@pourkit/cli 0.0.0-next-20260614002607 → 0.0.0-next-20260614074434

package/dist/e2e/run-live-e2e.js

@@ -58,20 +58,20 @@ function createLogger(name, filePath) {
       );
     },
     async close() {
-      await new Promise((resolve3) => {
+      await new Promise((resolve4) => {
         if (!fileStream) {
-          resolve3();
+          resolve4();
           return;
         }
         const timer = setTimeout(() => {
           if (!fileStream.destroyed) {
             fileStream.destroy();
           }
-          resolve3();
+          resolve4();
         }, 2e3);
         fileStream.end(() => {
           clearTimeout(timer);
-          resolve3();
+          resolve4();
         });
       });
     }
@@ -265,7 +265,7 @@ async function execJson(command, args, options = {}) {
   return JSON.parse(result.stdout);
 }
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function execCaptureWithRetry(command, args, options = {}) {
   const retries = options.retries ?? 3;
@@ -330,184 +330,45 @@ var init_common = __esm({
 
 // e2e/run-live-e2e.ts
 import path8 from "path";
-import { existsSync as existsSync14 } from "fs";
 import { pathToFileURL } from "url";
 import { mkdir as mkdir5, readFile as readFile4, readdir as readdir2, rm as rm2, writeFile as writeFile3 } from "fs/promises";
 
 // commands/issue-run.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
-import { isAbsolute as isAbsolute3, join as join14 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
+import { isAbsolute as isAbsolute4, join as join14 } from "path";
 
