath.trim(),
+    planningManifestFacts: {
+      parentPrdIssueUrl: input.planningManifestFacts.parentPrdIssueUrl.trim(),
+      childIssueCount: input.planningManifestFacts.childIssueCount
+    },
+    stage: stageResult.data,
+    stageReceipts: input.stageReceipts
+  };
+  return packet;
+}
+var TOKEN_LIKE_PATTERNS = [
+  /gh[ps]_[A-Za-z0-9]{36}/g,
+  /token[=:_\s][A-Za-z0-9_-]{20,}/gi,
+  /secret[=:_\s][A-Za-z0-9_-]{20,}/gi,
+  /credential[=:_\s][A-Za-z0-9_-]{20,}/gi,
+  /key[=:_\s][A-Za-z0-9_-]{20,}/gi,
+  /-----BEGIN (RSA |EC )?PRIVATE KEY-----/g,
+  /xox[baprs]-[A-Za-z0-9_-]{10,}/g
+];
+function redactSensitiveValues(input) {
+  let redacted = input;
+  for (const pattern of TOKEN_LIKE_PATTERNS) {
+    redacted = redacted.replace(pattern, "[REDACTED]");
+  }
+  return redacted;
+}
+
+// prd-run/final-review-validation.ts
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+function parseFinalReviewArtifact(artifactPath) {
+  if (!existsSync11(artifactPath)) {
+    return {
+      ok: false,
+      reason: "Final Review artifact not found.",
+      diagnostics: [`Artifact path: ${artifactPath}`]
+    };
+  }
+  let content;
+  try {
+    content = readFileSync11(artifactPath, "utf-8");
+  } catch (error) {
+    return {
+      ok: false,
+      reason: "Final Review artifact could not be read.",
+      diagnostics: [
+        error instanceof Error ? error.message : String(error),
+        `Artifact path: ${artifactPath}`
+      ]
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return {
+      ok: false,
+      reason: "Final Review artifact is not valid JSON.",
+      diagnostics: [`Artifact path: ${artifactPath}`]
+    };
+  }
+  const verdict = parsed.verdict;
+  if (!verdict || typeof verdict !== "string") {
+    return {
+      ok: false,
+      reason: "Final Review artifact is missing a verdict field.",
+      diagnostics: [`Artifact content preview: ${content.slice(0, 300)}`]
+    };
+  }
+  const allowedVerdicts = [
+    "pass_no_changes",
+    "pass_with_retouch",
+    "needs_human_review",
+    "blocked"
+  ];
+  if (!allowedVerdicts.includes(verdict)) {
+    return {
+      ok: false,
+      reason: `Final Review artifact has unsupported verdict "${verdict}".`,
+      diagnostics: [`Allowed verdicts: ${allowedVerdicts.join(", ")}`]
+    };
+  }
+  const summary = typeof parsed.summary === "string" ? parsed.summary : typeof parsed.reason === "string" ? parsed.reason : String(verdict);
+  const diagnostics = Array.isArray(parsed.diagnostics) ? parsed.diagnostics : [];
+  const changedPaths = Array.isArray(parsed.changedPaths) ? parsed.changedPaths : void 0;
+  const isAutoSummary = !parsed.summary && !parsed.reason;
+  if (verdict === "pass_with_retouch" && (!changedPaths || changedPaths.length === 0) && isAutoSummary) {
+    return {
+      ok: false,
+      reason: 'Final Review artifact with "pass_with_retouch" verdict requires changed paths.',
+      diagnostics: [
+        "pass_with_retouch verdict must include a changedPaths array in the artifact or provide a summary/reason with enough context for git diff fallback.",
+        "Provide changedPaths or a descriptive summary in the artifact."
+      ]
+    };
+  }
+  const prdRef = typeof parsed.prdRef === "string" && parsed.prdRef.trim() ? parsed.prdRef.trim() : void 0;
+  const stage = typeof parsed.stage === "string" && parsed.stage.trim() ? parsed.stage.trim() : void 0;
+  const checkoutBase = typeof parsed.checkoutBase === "string" && parsed.checkoutBase.trim() ? parsed.checkoutBase.trim() : void 0;
+  const reviewBase = typeof parsed.reviewBase === "string" && parsed.reviewBase.trim() ? parsed.reviewBase.trim() : void 0;
+  return {
+    ok: true,
+    verdict,
+    summary,
+    diagnostics,
+    changedPaths,
+    prdRef,
+    stage,
+    checkoutBase,
+    reviewBase
+  };
+}
+function validateFinalReviewArtifactSemanticIds(artifact, context) {
+  const errors = [];
+  if (!artifact.prdRef) {
+    errors.push("Final Review artifact is missing prdRef.");
+  } else if (artifact.prdRef !== context.prdRef) {
+    errors.push(
+      `Final Review artifact prdRef "${artifact.prdRef}" does not match active PRD Run "${context.prdRef}".`
+    );
+  }
+  if (!artifact.stage) {
+    errors.push("Final Review artifact is missing stage field.");
+  } else if (artifact.stage !== "prdFinalReview") {
+    errors.push(
+      `Final Review artifact stage "${artifact.stage}" is not "prdFinalReview".`
+    );
+  }
+  if (!artifact.checkoutBase) {
+    errors.push("Final Review artifact is missing checkoutBase.");
+  } else if (artifact.checkoutBase !== context.prdBranch) {
+    errors.push(
+      `Final Review artifact checkoutBase "${artifact.checkoutBase}" does not match active PRD Branch "${context.prdBranch}".`
+    );
+  }
+  if (!artifact.reviewBase) {
+    errors.push("Final Review artifact is missing reviewBase.");
+  } else if (artifact.reviewBase !== context.mergeBase) {
+    errors.push(
+      `Final Review artifact reviewBase "${artifact.reviewBase}" does not match active merge base "${context.mergeBase}".`
+    );
+  }
+  if (errors.length > 0) {
+    return { ok: false, errors, blockedGate: "final-review" };
+  }
+  return { ok: true };
+}
+function validateFinalReviewRetouchScope(changedPaths) {
+  if (!changedPaths || changedPaths.length === 0) {
+    return {
+      ok: false,
+      reason: "Final Review retouch scope validation failed. No changed paths available. Provide changed paths or run Final Review with a summary that includes changed paths.",
+      diagnostics: ["Changed paths list is empty or undefined."],
+      offendingPaths: []
+    };
+  }
+  const offendingPaths = changedPaths.filter((p) => !isRetouchScopePath(p));
+  const allowedPaths = changedPaths.filter((p) => isRetouchScopePath(p));
+  if (allowedPaths.length === 0) {
+    return {
+      ok: false,
+      reason: "Final Review retouch scope validation failed. No implementation, test, or Changeset paths found for retouch.",
+      diagnostics: [
+        "All changed paths are prohibited for retouch.",
+        ...changedPaths.map((p) => `  - ${p}`)
+      ],
+      offendingPaths
+    };
+  }
+  if (offendingPaths.length > 0) {
+    return {
+      ok: false,
+      reason: "Final Review retouch scope validation failed. Prohibited paths cannot be included in retouch PR.",
+      diagnostics: [
+        "Prohibited paths found:",
+        ...offendingPaths.map((p) => `  - ${p}`)
+      ],
+      offendingPaths
+    };
+  }
+  return { ok: true, changedPaths };
+}
+function validateFinalReviewAgentOutputs(options) {
+  const artifact = parseFinalReviewArtifact(options.artifactPath);
+  if (!artifact.ok) {
+    return { ...artifact, offendingPaths: [] };
+  }
+  const semanticResult = validateFinalReviewArtifactSemanticIds(
+    artifact,
+    options.context
+  );
+  if (!semanticResult.ok) {
+    return {
+      ok: false,
+      reason: "Final Review artifact has mismatched semantic IDs.",
+      diagnostics: semanticResult.errors,
+      offendingPaths: []
+    };
+  }
+  if (artifact.verdict !== "pass_with_retouch") {
+    return { ok: true, artifact };
+  }
+  const changedPaths = options.changedPaths && options.changedPaths.length > 0 ? options.changedPaths : artifact.changedPaths;
+  const retouch = validateFinalReviewRetouchScope(changedPaths ?? []);
+  if (!retouch.ok) {
+    return retouch;
+  }
+  return { ok: true, artifact, retouch };
+}
+function isRetouchScopePath(path9) {
+  if (path9.startsWith(".pourkit/architecture/") || path9 === ".pourkit/CONTEXT.md" || path9.startsWith(".pourkit/docs/adr/") || /^\.pourkit\/prd-runs\/[^/]+\.json$/.test(path9)) {
+    return false;
+  }
+  return true;
+}
+
 // commands/prd-run.ts
 init_common();
 
@@ -7338,19 +7677,20 @@ function canRetryFinalReviewBlock(record) {
 }
 function loadFinalReviewPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  return existsSync11(promptPath) ? readFileSync11(promptPath, "utf-8") : promptTemplate;
+  return existsSync12(promptPath) ? readFileSync12(promptPath, "utf-8") : promptTemplate;
 }
 function buildFinalReviewPrompt(options) {
   return [
     "# Active PRD Final Review Context",
     "",
-    `- PRD Ref: ${options.prdRef}`,
-    `- PRD Branch: ${options.prdBranch}`,
-    `- Merge Base: ${options.mergeBase}`,
-    `- PRD Run State: .pourkit/prd-runs/${options.prdRef}.json`,
-    `- Planning Manifest: ${options.manifestPath ?? "(not recorded)"}`,
+    `Worktree checkout base: ${options.evidencePacket.prdBranch}`,
+    `Review only this range: ${options.evidencePacket.mergeBase}..HEAD`,
+    "Do not compare against current target branch HEAD; the merge base is the review baseline.",
+    `Before handoff, run: npm run pourkit:validate-final-review -- ${options.evidencePacket.prdRef} --checkout-base ${options.evidencePacket.prdBranch} --review-base ${options.evidencePacket.mergeBase}`,
+    "Fix any validation failures before handing off.",
     "",
-    "Review only the active PRD above. Do not infer the active PRD from nearby files, Changesets, glob order, or other PRD Run state files.",
+    "Evidence Packet (do not infer PRD context from local state files):",
+    JSON.stringify(options.evidencePacket, null, 2),
     "",
     loadFinalReviewPrompt(options.repoRoot, options.promptTemplate)
   ].join("\n");
@@ -7358,6 +7698,95 @@ function buildFinalReviewPrompt(options) {
 function buildRetouchBranchName(prdRef) {
   return `prd-run/${prdRef}-final-review-retouch`;
 }
+function buildFinalReviewBranchName(prdRef) {
+  return `pourkit/${normalizePrdRunRef2(prdRef).toLowerCase()}-final-review`;
+}
+function finalReviewWorktreePath(repoRoot2, branchName) {
+  return join15(
+    repoRoot2,
+    ".sandcastle",
+    "worktrees",
+    branchName.replace(/\//g, "-")
+  );
+}
+function collectSpawnDiagnostics(result, fallback) {
+  const diagnostics = [];
+  const stderr = result.stderr?.toString?.().trim();
+  const stdout = result.stdout?.toString?.().trim();
+  if (stderr) diagnostics.push(stderr);
+  if (stdout) diagnostics.push(stdout);
+  return diagnostics.length > 0 ? diagnostics : [fallback];
+}
+function ensureFinalReviewWorktree(options) {
+  const worktreePath = finalReviewWorktreePath(
+    options.repoRoot,
+    options.branchName
+  );
+  const listResult = spawnSync2("git", ["worktree", "list", "--porcelain"], {
+    cwd: options.repoRoot,
+    encoding: "utf8"
+  });
+  if (listResult.status !== 0) {
+    return {
+      ok: false,
+      reason: "Final Review failed to list git worktrees.",
+      diagnostics: collectSpawnDiagnostics(
+        listResult,
+        "git worktree list failed"
+      )
+    };
+  }
+  const registeredPath = parseWorktreeListPorcelain(
+    listResult.stdout?.toString?.() ?? "",
+    options.branchName
+  );
+  if (registeredPath) {
+    if (registeredPath !== worktreePath) {
+      return {
+        ok: false,
+        reason: `Final Review branch ${options.branchName} already has a registered worktree outside .sandcastle/worktrees.`,
+        diagnostics: [`registered worktree: ${registeredPath}`]
+      };
+    }
+    return { ok: true, worktreePath: registeredPath };
+  }
+  if (existsSync12(worktreePath)) {
+    return {
+      ok: false,
+      reason: "Final Review worktree path exists but is not registered with git.",
+      diagnostics: [`stale worktree path: ${worktreePath}`]
+    };
+  }
+  mkdirSync8(dirname7(worktreePath), { recursive: true });
+  const branchResult = spawnSync2(
+    "git",
+    ["branch", "-f", options.branchName, `origin/${options.checkoutBase}`],
+    { cwd: options.repoRoot, encoding: "utf8" }
+  );
+  if (branchResult.status !== 0) {
+    return {
+      ok: false,
+      reason: `Final Review failed to prepare branch ${options.branchName}.`,
+      diagnostics: collectSpawnDiagnostics(branchResult, "git branch failed")
+    };
+  }
+  const addResult = spawnSync2(
+    "git",
+    ["worktree", "add", worktreePath, options.branchName],
