@pourkit/cli 0.0.0-next-20260614002607 → 0.0.0-next-20260614182520

package/dist/cli.js

@@ -58,20 +58,20 @@ function createLogger(name, filePath) {
       );
     },
     async close() {
-      await new Promise((resolve3) => {
+      await new Promise((resolve5) => {
         if (!fileStream) {
-          resolve3();
+          resolve5();
           return;
         }
         const timer = setTimeout(() => {
           if (!fileStream.destroyed) {
             fileStream.destroy();
           }
-          resolve3();
+          resolve5();
         }, 2e3);
         fileStream.end(() => {
           clearTimeout(timer);
-          resolve3();
+          resolve5();
         });
       });
     }
@@ -153,6 +153,7 @@ __export(common_exports, {
   execJson: () => execJson,
   parseWorktreeListPorcelain: () => parseWorktreeListPorcelain,
   readMaybeEnvInt: () => readMaybeEnvInt,
+  redactSensitiveValues: () => redactSensitiveValues,
   repoRelative: () => repoRelative,
   repoRoot: () => repoRoot,
   sleep: () => sleep,
@@ -265,7 +266,7 @@ async function execJson(command, args, options = {}) {
   return JSON.parse(result.stdout);
 }
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 async function execCaptureWithRetry(command, args, options = {}) {
   const retries = options.retries ?? 3;
@@ -311,7 +312,14 @@ function parseWorktreeListPorcelain(text2, branch) {
   }
   return null;
 }
-var execFileAsync, TRANSIENT_GH_ERROR, TYPE_LABELS;
+function redactSensitiveValues(input) {
+  let redacted = input;
+  for (const pattern of TOKEN_LIKE_PATTERNS) {
+    redacted = redacted.replace(pattern, "[REDACTED]");
+  }
+  return redacted;
+}
+var execFileAsync, TRANSIENT_GH_ERROR, TYPE_LABELS, TOKEN_LIKE_PATTERNS;
 var init_common = __esm({
   "shared/common.ts"() {
     "use strict";
@@ -325,6 +333,16 @@ var init_common = __esm({
       "type:polish",
       "type:refactor"
     ];
+    TOKEN_LIKE_PATTERNS = [
+      /gh[ps]_[A-Za-z0-9]{20,}/g,
+      /token[=:_\s][A-Za-z0-9_-]{20,}/gi,
+      /secret[=:_\s][A-Za-z0-9_-]{20,}/gi,
+      /credential[=:_\s][A-Za-z0-9_-]{20,}/gi,
+      /key[=:_\s][A-Za-z0-9_-]{20,}/gi,
+      /bearer\s+[A-Za-z0-9_-]{20,}/gi,
+      /authorization:\s*Bearer\s+[A-Za-z0-9_-]{20,}/gi,
+      /xox[baprs]-[A-Za-z0-9_-]{10,}/g
+    ];
   }
 });
 
@@ -335,175 +353,37 @@ import { pathToFileURL } from "url";
 import { Command, Option, CommanderError } from "commander";
 
 // shared/config.ts
-import { join } from "path";
-import { z } from "zod";
-var NonEmptyString = z.string().trim().min(1);
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, isAbsolute, join, normalize, sep, resolve } from "path";
+import Ajv from "ajv";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname(__filename);
+var SCHEMA_PATH = resolve(__dirname, "../schema/pourkit.schema.json");
+var _schema = null;
+var _validate = null;
+var _ajvErrors = null;
+function getValidator() {
+  if (!_validate) {
+    const schema = _schema ?? JSON.parse(readFileSync(SCHEMA_PATH, "utf-8"));
+    _schema = schema;
+    const ajv = new Ajv({ strict: true });
+    ajv.addKeyword("x-pourkit-schema-version");
+    const validate = ajv.compile(schema);
+    _validate = (data) => {
+      _ajvErrors = null;
+      const valid2 = validate(data);
+      if (!valid2) _ajvErrors = validate.errors;
+      return valid2;
+    };
+  }
+  return _validate;
+}
 var DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES = 3;
-var OutputRetriesConfigSchema = z.object({
-  missingOrEmpty: z.number().int().nonnegative().default(DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES)
-}).strict();
+var DEFAULT_BRANCH_TEMPLATE = "pourkit/{{issue.number}}/{{issue.slug}}";
 function resolveMissingOrEmptyOutputRetries(config) {