 // shared/config.ts
-import { join } from "path";
-import { z } from "zod";
-var NonEmptyString = z.string().trim().min(1);
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, isAbsolute, join, normalize, sep, resolve } from "path";
+import Ajv from "ajv";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname(__filename);
+var SCHEMA_PATH = resolve(__dirname, "../schema/pourkit.schema.json");
+var _schema = null;
+var _validate = null;
+var _ajvErrors = null;
+function getValidator() {
+  if (!_validate) {
+    const schema = _schema ?? JSON.parse(readFileSync(SCHEMA_PATH, "utf-8"));
+    _schema = schema;
+    const ajv = new Ajv({ strict: true });
+    ajv.addKeyword("x-pourkit-schema-version");
+    const validate = ajv.compile(schema);
+    _validate = (data) => {
+      _ajvErrors = null;
+      const valid2 = validate(data);
+      if (!valid2) _ajvErrors = validate.errors;
+      return valid2;
+    };
+  }
+  return _validate;
+}
 var DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES = 3;
-var OutputRetriesConfigSchema = z.object({
-  missingOrEmpty: z.number().int().nonnegative().default(DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES)
-}).strict();
+var DEFAULT_BRANCH_TEMPLATE = "pourkit/{{issue.number}}/{{issue.slug}}";
 function resolveMissingOrEmptyOutputRetries(config) {
   return config?.outputRetries?.missingOrEmpty ?? DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES;
 }
-var StageAgentConfigSchema = z.object({
-  agent: NonEmptyString,
-  model: NonEmptyString,
-  variant: NonEmptyString.optional(),
-  env: z.record(z.string(), z.string()).optional(),
-  promptTemplate: NonEmptyString,
-  outputRetries: OutputRetriesConfigSchema.optional()
-}).strict();
-var ReviewerConfigSchema = z.object({
-  agent: NonEmptyString,
-  model: NonEmptyString,
-  variant: NonEmptyString.optional(),
-  env: z.record(z.string(), z.string()).optional(),
-  promptTemplate: NonEmptyString,
-  outputRetries: OutputRetriesConfigSchema.optional(),
-  criteria: z.array(NonEmptyString),
-  includeReviewHistory: z.boolean().optional(),
-  passWithNotesRefactorAttempts: z.number().int().nonnegative().optional()
-}).strict();
-var VerificationCommandSchema = z.object({
-  command: z.string().nullable().optional(),
-  label: z.string().optional()
-}).strict().refine((d) => d.command && d.command.trim() !== "", {
-  message: "must have a non-empty command"
-}).transform((d) => ({
-  command: d.command,
-  label: d.label && d.label.trim() !== "" ? d.label : void 0
-}));
-var PrdRunModeSchema = z.enum(["github", "local"]);
-var QueueConfigSchema = z.object({
-  loop: z.boolean().optional()
-}).strict();
-var FailureResolutionConfigSchema = z.object({
-  agent: NonEmptyString,
-  model: NonEmptyString,
-  variant: NonEmptyString.optional(),
-  env: z.record(z.string(), z.string()).optional(),
-  promptTemplate: NonEmptyString,
-  outputRetries: OutputRetriesConfigSchema.optional(),
-  maxAttemptsPerFailure: z.number().int().positive(),
-  failureLimits: z.record(z.string(), z.number().int().positive()).optional()
-}).strict();
-var ReviewRefactorLoopStrategySchema = z.object({
-  type: z.literal("review-refactor-loop"),
-  implement: z.object({
-    builder: StageAgentConfigSchema
-  }).strict(),
-  conflictResolution: z.object({
-    agent: NonEmptyString,
-    model: NonEmptyString,
-    variant: NonEmptyString.optional(),
-    env: z.record(z.string(), z.string()).optional(),
-    promptTemplate: NonEmptyString,
-    maxAttempts: z.number().int().positive()
-  }).strict().optional(),
-  failureResolution: FailureResolutionConfigSchema,
-  review: z.object({
-    reviewer: ReviewerConfigSchema,
-    refactor: StageAgentConfigSchema,
-    maxIterations: z.number().int().positive(),
-    passWithNotesRefactorAttempts: z.number().int().nonnegative().default(2)
-  }).strict(),
-  verify: z.object({
-    commands: z.preprocess(
-      (v) => Array.isArray(v) ? v : [],
-      z.array(VerificationCommandSchema).refine((arr) => arr.length > 0, {
-        message: "must contain at least one command"
-      })
-    )
-  }).strict().optional(),
-  issueFinalReview: StageAgentConfigSchema.extend({
-    maxAttempts: z.number().int().positive()
-  }),
-  finalize: z.object({
-    prDescriptionAgent: StageAgentConfigSchema,
-    maxAttempts: z.number().int().positive()
-  }).strict(),
-  prdRun: z.object({
-    mode: PrdRunModeSchema.optional(),
-    // Uses promptTemplate (canonical StageAgentConfig field), not prompt as Issue contract may suggest
-    finalReview: StageAgentConfigSchema
-  }).strict().optional()
-}).strict();
-var TargetSerenaConfigSchema = z.object({
-  enabled: z.boolean().optional(),
-  required: z.boolean().optional()
-}).strict();
-var TargetSchema = z.object({
-  name: NonEmptyString,
-  baseBranch: z.preprocess(
-    (v) => typeof v === "string" && v.length > 0 ? v : void 0,
-    NonEmptyString.default("main")
-  ),
-  branchTemplate: z.string().default("pourkit/{{issue.number}}/{{issue.slug}}"),
-  setupCommands: z.preprocess(
-    (v) => Array.isArray(v) ? v : void 0,
-    z.array(VerificationCommandSchema).default([])
-  ),
-  autoMerge: z.preprocess(
-    (v) => typeof v === "boolean" ? v : void 0,
-    z.boolean().default(true)
-  ),
-  queue: QueueConfigSchema.optional(),
-  serena: TargetSerenaConfigSchema.optional(),
-  strategy: ReviewRefactorLoopStrategySchema
-}).strict();
-var LabelsSchema = z.object({
-  readyForAgent: NonEmptyString,
-  agentInProgress: NonEmptyString,
-  blocked: NonEmptyString,
-  prOpenAwaitingMerge: NonEmptyString,
-  readyForHuman: NonEmptyString,
-  needsTriage: NonEmptyString.optional().default("needs-triage")
-}).strict();
-var SandboxMountSchema = z.object({
-  hostPath: NonEmptyString,
-  sandboxPath: NonEmptyString,
-  readonly: z.boolean().default(false)
-}).strict();
-var SandboxSchema = z.object({
-  provider: NonEmptyString,
-  copyToWorktree: z.array(NonEmptyString).optional(),
-  mounts: z.array(SandboxMountSchema).optional(),
-  env: z.record(z.string()).optional(),
-  idleTimeoutSeconds: z.preprocess((v) => {
-    if (v === void 0) return void 0;
-    if (typeof v === "number" && Number.isFinite(v) && v > 0) return v;
-    return v;
-  }, z.number().int().positive().optional())
-}).strict();
-var ChecksSchema = z.object({
-  requiredLabels: z.array(NonEmptyString),
-  allowedAuthors: z.array(NonEmptyString),
-  checksFoundTimeoutSeconds: z.number().int().positive().optional(),
-  checksCompletionTimeoutSeconds: z.number().int().positive().optional(),
-  pollIntervalSeconds: z.number().int().positive().optional(),
-  issueListLimit: z.number().int().positive().optional()
-}).strict();
-var CleanupConfigSchema = z.object({
-  enabled: z.boolean().default(true),
-  worktreeRetentionDays: z.number().int().positive().default(14),
-  logRetentionDays: z.number().int().positive().default(30)
-}).strict();
-var SerenaConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  required: z.boolean().default(false),
-  mcpUrl: NonEmptyString.default("http://localhost:9121/mcp"),
-  sandboxMcpUrl: NonEmptyString.default("http://localhost:9121/mcp"),
-  dataDir: z.string().default(".pourkit/serena/"),
-  autoStart: z.boolean().default(false)
-}).strict();
-var PourkitConfigSchema = z.object({
-  targets: z.array(TargetSchema).min(1),
-  labels: LabelsSchema,
-  sandbox: SandboxSchema,
-  checks: ChecksSchema,
-  cleanup: CleanupConfigSchema.optional(),
-  serena: SerenaConfigSchema.default({})
-}).strict();
 var removedFieldReplacements = {
   "config.implementor": "targets[].strategy.implement.builder",
   "config.reviewer": "targets[].strategy.review.reviewer",
@@ -571,11 +432,12 @@ function checkRemovedFields(raw) {
     }
   }
 }
-function formatZodPath(path9) {
-  if (path9.length === 0) return "";
+function formatAjvPath(instancePath) {
+  if (!instancePath || instancePath === "/") return "";
+  const parts = instancePath.split("/").slice(1);
   let result = "";
-  for (const segment of path9) {
-    if (typeof segment === "number") {
+  for (const segment of parts) {
+    if (/^\d+$/.test(segment)) {
       result += `[${segment}]`;
     } else {
       result += result ? `.${segment}` : segment;
@@ -583,51 +445,172 @@ function formatZodPath(path9) {
   }
   return result;
 }
-function formatFirstZodError(err) {
-  const issue = err.issues[0];
-  const path9 = formatZodPath(issue.path);
-  if (path9 === "targets" && (issue.code === "too_small" || issue.code === "invalid_type")) {
-    return "Config must have at least one target";
+function formatFirstAjvError(errors) {
+  const error = errors[0];
+  const path9 = formatAjvPath(error.instancePath);
+  if (error.keyword === "required") {
+    const missingParam = error.params.missingProperty;
+    if (missingParam === "targets") {
+      return "Config must have at least one target";
+    }
+    if (path9 === "" && missingParam === "targets") {
+      return "Config must have at least one target";
+    }
+    if (path9) {
+      return `${path9} must have required property '${missingParam}'`;
+    }
+    return `${missingParam} must be an object`;
   }
-  if (issue.path.length >= 3 && issue.path[0] === "targets" && typeof issue.path[1] === "number" && issue.path[2] === "name" && issue.code === z.ZodIssueCode.too_small) {
-    return `Target[${issue.path[1]}] must have a non-empty name`;
+  if (error.keyword === "additionalProperties") {
+    const additionalProp = error.params.additionalProperty;
+    const keyPath = path9 ? `${path9}.${additionalProp}` : additionalProp;
+    return `${keyPath} is not supported`;
   }
-  switch (issue.code) {
-    case z.ZodIssueCode.invalid_type: {
-      if (issue.expected === "object") {
-        return path9 ? `${path9} must be an object` : "Config must be an object";
-      }
-      if (issue.expected === "integer") {
-        return `${path9} must be an integer`;
-      }
-      if (issue.expected === "string") {
-        return `${path9} must be a string`;
-      }
-      if (issue.expected === "number") {
-        return `${path9} must be a number`;
-      }
-      return issue.message;
+  if (error.keyword === "minLength") {
+    if (path9) {
+      return `${path9} must be a non-empty string`;
+    }
+    return "Config must be a non-empty string";
+  }
+  if (error.keyword === "const") {