+    { cwd: options.repoRoot, encoding: "utf8" }
+  );
+  if (addResult.status !== 0) {
+    return {
+      ok: false,
+      reason: `Final Review failed to create worktree for ${options.branchName}.`,
+      diagnostics: collectSpawnDiagnostics(
+        addResult,
+        "git worktree add failed"
+      )
+    };
+  }
+  return { ok: true, worktreePath };
+}
 function buildRetouchPrTitle(prdRef) {
   return `chore: ${prdRef} Final Review retouch`;
 }
@@ -7383,7 +7812,7 @@ async function createOrReuseFinalReviewRetouchPr(options) {
   if (existingPr && existingPr.state === "OPEN") {
     return existingPr;
   }
-  const worktreePath = mkdtempSync(join15(tmpdir(), "pourkit-retouch-"));
+  const worktreePath = mkdtempSync2(join15(tmpdir2(), "pourkit-retouch-"));
   try {
     runGitOrThrow(
       options.repoRoot,
@@ -7653,53 +8082,245 @@ async function runPrdRunFinalReviewCommand(options) {
     };
   }
   const prdBranch = record.prdBranch ?? prdRef;
-  const worktreePath = mkdtempSync(join15(tmpdir(), "pourkit-final-review-"));
-  try {
-    runGitOrThrow(
-      options.repoRoot,
-      ["worktree", "add", "--detach", worktreePath, `origin/${prdBranch}`],
-      "create final review worktree from PRD branch"
-    );
-    const startReceipt = {
-      status: "started",
-      targetName,
-      prdBranch,
-      mergeBase: mergeBaseResult.mergeBase,
-      diagnostics: [],
-      reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
+  const manifestResult = readPlanningArtifactManifest(options.repoRoot, prdRef);
+  if (!manifestResult.ok) {
+    const reason = `Evidence Packet construction failed: ${manifestResult.reason}`;
     writePrdRunRecord(options.repoRoot, {
       ...record,
-      status: "running",
+      status: "blocked",
       updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      blockedGate: "final-review",
+      blockedReason: reason,
+      diagnostics: manifestResult.diagnostics,
       targetName,
-      start: record.start,
-      planning: record.planning,
-      finalReview: startReceipt
-    });
-    const executionResult = await options.executionProvider.execute({
-      stage: "prdFinalReview",
-      agent: finalReviewConfig.agent,
-      model: finalReviewConfig.model,
-      prompt: buildFinalReviewPrompt({
-        repoRoot: options.repoRoot,
-        promptTemplate: finalReviewConfig.promptTemplate,
-        prdRef,
+      finalReview: {
+        status: "blocked",
+        targetName,
         prdBranch,
         mergeBase: mergeBaseResult.mergeBase,
-        manifestPath: record.manifestPath
-      }),
-      target: targetConfig,
+        diagnostics: manifestResult.diagnostics,
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      offendingPaths: manifestResult.offendingPaths
+    });
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "final-review",
+      blockedReason: reason,
+      diagnostics: manifestResult.diagnostics,
+      offendingPaths: manifestResult.offendingPaths
+    };
+  }
+  const evidencePacket = buildEvidencePacket({
+    prdRef,
+    prdBranch,
+    mergeBase: mergeBaseResult.mergeBase,
+    planningManifestPath: manifestResult.manifest.manifestPath,
+    planningManifestFacts: {
+      parentPrdIssueUrl: manifestResult.manifest.parentIssue.url,
+      childIssueCount: manifestResult.manifest.childIssues.length
+    },
+    stage: "prdFinalReview",
+    stageReceipts: { mergeBase: mergeBaseResult.mergeBase }
+  });
+  const startReceipt = {
+    status: "started",
+    targetName,
+    prdBranch,
+    mergeBase: mergeBaseResult.mergeBase,
+    diagnostics: [],
+    reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writePrdRunRecord(options.repoRoot, {
+    ...record,
+    status: "running",
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    targetName,
+    start: record.start,
+    planning: record.planning,
+    finalReview: startReceipt
+  });
+  const finalReviewBranchName = buildFinalReviewBranchName(prdBranch);
+  const worktreeResult = ensureFinalReviewWorktree({
+    repoRoot: options.repoRoot,
+    branchName: finalReviewBranchName,
+    checkoutBase: prdBranch
+  });
+  if (!worktreeResult.ok) {
+    writePrdRunRecord(options.repoRoot, {
+      ...record,
+      status: "blocked",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      blockedGate: "final-review",
+      blockedReason: worktreeResult.reason,
+      diagnostics: worktreeResult.diagnostics,
+      targetName,
+      start: record.start,
+      planning: record.planning,
+      finalReview: {
+        ...startReceipt,
+        status: "blocked",
+        diagnostics: worktreeResult.diagnostics
+      }
+    });
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "final-review",
+      blockedReason: worktreeResult.reason,
+      diagnostics: worktreeResult.diagnostics,
+      offendingPaths: []
+    };
+  }
+  const executionResult = await options.executionProvider.execute({
+    stage: "prdFinalReview",
+    agent: finalReviewConfig.agent,
+    model: finalReviewConfig.model,
+    prompt: buildFinalReviewPrompt({
       repoRoot: options.repoRoot,
-      branchName: prdBranch,
-      baseRef: mergeBaseResult.mergeBase,
-      sandbox: options.config.sandbox,
-      worktreePath,
+      promptTemplate: finalReviewConfig.promptTemplate,
+      evidencePacket
+    }),
+    target: targetConfig,
+    repoRoot: options.repoRoot,
+    branchName: finalReviewBranchName,
+    baseRef: prdBranch,
+    checkoutBase: prdBranch,
+    reviewBase: mergeBaseResult.mergeBase,
+    worktreePath: worktreeResult.worktreePath,
+    sandbox: options.config.sandbox,
+    artifactPath: ".pourkit/final-review-artifact.json",
+    logger: options.logger
+  });
+  if (!executionResult.success) {
+    const reason = executionResult.error ?? "Final Review execution failed.";
+    writePrdRunRecord(options.repoRoot, {
+      ...record,
+      status: "blocked",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      blockedGate: "final-review",
+      blockedReason: reason,
+      diagnostics: [reason],
+      targetName,
+      finalReview: {
+        status: "blocked",
+        targetName,
+        prdBranch,
+        mergeBase: mergeBaseResult.mergeBase,
+        diagnostics: [reason],
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      offendingPaths: []
+    });
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "final-review",
+      blockedReason: reason,
+      diagnostics: [reason],
+      offendingPaths: []
+    };
+  }
+  const resolvedWorktreePath = executionResult.worktreePath;
+  const artifactPath = join15(
+    resolvedWorktreePath,
+    ".pourkit/final-review-artifact.json"
+  );
+  const artifactResult = parseFinalReviewArtifact(artifactPath);
+  if (!artifactResult.ok) {
+    writePrdRunRecord(options.repoRoot, {
+      ...record,
+      status: "blocked",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      blockedGate: "final-review",
+      blockedReason: artifactResult.reason,
+      diagnostics: artifactResult.diagnostics,
+      targetName,
+      finalReview: {
+        status: "blocked",
+        targetName,
+        prdBranch,
+        mergeBase: mergeBaseResult.mergeBase,
+        diagnostics: artifactResult.diagnostics,
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      offendingPaths: []
+    });
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "final-review",
+      blockedReason: artifactResult.reason,
+      diagnostics: artifactResult.diagnostics,
+      offendingPaths: []
+    };
+  }
+  const semanticResult = validateFinalReviewArtifactSemanticIds(
+    artifactResult,
+    { prdRef, prdBranch, mergeBase: mergeBaseResult.mergeBase }
+  );
+  if (!semanticResult.ok) {
+    const diagnostics = semanticResult.errors.map(redactSensitiveValues);
+    const reason = "Final Review artifact has mismatched semantic IDs.";
+    writePrdRunRecord(options.repoRoot, {
+      ...record,
+      status: "blocked",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      blockedGate: "final-review",
+      blockedReason: reason,
+      diagnostics,
+      targetName,
+      finalReview: {
+        status: "blocked",
+        targetName,
+        prdBranch,
+        mergeBase: mergeBaseResult.mergeBase,
+        diagnostics,
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      offendingPaths: []
+    });
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "final-review",
+      blockedReason: reason,
+      diagnostics,
+      offendingPaths: []
+    };
+  }
+  const { verdict, summary, diagnostics: artifactDiagnostics } = artifactResult;
+  if (verdict === "pass_no_changes") {
+    const receipt = {
+      status: "succeeded",
+      targetName,
+      prdBranch,
+      mergeBase: mergeBaseResult.mergeBase,
+      verdict: "pass_no_changes",
       artifactPath: ".pourkit/final-review-artifact.json",
-      logger: options.logger
+      diagnostics: [],
+      reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    writePrdRunRecord(options.repoRoot, {
+      ...record,
+      status: "final_reviewed",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      targetName,
+      start: record.start,
+      planning: record.planning,
+      finalReview: receipt
     });
-    if (!executionResult.success) {
-      const reason = executionResult.error ?? "Final Review execution failed.";
+    return {
+      prdRef,
+      status: "final_reviewed",
+      finalReview: receipt,
+      diagnostics: []
+    };
+  }
+  if (verdict === "pass_with_retouch") {
+    if (!options.prProvider) {
+      const reason = "Missing PRProvider. Cannot create retouch PR without a PR provider.";
       writePrdRunRecord(options.repoRoot, {
         ...record,
         status: "blocked",
@@ -7713,6 +8334,7 @@ async function runPrdRunFinalReviewCommand(options) {
           targetName,
           prdBranch,
           mergeBase: mergeBaseResult.mergeBase,
+          verdict: "pass_with_retouch",
           diagnostics: [reason],
           reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
         },
@@ -7727,26 +8349,118 @@ async function runPrdRunFinalReviewCommand(options) {
         offendingPaths: []
       };
     }
-    const artifactPath = join15(
-      worktreePath,
-      ".pourkit/final-review-artifact.json"
-    );
-    const artifactResult = parseFinalReviewArtifact(artifactPath);
-    if (!artifactResult.ok) {
+    const autoMerge = options.autoMerge ?? true;
+    const existingRetouchPrNumber = record.finalReview?.retouchPrNumber;
+    if (existingRetouchPrNumber && autoMerge) {
+      const existingPr = await getPrByNumberIfAvailable(
+        options.prProvider,
+        existingRetouchPrNumber
+      );
+      if (existingPr?.state === "MERGED" && existingPr.mergeCommitSha) {
+        const receipt2 = {
+          status: "final_reviewed",
+          targetName,
+          prdBranch,
+          mergeBase: mergeBaseResult.mergeBase,
+          verdict: "pass_with_retouch",
+          artifactPath: ".pourkit/final-review-artifact.json",
+          diagnostics: [],
+          reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          retouchPrNumber: existingRetouchPrNumber,
+          retouchPrUrl: existingPr.url,
+          retouchMergeCommit: existingPr.mergeCommitSha,
+          autoMerge,
+          changedPaths: record.finalReview?.changedPaths ?? []
+        };
+        writePrdRunRecord(options.repoRoot, {
+          ...record,
+          status: "final_reviewed",
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          targetName,
+          start: record.start,
+          planning: record.planning,
+          finalReview: receipt2
+        });
+        return {
+          prdRef,
+          status: "final_reviewed",
+          finalReview: receipt2,
+          diagnostics: []
+        };
+      }
+    }
+    const changedPathsFromArtifact = artifactResult.changedPaths;
+    let resolvedChangedPaths;
+    if (changedPathsFromArtifact && changedPathsFromArtifact.length > 0) {