   return config?.outputRetries?.missingOrEmpty ?? DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES;
 }
-var StageAgentConfigSchema = z.object({
-  agent: NonEmptyString,
-  model: NonEmptyString,
-  variant: NonEmptyString.optional(),
-  env: z.record(z.string(), z.string()).optional(),
-  promptTemplate: NonEmptyString,
-  outputRetries: OutputRetriesConfigSchema.optional()
-}).strict();
-var ReviewerConfigSchema = z.object({
-  agent: NonEmptyString,
-  model: NonEmptyString,
-  variant: NonEmptyString.optional(),
-  env: z.record(z.string(), z.string()).optional(),
-  promptTemplate: NonEmptyString,
-  outputRetries: OutputRetriesConfigSchema.optional(),
-  criteria: z.array(NonEmptyString),
-  includeReviewHistory: z.boolean().optional(),
-  passWithNotesRefactorAttempts: z.number().int().nonnegative().optional()
-}).strict();
-var VerificationCommandSchema = z.object({
-  command: z.string().nullable().optional(),
-  label: z.string().optional()
-}).strict().refine((d) => d.command && d.command.trim() !== "", {
-  message: "must have a non-empty command"
-}).transform((d) => ({
-  command: d.command,
-  label: d.label && d.label.trim() !== "" ? d.label : void 0
-}));
-var PrdRunModeSchema = z.enum(["github", "local"]);
-var QueueConfigSchema = z.object({
-  loop: z.boolean().optional()
-}).strict();
-var FailureResolutionConfigSchema = z.object({
-  agent: NonEmptyString,
-  model: NonEmptyString,
-  variant: NonEmptyString.optional(),
-  env: z.record(z.string(), z.string()).optional(),
-  promptTemplate: NonEmptyString,
-  outputRetries: OutputRetriesConfigSchema.optional(),
-  maxAttemptsPerFailure: z.number().int().positive(),
-  failureLimits: z.record(z.string(), z.number().int().positive()).optional()
-}).strict();
-var ReviewRefactorLoopStrategySchema = z.object({
-  type: z.literal("review-refactor-loop"),
-  implement: z.object({
-    builder: StageAgentConfigSchema
-  }).strict(),
-  conflictResolution: z.object({
-    agent: NonEmptyString,
-    model: NonEmptyString,
-    variant: NonEmptyString.optional(),
-    env: z.record(z.string(), z.string()).optional(),
-    promptTemplate: NonEmptyString,
-    maxAttempts: z.number().int().positive()
-  }).strict().optional(),
-  failureResolution: FailureResolutionConfigSchema,
-  review: z.object({
-    reviewer: ReviewerConfigSchema,
-    refactor: StageAgentConfigSchema,
-    maxIterations: z.number().int().positive(),
-    passWithNotesRefactorAttempts: z.number().int().nonnegative().default(2)
-  }).strict(),
-  verify: z.object({
-    commands: z.preprocess(
-      (v) => Array.isArray(v) ? v : [],
-      z.array(VerificationCommandSchema).refine((arr) => arr.length > 0, {
-        message: "must contain at least one command"
-      })
-    )
-  }).strict().optional(),
-  issueFinalReview: StageAgentConfigSchema.extend({
-    maxAttempts: z.number().int().positive()
-  }),
-  finalize: z.object({
-    prDescriptionAgent: StageAgentConfigSchema,
-    maxAttempts: z.number().int().positive()
-  }).strict(),
-  prdRun: z.object({
-    mode: PrdRunModeSchema.optional(),
-    // Uses promptTemplate (canonical StageAgentConfig field), not prompt as Issue contract may suggest
-    finalReview: StageAgentConfigSchema
-  }).strict().optional()
-}).strict();
-var TargetSerenaConfigSchema = z.object({
-  enabled: z.boolean().optional(),
-  required: z.boolean().optional()
-}).strict();
-var TargetSchema = z.object({
-  name: NonEmptyString,
-  baseBranch: z.preprocess(
-    (v) => typeof v === "string" && v.length > 0 ? v : void 0,
-    NonEmptyString.default("main")
-  ),
-  branchTemplate: z.string().default("pourkit/{{issue.number}}/{{issue.slug}}"),
-  setupCommands: z.preprocess(
-    (v) => Array.isArray(v) ? v : void 0,
-    z.array(VerificationCommandSchema).default([])