+    const allowedValue = error.params.allowedValue;
+    return `${path9 || "Config"} must be ${JSON.stringify(allowedValue)}`;
+  }
+  if (error.keyword === "enum") {
+    const allowedValues = error.params.allowedValues;
+    return `${path9} must be one of: ${allowedValues.map((v) => JSON.stringify(v)).join(", ")}`;
+  }
+  if (error.keyword === "minimum" || error.keyword === "exclusiveMinimum") {
+    const limit = error.params.limit;
+    if (limit === 1) {
+      return `${path9} must be a positive number`;
+    }
+    return `${path9} must be at least ${limit}`;
+  }
+  if (error.keyword === "type") {
+    const expected = error.params.type;
+    if (path9 === "") {
+      return `Config must be an object`;
+    }
+    if (expected === "object") {
+      return `${path9} must be an object`;
+    }
+    if (expected === "integer") {
+      return `${path9} must be an integer`;
+    }
+    if (expected === "string") {
+      return `${path9} must be a string`;
+    }
+    if (expected === "number") {
+      return `${path9} must be a number`;
+    }
+    return `${path9} must be ${expected === "integer" ? "an integer" : `a ${expected}`}`;
+  }
+  if (error.keyword === "minItems") {
+    return `${path9} must contain at least one item`;
+  }
+  if (error.keyword === "pattern") {
+    return `${path9} has an invalid format`;
+  }
+  return `${path9 || "Config"} ${error.message || "is invalid"}`;
+}
+function applyOutputRetriesDefaults(retries) {
+  if (retries === void 0) return void 0;
+  return {
+    missingOrEmpty: retries.missingOrEmpty ?? DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES
+  };
+}
+function applyStageAgentDefaults(agent) {
+  return {
+    ...agent,
+    outputRetries: applyOutputRetriesDefaults(agent.outputRetries)
+  };
+}
+function assertRepoRelativePath(value, location) {
+  const normalized = normalize(value);
+  if (isAbsolute(value) || isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${sep}`)) {
+    throw new Error(
+      `${location} must stay within the repository and be repo-relative; got "${value}"`
+    );
+  }
+}
+function assertBaseBranch(value, location) {
+  if (value.includes("/")) {
+    throw new Error(
+      `${location} must be a local branch name, not a remote-qualified, tag, ref, or path-like name; got "${value}"`
+    );
+  }
+  if (/^[0-9a-f]{7,40}$/i.test(value)) {
+    throw new Error(
+      `${location} must be a branch name, not a commit SHA; got "${value}"`
+    );
+  }
+}
+function assertStageAgentPath(agent, location) {
+  if (!agent) return;
+  const promptTemplate = agent.promptTemplate;
+  if (typeof promptTemplate === "string") {
+    assertRepoRelativePath(promptTemplate, `${location}.promptTemplate`);
+  }
+}
+function validateConfigSemantics(data) {
+  const sandbox = data.sandbox;
+  const copyToWorktree = sandbox?.copyToWorktree;
+  copyToWorktree?.forEach((entry, index) => {
+    assertRepoRelativePath(entry, `sandbox.copyToWorktree[${index}]`);
+  });
+  const targetNames = /* @__PURE__ */ new Set();
+  data.targets.forEach((target, targetIndex) => {
+    const name = target.name;
+    if (targetNames.has(name)) {
+      throw new Error(
+        `Duplicate target name "${name}"; target names must be unique`
+      );
+    }
+    targetNames.add(name);
+    assertBaseBranch(
+      target.baseBranch,
+      `targets[${targetIndex}].baseBranch`
+    );
+    const strategy = target.strategy;
+    const implement = strategy.implement;
+    const review = strategy.review;
+    const finalize = strategy.finalize;
+    assertStageAgentPath(
+      implement.builder,
+      `targets[${targetIndex}].strategy.implement.builder`
+    );
+    assertStageAgentPath(
+      strategy.conflictResolution,
+      `targets[${targetIndex}].strategy.conflictResolution`
+    );
+    assertStageAgentPath(
+      strategy.failureResolution,
+      `targets[${targetIndex}].strategy.failureResolution`
+    );
+    assertStageAgentPath(
+      review.reviewer,
+      `targets[${targetIndex}].strategy.review.reviewer`
+    );
+    assertStageAgentPath(
+      review.refactor,
+      `targets[${targetIndex}].strategy.review.refactor`
+    );
+    assertStageAgentPath(
+      strategy.issueFinalReview,
+      `targets[${targetIndex}].strategy.issueFinalReview`
+    );
+    assertStageAgentPath(
+      finalize.prDescriptionAgent,
+      `targets[${targetIndex}].strategy.finalize.prDescriptionAgent`
+    );
+  });
+}
+function assertKnownKeys(value, path9, knownKeys) {
+  for (const key of Object.keys(value)) {
+    if (!knownKeys.includes(key)) {
+      throw new Error(`${path9}.${key} is not supported`);
     }
-    case z.ZodIssueCode.too_small:
-      if (issue.type === "string" && issue.minimum === 1) {
-        return `${path9} must be a non-empty string`;
-      }
-      if (issue.type === "array" && issue.minimum === 1) {
-        return `${path9} must not be empty`;
-      }
-      if (issue.type === "number") {
-        return `${path9} must be a positive number`;
-      }
-      return issue.message;
-    case z.ZodIssueCode.invalid_literal:
-      return `${path9} must be ${issue.expected}`;
-    case z.ZodIssueCode.unrecognized_keys:
-      const keyPath = path9 ? `${path9}.${issue.keys[0]}` : issue.keys[0];
-      return `${keyPath} is not supported`;
-    case z.ZodIssueCode.custom:
-      return path9 ? `${path9} ${issue.message}` : issue.message;
-    default:
-      return issue.message;
   }
 }
 function parseConfig(raw) {
@@ -649,6 +632,7 @@ function parseConfig(raw) {
       "name",
       "baseBranch",
       "branchTemplate",
+      "prdRun",
       "setupCommands",
       "autoMerge",
       "queue",
@@ -664,9 +648,20 @@ function parseConfig(raw) {
         `targets[${i}].strategy.conflictResolution has been removed; use targets[${i}].strategy.failureResolution`
       );
     }
-    if (strategy && typeof strategy === "object" && strategy.prdRun && typeof strategy.prdRun === "object" && "reconciliation" in strategy.prdRun) {
+    if (strategy && typeof strategy === "object" && strategy.prdRun && typeof strategy.prdRun === "object") {
+      const prdRun = strategy.prdRun;
+      if ("reconciliation" in prdRun) {
+        throw new Error(
+          `targets[${i}].strategy.prdRun.reconciliation has been removed; PRD Run no longer invokes Architect reconciliation.`
+        );
+      }
+      if ("finalReview" in prdRun) {
+        throw new Error(
+          `targets[${i}].strategy.prdRun.finalReview has been removed; PRD-wide Final Review is no longer part of the PRD Run lifecycle. Use targets[${i}].strategy.issueFinalReview instead.`
+        );
+      }
       throw new Error(
-        `targets[${i}].strategy.prdRun.reconciliation has been removed; PRD Run no longer invokes Architect reconciliation.`
+        `targets[${i}].strategy.prdRun is not supported in the new config; use targets[${i}].prdRun instead.`
       );
     }
   }
@@ -676,67 +671,126 @@ function parseConfig(raw) {
       "copyToWorktree",
       "mounts",
       "env",
-      "idleTimeoutSeconds"
+      "idleTimeoutSeconds",
+      "forceRebuild"
     ]);
   }
-  const result = PourkitConfigSchema.safeParse(raw);
-  if (!result.success) {
-    throw new Error(formatFirstZodError(result.error));
-  }
-  const data = result.data;
-  const targets = data.targets.map((t) => {
-    const setupCommands = t.setupCommands?.map((cmd, i) => ({
-      command: cmd.command,
-      label: cmd.label ?? `check-${i}`
-    }));
-    const verifyCommands = t.strategy.verify?.commands?.map((cmd, i) => ({
-      command: cmd.command,
-      label: cmd.label ?? `check-${i}`
-    }));
-    return {
-      name: t.name,
-      baseBranch: t.baseBranch,
-      branchTemplate: t.branchTemplate,
-      setupCommands,
-      autoMerge: t.autoMerge,
-      queue: t.queue,
-      serena: t.serena,
-      strategy: {
-        type: "review-refactor-loop",
-        implement: { builder: t.strategy.implement.builder },
-        failureResolution: {
-          agent: t.strategy.failureResolution.agent,
-          model: t.strategy.failureResolution.model,
-          promptTemplate: t.strategy.failureResolution.promptTemplate,
-          outputRetries: t.strategy.failureResolution.outputRetries,
-          maxAttemptsPerFailure: t.strategy.failureResolution.maxAttemptsPerFailure,
-          failureLimits: t.strategy.failureResolution.failureLimits
-        },
-        review: {
-          reviewer: t.strategy.review.reviewer,
-          refactor: t.strategy.review.refactor,
-          maxIterations: t.strategy.review.maxIterations,
-          passWithNotesRefactorAttempts: t.strategy.review.passWithNotesRefactorAttempts
-        },
-        ...t.strategy.verify ? { verify: { commands: verifyCommands } } : {},
-        issueFinalReview: t.strategy.issueFinalReview,
-        finalize: {
-          prDescriptionAgent: t.strategy.finalize.prDescriptionAgent,
-          maxAttempts: t.strategy.finalize.maxAttempts
-        },
-        ...t.strategy.prdRun ? {
-          prdRun: {
-            ...t.strategy.prdRun.mode ? { mode: t.strategy.prdRun.mode } : {},
-            finalReview: t.strategy.prdRun.finalReview
+  const validate = getValidator();
+  if (!validate(raw)) {
+    throw new Error(
+      formatFirstAjvError(
+        _ajvErrors ?? [
+          {
+            instancePath: "",
+            message: "validation failed",
+            keyword: "error",
+            params: {}
           }
-        } : {}
-      }
-    };
-  });
+        ]
+      )
+    );
+  }
+  const data = config;
+  validateConfigSemantics(data);
+  const targets = data.targets.map(
+    (t) => {
+      const input = t;
+      const strategy = input.strategy;
+      const implement = strategy.implement;
+      const failureResolution = strategy.failureResolution;
+      const review = strategy.review;
+      const reviewReviewer = review.reviewer;
+      const reviewRefactor = review.refactor;
+      const finalize = strategy.finalize;
+      const issueFinalReview = strategy.issueFinalReview;
+      const setupCommands = input.setupCommands?.map((cmd, i) => ({
+        command: cmd.command,
+        label: cmd.label ?? `check-${i}`
+      }));
+      const verifyCommands = strategy.verify?.commands ? strategy.verify.commands : void 0;