+      resolvedChangedPaths = changedPathsFromArtifact;
+    } else {
+      const diffResult = spawnSync2(
+        "git",
+        ["diff", "--name-only", mergeBaseResult.mergeBase, "HEAD", "--", "."],
+        {
+          cwd: resolvedWorktreePath,
+          encoding: "utf8"
+        }
+      );
+      resolvedChangedPaths = diffResult.stdout.split(/\r?\n/).filter(Boolean);
+    }
+    const scopeResult = validateFinalReviewRetouchScope(resolvedChangedPaths);
+    if (!scopeResult.ok) {
       writePrdRunRecord(options.repoRoot, {
         ...record,
         status: "blocked",
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         blockedGate: "final-review",
-        blockedReason: artifactResult.reason,
-        diagnostics: artifactResult.diagnostics,
+        blockedReason: scopeResult.reason,
+        diagnostics: scopeResult.diagnostics,
+        targetName,
+        finalReview: {
+          status: "blocked",
+          targetName,
+          prdBranch,
+          mergeBase: mergeBaseResult.mergeBase,
+          verdict: "pass_with_retouch",
+          diagnostics: scopeResult.diagnostics,
+          reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        offendingPaths: scopeResult.offendingPaths
+      });
+      return {
+        prdRef,
+        status: "blocked",
+        blockedGate: "final-review",
+        blockedReason: scopeResult.reason,
+        diagnostics: scopeResult.diagnostics,
+        offendingPaths: scopeResult.offendingPaths
+      };
+    }
+    let retouchPr;
+    try {
+      retouchPr = await createOrReuseFinalReviewRetouchPr({
+        repoRoot: options.repoRoot,
+        sourceWorktreePath: resolvedWorktreePath,
+        prdRef,
+        changedPaths: scopeResult.changedPaths,
+        summary,
+        prProvider: options.prProvider
+      });
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      writePrdRunRecord(options.repoRoot, {
+        ...record,
+        status: "blocked",
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        blockedGate: "final-review",
+        blockedReason: `Failed to create retouch PR: ${msg}`,
+        diagnostics: [msg],
         targetName,
         finalReview: {
           status: "blocked",
           targetName,
           prdBranch,
           mergeBase: mergeBaseResult.mergeBase,
-          diagnostics: artifactResult.diagnostics,
+          verdict: "pass_with_retouch",
+          diagnostics: [msg],
           reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
         },
         offendingPaths: []
@@ -7755,501 +8469,555 @@ async function runPrdRunFinalReviewCommand(options) {
         prdRef,
         status: "blocked",
         blockedGate: "final-review",
-        blockedReason: artifactResult.reason,
-        diagnostics: artifactResult.diagnostics,
+        blockedReason: `Failed to create retouch PR: ${msg}`,
+        diagnostics: [msg],
         offendingPaths: []
       };
     }
-    const {
-      verdict,
-      summary,
-      diagnostics: artifactDiagnostics
-    } = artifactResult;
-    if (verdict === "pass_no_changes") {
-      const receipt = {
-        status: "succeeded",
+    if (!autoMerge) {
+      const receipt2 = {
+        status: "needs_human_review",
         targetName,
         prdBranch,
         mergeBase: mergeBaseResult.mergeBase,
-        verdict: "pass_no_changes",
+        verdict: "pass_with_retouch",
         artifactPath: ".pourkit/final-review-artifact.json",
         diagnostics: [],
-        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        retouchPrNumber: retouchPr.number,
+        retouchPrUrl: retouchPr.url,
+        autoMerge: false,
+        changedPaths: scopeResult.changedPaths
       };
       writePrdRunRecord(options.repoRoot, {
         ...record,
-        status: "final_reviewed",
+        status: "blocked",
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        blockedGate: "final-review",
+        blockedReason: `Retouch PR #${retouchPr.number} created but auto-merge disabled. PRD Final Review will not advance until the PR is merged.`,
+        diagnostics: [
+          `Retouch PR #${retouchPr.number}: ${retouchPr.url}`,
+          "Auto-merge disabled. Merge the PR manually or rerun with auto-merge enabled."
+        ],
         targetName,
-        start: record.start,
-        planning: record.planning,
-        finalReview: receipt
+        finalReview: receipt2,
+        offendingPaths: []
       });
       return {
         prdRef,
-        status: "final_reviewed",
-        finalReview: receipt,
-        diagnostics: []
+        status: "needs_human_review",
+        finalReview: receipt2,
+        diagnostics: [
+          `Retouch PR #${retouchPr.number}: ${retouchPr.url}`,
+          "Auto-merge disabled. Merge the PR manually or rerun with auto-merge enabled."
+        ]
       };
     }
-    if (verdict === "pass_with_retouch") {
-      if (!options.prProvider) {
-        const reason = "Missing PRProvider. Cannot create retouch PR without a PR provider.";
-        writePrdRunRecord(options.repoRoot, {
-          ...record,
-          status: "blocked",
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          blockedGate: "final-review",
-          blockedReason: reason,
-          diagnostics: [reason],
-          targetName,
-          finalReview: {
-            status: "blocked",
-            targetName,
-            prdBranch,
-            mergeBase: mergeBaseResult.mergeBase,
-            verdict: "pass_with_retouch",
-            diagnostics: [reason],
-            reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
-          },
-          offendingPaths: []
-        });
-        return {
-          prdRef,
-          status: "blocked",
-          blockedGate: "final-review",
-          blockedReason: reason,
-          diagnostics: [reason],
-          offendingPaths: []
-        };
-      }
-      const autoMerge = options.autoMerge ?? true;
-      const existingRetouchPrNumber = record.finalReview?.retouchPrNumber;
-      if (existingRetouchPrNumber && autoMerge) {
-        const existingPr = await getPrByNumberIfAvailable(
-          options.prProvider,
-          existingRetouchPrNumber
-        );
-        if (existingPr?.state === "MERGED" && existingPr.mergeCommitSha) {
-          const receipt2 = {
-            status: "final_reviewed",
-            targetName,
-            prdBranch,
-            mergeBase: mergeBaseResult.mergeBase,
-            verdict: "pass_with_retouch",
-            artifactPath: ".pourkit/final-review-artifact.json",
-            diagnostics: [],
-            reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            retouchPrNumber: existingRetouchPrNumber,
-            retouchPrUrl: existingPr.url,
-            retouchMergeCommit: existingPr.mergeCommitSha,
-            autoMerge,
-            changedPaths: record.finalReview?.changedPaths ?? []
-          };
-          writePrdRunRecord(options.repoRoot, {
-            ...record,
-            status: "final_reviewed",
-            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            targetName,
-            start: record.start,
-            planning: record.planning,
-            finalReview: receipt2
-          });
-          return {
-            prdRef,
-            status: "final_reviewed",
-            finalReview: receipt2,
-            diagnostics: []
-          };
-        }
-      }
-      const changedPathsFromArtifact = artifactResult.changedPaths;
-      let resolvedChangedPaths;
-      if (changedPathsFromArtifact && changedPathsFromArtifact.length > 0) {
-        resolvedChangedPaths = changedPathsFromArtifact;
-      } else {
-        const diffResult = spawnSync2(
-          "git",
-          ["diff", "--name-only", mergeBaseResult.mergeBase, "HEAD", "--", "."],
-          {
-            cwd: worktreePath,
-            encoding: "utf8"
-          }
-        );
-        resolvedChangedPaths = diffResult.stdout.split(/\r?\n/).filter(Boolean);
-      }
-      const scopeResult = validateFinalReviewRetouchScope(resolvedChangedPaths);
-      if (!scopeResult.ok) {
-        writePrdRunRecord(options.repoRoot, {
-          ...record,
-          status: "blocked",
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          blockedGate: "final-review",
-          blockedReason: scopeResult.reason,
-          diagnostics: scopeResult.diagnostics,
-          targetName,
-          finalReview: {
-            status: "blocked",
-            targetName,
-            prdBranch,
-            mergeBase: mergeBaseResult.mergeBase,
-            verdict: "pass_with_retouch",
-            diagnostics: scopeResult.diagnostics,
-            reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
-          },
-          offendingPaths: scopeResult.offendingPaths
-        });
-        return {
-          prdRef,
-          status: "blocked",
-          blockedGate: "final-review",
-          blockedReason: scopeResult.reason,
-          diagnostics: scopeResult.diagnostics,
-          offendingPaths: scopeResult.offendingPaths
-        };
-      }
-      let retouchPr;
-      try {
-        retouchPr = await createOrReuseFinalReviewRetouchPr({
-          repoRoot: options.repoRoot,
-          sourceWorktreePath: worktreePath,
-          prdRef,
-          changedPaths: scopeResult.changedPaths,
-          summary,
-          prProvider: options.prProvider
-        });
-      } catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        writePrdRunRecord(options.repoRoot, {
-          ...record,
-          status: "blocked",
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          blockedGate: "final-review",
-          blockedReason: `Failed to create retouch PR: ${msg}`,
-          diagnostics: [msg],
-          targetName,
-          finalReview: {
-            status: "blocked",
-            targetName,
-            prdBranch,
-            mergeBase: mergeBaseResult.mergeBase,
-            verdict: "pass_with_retouch",
-            diagnostics: [msg],
-            reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
-          },
-          offendingPaths: []
-        });
-        return {
-          prdRef,
-          status: "blocked",
-          blockedGate: "final-review",
-          blockedReason: `Failed to create retouch PR: ${msg}`,
-          diagnostics: [msg],
-          offendingPaths: []
-        };
-      }
-      if (!autoMerge) {
-        const receipt2 = {
-          status: "needs_human_review",
-          targetName,
-          prdBranch,
-          mergeBase: mergeBaseResult.mergeBase,
-          verdict: "pass_with_retouch",
-          artifactPath: ".pourkit/final-review-artifact.json",
-          diagnostics: [],
-          reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          retouchPrNumber: retouchPr.number,
-          retouchPrUrl: retouchPr.url,
-          autoMerge: false,
-          changedPaths: scopeResult.changedPaths
-        };
-        writePrdRunRecord(options.repoRoot, {
-          ...record,
-          status: "blocked",
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          blockedGate: "final-review",
-          blockedReason: `Retouch PR #${retouchPr.number} created but auto-merge disabled. PRD Final Review will not advance until the PR is merged.`,
-          diagnostics: [
-            `Retouch PR #${retouchPr.number}: ${retouchPr.url}`,
-            "Auto-merge disabled. Merge the PR manually or rerun with auto-merge enabled."
-          ],
-          targetName,
-          finalReview: receipt2,
-          offendingPaths: []
-        });
-        return {
-          prdRef,
-          status: "needs_human_review",
-          finalReview: receipt2,
-          diagnostics: [
-            `Retouch PR #${retouchPr.number}: ${retouchPr.url}`,
-            "Auto-merge disabled. Merge the PR manually or rerun with auto-merge enabled."