-  ),
-  autoMerge: z.preprocess(
-    (v) => typeof v === "boolean" ? v : void 0,
-    z.boolean().default(true)
-  ),
-  queue: QueueConfigSchema.optional(),
-  serena: TargetSerenaConfigSchema.optional(),
-  strategy: ReviewRefactorLoopStrategySchema
-}).strict();
-var LabelsSchema = z.object({
-  readyForAgent: NonEmptyString,
-  agentInProgress: NonEmptyString,
-  blocked: NonEmptyString,
-  prOpenAwaitingMerge: NonEmptyString,
-  readyForHuman: NonEmptyString,
-  needsTriage: NonEmptyString.optional().default("needs-triage")
-}).strict();
-var SandboxMountSchema = z.object({
-  hostPath: NonEmptyString,
-  sandboxPath: NonEmptyString,
-  readonly: z.boolean().default(false)
-}).strict();
-var SandboxSchema = z.object({
-  provider: NonEmptyString,
-  copyToWorktree: z.array(NonEmptyString).optional(),
-  mounts: z.array(SandboxMountSchema).optional(),
-  env: z.record(z.string()).optional(),
-  idleTimeoutSeconds: z.preprocess((v) => {
-    if (v === void 0) return void 0;
-    if (typeof v === "number" && Number.isFinite(v) && v > 0) return v;
-    return v;
-  }, z.number().int().positive().optional())
-}).strict();
-var ChecksSchema = z.object({
-  requiredLabels: z.array(NonEmptyString),
-  allowedAuthors: z.array(NonEmptyString),
-  checksFoundTimeoutSeconds: z.number().int().positive().optional(),
-  checksCompletionTimeoutSeconds: z.number().int().positive().optional(),
-  pollIntervalSeconds: z.number().int().positive().optional(),
-  issueListLimit: z.number().int().positive().optional()
-}).strict();
-var CleanupConfigSchema = z.object({
-  enabled: z.boolean().default(true),
-  worktreeRetentionDays: z.number().int().positive().default(14),
-  logRetentionDays: z.number().int().positive().default(30)
-}).strict();
-var SerenaConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  required: z.boolean().default(false),
-  mcpUrl: NonEmptyString.default("http://localhost:9121/mcp"),
-  sandboxMcpUrl: NonEmptyString.default("http://localhost:9121/mcp"),
-  dataDir: z.string().default(".pourkit/serena/"),
-  autoStart: z.boolean().default(false)
-}).strict();
-var PourkitConfigSchema = z.object({
-  targets: z.array(TargetSchema).min(1),
-  labels: LabelsSchema,
-  sandbox: SandboxSchema,
-  checks: ChecksSchema,
-  cleanup: CleanupConfigSchema.optional(),
-  serena: SerenaConfigSchema.default({})
-}).strict();
 var removedFieldReplacements = {
   "config.implementor": "targets[].strategy.implement.builder",
   "config.reviewer": "targets[].strategy.review.reviewer",
@@ -567,11 +447,12 @@ function checkRemovedFields(raw) {
     }
   }
 }
-function formatZodPath(path9) {
-  if (path9.length === 0) return "";
+function formatAjvPath(instancePath) {
+  if (!instancePath || instancePath === "/") return "";
+  const parts = instancePath.split("/").slice(1);
   let result = "";
-  for (const segment of path9) {
-    if (typeof segment === "number") {
+  for (const segment of parts) {
+    if (/^\d+$/.test(segment)) {
       result += `[${segment}]`;
     } else {
       result += result ? `.${segment}` : segment;
@@ -579,51 +460,172 @@ function formatZodPath(path9) {
   }
   return result;
 }
-function formatFirstZodError(err) {
-  const issue = err.issues[0];
-  const path9 = formatZodPath(issue.path);
-  if (path9 === "targets" && (issue.code === "too_small" || issue.code === "invalid_type")) {
-    return "Config must have at least one target";
+function formatFirstAjvError(errors) {
+  const error = errors[0];
+  const path9 = formatAjvPath(error.instancePath);
+  if (error.keyword === "required") {
+    const missingParam = error.params.missingProperty;
+    if (missingParam === "targets") {
+      return "Config must have at least one target";
+    }