+      const verifyLabeled = verifyCommands?.map((cmd, i) => ({
+        command: cmd.command,
+        label: cmd.label ?? `check-${i}`
+      }));
+      return {
+        name: input.name,
+        baseBranch: input.baseBranch,
+        branchTemplate: input.branchTemplate ?? DEFAULT_BRANCH_TEMPLATE,
+        prdRun: input.prdRun,
+        setupCommands,
+        autoMerge: input.autoMerge !== void 0 ? input.autoMerge : true,
+        queue: input.queue,
+        serena: input.serena,
+        strategy: {
+          type: "review-refactor-loop",
+          implement: {
+            builder: applyStageAgentDefaults(
+              implement.builder
+            )
+          },
+          failureResolution: {
+            agent: failureResolution.agent,
+            model: failureResolution.model,
+            variant: failureResolution.variant,
+            env: failureResolution.env,
+            promptTemplate: failureResolution.promptTemplate,
+            outputRetries: applyOutputRetriesDefaults(
+              failureResolution.outputRetries
+            ),
+            maxAttemptsPerFailure: failureResolution.maxAttemptsPerFailure,
+            failureLimits: failureResolution.failureLimits
+          },
+          review: {
+            reviewer: {
+              agent: reviewReviewer.agent,
+              model: reviewReviewer.model,
+              variant: reviewReviewer.variant,
+              env: reviewReviewer.env,
+              promptTemplate: reviewReviewer.promptTemplate,
+              outputRetries: applyOutputRetriesDefaults(
+                reviewReviewer.outputRetries
+              ),
+              criteria: reviewReviewer.criteria,
+              includeReviewHistory: reviewReviewer.includeReviewHistory,
+              passWithNotesRefactorAttempts: reviewReviewer.passWithNotesRefactorAttempts
+            },
+            refactor: applyStageAgentDefaults(
+              reviewRefactor
+            ),
+            maxIterations: review.maxIterations,
+            passWithNotesRefactorAttempts: review.passWithNotesRefactorAttempts ?? 2
+          },
+          ...verifyLabeled ? { verify: { commands: verifyLabeled } } : {},
+          issueFinalReview: {
+            ...issueFinalReview,
+            maxAttempts: issueFinalReview.maxAttempts,
+            outputRetries: applyOutputRetriesDefaults(
+              issueFinalReview.outputRetries
+            )
+          },
+          finalize: {
+            prDescriptionAgent: applyStageAgentDefaults(
+              finalize.prDescriptionAgent
+            ),
+            maxAttempts: finalize.maxAttempts
+          }
+        }
+      };
+    }
+  );
+  const serenaRaw = data.serena;
+  const serenaDefaults = {
+    mcpUrl: serenaRaw?.mcpUrl ?? "http://localhost:9121/mcp",
+    sandboxMcpUrl: serenaRaw?.sandboxMcpUrl ?? "http://localhost:9121/mcp",
+    dataDir: serenaRaw?.dataDir ?? ".pourkit/serena/"
+  };
   const serena = {
-    ...data.serena,
-    mcpUrl: process.env.POURKIT_SERENA_MCP_URL ?? data.serena.mcpUrl,
-    sandboxMcpUrl: process.env.POURKIT_SERENA_SANDBOX_MCP_URL ?? data.serena.sandboxMcpUrl
+    enabled: serenaRaw?.enabled ?? false,
+    required: serenaRaw?.required ?? false,
+    mcpUrl: process.env.POURKIT_SERENA_MCP_URL ?? serenaDefaults.mcpUrl,
+    sandboxMcpUrl: process.env.POURKIT_SERENA_SANDBOX_MCP_URL ?? serenaDefaults.sandboxMcpUrl,
+    dataDir: serenaDefaults.dataDir,
+    autoStart: serenaRaw?.autoStart ?? false
   };
   if (serena.mcpUrl.trim() === "") {
     throw new Error("POURKIT_SERENA_MCP_URL must be a non-empty string");
@@ -746,84 +800,100 @@ function parseConfig(raw) {
       "POURKIT_SERENA_SANDBOX_MCP_URL must be a non-empty string"
     );
   }
+  const checksRaw = data.checks;
+  const labelsRaw = data.labels;
+  const cleanupRaw = data.cleanup;
+  const sandboxRaw = data.sandbox;
   return {
     targets,
-    labels: data.labels,
+    labels: {
+      readyForAgent: labelsRaw?.readyForAgent ?? "ready-for-agent",
+      agentInProgress: labelsRaw?.agentInProgress ?? "agent-in-progress",
+      blocked: labelsRaw?.blocked ?? "blocked",
+      prOpenAwaitingMerge: labelsRaw?.prOpenAwaitingMerge ?? "pr-open-awaiting-merge",
+      readyForHuman: labelsRaw?.readyForHuman ?? "ready-for-human",
+      needsTriage: labelsRaw?.needsTriage ?? "needs-triage"
+    },
     sandbox: {
-      provider: data.sandbox.provider,
-      copyToWorktree: data.sandbox.copyToWorktree,
-      mounts: data.sandbox.mounts,
-      env: data.sandbox.env,
-      idleTimeoutSeconds: data.sandbox.idleTimeoutSeconds
+      provider: sandboxRaw?.provider ?? "docker",
+      copyToWorktree: sandboxRaw?.copyToWorktree,
+      mounts: sandboxRaw?.mounts ? sandboxRaw.mounts.map((m) => ({
+        hostPath: m.hostPath,
+        sandboxPath: m.sandboxPath,
+        readonly: m.readonly ?? false
+      })) : void 0,
+      env: sandboxRaw?.env,
+      idleTimeoutSeconds: sandboxRaw?.idleTimeoutSeconds,
+      forceRebuild: sandboxRaw?.forceRebuild
     },
     checks: {
-      requiredLabels: data.checks.requiredLabels,
-      allowedAuthors: data.checks.allowedAuthors,
-      checksFoundTimeoutSeconds: data.checks.checksFoundTimeoutSeconds ?? 60,
-      checksCompletionTimeoutSeconds: data.checks.checksCompletionTimeoutSeconds ?? 30 * 60,
-      pollIntervalSeconds: data.checks.pollIntervalSeconds ?? 15,
-      issueListLimit: data.checks.issueListLimit ?? 50
+      requiredLabels: checksRaw?.requiredLabels ?? [],
+      allowedAuthors: checksRaw?.allowedAuthors ?? [],
+      checksFoundTimeoutSeconds: checksRaw?.checksFoundTimeoutSeconds ?? 60,
+      checksCompletionTimeoutSeconds: checksRaw?.checksCompletionTimeoutSeconds ?? 30 * 60,
+      pollIntervalSeconds: checksRaw?.pollIntervalSeconds ?? 15,
+      issueListLimit: checksRaw?.issueListLimit ?? 50
     },
     serena,
     cleanup: {
-      enabled: data.cleanup?.enabled ?? true,
-      worktreeRetentionDays: data.cleanup?.worktreeRetentionDays ?? 14,
-      logRetentionDays: data.cleanup?.logRetentionDays ?? 30
+      enabled: cleanupRaw?.enabled ?? true,
+      worktreeRetentionDays: cleanupRaw?.worktreeRetentionDays ?? 14,
+      logRetentionDays: cleanupRaw?.logRetentionDays ?? 30
     }
   };
 }
-function assertKnownKeys(value, path9, knownKeys) {
-  for (const key of Object.keys(value)) {
-    if (!knownKeys.includes(key)) {
-      throw new Error(`${path9}.${key} is not supported`);
-    }
-  }
-}
 function getVerificationCommands(target) {
   return target.strategy.verify?.commands ?? [];
 }
-async function loadRepoConfig(repoRoot2, configFileName = "pourkit.config.ts") {
-  const { existsSync: existsSync15 } = await import("fs");
-  const { mkdir: mkdir6, writeFile: writeFile4, rm: rm3 } = await import("fs/promises");
-  const { join: pjoin, basename } = await import("path");
-  const { pathToFileURL: pathToFileURL2 } = await import("url");
-  const { build } = await import("esbuild");
-  const configPath = pjoin(repoRoot2, configFileName);
-  if (!existsSync15(configPath)) {
+var OBSOLETE_CONFIG_PATHS = [
+  "pourkit.config.ts",
+  "pourkit.config.mjs",
+  "pourkit.config.js",
+  "pourkit.json"
+];
+var CANONICAL_CONFIG_PATH = ".pourkit/config.json";
+async function loadRepoConfig(repoRoot2, _configFileName) {
+  const { existsSync: existsSync14 } = await import("fs");
+  const { join: pjoin } = await import("path");
+  for (const obPath of OBSOLETE_CONFIG_PATHS) {
+    const fullPath = pjoin(repoRoot2, obPath);
+    if (existsSync14(fullPath)) {
+      const isRootJson = obPath === "pourkit.json";
+      throw new Error(
+        isRootJson ? `Found root ${obPath}, but Pourkit config now lives at ${CANONICAL_CONFIG_PATH}. Move the file and update "$schema" to "./schema/pourkit.schema.json".` : `Found ${obPath}, but executable config is no longer supported. Move configuration to ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
+      );
+    }
+  }
+  const configPath = pjoin(repoRoot2, CANONICAL_CONFIG_PATH);
+  if (!existsSync14(configPath)) {
     throw new Error(
-      `No config file found at ${configPath}. Create a ${configFileName} that exports a default PourkitConfig.`
+      `No Pourkit config found at ${CANONICAL_CONFIG_PATH}. Run pourkit init or create ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
     );
   }
-  const tmpDir = pjoin(repoRoot2, ".pourkit", ".tmp", "config");
-  await mkdir6(tmpDir, { recursive: true });
-  const tmpFile = pjoin(
-    tmpDir,
-    `pourkit-config-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.mjs`
-  );
+  const { readFile: readFile5 } = await import("fs/promises");
+  const raw = await readFile5(configPath, "utf-8");
+  let parsed;
   try {
-    await build({
-      entryPoints: [configPath],
-      bundle: true,
-      write: false,
-      platform: "node",
-      format: "esm",
-      external: ["node:*"]
-    }).then(async (result) => {
-      const output = result.outputFiles[0].text;
-      await writeFile4(tmpFile, output, "utf-8");
-    });
-    const imported = await import(pathToFileURL2(tmpFile).href);
-    const raw = imported.default;
-    if (raw === void 0) {
-      throw new Error("pourkit.config.ts must have a default export");
-    }
-    return parseConfig(raw);
-  } finally {
-    try {
-      await rm3(tmpFile, { force: true });
-    } catch {
-    }
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    const message = err instanceof SyntaxError ? err.message : String(err);
+    throw new Error(`${CANONICAL_CONFIG_PATH}: Invalid JSON \u2014 ${message}`);
+  }
+  return parseConfig(parsed);
+}
+async function loadConfig(configPath) {
+  const { readFile: readFile5 } = await import("fs/promises");
+  const ext = configPath.split(".").pop()?.toLowerCase();
+  if (ext === "json") {
+    const raw = await readFile5(configPath, "utf-8");
+    return parseConfig(JSON.parse(raw));
+  }
+  if (ext === "mjs" || ext === "js" || ext === "ts") {
+    throw new Error(
+      `Executable config (${ext}) is no longer supported. Use .pourkit/config.json with "$schema": "./schema/pourkit.schema.json".`
+    );
   }
+  throw new Error(`Unsupported config format: ${ext}`);
 }
 function resolvePromptTemplatePath(repoRoot2, promptTemplate) {
   if (promptTemplate.includes("/")) {
@@ -872,8 +942,8 @@ function renderTemplate(template, issue) {
 init_common();
 