-          ]
-        };
-      }
-      try {
-        await options.prProvider.waitForPrChecks(retouchPr.number);
-      } catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        const receipt2 = {
-          status: "started",
-          targetName,
-          prdBranch,
-          mergeBase: mergeBaseResult.mergeBase,
-          verdict: "pass_with_retouch",
-          artifactPath: ".pourkit/final-review-artifact.json",
-          diagnostics: [msg],
-          reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          retouchPrNumber: retouchPr.number,
-          retouchPrUrl: retouchPr.url,
-          autoMerge: true,
-          changedPaths: scopeResult.changedPaths
-        };
-        writePrdRunRecord(options.repoRoot, {
-          ...record,
-          status: "blocked",
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          blockedGate: "final-review",
-          blockedReason: `Retouch PR #${retouchPr.number} checks failed: ${msg}`,
-          diagnostics: [msg],
-          targetName,
-          finalReview: receipt2,
-          offendingPaths: []
-        });
-        return {
-          prdRef,
-          status: "blocked",
-          blockedGate: "final-review",
-          blockedReason: `Retouch PR #${retouchPr.number} checks failed: ${msg}`,
-          diagnostics: [msg],
-          offendingPaths: []
-        };
-      }
-      try {
-        await options.prProvider.mergePr(retouchPr.number, {
-          method: "squash"
-        });
-      } catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        const receipt2 = {
-          status: "started",
-          targetName,
-          prdBranch,
-          mergeBase: mergeBaseResult.mergeBase,
-          verdict: "pass_with_retouch",
-          artifactPath: ".pourkit/final-review-artifact.json",
-          diagnostics: [msg],
-          reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          retouchPrNumber: retouchPr.number,
-          retouchPrUrl: retouchPr.url,
-          autoMerge: true,
-          changedPaths: scopeResult.changedPaths
-        };
-        writePrdRunRecord(options.repoRoot, {
-          ...record,
-          status: "blocked",
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          blockedGate: "final-review",
-          blockedReason: `Retouch PR #${retouchPr.number} merge failed: ${msg}`,
-          diagnostics: [msg],
-          targetName,
-          finalReview: receipt2,
-          offendingPaths: []
-        });
-        return {
-          prdRef,
-          status: "blocked",
-          blockedGate: "final-review",
-          blockedReason: `Retouch PR #${retouchPr.number} merge failed: ${msg}`,
-          diagnostics: [msg],
-          offendingPaths: []
-        };
-      }
-      let mergedPr = null;
-      for (let attempt = 0; attempt < 3; attempt += 1) {
-        try {
-          const candidate = await options.prProvider.getPr(
-            retouchPr.headRefName
-          );
-          if (candidate?.state === "MERGED" && candidate.mergeCommitSha) {
-            mergedPr = candidate;
-            break;
-          }
-        } catch {
-        }
-        if (attempt < 2) {
-          await sleep(1e3);
-        }
-      }
-      const mergeCommitSha = mergedPr?.mergeCommitSha;
-      if (!mergeCommitSha) {
-        const receipt2 = {
-          status: "started",
-          targetName,
-          prdBranch,
-          mergeBase: mergeBaseResult.mergeBase,
-          verdict: "pass_with_retouch",
-          artifactPath: ".pourkit/final-review-artifact.json",
-          diagnostics: [
-            `Retouch PR #${retouchPr.number} merged but merge commit SHA not available.`
-          ],
-          reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          retouchPrNumber: retouchPr.number,
-          retouchPrUrl: retouchPr.url,
-          autoMerge: true,
-          changedPaths: scopeResult.changedPaths
-        };
-        writePrdRunRecord(options.repoRoot, {
-          ...record,
-          status: "blocked",
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          blockedGate: "final-review",
-          blockedReason: `Retouch PR #${retouchPr.number} merged without exposing a merge commit SHA.`,
-          diagnostics: [
-            `Retouch PR #${retouchPr.number} merged but merge commit SHA not available.`
-          ],
-          targetName,
-          finalReview: receipt2,
-          offendingPaths: []
-        });
-        return {
-          prdRef,
-          status: "blocked",
-          blockedGate: "final-review",
-          blockedReason: `Retouch PR #${retouchPr.number} merged without exposing a merge commit SHA.`,
-          diagnostics: [
-            `Retouch PR #${retouchPr.number} merged but merge commit SHA not available.`
-          ],
-          offendingPaths: []
-        };
-      }
-      const receipt = {
-        status: "final_reviewed",
+    try {
+      await options.prProvider.waitForPrChecks(retouchPr.number);
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      const receipt2 = {
+        status: "started",
         targetName,
         prdBranch,
         mergeBase: mergeBaseResult.mergeBase,
         verdict: "pass_with_retouch",
         artifactPath: ".pourkit/final-review-artifact.json",
-        diagnostics: [],
+        diagnostics: [msg],
         reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
         retouchPrNumber: retouchPr.number,
         retouchPrUrl: retouchPr.url,
-        retouchMergeCommit: mergeCommitSha,
         autoMerge: true,
         changedPaths: scopeResult.changedPaths
       };
       writePrdRunRecord(options.repoRoot, {
         ...record,
-        status: "final_reviewed",
+        status: "blocked",
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        blockedGate: "final-review",
+        blockedReason: `Retouch PR #${retouchPr.number} checks failed: ${msg}`,
+        diagnostics: [msg],
         targetName,
-        start: record.start,
-        planning: record.planning,
-        finalReview: receipt
+        finalReview: receipt2,
+        offendingPaths: []
       });
       return {
         prdRef,
-        status: "final_reviewed",
-        finalReview: receipt,
-        diagnostics: []
+        status: "blocked",
+        blockedGate: "final-review",
+        blockedReason: `Retouch PR #${retouchPr.number} checks failed: ${msg}`,
+        diagnostics: [msg],
+        offendingPaths: []
       };
     }
-    if (verdict === "needs_human_review") {
-      const reason = summary || "Final Review requires human review.";
-      const receipt = {
-        status: "needs_human_review",
+    try {
+      await options.prProvider.mergePr(retouchPr.number, {
+        method: "squash"
+      });
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      const receipt2 = {
+        status: "started",
         targetName,
         prdBranch,
         mergeBase: mergeBaseResult.mergeBase,
-        verdict: "needs_human_review",
+        verdict: "pass_with_retouch",
         artifactPath: ".pourkit/final-review-artifact.json",
-        diagnostics: artifactDiagnostics.length > 0 ? artifactDiagnostics : [reason],
-        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+        diagnostics: [msg],
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        retouchPrNumber: retouchPr.number,
+        retouchPrUrl: retouchPr.url,
+        autoMerge: true,
+        changedPaths: scopeResult.changedPaths
       };
       writePrdRunRecord(options.repoRoot, {
         ...record,
         status: "blocked",
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         blockedGate: "final-review",
-        blockedReason: reason,
-        diagnostics: [reason],
+        blockedReason: `Retouch PR #${retouchPr.number} merge failed: ${msg}`,
+        diagnostics: [msg],
         targetName,
-        finalReview: receipt,
+        finalReview: receipt2,
         offendingPaths: []
       });
       return {
         prdRef,
-        status: "needs_human_review",
-        finalReview: receipt,
-        diagnostics: [reason]
+        status: "blocked",
+        blockedGate: "final-review",
+        blockedReason: `Retouch PR #${retouchPr.number} merge failed: ${msg}`,
+        diagnostics: [msg],
+        offendingPaths: []
       };
     }
-    if (verdict === "blocked") {
-      const reason = summary || "Final Review blocked.";
-      const receipt = {
-        status: "blocked",
+    let mergedPr = null;
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      try {
+        const candidate = await options.prProvider.getPr(
+          retouchPr.headRefName
+        );
+        if (candidate?.state === "MERGED" && candidate.mergeCommitSha) {
+          mergedPr = candidate;
+          break;
+        }
+      } catch {
+      }
+      if (attempt < 2) {
+        await sleep(1e3);
+      }
+    }
+    const mergeCommitSha = mergedPr?.mergeCommitSha;
+    if (!mergeCommitSha) {
+      const receipt2 = {
+        status: "started",
         targetName,
         prdBranch,
         mergeBase: mergeBaseResult.mergeBase,
-        verdict: "blocked",
+        verdict: "pass_with_retouch",
         artifactPath: ".pourkit/final-review-artifact.json",
-        diagnostics: artifactDiagnostics.length > 0 ? artifactDiagnostics : [reason],
-        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+        diagnostics: [
+          `Retouch PR #${retouchPr.number} merged but merge commit SHA not available.`
+        ],
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        retouchPrNumber: retouchPr.number,
+        retouchPrUrl: retouchPr.url,
+        autoMerge: true,
+        changedPaths: scopeResult.changedPaths
       };
       writePrdRunRecord(options.repoRoot, {
         ...record,
         status: "blocked",
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         blockedGate: "final-review",
-        blockedReason: reason,
-        diagnostics: [reason],
+        blockedReason: `Retouch PR #${retouchPr.number} merged without exposing a merge commit SHA.`,
+        diagnostics: [
+          `Retouch PR #${retouchPr.number} merged but merge commit SHA not available.`
+        ],
         targetName,
-        finalReview: receipt,
+        finalReview: receipt2,
         offendingPaths: []
       });
       return {
         prdRef,
         status: "blocked",
         blockedGate: "final-review",
-        blockedReason: reason,
-        diagnostics: [reason],
+        blockedReason: `Retouch PR #${retouchPr.number} merged without exposing a merge commit SHA.`,
+        diagnostics: [
+          `Retouch PR #${retouchPr.number} merged but merge commit SHA not available.`
+        ],
         offendingPaths: []
       };
     }
-    const unsupportedReason = `Final Review returned unsupported verdict "${verdict}".`;
+    const receipt = {
+      status: "final_reviewed",
+      targetName,
+      prdBranch,
+      mergeBase: mergeBaseResult.mergeBase,
+      verdict: "pass_with_retouch",
+      artifactPath: ".pourkit/final-review-artifact.json",
+      diagnostics: [],
+      reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      retouchPrNumber: retouchPr.number,
+      retouchPrUrl: retouchPr.url,
+      retouchMergeCommit: mergeCommitSha,
+      autoMerge: true,
+      changedPaths: scopeResult.changedPaths
+    };
+    writePrdRunRecord(options.repoRoot, {
+      ...record,
+      status: "final_reviewed",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      targetName,
+      start: record.start,
+      planning: record.planning,
+      finalReview: receipt
+    });
+    return {
+      prdRef,
+      status: "final_reviewed",
+      finalReview: receipt,
+      diagnostics: []
+    };
+  }
+  if (verdict === "needs_human_review") {
+    const reason = summary || "Final Review requires human review.";
+    const receipt = {
+      status: "needs_human_review",
+      targetName,
+      prdBranch,
+      mergeBase: mergeBaseResult.mergeBase,
+      verdict: "needs_human_review",
+      artifactPath: ".pourkit/final-review-artifact.json",
+      diagnostics: artifactDiagnostics.length > 0 ? artifactDiagnostics : [reason],
+      reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
     writePrdRunRecord(options.repoRoot, {
       ...record,
       status: "blocked",
       updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       blockedGate: "final-review",
-      blockedReason: unsupportedReason,
-      diagnostics: [unsupportedReason],
+      blockedReason: reason,
+      diagnostics: [reason],
       targetName,
-      finalReview: {
-        status: "blocked",
-        targetName,
-        prdBranch,
-        mergeBase: mergeBaseResult.mergeBase,
-        diagnostics: [unsupportedReason],
-        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
-      },
+      finalReview: receipt,
       offendingPaths: []
     });
     return {
       prdRef,
+      status: "needs_human_review",
+      finalReview: receipt,
+      diagnostics: [reason]
+    };
+  }
+  if (verdict === "blocked") {
+    const reason = summary || "Final Review blocked.";
+    const receipt = {
       status: "blocked",
+      targetName,
+      prdBranch,
+      mergeBase: mergeBaseResult.mergeBase,
+      verdict: "blocked",
+      artifactPath: ".pourkit/final-review-artifact.json",
+      diagnostics: artifactDiagnostics.length > 0 ? artifactDiagnostics : [reason],