+    if (path9 === "" && missingParam === "targets") {
+      return "Config must have at least one target";
+    }
+    if (path9) {
+      return `${path9} must have required property '${missingParam}'`;
+    }
+    return `${missingParam} must be an object`;
   }
-  if (issue.path.length >= 3 && issue.path[0] === "targets" && typeof issue.path[1] === "number" && issue.path[2] === "name" && issue.code === z.ZodIssueCode.too_small) {
-    return `Target[${issue.path[1]}] must have a non-empty name`;
+  if (error.keyword === "additionalProperties") {
+    const additionalProp = error.params.additionalProperty;
+    const keyPath = path9 ? `${path9}.${additionalProp}` : additionalProp;
+    return `${keyPath} is not supported`;
   }
-  switch (issue.code) {
-    case z.ZodIssueCode.invalid_type: {
-      if (issue.expected === "object") {
-        return path9 ? `${path9} must be an object` : "Config must be an object";
-      }
-      if (issue.expected === "integer") {
-        return `${path9} must be an integer`;
-      }
-      if (issue.expected === "string") {
-        return `${path9} must be a string`;
-      }
-      if (issue.expected === "number") {
-        return `${path9} must be a number`;
-      }
-      return issue.message;
+  if (error.keyword === "minLength") {
+    if (path9) {
+      return `${path9} must be a non-empty string`;
+    }
+    return "Config must be a non-empty string";
+  }
+  if (error.keyword === "const") {
+    const allowedValue = error.params.allowedValue;
+    return `${path9 || "Config"} must be ${JSON.stringify(allowedValue)}`;
+  }
+  if (error.keyword === "enum") {
+    const allowedValues = error.params.allowedValues;
+    return `${path9} must be one of: ${allowedValues.map((v) => JSON.stringify(v)).join(", ")}`;
+  }
+  if (error.keyword === "minimum" || error.keyword === "exclusiveMinimum") {
+    const limit = error.params.limit;
+    if (limit === 1) {
+      return `${path9} must be a positive number`;
+    }
+    return `${path9} must be at least ${limit}`;
+  }
+  if (error.keyword === "type") {
+    const expected = error.params.type;
+    if (path9 === "") {
+      return `Config must be an object`;
+    }
+    if (expected === "object") {
+      return `${path9} must be an object`;
+    }
+    if (expected === "integer") {
+      return `${path9} must be an integer`;
+    }
+    if (expected === "string") {
+      return `${path9} must be a string`;
+    }
+    if (expected === "number") {
+      return `${path9} must be a number`;
+    }
+    return `${path9} must be ${expected === "integer" ? "an integer" : `a ${expected}`}`;
+  }
+  if (error.keyword === "minItems") {
+    return `${path9} must contain at least one item`;
+  }
+  if (error.keyword === "pattern") {
+    return `${path9} has an invalid format`;
+  }
+  return `${path9 || "Config"} ${error.message || "is invalid"}`;
+}
+function applyOutputRetriesDefaults(retries) {
+  if (retries === void 0) return void 0;
+  return {
+    missingOrEmpty: retries.missingOrEmpty ?? DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES
+  };
+}
+function applyStageAgentDefaults(agent) {
+  return {
+    ...agent,
+    outputRetries: applyOutputRetriesDefaults(agent.outputRetries)
+  };
+}
+function assertRepoRelativePath(value, location) {
+  const normalized = normalize(value);
+  if (isAbsolute(value) || isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${sep}`)) {
+    throw new Error(
+      `${location} must stay within the repository and be repo-relative; got "${value}"`
+    );
+  }
+}
+function assertBaseBranch(value, location) {
+  if (value.includes("/")) {
+    throw new Error(
+      `${location} must be a local branch name, not a remote-qualified, tag, ref, or path-like name; got "${value}"`
+    );