 // shared/run-context.ts
-import { existsSync, readFileSync, readdirSync } from "fs";
-import { isAbsolute, join as join2, relative, resolve } from "path";
+import { existsSync, readFileSync as readFileSync2, readdirSync } from "fs";
+import { isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2 } from "path";
 
 // commands/run-verification.ts
 init_common();
@@ -1014,11 +1084,17 @@ function buildRunContextMarkdown(options) {
     }
   }
   if (sections.includes("branch")) {
+    const canonicalBaseRef = `origin/${target.baseBranch}`;
     parts.push(
       "## Branch",
       "",
       `- Base: ${target.baseBranch}`,
+      `- Canonical Base Ref: ${canonicalBaseRef}`,
       `- Working Branch: ${branchName}`,
+      "",
+      "Use the canonical base ref for scope checks, commit ranges, and diffs. Do not use a bare PRD/base branch name such as `PRD-0063`; local branches with those names may be stale.",
+      "",
+      "Runner-owned Git operations: do not run destructive history/worktree commands such as `git reset --hard`, `git checkout .`, `git clean`, `git rebase`, `git merge`, or `git branch -f`. Edit files only; the runner owns branch/base movement.",
       ""
     );
   }
@@ -1081,7 +1157,7 @@ function renderPrdContext(issue, parentPrdIssue, repoRoot2) {
       `### Parent PRD Content: \`${relative(repoRoot2, parentPrdPath)}\``,
       "",
       "```markdown",
-      readFileSync(parentPrdPath, "utf-8").trimEnd(),
+      readFileSync2(parentPrdPath, "utf-8").trimEnd(),
       "```",
       ""
     );
@@ -1108,7 +1184,7 @@ function renderPrdContext(issue, parentPrdIssue, repoRoot2) {
       `### Document Content: \`${documentPath}\``,
       "",
       "```markdown",
-      readFileSync(absolutePath, "utf-8").trimEnd(),
+      readFileSync2(absolutePath, "utf-8").trimEnd(),
       "```",
       ""
     );
@@ -1133,10 +1209,10 @@ function extractRepoPaths(section) {
   return Array.from(paths);
 }
 function resolveRepoPath(repoRoot2, path9) {
-  if (isAbsolute(path9) || path9.includes("\0")) return null;
-  const resolved = resolve(repoRoot2, path9);
+  if (isAbsolute2(path9) || path9.includes("\0")) return null;
+  const resolved = resolve2(repoRoot2, path9);
   const repoRelative2 = relative(repoRoot2, resolved);
-  if (repoRelative2.startsWith("..") || isAbsolute(repoRelative2)) return null;
+  if (repoRelative2.startsWith("..") || isAbsolute2(repoRelative2)) return null;
   return resolved;
 }
 function findParentPrdPath(repoRoot2, parentRef) {
@@ -1180,17 +1256,19 @@ function renderCriteria(criteria) {
 