+      reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    writePrdRunRecord(options.repoRoot, {
+      ...record,
+      status: "blocked",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       blockedGate: "final-review",
-      blockedReason: unsupportedReason,
+      blockedReason: reason,
+      diagnostics: [reason],
+      targetName,
+      finalReview: receipt,
+      offendingPaths: []
+    });
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "final-review",
+      blockedReason: reason,
+      diagnostics: [reason],
+      offendingPaths: []
+    };
+  }
+  const unsupportedReason = `Final Review returned unsupported verdict "${verdict}".`;
+  writePrdRunRecord(options.repoRoot, {
+    ...record,
+    status: "blocked",
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    blockedGate: "final-review",
+    blockedReason: unsupportedReason,
+    diagnostics: [unsupportedReason],
+    targetName,
+    finalReview: {
+      status: "blocked",
+      targetName,
+      prdBranch,
+      mergeBase: mergeBaseResult.mergeBase,
       diagnostics: [unsupportedReason],
+      reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    offendingPaths: []
+  });
+  return {
+    prdRef,
+    status: "blocked",
+    blockedGate: "final-review",
+    blockedReason: unsupportedReason,
+    diagnostics: [unsupportedReason],
+    offendingPaths: []
+  };
+}
+function runPrdRunValidateFinalReviewCommand(options) {
+  const prdRef = normalizePrdRunRef2(options.prdRef);
+  const checkoutBase = options.checkoutBase ?? prdRef;
+  const artifactPath = options.artifactPath ? options.artifactPath : join15(options.repoRoot, ".pourkit", "final-review-artifact.json");
+  const artifact = parseFinalReviewArtifact(artifactPath);
+  if (!artifact.ok) {
+    return {
+      prdRef,
+      status: "invalid",
+      artifactPath,
+      reason: artifact.reason,
+      diagnostics: artifact.diagnostics,
       offendingPaths: []
     };
-  } finally {
-    spawnSync2("git", ["worktree", "remove", "--force", worktreePath], {
-      cwd: options.repoRoot,
-      encoding: "utf8"
+  }
+  let changedPaths = options.changedPaths;
+  if (artifact.verdict === "pass_with_retouch" && (!changedPaths || changedPaths.length === 0) && (!artifact.changedPaths || artifact.changedPaths.length === 0)) {
+    const diffResult = spawnSync2(
+      "git",
+      ["diff", "--name-only", options.reviewBase, "HEAD", "--", "."],
+      { cwd: options.repoRoot, encoding: "utf8" }
+    );
+    if (diffResult.status !== 0) {
+      return {
+        prdRef,
+        status: "invalid",
+        artifactPath,
+        reason: "Final Review retouch path discovery failed.",
+        diagnostics: collectSpawnDiagnostics(diffResult, "git diff failed"),
+        offendingPaths: []
+      };
+    }
+    changedPaths = diffResult.stdout.split(/\r?\n/).filter(Boolean);
+  }
+  const result = validateFinalReviewAgentOutputs({
+    artifactPath,
+    context: {
+      prdRef,
+      prdBranch: checkoutBase,
+      mergeBase: options.reviewBase
+    },
+    changedPaths
+  });
+  if (!result.ok) {
+    return {
+      prdRef,
+      status: "invalid",
+      artifactPath,
+      reason: result.reason,
+      diagnostics: result.diagnostics,
+      offendingPaths: result.offendingPaths
+    };
+  }
+  return {
+    prdRef,
+    status: "valid",
+    artifactPath,
+    verdict: result.artifact.verdict,
+    diagnostics: [],
+    changedPaths: result.retouch?.changedPaths
+  };
+}
+async function runPrdRunReconcileCommand(options) {
+  const prdRef = normalizePrdRunRef2(options.prdRef);
+  const targetName = options.targetName.trim();
+  if (!targetName) {
+    throw new Error(
+      `Invalid target name "${options.targetName}". Expected a non-empty target name.`
+    );
+  }
+  const { record, diagnostics: readDiagnostics } = readPrdRun(
+    options.repoRoot,
+    prdRef
+  );
+  if (readDiagnostics.length > 0) {
+    const reason = `PRD Run ${prdRef} has a malformed record and cannot reconcile.`;
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: reason,
+      diagnostics: readDiagnostics,
+      offendingPaths: []
+    };
+  }
+  if (!record) {
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: `PRD Run ${prdRef} does not exist. Run prd-run prepare/start/launch first.`,
+      diagnostics: [`No PRD Run record found for ${prdRef}`],
+      offendingPaths: []
+    };
+  }
+  if (record.status !== "final_reviewed" && record.blockedGate !== "reconciliation") {
+    const reason = `PRD Run ${prdRef} has not completed Final Review. Reconciliation requires status "final_reviewed", got "${record.status}".`;
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: reason,
+      diagnostics: [`Current status: ${record.status}`],
+      offendingPaths: []
+    };
+  }
+  if (!record.finalReview) {
+    const reason = `PRD Run ${prdRef} has no Final Review receipt. Cannot reconcile without a completed Final Review.`;
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: reason,
+      diagnostics: ["Missing finalReview receipt in PRD Run record."],
+      offendingPaths: []
+    };
+  }
+  const finalReviewReceipt = record.finalReview;
+  if (finalReviewReceipt.status !== "final_reviewed" && finalReviewReceipt.status !== "succeeded") {
+    const reason = `PRD Run ${prdRef} Final Review receipt has status "${finalReviewReceipt.status}"; expected "final_reviewed" or "succeeded".`;
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: reason,
+      diagnostics: [
+        `Final Review status: ${finalReviewReceipt.status}`,
+        `Verdict: ${finalReviewReceipt.verdict ?? "unknown"}`
+      ],
+      offendingPaths: []
+    };
+  }
+  const prdBranch = record.prdBranch ?? prdRef;
+  const mergeBase = finalReviewReceipt.mergeBase;
+  if (!mergeBase || mergeBase.length < 6) {
+    const reason = `PRD Run ${prdRef} Final Review receipt is missing a valid merge base.`;
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: reason,
+      diagnostics: [
+        mergeBase ? `Merge base "${mergeBase}" is too short.` : "Merge base is missing."
+      ],
+      offendingPaths: []
+    };
+  }
+  const manifestResult = readPlanningArtifactManifest(options.repoRoot, prdRef);
+  if (!manifestResult.ok) {
+    const reason = `Reconciliation Evidence Packet construction failed: ${manifestResult.reason}`;
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: reason,
+      diagnostics: manifestResult.diagnostics,
+      offendingPaths: manifestResult.offendingPaths
+    };
+  }
+  const manifest = manifestResult.manifest;
+  let evidencePacket;
+  try {
+    evidencePacket = buildEvidencePacket({
+      prdRef,
+      prdBranch,
+      mergeBase,
+      planningManifestPath: manifest.manifestPath,
+      planningManifestFacts: {
+        parentPrdIssueUrl: manifest.parentIssue.url,
+        childIssueCount: manifest.childIssues.length
+      },
+      stage: "prdReconciliation",
+      stageReceipts: { finalReviewReceipt }
     });
-    rmSync3(worktreePath, { recursive: true, force: true });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    const reason = `Reconciliation Evidence Packet construction failed: ${msg}`;
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: reason,
+      diagnostics: [msg],
+      offendingPaths: []
+    };
+  }
+  if (evidencePacket.stage !== "prdReconciliation") {
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: `Evidence Packet stage is "${evidencePacket.stage}", expected "prdReconciliation".`,
+      diagnostics: [`Stage: ${evidencePacket.stage}`],
+      offendingPaths: []
+    };
   }
+  const expectedRef = prdRef;
+  if (evidencePacket.prdRef !== expectedRef) {
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: `Evidence Packet PRD ref "${evidencePacket.prdRef}" does not match active PRD Run "${expectedRef}".`,
+      diagnostics: [
+        `Evidence Packet PRD ref: ${evidencePacket.prdRef}`,
+        `Expected: ${expectedRef}`
+      ],
+      offendingPaths: []
+    };
+  }
+  if (evidencePacket.prdBranch !== prdBranch) {
+    return {
+      prdRef,
+      status: "blocked",
+      blockedGate: "reconciliation",
+      blockedReason: `Evidence Packet PRD branch "${evidencePacket.prdBranch}" does not match active PRD Branch "${prdBranch}".`,
+      diagnostics: [
+        `Evidence Packet branch: ${evidencePacket.prdBranch}`,
+        `Expected: ${prdBranch}`
+      ],
+      offendingPaths: []
+    };
+  }
+  const receipt = {
+    status: "blocked",
+    targetName,
+    prdBranch,
+    mergeBase,
+    diagnostics: [
+      "Reconciliation automation is not fully implemented. Full reconciliation requires Worktree creation, Architect invocation, output validation, and PR creation, none of which are implemented in this version."
+    ]
+  };
+  writePrdRunRecord(options.repoRoot, {
+    ...record,
+    status: "final_reviewed",
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    targetName,
+    start: record.start,
+    planning: record.planning,
+    finalReview: record.finalReview,
+    reconciliation: receipt
+  });
+  return {
+    prdRef,
+    status: "reconciled",
+    reconciliation: receipt,
+    diagnostics: ["Reconciliation automation is not fully implemented."]
+  };
 }
 function computeFinalReviewMergeBase(repoRoot2, prdRef) {
   const normalized = normalizePrdRunRef2(prdRef);
@@ -8285,97 +9053,169 @@ function computeFinalReviewMergeBase(repoRoot2, prdRef) {
   if (mergeBaseResult.status !== 0) {
     if (mergeBaseResult.stderr?.toString?.()?.trim()) {
       mergeBaseDiagnostics.push(mergeBaseResult.stderr.toString().trim());
-    }
-    if (mergeBaseResult.stdout?.toString?.()?.trim()) {
-      mergeBaseDiagnostics.push(mergeBaseResult.stdout.toString().trim());
-    }
-    return {
-      ok: false,
-      gate: "final-review",
-      reason: `Final Review merge-base computation failed for origin/dev and origin/${normalized}.`,
-      diagnostics: mergeBaseDiagnostics.length > 0 ? mergeBaseDiagnostics : ["git merge-base returned non-zero exit status"]
-    };
-  }
-  const mergeBase = mergeBaseResult.stdout?.toString?.()?.trim();
-  if (!mergeBase) {
-    return {
-      ok: false,
-      gate: "final-review",
-      reason: `Final Review merge-base returned empty result for origin/dev and origin/${normalized}.`,
-      diagnostics: [
-        `merge-base stdout was empty for origin/dev..origin/${normalized}`
-      ]
-    };
-  }
-  return { ok: true, mergeBase, diagnostics: fetchDiagnostics };
-}
-function parseFinalReviewArtifact(artifactPath) {
-  if (!existsSync11(artifactPath)) {
-    return {
-      ok: false,
-      reason: "Final Review artifact not found.",
-      diagnostics: [`Artifact path: ${artifactPath}`]
-    };
-  }
-  let content;
-  try {
-    content = readFileSync11(artifactPath, "utf-8");
-  } catch (error) {
-    return {
-      ok: false,
-      reason: "Final Review artifact could not be read.",
-      diagnostics: [
-        error instanceof Error ? error.message : String(error),
-        `Artifact path: ${artifactPath}`
-      ]
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    return {
-      ok: false,
-      reason: "Final Review artifact is not valid JSON.",
-      diagnostics: [`Artifact path: ${artifactPath}`]
-    };
-  }
-  const verdict = parsed.verdict;
-  if (!verdict || typeof verdict !== "string") {
-    return {
-      ok: false,
-      reason: "Final Review artifact is missing a verdict field.",
-      diagnostics: [`Artifact content preview: ${content.slice(0, 300)}`]
-    };
-  }
-  const allowedVerdicts = [
-    "pass_no_changes",
-    "pass_with_retouch",
-    "needs_human_review",
-    "blocked"
-  ];
-  if (!allowedVerdicts.includes(verdict)) {
+    }
+    if (mergeBaseResult.stdout?.toString?.()?.trim()) {
+      mergeBaseDiagnostics.push(mergeBaseResult.stdout.toString().trim());
+    }
     return {
       ok: false,
-      reason: `Final Review artifact has unsupported verdict "${verdict}".`,
-      diagnostics: [`Allowed verdicts: ${allowedVerdicts.join(", ")}`]
+      gate: "final-review",
+      reason: `Final Review merge-base computation failed for origin/dev and origin/${normalized}.`,
+      diagnostics: mergeBaseDiagnostics.length > 0 ? mergeBaseDiagnostics : ["git merge-base returned non-zero exit status"]
     };
   }
-  const summary = typeof parsed.summary === "string" ? parsed.summary : typeof parsed.reason === "string" ? parsed.reason : String(verdict);
-  const diagnostics = Array.isArray(parsed.diagnostics) ? parsed.diagnostics : [];
-  const changedPaths = Array.isArray(parsed.changedPaths) ? parsed.changedPaths : void 0;
-  const isAutoSummary = !parsed.summary && !parsed.reason;
-  if (verdict === "pass_with_retouch" && (!changedPaths || changedPaths.length === 0) && isAutoSummary) {
+  const mergeBase = mergeBaseResult.stdout?.toString?.()?.trim();
+  if (!mergeBase) {
     return {
       ok: false,
-      reason: 'Final Review artifact with "pass_with_retouch" verdict requires changed paths.',
+      gate: "final-review",
+      reason: `Final Review merge-base returned empty result for origin/dev and origin/${normalized}.`,
       diagnostics: [
-        "pass_with_retouch verdict must include a changedPaths array in the artifact or provide a summary/reason with enough context for git diff fallback.",
-        "Provide changedPaths or a descriptive summary in the artifact."