+  }
+  if (/^[0-9a-f]{7,40}$/i.test(value)) {
+    throw new Error(
+      `${location} must be a branch name, not a commit SHA; got "${value}"`
+    );
+  }
+}
+function assertStageAgentPath(agent, location) {
+  if (!agent) return;
+  const promptTemplate = agent.promptTemplate;
+  if (typeof promptTemplate === "string") {
+    assertRepoRelativePath(promptTemplate, `${location}.promptTemplate`);
+  }
+}
+function validateConfigSemantics(data) {
+  const sandbox = data.sandbox;
+  const copyToWorktree = sandbox?.copyToWorktree;
+  copyToWorktree?.forEach((entry, index) => {
+    assertRepoRelativePath(entry, `sandbox.copyToWorktree[${index}]`);
+  });
+  const targetNames = /* @__PURE__ */ new Set();
+  data.targets.forEach((target, targetIndex) => {
+    const name = target.name;
+    if (targetNames.has(name)) {
+      throw new Error(
+        `Duplicate target name "${name}"; target names must be unique`
+      );
+    }
+    targetNames.add(name);
+    assertBaseBranch(
+      target.baseBranch,
+      `targets[${targetIndex}].baseBranch`
+    );
+    const strategy = target.strategy;
+    const implement = strategy.implement;
+    const review = strategy.review;
+    const finalize = strategy.finalize;
+    assertStageAgentPath(
+      implement.builder,
+      `targets[${targetIndex}].strategy.implement.builder`
+    );
+    assertStageAgentPath(
+      strategy.conflictResolution,
+      `targets[${targetIndex}].strategy.conflictResolution`
+    );
+    assertStageAgentPath(
+      strategy.failureResolution,
+      `targets[${targetIndex}].strategy.failureResolution`
+    );
+    assertStageAgentPath(
+      review.reviewer,
+      `targets[${targetIndex}].strategy.review.reviewer`
+    );
+    assertStageAgentPath(
+      review.refactor,
+      `targets[${targetIndex}].strategy.review.refactor`
+    );
+    assertStageAgentPath(
+      strategy.issueFinalReview,
+      `targets[${targetIndex}].strategy.issueFinalReview`
+    );
+    assertStageAgentPath(
+      finalize.prDescriptionAgent,
+      `targets[${targetIndex}].strategy.finalize.prDescriptionAgent`
+    );
+  });
+}
+function assertKnownKeys(value, path9, knownKeys) {
+  for (const key of Object.keys(value)) {
+    if (!knownKeys.includes(key)) {
+      throw new Error(`${path9}.${key} is not supported`);
     }
-    case z.ZodIssueCode.too_small:
-      if (issue.type === "string" && issue.minimum === 1) {
-        return `${path9} must be a non-empty string`;
-      }
-      if (issue.type === "array" && issue.minimum === 1) {
-        return `${path9} must not be empty`;
-      }
-      if (issue.type === "number") {
-        return `${path9} must be a positive number`;
-      }
-      return issue.message;
-    case z.ZodIssueCode.invalid_literal:
-      return `${path9} must be ${issue.expected}`;
-    case z.ZodIssueCode.unrecognized_keys:
-      const keyPath = path9 ? `${path9}.${issue.keys[0]}` : issue.keys[0];
-      return `${keyPath} is not supported`;
-    case z.ZodIssueCode.custom:
-      return path9 ? `${path9} ${issue.message}` : issue.message;
-    default:
-      return issue.message;
   }
 }
 function parseConfig(raw) {
@@ -645,6 +647,7 @@ function parseConfig(raw) {
       "name",
       "baseBranch",
       "branchTemplate",
+      "prdRun",
       "setupCommands",
       "autoMerge",
       "queue",
@@ -660,9 +663,20 @@ function parseConfig(raw) {
         `targets[${i}].strategy.conflictResolution has been removed; use targets[${i}].strategy.failureResolution`
       );
     }
-    if (strategy && typeof strategy === "object" && strategy.prdRun && typeof strategy.prdRun === "object" && "reconciliation" in strategy.prdRun) {
+    if (strategy && typeof strategy === "object" && strategy.prdRun && typeof strategy.prdRun === "object") {