 // shared/prompt-guidance.ts
 var PROTECTED_WORK_RULE = "Do **not** revert, delete, or substantially strip already-landed protected sibling/base work unless the issue explicitly requires those files.";
+var RUNNER_OWNED_GIT_RULE = "Do **not** move Git history or reset the Worktree. Do not run `git reset --hard`, `git checkout .`, `git clean`, `git rebase`, `git merge`, `git branch -f`, or equivalent destructive history/worktree commands; branch/base changes are runner-owned.";
 function appendProtectedWorkGuidance(promptBody) {
   return `${promptBody}
 
 ## Hard Rule
 
-- ${PROTECTED_WORK_RULE}`;
+- ${PROTECTED_WORK_RULE}
+- ${RUNNER_OWNED_GIT_RULE}`;
 }
 
 // shared/worktree-run-state.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname, join as join3 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
 var WORKTREE_RUN_STATE_PATH = ".pourkit/state.json";
 function readWorktreeRunState(worktreePath) {
   const statePath = join3(worktreePath, WORKTREE_RUN_STATE_PATH);
@@ -1198,7 +1276,7 @@ function readWorktreeRunState(worktreePath) {
     return null;
   }
   try {
-    const raw = JSON.parse(readFileSync2(statePath, "utf-8"));
+    const raw = JSON.parse(readFileSync3(statePath, "utf-8"));
     if (isValidWorktreeRunState(raw)) {
       return raw;
     }
@@ -1219,7 +1297,7 @@ function isValidWorktreeRunState(raw) {
 }
 function writeWorktreeRunState(worktreePath, state) {
   const statePath = join3(worktreePath, WORKTREE_RUN_STATE_PATH);
-  mkdirSync2(dirname(statePath), { recursive: true });
+  mkdirSync2(dirname2(statePath), { recursive: true });
   writeFileSync(statePath, JSON.stringify(state, null, 2), "utf-8");
 }
 function updateWorktreeRunState(worktreePath, update) {
@@ -1541,12 +1619,12 @@ function validateRecoveryDecision(artifact, allowedDecisions) {
 }
 
 // shared/attempt-log.ts
-import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
 var ATTEMPT_LOG_PATH = ".pourkit/attempt-log.jsonl";
 function writeAttemptLog(worktreePath, entry) {
   const logPath = join4(worktreePath, ATTEMPT_LOG_PATH);
-  mkdirSync3(dirname2(logPath), { recursive: true });
+  mkdirSync3(dirname3(logPath), { recursive: true });
   appendFileSync(logPath, JSON.stringify(entry) + "\n", "utf-8");
 }
 function readAttemptLog(worktreePath) {
@@ -1554,7 +1632,7 @@ function readAttemptLog(worktreePath) {
   if (!existsSync3(logPath)) {
     return [];
   }
-  const raw = readFileSync3(logPath, "utf-8");
+  const raw = readFileSync4(logPath, "utf-8");
   const lines = raw.split("\n").filter((l) => l.length > 0);
   const entries = [];
   for (const line of lines) {
@@ -1673,7 +1751,7 @@ async function runBaseRefreshAttempt(options) {
 }
 
 // commands/conflict-resolution.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
 import { join as join8 } from "path";
 init_common();
 
@@ -1838,8 +1916,8 @@ function parseConflictResolutionArtifact(output) {
 // commands/artifact-validation.ts
 import { createHash } from "crypto";
 import { execSync } from "child_process";
-import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve2 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
+import { isAbsolute as isAbsolute3, join as join7, resolve as resolve3 } from "path";
 
 // pr/review-verdict.ts
 var ReviewVerdictProtocolError = class extends Error {
@@ -1874,15 +1952,15 @@ function parseReviewVerdict(output) {
 import {
   existsSync as existsSync6,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readdirSync as readdirSync2,
   writeFileSync as writeFileSync3
 } from "fs";
 import { join as join6 } from "path";
 
 // execution/agent-output-retry.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 async function executeWithMissingOrEmptyArtifactRetry({
   executionProvider,
   executionOptions,
@@ -1942,20 +2020,20 @@ function readArtifactOutput(artifactPath) {
   if (!existsSync4(artifactPath)) {
     return { _tag: "missing", path: artifactPath };
   }
-  const output = readFileSync4(artifactPath, "utf-8");
+  const output = readFileSync5(artifactPath, "utf-8");
   if (!output.trim()) {
     return { _tag: "empty", path: artifactPath };
   }
   return { _tag: "content", value: output, path: artifactPath };
 }
 function prepareArtifactPath(artifactPath) {
-  mkdirSync4(dirname3(artifactPath), { recursive: true });
+  mkdirSync4(dirname4(artifactPath), { recursive: true });
   rmSync(artifactPath, { recursive: true, force: true });
 }
 
 // shared/effect-services.ts
 import { Context, Effect as Effect3, Layer } from "effect";
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "fs";
 var GitExecutionError = class extends Error {
   _tag = "GitExecutionError";
   message;
@@ -1971,7 +2049,7 @@ var FileSystemDefault = Layer.succeed(
   FileSystem,
   FileSystem.of({
     readFile: (path9) => Effect3.try({
-      try: () => readFileSync5(path9, "utf-8"),
+      try: () => readFileSync6(path9, "utf-8"),
       catch: (error) => new Error(
         `Failed to read file ${path9}: ${error instanceof Error ? error.message : String(error)}`
       )
@@ -2195,7 +2273,7 @@ function validateRefactorArtifact(artifactPath, findingIds) {
       `Refactor artifact missing at ${artifactPath}`
     );
   }
-  const content = readFileSync6(artifactPath, "utf-8");
+  const content = readFileSync7(artifactPath, "utf-8");
   if (!content.trim()) {
     throw new RefactorArtifactValidationError("Refactor artifact is empty");
   }
@@ -2520,12 +2598,29 @@ A prior review emitted \`NEEDS_HUMAN\` and stopped the agent loop. The issue has
 Before carrying forward old blockers, inspect newer issue comments and the current worktree. Treat prior Reviewer and Refactor Artifacts as historical context, not active findings unless they still apply.
 
 ` : "";
-    return `${renderedTemplate}
+    return appendProtectedWorkGuidance(`${renderedTemplate}
 
 ## Shared Run Context
 
 Read the selected issue requirements, PRD context, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
 
+## Initial Verification Pass
+
+- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
+- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
+- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
+- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
+- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
+- If no verification commands are configured, note that and proceed with normal review.
+
+## Scope Evidence Rules
+
+- Use the Run Context's canonical base ref, for example \`origin/<base>\`, for scope diffs and commit ranges.
+- Do not use bare PRD/base branch names such as \`PRD-0063\`, \`main\`, or \`dev\` for scope decisions; local branches with those names may be stale.
+- Only call a file or commit out of scope when it is part of the working branch's delta from the canonical base ref.
+- Do not recommend reverting accepted sibling/base work. If a file is present or changed on the canonical base ref, it is not this Issue's scope overreach.
+- If scope evidence is ambiguous, use \`NEEDS_HUMAN\` or ask for a runner/base mismatch decision instead of telling Refactor to revert files.
+
 ${hasCriteriaPlaceholder ? "" : `## Review Criteria
 
 ${criteriaBlock}
@@ -2542,7 +2637,7 @@ End the file with exactly one wrapped verdict token: <verdict>PASS</verdict>, <v
 
 Findings must include an ID column with values in the format R${iteration}.F{findingNumber} (e.g., R${iteration}.F1, R${iteration}.F2) and a Supersedes column referencing the finding ID being superseded (or a hyphen for new findings).
 