+        `merge-base stdout was empty for origin/dev..origin/${normalized}`
       ]
     };
   }
-  return { ok: true, verdict, summary, diagnostics, changedPaths };
+  return { ok: true, mergeBase, diagnostics: fetchDiagnostics };
+}
+var PRD_047_PRD_MIRROR_PATH = ".pourkit/architecture/initiatives/prd-run-lifecycle-and-integration-gate/prds/PRD-047-prd-reconciliation-run/PRD.md";
+var PRD_047_CHILD_ISSUE_DIR = ".pourkit/architecture/initiatives/prd-run-lifecycle-and-integration-gate/prds/PRD-047-prd-reconciliation-run/issues/";
+var PRD_047_ESCAPE_HATCH_PATH = ".pourkit/architecture/initiatives/prd-run-lifecycle-and-integration-gate/completions/006-prd-047-prd-reconciliation-run-status.md";
+var PRD_047_MANIFEST_PATH = ".pourkit/architecture/initiatives/prd-run-lifecycle-and-integration-gate/prds/PRD-047-prd-reconciliation-run/planning-manifest.md";
+function auditPrd047Implementation(repoRoot2, prdRef) {
+  const normalizedRef = normalizePrdRunRef2(prdRef);
+  const blockerBugs = [];
+  const blockersFixed = [];
+  const nonBlockers = [];
+  const prdMirrorPath = join15(repoRoot2, PRD_047_PRD_MIRROR_PATH);
+  const completionsDir = join15(repoRoot2, dirname7(PRD_047_ESCAPE_HATCH_PATH));
+  let escapeHatchPresent = false;
+  if (existsSync12(completionsDir)) {
+    const files = readdirSync4(completionsDir);
+    escapeHatchPresent = files.some(
+      (f) => f.endsWith(".md") && (f.includes("prd-047") || f.includes("prd-reconciliation"))
+    );
+  }
+  if (!escapeHatchPresent) {
+    escapeHatchPresent = existsSync12(join15(repoRoot2, PRD_047_ESCAPE_HATCH_PATH));
+  }
+  const prdMirrorExists = existsSync12(prdMirrorPath);
+  if (!prdMirrorExists) {
+    nonBlockers.push(
+      `PRD-047 PRD mirror not found at ${PRD_047_PRD_MIRROR_PATH}. Cannot verify scope alignment from published mirrors.`
+    );
+  }
+  if (prdMirrorExists) {
+    const mirrorContent = readFileSync12(prdMirrorPath, "utf-8");
+    const hasReconcileCommand = mirrorContent.includes("prd-run reconcile");
+    const hasEscapeHatch = mirrorContent.includes("escape hatch");
+    if (!hasReconcileCommand) {
+      blockerBugs.push(
+        "PRD-047 PRD mirror does not reference prd-run reconcile command."
+      );
+    }
+    if (!hasEscapeHatch) {
+      nonBlockers.push(
+        "PRD-047 PRD mirror does not reference escape hatch mechanism."
+      );
+    }
+  }
+  const childIssueDir = join15(repoRoot2, PRD_047_CHILD_ISSUE_DIR);
+  const childIssuesExist = existsSync12(childIssueDir);
+  if (!childIssuesExist) {
+    nonBlockers.push(
+      `PRD-047 child Issue mirrors not found at ${PRD_047_CHILD_ISSUE_DIR}.`
+    );
+  }
+  const manifestPath = join15(repoRoot2, PRD_047_MANIFEST_PATH);
+  if (existsSync12(manifestPath)) {
+    const manifestContent = readFileSync12(manifestPath, "utf-8");
+    if (!manifestContent.includes("ready_for_prepare")) {
+      nonBlockers.push(
+        "Planning Artifact Manifest is not marked as ready_for_prepare."
+      );
+    }
+    if (!manifestContent.includes("Publication Receipt")) {
+      nonBlockers.push(
+        "Planning Artifact Manifest is missing parent PRD publication receipt."
+      );
+    }
+    if (!manifestContent.includes("Triage Receipt")) {
+      nonBlockers.push(
+        "Planning Artifact Manifest is missing child Issue triage receipt."
+      );
+    }
+  } else {
+    nonBlockers.push(
+      "Planning Artifact Manifest not found. Cannot verify publication receipts."
+    );
+  }
+  const prdRunRecord = readPrdRun(repoRoot2, normalizedRef);
+  if (prdRunRecord.record && prdRunRecord.record.reconciliation) {
+    if (prdRunRecord.record.reconciliation.status === "succeeded") {
+      blockerBugs.push(
+        "Fabricated reconciliation success: reconciliation receipt has status 'succeeded' but full reconciliation automation is not implemented."
+      );
+    }
+  }
+  if (prdRunRecord.record && prdRunRecord.record.finalReview) {
+    if (prdRunRecord.record.finalReview.status === "succeeded" && (!prdRunRecord.record.finalReview.artifactPath || !prdRunRecord.record.finalReview.reviewedAt)) {
+      blockerBugs.push(
+        "Fabricated Final Review receipt: status is 'succeeded' without evidence of agent execution (missing artifactPath or reviewedAt)."
+      );
+    }
+  }
+  if (prdRunRecord.record && prdRunRecord.record.start) {
+    const start = prdRunRecord.record.start;
+    if (start.prdBranch !== normalizedRef) {
+      blockerBugs.push(
+        `PRD Branch mismatch: start receipt branch "${start.prdBranch}" does not match PRD ref "${normalizedRef}".`
+      );
+    }
+    if (!start.startBaseCommit) {
+      blockerBugs.push(
+        `PRD Run start receipt is missing startBaseCommit for branch "${start.prdBranch}".`
+      );
+    }
+    if (!start.branchAction) {
+      blockerBugs.push(
+        `PRD Run start receipt is missing branchAction for branch "${start.prdBranch}".`
+      );
+    }
+  }
+  if (prdRunRecord.record && prdRunRecord.record.status === "waiting_for_integration" && !prdRunRecord.record.reconciliation) {
+    blockerBugs.push(
+      "PRD Run is in 'waiting_for_integration' status without a reconciliation receipt."
+    );
+  }
+  if (!prdRunRecord.record) {
+    nonBlockers.push(
+      `No PRD Run record found for ${normalizedRef}. Cannot verify implementation state.`
+    );
+  }
+  if (!prdMirrorExists && !childIssuesExist && !prdRunRecord.record) {
+    nonBlockers.push(
+      "Insufficient evidence to verify PRD-047 scope alignment: mirrors and PRD Run record are missing."
+    );
+  }
+  if (escapeHatchPresent) {
+    blockersFixed.push(
+      "PRD-047 escape-hatch lifecycle violation record confirmed present."
+    );
+  } else {
+    nonBlockers.push(
+      "PRD-047 escape-hatch lifecycle violation record is missing. Expected at " + PRD_047_ESCAPE_HATCH_PATH + "."
+    );
+  }
+  return {
+    blockerBugs,
+    blockersFixed,
+    nonBlockers,
+    escapeHatchPresent
+  };
+}
+function runPrdRunAuditCommand(options) {
+  const prdRef = normalizePrdRunRef2(options.prdRef);
+  return auditPrd047Implementation(options.repoRoot, prdRef);
 }
 async function runPrdRunLaunchCommand(options) {
   const prdRef = normalizePrdRunRef2(options.prdRef);
@@ -8386,18 +9226,16 @@ async function runPrdRunLaunchCommand(options) {
   const existingRecord = readPrdRun(options.repoRoot, prdRef);
   if (existingRecord.record) {
     const terminal = /* @__PURE__ */ new Set([
-      "drained",
       "waiting_for_integration",
       "finalizing",
-      "complete",
-      "final_reviewed"
+      "complete"
     ]);
     if (terminal.has(existingRecord.record.status)) {
       return {
         prdRef,
         status: existingRecord.record.status,
         attempted: [],
-        skipped: ["prepare", "start", "queue"],
+        skipped: ["prepare", "start", "queue", "final-review", "reconcile"],
         resumed: [],
         diagnostics: [
           `PRD Run ${prdRef} is already in status "${existingRecord.record.status}".`
@@ -8407,28 +9245,42 @@ async function runPrdRunLaunchCommand(options) {
   }
   if (existingRecord.record) {
     const status = existingRecord.record.status;
-    const resumableStartBlock = status === "blocked" && (existingRecord.record.blockedGate === "queue" || existingRecord.record.blockedGate === "branch-state");
-    if (status === "starting" || status === "running" || resumableStartBlock) {
-      if (existingRecord.record.start) {
+    if (status === "drained") {
+      skipped.push("prepare", "start", "queue");
+      resumed.push("final-review");
+    } else if (status === "final_reviewed") {
+      skipped.push("prepare", "start", "queue", "final-review");
+      resumed.push("reconcile");
+    } else if (status === "blocked" && existingRecord.record.blockedGate === "reconciliation") {
+      skipped.push("prepare", "start", "queue", "final-review");
+      resumed.push("reconcile");
+    } else if (status === "blocked" && existingRecord.record.blockedGate === "final-review" && canRetryFinalReviewBlock(existingRecord.record)) {
+      skipped.push("prepare", "start", "queue");
+      resumed.push("final-review");
+    } else {
+      const resumableStartBlock = status === "blocked" && (existingRecord.record.blockedGate === "queue" || existingRecord.record.blockedGate === "branch-state");
+      if (status === "starting" || status === "running" || resumableStartBlock) {
+        if (existingRecord.record.start) {
+          skipped.push("prepare");
+          resumed.push("start");
+        } else {
+          return {
+            prdRef,
+            status: "blocked",
+            attempted: [],
+            skipped: ["prepare", "start", "queue", "final-review", "reconcile"],
+            resumed: [],
+            diagnostics: [
+              `PRD Run ${prdRef} is in status "${status}" but has no start receipt.`
+            ],
+            blockedGate: "branch-state",
+            blockedReason: `PRD Run ${prdRef} is in status "${status}" without a start receipt. Cannot resume launch.`,
+            offendingPaths: []
+          };
+        }
+      } else if (status === "ready_to_start") {
         skipped.push("prepare");
-        resumed.push("start");
-      } else {
-        return {
-          prdRef,
-          status: "blocked",
-          attempted: [],
-          skipped: ["prepare", "start", "queue"],
-          resumed: [],
-          diagnostics: [
-            `PRD Run ${prdRef} is in status "${status}" but has no start receipt.`
-          ],
-          blockedGate: "branch-state",
-          blockedReason: `PRD Run ${prdRef} is in status "${status}" without a start receipt. Cannot resume launch.`,
-          offendingPaths: []
-        };
       }
-    } else if (status === "ready_to_start") {
-      skipped.push("prepare");
     }
   }
   if (existingRecord.record && existingRecord.record.status !== "blocked" && !skipped.includes("prepare")) {
@@ -8470,57 +9322,166 @@ async function runPrdRunLaunchCommand(options) {
     }
     diagnostics.push(...prepareResult.diagnostics);
   }
-  attempted.push("start");
-  const startResult = await runPrdRunStartCommand({
-    repoRoot: options.repoRoot,
-    prdRef,
-    targetName: options.targetName,
-    config: options.config,
-    issueProvider: options.issueProvider,
-    prProvider: options.prProvider,
-    executionProvider: options.executionProvider,
-    logger: options.logger,
-    skipPrepareCheck: options.skipPrepareCheck,
-    adoptExistingBranch: options.adoptExistingBranch
-  });
-  const skippedAfterStart = skipped.includes("prepare") ? [...skipped, "queue"] : ["queue"];
-  if (startResult.status === "blocked") {
-    return {
+  let startResult;
+  if (!skipped.includes("start")) {
+    attempted.push("start");
+    startResult = await runPrdRunStartCommand({
+      repoRoot: options.repoRoot,
       prdRef,
-      status: "blocked",
-      attempted,
-      skipped: skippedAfterStart,
-      resumed,
-      diagnostics: startResult.diagnostics,
-      blockedGate: startResult.blockedGate,
-      blockedReason: startResult.blockedReason,
-      offendingPaths: startResult.offendingPaths,
-      prepare: prepareResult,
-      start: startResult
-    };
-  }
-  if (startResult.status === "starting") {
-    return {
+      targetName: options.targetName,
+      config: options.config,
+      issueProvider: options.issueProvider,