+      const prdRun = strategy.prdRun;
+      if ("reconciliation" in prdRun) {
+        throw new Error(
+          `targets[${i}].strategy.prdRun.reconciliation has been removed; PRD Run no longer invokes Architect reconciliation.`
+        );
+      }
+      if ("finalReview" in prdRun) {
+        throw new Error(
+          `targets[${i}].strategy.prdRun.finalReview has been removed; PRD-wide Final Review is no longer part of the PRD Run lifecycle. Use targets[${i}].strategy.issueFinalReview instead.`
+        );
+      }
       throw new Error(
-        `targets[${i}].strategy.prdRun.reconciliation has been removed; PRD Run no longer invokes Architect reconciliation.`
+        `targets[${i}].strategy.prdRun is not supported in the new config; use targets[${i}].prdRun instead.`
       );
     }
   }
@@ -672,67 +686,126 @@ function parseConfig(raw) {
       "copyToWorktree",
       "mounts",
       "env",
-      "idleTimeoutSeconds"
+      "idleTimeoutSeconds",
+      "forceRebuild"
     ]);
   }
-  const result = PourkitConfigSchema.safeParse(raw);
-  if (!result.success) {
-    throw new Error(formatFirstZodError(result.error));
-  }
-  const data = result.data;
-  const targets = data.targets.map((t) => {
-    const setupCommands = t.setupCommands?.map((cmd, i) => ({
-      command: cmd.command,
-      label: cmd.label ?? `check-${i}`
-    }));
-    const verifyCommands = t.strategy.verify?.commands?.map((cmd, i) => ({
-      command: cmd.command,
-      label: cmd.label ?? `check-${i}`
-    }));
-    return {
-      name: t.name,
-      baseBranch: t.baseBranch,
-      branchTemplate: t.branchTemplate,
-      setupCommands,
-      autoMerge: t.autoMerge,
-      queue: t.queue,
-      serena: t.serena,
-      strategy: {
-        type: "review-refactor-loop",
-        implement: { builder: t.strategy.implement.builder },
-        failureResolution: {
-          agent: t.strategy.failureResolution.agent,
-          model: t.strategy.failureResolution.model,
-          promptTemplate: t.strategy.failureResolution.promptTemplate,
-          outputRetries: t.strategy.failureResolution.outputRetries,
-          maxAttemptsPerFailure: t.strategy.failureResolution.maxAttemptsPerFailure,
-          failureLimits: t.strategy.failureResolution.failureLimits
-        },
-        review: {
-          reviewer: t.strategy.review.reviewer,
-          refactor: t.strategy.review.refactor,
-          maxIterations: t.strategy.review.maxIterations,
-          passWithNotesRefactorAttempts: t.strategy.review.passWithNotesRefactorAttempts
-        },
-        ...t.strategy.verify ? { verify: { commands: verifyCommands } } : {},
-        issueFinalReview: t.strategy.issueFinalReview,
-        finalize: {
-          prDescriptionAgent: t.strategy.finalize.prDescriptionAgent,
-          maxAttempts: t.strategy.finalize.maxAttempts
-        },
-        ...t.strategy.prdRun ? {
-          prdRun: {
-            ...t.strategy.prdRun.mode ? { mode: t.strategy.prdRun.mode } : {},
-            finalReview: t.strategy.prdRun.finalReview
+  const validate = getValidator();
+  if (!validate(raw)) {
+    throw new Error(
+      formatFirstAjvError(
+        _ajvErrors ?? [
+          {
+            instancePath: "",
+            message: "validation failed",
+            keyword: "error",
+            params: {}
           }
-        } : {}
-      }
-    };
-  });
+        ]
+      )
+    );
+  }
+  const data = config;
+  validateConfigSemantics(data);
+  const targets = data.targets.map(
+    (t) => {
+      const input = t;
+      const strategy = input.strategy;
+      const implement = strategy.implement;
+      const failureResolution = strategy.failureResolution;
+      const review = strategy.review;