-When verdict is NEEDS_HUMAN, include Human Handoff Summary and Human Handoff Reason sections before the final verdict token.`;
+When verdict is NEEDS_HUMAN, include Human Handoff Summary and Human Handoff Reason sections before the final verdict token.`);
   });
 }
 function renderReviewHistory(reviewHistory) {
@@ -2667,12 +2762,12 @@ function recoverReviewOutputFromLog(logPath) {
   if (!existsSync6(logPath)) {
     return null;
   }
-  const logContent = readFileSync6(logPath, "utf-8");
+  const logContent = readFileSync7(logPath, "utf-8");
   return recoverReviewOutputFromString(logContent);
 }
 function readReviewArtifact(artifactPath, logPath) {
   if (existsSync6(artifactPath)) {
-    const output = readFileSync6(artifactPath, "utf-8");
+    const output = readFileSync7(artifactPath, "utf-8");
     if (output.trim()) {
       return output;
     }
@@ -3164,7 +3259,7 @@ function inferConventionalType(commitSummaries) {
 }
 
 // prd-run/final-review-validation.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
 function parseFinalReviewArtifact(artifactPath) {
   if (!existsSync7(artifactPath)) {
     return {
@@ -3175,7 +3270,7 @@ function parseFinalReviewArtifact(artifactPath) {
   }
   let content;
   try {
-    content = readFileSync7(artifactPath, "utf-8");
+    content = readFileSync8(artifactPath, "utf-8");
   } catch (error) {
     return {
       ok: false,
@@ -3378,7 +3473,7 @@ function readArtifact(options) {
     };
   }
   try {
-    const content = readFileSync8(options.artifactPath, "utf-8");
+    const content = readFileSync9(options.artifactPath, "utf-8");
     if (!content.trim()) {
       return { ok: false, result: invalid(options, "Artifact is empty") };
     }
@@ -3448,7 +3543,7 @@ function validateIssueFinalReviewArtifact(parsed, options) {
   for (const p of parsed.changedPaths) {
     const normalized = p.replace(/\\/g, "/");
     const segments = normalized.split("/");
-    if (normalized.trim() === "" || normalized === "." || normalized === ".." || isAbsolute2(p) || normalized.startsWith("/") || segments.some((segment) => segment === "..")) {
+    if (normalized.trim() === "" || normalized === "." || normalized === ".." || isAbsolute3(p) || normalized.startsWith("/") || segments.some((segment) => segment === "..")) {
       return {
         ok: false,
         reason: `changedPaths must not contain absolute paths or path traversal: ${p}`,
@@ -3549,7 +3644,7 @@ function validateAgentArtifact(options) {
       case "refactor": {
         let findingIds = options.findingIds ?? [];
         if (findingIds.length === 0 && options.latestReviewArtifactPath) {
-          const latestReview = readFileSync8(
+          const latestReview = readFileSync9(
             options.latestReviewArtifactPath,
             "utf-8"
           );
@@ -3572,10 +3667,10 @@ function validateAgentArtifact(options) {
         if (options.checkConflictMarkers !== false && parsed.status === "resolved") {
           const base = options.worktreePath ?? process.cwd();
           const filesWithMarkers = parsed.files.filter((file) => {
-            const filePath = resolve2(base, file);
+            const filePath = resolve3(base, file);
             try {
               return CONFLICT_MARKER_PATTERN.test(
-                readFileSync8(filePath, "utf-8")
+                readFileSync9(filePath, "utf-8")
               );
             } catch {
               return false;
@@ -3686,7 +3781,7 @@ async function hasUnresolvedConflictMarkers(worktreePath, files) {
   for (const file of files) {
     const filePath = join8(worktreePath, file);
     try {
-      const content = readFileSync9(filePath, "utf-8");
+      const content = readFileSync10(filePath, "utf-8");
       if (CONFLICT_MARKER_PATTERN2.test(content)) {
         return true;
       }
@@ -3944,7 +4039,7 @@ async function canReachMcp(url) {
       return true;
     } catch {
       if (attempt < 9) {
-        await new Promise((resolve3) => setTimeout(resolve3, 100));
+        await new Promise((resolve4) => setTimeout(resolve4, 100));
       }
     }
   }
@@ -3995,7 +4090,7 @@ async function prepareSerenaForTarget(options) {
 }
 
 // failure-resolution/failure-resolution-agent.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { join as join9 } from "path";
 
 // failure-resolution/recovery-policy.ts
@@ -4149,7 +4244,7 @@ async function runFailureResolutionAgent(options) {
   }
   let artifact;
   try {
-    const md = readFileSync10(fullArtifactPath, "utf-8");
+    const md = readFileSync11(fullArtifactPath, "utf-8");
     const validation2 = validateAgentArtifact({
       kind: "failure-resolution",
       artifactPath: fullArtifactPath,
@@ -4243,7 +4338,7 @@ async function writeRecoveryAttempt(worktreePath, outcome, fingerprint, summary,
 
 // commands/pr-description-agent.ts
 import { join as join11 } from "path";
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 
 // pr/pr-description-context.ts
 init_common();
@@ -4437,7 +4532,7 @@ function runFinalizerAgent(options) {
       ],
       logger: options.logger
     });
-    const output = readFileSync11(artifactPath, "utf-8");
+    const output = readFileSync12(artifactPath, "utf-8");
     yield* persistGeneratedArtifactEffect(options.worktreePath, output, fs);
     return result;
   });
@@ -4565,7 +4660,7 @@ function persistGeneratedArtifactEffect(worktreePath, output, fs) {
 
 // prd-run/local-merge-coordinator.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync4 } from "fs";
 import { join as join12 } from "path";
 
 // prd-run/local-branches.ts
@@ -4592,7 +4687,7 @@ function readIssueBranchName(repoRoot2, prdId, issueId) {
   const issuePath = getIssueArtifactPath(repoRoot2, prdId, issueId);
   if (!existsSync10(issuePath)) return null;
   try {
-    const content = readFileSync12(issuePath, "utf-8");
+    const content = readFileSync13(issuePath, "utf-8");
     const parsed = JSON.parse(content);
     return typeof parsed.branchName === "string" && parsed.branchName ? parsed.branchName : null;
   } catch {
@@ -4604,7 +4699,7 @@ async function hasLocalIssueMergeReceipt(prdId, issueId, repoRoot2) {
   const receiptPath = getMergeReceiptPath(root, prdId, issueId);
   if (!existsSync10(receiptPath)) return null;
   try {
-    const content = readFileSync12(receiptPath, "utf-8");
+    const content = readFileSync13(receiptPath, "utf-8");
     const parsed = JSON.parse(content);
     if (typeof parsed.prdId === "string" && typeof parsed.issueId === "string" && typeof parsed.stage === "string" && typeof parsed.sourceBranch === "string" && typeof parsed.localPrdBranch === "string" && typeof parsed.mergeCommit === "string" && typeof parsed.completedAt === "string") {
       return parsed;
@@ -4620,7 +4715,7 @@ async function squashMergeLocalIssue(prdId, issueId, input, repoRoot2) {
   if (existsSync10(receiptPath)) {
     try {
       const existing = JSON.parse(
-        readFileSync12(receiptPath, "utf-8")
+        readFileSync13(receiptPath, "utf-8")
       );
       if (existing.prdId === prdId && existing.issueId === issueId && existing.mergeCommit) {
         return {
@@ -4983,7 +5078,7 @@ function runMergeCoordinator(options) {
 }
 
 // commands/issue-final-review-agent.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync14 } from "fs";
 import { join as join13 } from "path";
 var ISSUE_FINAL_REVIEW_ARTIFACT_PATH = join13(
   ".pourkit",
@@ -5097,12 +5192,21 @@ async function runIssueFinalReviewAgent(options) {
 }
 function loadIssueFinalReviewPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync11(promptPath) ? readFileSync13(promptPath, "utf-8") : promptTemplate;
+  const promptBody = existsSync11(promptPath) ? readFileSync14(promptPath, "utf-8") : promptTemplate;
   return appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
 
-Read the selected issue requirements, PRD context, comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}`);
+Read the selected issue requirements, PRD context, comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
+
+## Initial Verification Pass
+
+- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
+- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
+- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
+- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
+- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
+- If no verification commands are configured, note that and proceed with normal review.`);
 }
 