+      prProvider: options.prProvider,
+      executionProvider: options.executionProvider,
+      logger: options.logger,
+      skipPrepareCheck: options.skipPrepareCheck,
+      adoptExistingBranch: options.adoptExistingBranch
+    });
+    const skippedAfterStart = [
+      ...skipped.includes("prepare") ? ["prepare"] : [],
+      "queue",
+      "final-review",
+      "reconcile"
+    ];
+    if (startResult.status === "blocked") {
+      return {
+        prdRef,
+        status: "blocked",
+        attempted,
+        skipped: skippedAfterStart,
+        resumed,
+        diagnostics: startResult.diagnostics,
+        blockedGate: startResult.blockedGate,
+        blockedReason: startResult.blockedReason,
+        offendingPaths: startResult.offendingPaths,
+        prepare: prepareResult,
+        start: startResult
+      };
+    }
+    if (startResult.status === "starting") {
+      return {
+        prdRef,
+        status: "starting",
+        attempted,
+        skipped: skippedAfterStart,
+        resumed,
+        diagnostics: startResult.diagnostics,
+        prepare: prepareResult,
+        start: startResult
+      };
+    }
+    diagnostics.push(...startResult.diagnostics);
+    attempted.push("queue");
+  }
+  let finalReviewResult;
+  if (!skipped.includes("final-review")) {
+    attempted.push("final-review");
+    finalReviewResult = await runPrdRunFinalReviewCommand({
+      repoRoot: options.repoRoot,
       prdRef,
-      status: "starting",
-      attempted,
-      skipped: skippedAfterStart,
-      resumed,
-      diagnostics: startResult.diagnostics,
-      prepare: prepareResult,
-      start: startResult
-    };
+      targetName: options.targetName,
+      autoMerge: options.autoMerge,
+      issueProvider: options.issueProvider,
+      prProvider: options.prProvider,
+      executionProvider: options.executionProvider,
+      config: options.config,
+      logger: options.logger
+    });
+    const skippedAfterFr = [
+      ...skipped.includes("prepare") ? ["prepare"] : [],
+      ...skipped.includes("start") ? ["queue"] : [],
+      "reconcile"
+    ];
+    if (finalReviewResult.status === "blocked") {
+      return {
+        prdRef,
+        status: "blocked",
+        attempted,
+        skipped: skippedAfterFr,
+        resumed,
+        diagnostics: finalReviewResult.diagnostics,
+        blockedGate: "final-review",
+        blockedReason: finalReviewResult.blockedReason,
+        offendingPaths: finalReviewResult.offendingPaths,
+        prepare: prepareResult,
+        start: startResult,
+        finalReview: finalReviewResult
+      };
+    }
+    if (finalReviewResult.status === "needs_human_review") {
+      return {
+        prdRef,
+        status: "blocked",
+        attempted,
+        skipped: skippedAfterFr,
+        resumed,
+        diagnostics: finalReviewResult.diagnostics,
+        blockedGate: "final-review",
+        blockedReason: finalReviewResult.finalReview.verdict ?? "needs_human_review",
+        offendingPaths: [],
+        prepare: prepareResult,
+        start: startResult,
+        finalReview: finalReviewResult
+      };
+    }
+    diagnostics.push(...finalReviewResult.diagnostics);
+  }
+  let reconcileResult;
+  if (!skipped.includes("reconcile")) {
+    attempted.push("reconcile");
+    reconcileResult = await runPrdRunReconcileCommand({
+      repoRoot: options.repoRoot,
+      prdRef,
+      targetName: options.targetName,
+      config: options.config,
+      logger: options.logger
+    });
+    if (reconcileResult.status === "blocked") {
+      return {
+        prdRef,
+        status: "blocked",
+        attempted,
+        skipped: [...skipped],
+        resumed,
+        diagnostics: reconcileResult.diagnostics,
+        blockedGate: "reconciliation",
+        blockedReason: reconcileResult.blockedReason,
+        offendingPaths: reconcileResult.offendingPaths,
+        prepare: prepareResult,
+        start: startResult,
+        finalReview: finalReviewResult,
+        reconcile: reconcileResult
+      };
+    }
+    diagnostics.push(...reconcileResult.diagnostics);
   }
-  attempted.push("queue");
+  const currentRecord = readPrdRun(options.repoRoot, prdRef).record;
+  writePrdRunRecord(options.repoRoot, {
+    prdRef,
+    status: "waiting_for_integration",
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    targetName: currentRecord?.targetName ?? options.targetName,
+    prdBranch: currentRecord?.prdBranch,
+    manifestPath: currentRecord?.manifestPath,
+    planning: currentRecord?.planning,
+    start: currentRecord?.start,
+    finalReview: currentRecord?.finalReview,
+    reconciliation: currentRecord?.reconciliation,
+    scopeChanges: currentRecord?.scopeChanges
+  });
   return {
     prdRef,
-    status: "drained",
+    status: "waiting_for_integration",
     attempted,
     skipped,
     resumed,
-    diagnostics: startResult.diagnostics,
+    diagnostics: [
+      "Integration Gate is not implemented. PRD Run is waiting for manual integration."
+    ],
     prepare: prepareResult,
-    start: startResult
+    start: startResult,
+    finalReview: finalReviewResult,
+    reconcile: reconcileResult
   };
 }
 async function runPrdRunPrepareCommand(options) {
@@ -9690,47 +10651,6 @@ function validateArchitecturePlanningDiffScope(changedFiles) {
 function isArchitecturePlanningDiffPath(path9) {
   return path9.startsWith(".pourkit/architecture/") || path9 === ".pourkit/CONTEXT.md" || path9.startsWith(".pourkit/docs/adr/");
 }
-function isRetouchScopePath(path9) {
-  if (path9.startsWith(".pourkit/architecture/") || path9 === ".pourkit/CONTEXT.md" || path9.startsWith(".pourkit/docs/adr/") || /^\.pourkit\/prd-runs\/[^/]+\.json$/.test(path9)) {
-    return false;
-  }
-  return true;
-}
-function validateFinalReviewRetouchScope(changedPaths) {
-  if (!changedPaths || changedPaths.length === 0) {
-    return {
-      ok: false,
-      reason: "Final Review retouch scope validation failed. No changed paths available. Provide changed paths or run Final Review with a summary that includes changed paths.",
-      diagnostics: ["Changed paths list is empty or undefined."],
-      offendingPaths: []
-    };
-  }
-  const offendingPaths = changedPaths.filter((p) => !isRetouchScopePath(p));
-  const allowedPaths = changedPaths.filter((p) => isRetouchScopePath(p));
-  if (allowedPaths.length === 0) {
-    return {
-      ok: false,
-      reason: "Final Review retouch scope validation failed. No implementation, test, or Changeset paths found for retouch.",
-      diagnostics: [
-        "All changed paths are prohibited for retouch.",
-        ...changedPaths.map((p) => `  - ${p}`)
-      ],
-      offendingPaths
-    };
-  }
-  if (offendingPaths.length > 0) {
-    return {
-      ok: false,
-      reason: "Final Review retouch scope validation failed. Prohibited paths cannot be included in retouch PR.",
-      diagnostics: [
-        "Prohibited paths found:",
-        ...offendingPaths.map((p) => `  - ${p}`)
-      ],
-      offendingPaths
-    };
-  }
-  return { ok: true, changedPaths };
-}
 async function ensurePlanningBranchPublished(repoRoot2, branchName, changedFiles) {
   const remoteResult = spawnSync2("git", ["remote", "get-url", "origin"], {
     cwd: repoRoot2,
@@ -9739,7 +10659,7 @@ async function ensurePlanningBranchPublished(repoRoot2, branchName, changedFiles
   if (remoteResult.status !== 0) {
     return;
   }
-  const worktreePath = mkdtempSync(join15(tmpdir(), "pourkit-planning-"));
+  const worktreePath = mkdtempSync2(join15(tmpdir2(), "pourkit-planning-"));
   try {
     runGitOrThrow(repoRoot2, ["fetch", "origin", "dev"], "fetch origin/dev");
     runGitOrThrow(
@@ -10013,7 +10933,7 @@ function parseGitStatusLine(line) {
   return { status, path: path9.replace(/^"|"$/g, "") };
 }
 function validateManifestArtifactExistence(repoRoot2, manifest) {
-  const missingPaths = listManifestArtifactPaths(repoRoot2, manifest).filter((path9) => !existsSync11(path9)).map((path9) => toRepoRelativePath2(repoRoot2, path9));
+  const missingPaths = listManifestArtifactPaths(repoRoot2, manifest).filter((path9) => !existsSync12(path9)).map((path9) => toRepoRelativePath2(repoRoot2, path9));
   if (missingPaths.length > 0) {
     return {
       ok: false,
@@ -10430,7 +11350,7 @@ async function runPrMergeCommand(args, logger, prProvider, config) {
 
 // commands/init.ts
 init_github_client();
-import { existsSync as existsSync12, statSync } from "fs";
+import { existsSync as existsSync13, statSync } from "fs";
 import {
   copyFile,
   mkdir as mkdir4,
@@ -10872,7 +11792,7 @@ async function computeFileChecksum(filePath) {
   return createHash2("sha256").update(content).digest("hex");
 }
 function lockfileExists(root, name) {
-  return existsSync12(path7.join(root, name));
+  return existsSync13(path7.join(root, name));
 }
 function detectPackageManager(root) {
   if (lockfileExists(root, "pnpm-lock.yaml")) return "pnpm";
@@ -10916,7 +11836,7 @@ async function discoverLocalSource(sourcePath) {
 async function discoverReadme(root) {
   for (const name of ["README.md", "readme.md"]) {
     const p = path7.join(root, name);
-    if (existsSync12(p)) {
+    if (existsSync13(p)) {
       return p;
     }
   }
@@ -10926,7 +11846,7 @@ async function discoverAgentFiles(root) {
   const files = [];
   for (const name of ["AGENTS.md", "CLAUDE.md"]) {
     const p = path7.join(root, name);
-    if (existsSync12(p)) {
+    if (existsSync13(p)) {
       files.push(p);
     }
   }
@@ -10934,7 +11854,7 @@ async function discoverAgentFiles(root) {
 }
 async function discoverMerlleState(root) {
   const p = path7.join(root, ".pourkit", "state.json");
-  return existsSync12(p) ? p : null;
+  return existsSync13(p) ? p : null;
 }
 async function discoverAgentSkills(root) {
   const dirs = [
@@ -10943,7 +11863,7 @@ async function discoverAgentSkills(root) {
   ];
   const found = [];
   for (const d of dirs) {
-    if (existsSync12(d)) {
+    if (existsSync13(d)) {
       found.push(d);
     }
   }
@@ -10953,12 +11873,12 @@ async function discoverRootDomainDocs(root) {
   const docs = [];
   for (const name of ["CONTEXT.md", "CONTEXT-MAP.md"]) {
     const p = path7.join(root, name);
-    if (existsSync12(p)) {
+    if (existsSync13(p)) {
       docs.push(p);
     }
   }
   const adrDir = path7.join(root, "docs", "adr");
-  if (existsSync12(adrDir)) {
+  if (existsSync13(adrDir)) {
     const entries = await readdir(adrDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -11101,7 +12021,7 @@ async function planInit(options) {
       for (const file of skillFiles) {
         const relPath = path7.relative(s, file);
         const destPath = path7.join(targetRoot, ".agents", "skills", relPath);
-        if (!existsSync12(destPath)) {
+        if (!existsSync13(destPath)) {
           operations.push({
             kind: "copy",
             sourcePath: file,
@@ -11164,7 +12084,7 @@ async function planInit(options) {
     });
   }
   if (sourceRoot) {
-    if (!existsSync12(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
+    if (!existsSync13(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
       warnings.push(
         `--from-local path does not exist or is not a directory: ${sourceRoot}`
       );
@@ -11283,7 +12203,7 @@ async function planInit(options) {
             requiresConfirmation: false,
             destructive: false