+      const reviewReviewer = review.reviewer;
+      const reviewRefactor = review.refactor;
+      const finalize = strategy.finalize;
+      const issueFinalReview = strategy.issueFinalReview;
+      const setupCommands = input.setupCommands?.map((cmd, i) => ({
+        command: cmd.command,
+        label: cmd.label ?? `check-${i}`
+      }));
+      const verifyCommands = strategy.verify?.commands ? strategy.verify.commands : void 0;
+      const verifyLabeled = verifyCommands?.map((cmd, i) => ({
+        command: cmd.command,
+        label: cmd.label ?? `check-${i}`
+      }));
+      return {
+        name: input.name,
+        baseBranch: input.baseBranch,
+        branchTemplate: input.branchTemplate ?? DEFAULT_BRANCH_TEMPLATE,
+        prdRun: input.prdRun,
+        setupCommands,
+        autoMerge: input.autoMerge !== void 0 ? input.autoMerge : true,
+        queue: input.queue,
+        serena: input.serena,
+        strategy: {
+          type: "review-refactor-loop",
+          implement: {
+            builder: applyStageAgentDefaults(
+              implement.builder
+            )
+          },
+          failureResolution: {
+            agent: failureResolution.agent,
+            model: failureResolution.model,
+            variant: failureResolution.variant,
+            env: failureResolution.env,
+            promptTemplate: failureResolution.promptTemplate,
+            outputRetries: applyOutputRetriesDefaults(
+              failureResolution.outputRetries
+            ),
+            maxAttemptsPerFailure: failureResolution.maxAttemptsPerFailure,
+            failureLimits: failureResolution.failureLimits
+          },
+          review: {
+            reviewer: {
+              agent: reviewReviewer.agent,
+              model: reviewReviewer.model,
+              variant: reviewReviewer.variant,
+              env: reviewReviewer.env,
+              promptTemplate: reviewReviewer.promptTemplate,
+              outputRetries: applyOutputRetriesDefaults(
+                reviewReviewer.outputRetries
+              ),
+              criteria: reviewReviewer.criteria,
+              includeReviewHistory: reviewReviewer.includeReviewHistory,
+              passWithNotesRefactorAttempts: reviewReviewer.passWithNotesRefactorAttempts
+            },
+            refactor: applyStageAgentDefaults(
+              reviewRefactor
+            ),
+            maxIterations: review.maxIterations,
+            passWithNotesRefactorAttempts: review.passWithNotesRefactorAttempts ?? 2
+          },
+          ...verifyLabeled ? { verify: { commands: verifyLabeled } } : {},
+          issueFinalReview: {
+            ...issueFinalReview,
+            maxAttempts: issueFinalReview.maxAttempts,
+            outputRetries: applyOutputRetriesDefaults(
+              issueFinalReview.outputRetries
+            )
+          },
+          finalize: {
+            prDescriptionAgent: applyStageAgentDefaults(
+              finalize.prDescriptionAgent
+            ),
+            maxAttempts: finalize.maxAttempts
+          }
+        }
+      };
+    }
+  );
+  const serenaRaw = data.serena;
+  const serenaDefaults = {
+    mcpUrl: serenaRaw?.mcpUrl ?? "http://localhost:9121/mcp",
+    sandboxMcpUrl: serenaRaw?.sandboxMcpUrl ?? "http://localhost:9121/mcp",
+    dataDir: serenaRaw?.dataDir ?? ".pourkit/serena/"
+  };
   const serena = {
-    ...data.serena,
-    mcpUrl: process.env.POURKIT_SERENA_MCP_URL ?? data.serena.mcpUrl,
-    sandboxMcpUrl: process.env.POURKIT_SERENA_SANDBOX_MCP_URL ?? data.serena.sandboxMcpUrl
+    enabled: serenaRaw?.enabled ?? false,
+    required: serenaRaw?.required ?? false,
+    mcpUrl: process.env.POURKIT_SERENA_MCP_URL ?? serenaDefaults.mcpUrl,