 // issues/issue-transitions.ts
@@ -5305,7 +5409,7 @@ async function advanceIssueFinalReview(options) {
         "Issue Final Review state is incomplete: missing artifactPath"
       );
     }
-    const artifactPath = isAbsolute3(ifrFromState.artifactPath) ? ifrFromState.artifactPath : join14(worktreePath, ifrFromState.artifactPath);
+    const artifactPath = isAbsolute4(ifrFromState.artifactPath) ? ifrFromState.artifactPath : join14(worktreePath, ifrFromState.artifactPath);
     const validation = validateAgentArtifact({
       kind: "issue-final-review",
       artifactPath,
@@ -5337,6 +5441,12 @@ async function advanceIssueFinalReview(options) {
     logger,
     reviewArtifactPath
   });
+  await assertCanonicalBaseAncestor({
+    worktreePath,
+    baseRef: `origin/${target.baseBranch}`,
+    stageName: "Issue Final Review",
+    logger
+  });
   if (result.verdict === "pass") {
     updateWorktreeRunState(worktreePath, {
       issueFinalReview: {
@@ -5561,6 +5671,14 @@ async function startIssueRun(options) {
     };
   }
   if (executionResult.worktreePath) {
+    if (shouldRunBuilder) {
+      await assertCanonicalBaseAncestor({
+        worktreePath: executionResult.worktreePath,
+        baseRef: `origin/${effectiveBaseBranch}`,
+        stageName: "Builder",
+        logger
+      });
+    }
     if (worktreeState) {
       updateWorktreeRunState(executionResult.worktreePath, {
         completedStages: { builder: true }
@@ -5622,6 +5740,12 @@ async function advanceIssueRunReview(options) {
       }
     })
   );
+  await assertCanonicalBaseAncestor({
+    worktreePath: options.worktreePath,
+    baseRef: `origin/${options.target.baseBranch}`,
+    stageName: "Review/Refactor",
+    logger: options.logger
+  });
   updateWorktreeRunState(options.worktreePath, {
     review: {
       lifetimeIterations: reviewResult.lifetimeIterations,
@@ -5690,7 +5814,7 @@ async function completeIssueRun(options) {
               message: `Finalizer artifact missing at ${finalizerFromState.artifactPath}`
             });
           }
-          const artifactContent = readFileSync14(
+          const artifactContent = readFileSync15(
             finalizerFromState.artifactPath,
             "utf-8"
           );
@@ -5748,6 +5872,14 @@ async function completeIssueRun(options) {
       }
       prTitle = finalizerResult.title;
       prBody = finalizerResult.body;
+      if (executionResult.worktreePath) {
+        await assertCanonicalBaseAncestor({
+          worktreePath: executionResult.worktreePath,
+          baseRef: `origin/${effectiveBaseBranch}`,
+          stageName: "Finalizer",
+          logger
+        });
+      }
     }
     prTitle = ensureConventionalPrTitle(
       prTitle,
@@ -6116,18 +6248,12 @@ function getRefactorArtifactDir(artifactPath) {
 }
 async function finalizeWorktreeCommit(options) {
   const { worktreePath, baseRef, title, body, logger } = options;
-  await syncRemoteBaseRef(worktreePath, baseRef, logger);
-  try {
-    await execCapture("git", ["merge-base", "--is-ancestor", baseRef, "HEAD"], {
-      cwd: worktreePath,
-      logger,
-      label: "git merge-base --is-ancestor"
-    });
-  } catch {
-    throw new Error(
-      `Cannot finalize stale worktree: ${baseRef} is not an ancestor of HEAD. Refresh the branch onto the latest target base before creating the final commit.`
-    );
-  }
+  await assertCanonicalBaseAncestor({
+    worktreePath,
+    baseRef,
+    stageName: "final commit",
+    logger
+  });
   await execCapture("git", ["reset", "--soft", baseRef], {
     cwd: worktreePath,
     logger,
@@ -6144,6 +6270,21 @@ async function finalizeWorktreeCommit(options) {
     label: "git commit"
   });
 }
+async function assertCanonicalBaseAncestor(options) {
+  const { worktreePath, baseRef, stageName, logger } = options;
+  await syncRemoteBaseRef(worktreePath, baseRef, logger);
+  try {
+    await execCapture("git", ["merge-base", "--is-ancestor", baseRef, "HEAD"], {
+      cwd: worktreePath,
+      logger,
+      label: "git merge-base --is-ancestor"
+    });
+  } catch {
+    throw new Error(
+      `Cannot continue after ${stageName}: ${baseRef} is not an ancestor of HEAD. An agent may have moved the issue branch behind the canonical base; refresh the branch onto the latest target base before continuing.`
+    );
+  }
+}
 async function syncRemoteBaseRef(worktreePath, baseRef, logger) {
   const remoteBase = parseRemoteBaseRef(baseRef);
   if (!remoteBase) {
@@ -6387,7 +6528,7 @@ async function syncTargetBranch(root, baseBranch, logger) {
 }
 function loadBuilderPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync12(promptPath) ? readFileSync14(promptPath, "utf-8") : promptTemplate;
+  const promptBody = existsSync12(promptPath) ? readFileSync15(promptPath, "utf-8") : promptTemplate;
   return appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
@@ -7384,7 +7525,7 @@ import path6 from "path";
 
 // execution/sandbox-image.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "fs";
 import path5 from "path";
 function sandboxImageName(repoRoot2) {
   const dirName = path5.basename(repoRoot2.replace(/[\\/]+$/, "")) || "local";
@@ -7394,7 +7535,7 @@ function sandboxImageName(repoRoot2) {
   if (!existsSync13(dockerfilePath)) {
     return `sandcastle:${baseName}`;
   }
-  const fingerprint = createHash2("sha256").update(readFileSync15(dockerfilePath)).digest("hex").slice(0, 8);
+  const fingerprint = createHash2("sha256").update(readFileSync16(dockerfilePath)).digest("hex").slice(0, 8);
   return `sandcastle:${baseName}-${fingerprint}`;
 }
 
@@ -7436,11 +7577,11 @@ init_common();
 import { mkdtempSync } from "fs";
 import { writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname5, join as join15 } from "path";
 async function writeExecutionArtifacts(worktreePath, artifacts) {
   for (const artifact of artifacts) {
     const filePath = join15(worktreePath, artifact.path);
-    await ensureDir(dirname4(filePath));
+    await ensureDir(dirname5(filePath));
     await writeFile(filePath, artifact.content, "utf-8");
   }
 }
@@ -8019,10 +8160,7 @@ function resolveE2EConfigFile(root) {
   if (explicitConfig) {
     return explicitConfig;
   }
-  if (existsSync14(path8.join(root, "pourkit.config.ts"))) {
-    return "pourkit.config.ts";
-  }
-  return "pourkit.config.example.ts";
+  return path8.join(".pourkit", "config.json");
 }
 function generateRunId() {
   return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
@@ -8390,7 +8528,8 @@ async function runSuccessE2E(options, runId, root, logger, client) {
     if (!options.keep) {
       await persistResources(root, runId, resources);
     }
-    const baseConfig = await loadRepoConfig(root, resolveE2EConfigFile(root));
+    const e2eConfigFile = resolveE2EConfigFile(root);
+    const baseConfig = e2eConfigFile === path8.join(".pourkit", "config.json") ? await loadRepoConfig(root) : await loadConfig(path8.resolve(root, e2eConfigFile));
     const profile = resolveProfile(options.fullCheck);
     const config = makeE2EConfig(
       baseConfig,
@@ -8507,7 +8646,8 @@ async function runFailureE2E(options, runId, root, logger) {
     if (!options.keep) {
       await persistResources(root, runId, resources);
     }
-    const baseConfig = await loadRepoConfig(root, resolveE2EConfigFile(root));
+    const e2eConfigFile = resolveE2EConfigFile(root);
+    const baseConfig = e2eConfigFile === path8.join(".pourkit", "config.json") ? await loadRepoConfig(root) : await loadConfig(path8.resolve(root, e2eConfigFile));
     const profile = resolveProfile(options.fullCheck);
     const config = makeFailureE2EConfig(
       baseConfig,