           });
-        } else if (existsSync12(destPath)) {
+        } else if (existsSync13(destPath)) {
           operations.push({
             kind: "skip",
             path: destPath,
@@ -11341,7 +12261,7 @@ async function planInit(options) {
         }
       }
       const contextPath = path7.join(targetRoot, ".pourkit", "CONTEXT.md");
-      if (!existsSync12(contextPath) && !merleDestPaths.has(contextPath)) {
+      if (!existsSync13(contextPath) && !merleDestPaths.has(contextPath)) {
         operations.push({
           kind: "create",
           path: contextPath,
@@ -11359,7 +12279,7 @@ async function planInit(options) {
         "adr",
         ".gitkeep"
       );
-      if (!existsSync12(adrGitkeep)) {
+      if (!existsSync13(adrGitkeep)) {
         operations.push({
           kind: "create",
           path: adrGitkeep,
@@ -11371,7 +12291,7 @@ async function planInit(options) {
       }
       const srcDocAgents = path7.join(sourceRoot, ".pourkit", "docs", "agents");
       const tgtDocAgents = path7.join(targetRoot, ".pourkit", "docs", "agents");
-      if (existsSync12(srcDocAgents) && !existsSync12(tgtDocAgents)) {
+      if (existsSync13(srcDocAgents) && !existsSync13(tgtDocAgents)) {
         const docFiles = await walkDir(srcDocAgents);
         for (const file of docFiles) {
           const relPath = path7.relative(srcDocAgents, file);
@@ -11404,7 +12324,7 @@ async function planInit(options) {
       }
       const srcPrompts = path7.join(sourceRoot, ".pourkit", "prompts");
       const tgtPrompts = path7.join(targetRoot, ".pourkit", "prompts");
-      if (existsSync12(srcPrompts) && !existsSync12(tgtPrompts)) {
+      if (existsSync13(srcPrompts) && !existsSync13(tgtPrompts)) {
         const promptFiles = await walkDir(srcPrompts);
         for (const file of promptFiles) {
           const relPath = path7.relative(srcPrompts, file);
@@ -11431,7 +12351,7 @@ async function planInit(options) {
         ".sandcastle",
         "Dockerfile"
       );
-      if (existsSync12(tgtSandboxDockerfile)) {
+      if (existsSync13(tgtSandboxDockerfile)) {
         operations.push({
           kind: "skip",
           path: tgtSandboxDockerfile,
@@ -11440,7 +12360,7 @@ async function planInit(options) {
           requiresConfirmation: false,
           destructive: false
         });
-      } else if (existsSync12(srcSandboxDockerfile)) {
+      } else if (existsSync13(srcSandboxDockerfile)) {
         const checksum = await computeFileChecksum(srcSandboxDockerfile);
         operations.push({
           kind: "copy",
@@ -11454,7 +12374,7 @@ async function planInit(options) {
         });
       }
       const configTsPath = path7.join(targetRoot, "pourkit.config.ts");
-      if (!existsSync12(configTsPath)) {
+      if (!existsSync13(configTsPath)) {
         const verifyCommands = inferVerificationCommands(
           packageScripts,
           pm || "npm"
@@ -11491,7 +12411,7 @@ async function planInit(options) {
       const hasExistingAgents = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("AGENTS.md")
       );
-      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync12(path7.join(targetRoot, "AGENTS.md"))) {
+      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync13(path7.join(targetRoot, "AGENTS.md"))) {
         operations.push({
           kind: "create",
           path: path7.join(targetRoot, "AGENTS.md"),
@@ -11507,7 +12427,7 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
       const hasExistingClaude = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("CLAUDE.md")
       );
-      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync12(path7.join(targetRoot, "CLAUDE.md"))) {
+      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync13(path7.join(targetRoot, "CLAUDE.md"))) {
         operations.push({
           kind: "create",
           path: path7.join(targetRoot, "CLAUDE.md"),
@@ -11522,7 +12442,7 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
       }
       const gitignoreTarget = path7.join(targetRoot, ".gitignore");
       const gitignoreContent = generateGitignoreBlock();
-      if (!existsSync12(gitignoreTarget)) {
+      if (!existsSync13(gitignoreTarget)) {
         operations.push({
           kind: "create",
           path: gitignoreTarget,
@@ -11546,7 +12466,7 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
         });
       }
       const openCodePath = path7.join(targetRoot, "opencode.json");
-      if (!existsSync12(openCodePath)) {
+      if (!existsSync13(openCodePath)) {
         operations.push({
           kind: "create",
           path: openCodePath,
@@ -11603,7 +12523,7 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
         }
       }
       const manifestPath = path7.join(targetRoot, ".pourkit", "manifest.json");
-      if (existsSync12(manifestPath)) {
+      if (existsSync13(manifestPath)) {
         operations.push({
           kind: "skip",
           path: manifestPath,
@@ -11922,7 +12842,7 @@ async function updateManagedBlock(filePath, content) {
   const blockContent = `${MANAGED_BLOCK_BEGIN}
 ${content}${MANAGED_BLOCK_END}
 `;
-  if (!existsSync12(filePath)) {
+  if (!existsSync13(filePath)) {
     const dir = path7.dirname(filePath);
     await mkdir4(dir, { recursive: true });
     await writeFileAtomic(filePath, blockContent);
@@ -11951,7 +12871,7 @@ async function writeManifest(plan, sourceMeta, agentFiles, packageManager) {
     if (op.requiresConfirmation) continue;
     const relPath = path7.relative(plan.targetRoot, op.path);
     if (relPath === ".pourkit/manifest.json") continue;
-    if (existsSync12(op.path)) {
+    if (existsSync13(op.path)) {
       const sha256 = await computeFileChecksum(op.path);
       assets[relPath] = {
         ownership: op.ownership || "managed",
@@ -11996,7 +12916,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync12(op.path) && !op.destructive) {
+          if (existsSync13(op.path) && !op.destructive) {
             skipped++;
             continue;
           }
@@ -12011,7 +12931,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync12(op.path)) {
+          if (existsSync13(op.path)) {
             skipped++;
             continue;
           }
@@ -12040,7 +12960,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync12(op.path)) {
+          if (existsSync13(op.path)) {
             skipped++;
             continue;
           }
@@ -12180,7 +13100,7 @@ async function applyInitFromSource(options) {
     if (!manifestSkipped) {
       const agentFiles = [];
       for (const name of ["AGENTS.md", "CLAUDE.md"]) {
-        if (existsSync12(path7.join(targetRoot, name))) {
+        if (existsSync13(path7.join(targetRoot, name))) {
           agentFiles.push(path7.join(targetRoot, name));
         }
       }
@@ -13411,11 +14331,46 @@ function createCliProgram(version) {
     });
     console.log(JSON.stringify(result, null, 2));
   });
+  prdRun.command("audit").argument("<prdRef>", "PRD ref").option("--cwd <path>", "target repository directory").action(async (prdRef, options) => {
+    const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+    const result = runPrdRunAuditCommand({
+      repoRoot: targetRepoRoot,
+      prdRef
+    });
+    console.log(JSON.stringify(result, null, 2));
+  });
   prdRun.command("list").option("--cwd <path>", "target repository directory").action(async (options) => {
     const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
     const result = runPrdRunListCommand({ repoRoot: targetRepoRoot });
     console.log(JSON.stringify(result, null, 2));
   });
+  prdRun.command("validate-final-review").argument("<prdRef>", "PRD ref").requiredOption("--review-base <sha>", "merge-base SHA used for review").option("--checkout-base <ref>", "PRD Branch checkout base").option("--artifact-path <path>", "artifact path to validate").option(
+    "--changed-path <path>",
+    "changed path to validate for retouch scope (repeatable)",
+    (value, previous) => {
+      previous.push(value);
+      return previous;
+    },
+    []
+  ).option("--cwd <path>", "target repository directory").action(
+    (prdRef, options) => {
+      const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+      const normalizedPrdRef = normalizePrdRef(prdRef);
+      const artifactPath = options.artifactPath ? path8.isAbsolute(options.artifactPath) ? options.artifactPath : path8.resolve(targetRepoRoot, options.artifactPath) : void 0;
+      const result = runPrdRunValidateFinalReviewCommand({
+        repoRoot: targetRepoRoot,
+        prdRef: normalizedPrdRef,
+        checkoutBase: options.checkoutBase,
+        reviewBase: options.reviewBase,
+        artifactPath,
+        changedPaths: options.changedPath
+      });
+      console.log(JSON.stringify(result, null, 2));
+      if (result.status === "invalid") {
+        process.exitCode = 1;
+      }
+    }
+  );
   prdRun.command("final-review").argument("<prdRef>", "PRD ref").requiredOption("--target <name>", "target name").option("--cwd <path>", "target repository directory").option("--no-auto-merge", "disable auto-merge").action(
     async (prdRef, options) => {
       const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
@@ -13463,6 +14418,39 @@ function createCliProgram(version) {
       }
     }
   );
+  prdRun.command("reconcile").argument("<prdRef>", "PRD ref").requiredOption("--target <name>", "target name").option("--cwd <path>", "target repository directory").action(
+    async (prdRef, options) => {
+      const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+      const normalizedPrdRef = normalizePrdRef(prdRef);
+      const logPath = path8.join(
+        targetRepoRoot,
+        ".pourkit",
+        "logs",
+        "prd-run-reconcile.log"
+      );
+      const logger = createLogger("pourkit", logPath);
+      try {
+        const config = await loadRepoConfig(targetRepoRoot);
+        const result = await runPrdRunReconcileCommand({
+          repoRoot: targetRepoRoot,
+          prdRef: normalizedPrdRef,
+          targetName: options.target,
+          config,
+          logger
+        });
+        console.log(JSON.stringify(result, null, 2));
+        if (result.status === "blocked") {
+          process.exitCode = 1;
+        }
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.error(`Error: ${msg}`);
+        process.exit(1);
+      } finally {
+        await logger.close();
+      }
+    }
+  );
   program.command("init").description("Initialize .pourkit layout in a target repo").option("--dry-run", "print the init plan without applying changes").option("--json", "output machine-readable JSON plan").option("--from-local <path>", "local source repo to copy artifacts from").option("--cwd <path>", "target repository directory").addOption(
     new Option(
       "--docs-migration <mode>",
@@ -13624,11 +14612,11 @@ function createCliProgram(version) {
   return program;
 }
 async function resolveCliVersion() {
-  if (isPackageVersion("0.0.0-next-20260604153710")) {
-    return "0.0.0-next-20260604153710";
+  if (isPackageVersion("0.0.0-next-20260604225844")) {
+    return "0.0.0-next-20260604225844";
   }
-  if (isReleaseVersion("0.0.0-next-20260604153710")) {
-    return "0.0.0-next-20260604153710";
+  if (isReleaseVersion("0.0.0-next-20260604225844")) {
+    return "0.0.0-next-20260604225844";
   }
   try {
     const root = repoRoot();