+    sandboxMcpUrl: process.env.POURKIT_SERENA_SANDBOX_MCP_URL ?? serenaDefaults.sandboxMcpUrl,
+    dataDir: serenaDefaults.dataDir,
+    autoStart: serenaRaw?.autoStart ?? false
   };
   if (serena.mcpUrl.trim() === "") {
     throw new Error("POURKIT_SERENA_MCP_URL must be a non-empty string");
@@ -742,39 +815,48 @@ function parseConfig(raw) {
       "POURKIT_SERENA_SANDBOX_MCP_URL must be a non-empty string"
     );
   }
+  const checksRaw = data.checks;
+  const labelsRaw = data.labels;
+  const cleanupRaw = data.cleanup;
+  const sandboxRaw = data.sandbox;
   return {
     targets,
-    labels: data.labels,
+    labels: {
+      readyForAgent: labelsRaw?.readyForAgent ?? "ready-for-agent",
+      agentInProgress: labelsRaw?.agentInProgress ?? "agent-in-progress",
+      blocked: labelsRaw?.blocked ?? "blocked",
+      prOpenAwaitingMerge: labelsRaw?.prOpenAwaitingMerge ?? "pr-open-awaiting-merge",
+      readyForHuman: labelsRaw?.readyForHuman ?? "ready-for-human",
+      needsTriage: labelsRaw?.needsTriage ?? "needs-triage"
+    },
     sandbox: {
-      provider: data.sandbox.provider,
-      copyToWorktree: data.sandbox.copyToWorktree,
-      mounts: data.sandbox.mounts,
-      env: data.sandbox.env,
-      idleTimeoutSeconds: data.sandbox.idleTimeoutSeconds
+      provider: sandboxRaw?.provider ?? "docker",
+      copyToWorktree: sandboxRaw?.copyToWorktree,
+      mounts: sandboxRaw?.mounts ? sandboxRaw.mounts.map((m) => ({
+        hostPath: m.hostPath,
+        sandboxPath: m.sandboxPath,
+        readonly: m.readonly ?? false
+      })) : void 0,
+      env: sandboxRaw?.env,
+      idleTimeoutSeconds: sandboxRaw?.idleTimeoutSeconds,
+      forceRebuild: sandboxRaw?.forceRebuild
     },
     checks: {
-      requiredLabels: data.checks.requiredLabels,
-      allowedAuthors: data.checks.allowedAuthors,
-      checksFoundTimeoutSeconds: data.checks.checksFoundTimeoutSeconds ?? 60,
-      checksCompletionTimeoutSeconds: data.checks.checksCompletionTimeoutSeconds ?? 30 * 60,
-      pollIntervalSeconds: data.checks.pollIntervalSeconds ?? 15,
-      issueListLimit: data.checks.issueListLimit ?? 50
+      requiredLabels: checksRaw?.requiredLabels ?? [],
+      allowedAuthors: checksRaw?.allowedAuthors ?? [],
+      checksFoundTimeoutSeconds: checksRaw?.checksFoundTimeoutSeconds ?? 60,
+      checksCompletionTimeoutSeconds: checksRaw?.checksCompletionTimeoutSeconds ?? 30 * 60,
+      pollIntervalSeconds: checksRaw?.pollIntervalSeconds ?? 15,
+      issueListLimit: checksRaw?.issueListLimit ?? 50
     },
     serena,
     cleanup: {
-      enabled: data.cleanup?.enabled ?? true,
-      worktreeRetentionDays: data.cleanup?.worktreeRetentionDays ?? 14,
-      logRetentionDays: data.cleanup?.logRetentionDays ?? 30
+      enabled: cleanupRaw?.enabled ?? true,
+      worktreeRetentionDays: cleanupRaw?.worktreeRetentionDays ?? 14,
+      logRetentionDays: cleanupRaw?.logRetentionDays ?? 30
     }
   };
 }
-function assertKnownKeys(value, path9, knownKeys) {
-  for (const key of Object.keys(value)) {
-    if (!knownKeys.includes(key)) {
-      throw new Error(`${path9}.${key} is not supported`);
-    }
-  }
-}
 function getVerificationCommands(target) {
   return target.strategy.verify?.commands ?? [];
 }
@@ -782,7 +864,7 @@ function resolvePrdRunMode(target, opts) {
   if (opts?.localOverride === true) {
     return { mode: "local", source: "cli-override", targetName: target.name };
   }
-  const configMode = target.strategy.prdRun?.mode;
+  const configMode = target.prdRun?.mode;
   if (configMode) {
     return {
       mode: configMode,
@@ -792,48 +874,41 @@ function resolvePrdRunMode(target, opts) {
   }
   return { mode: "github", source: "default", targetName: target.name };
 }
-async function loadRepoConfig(repoRoot2, configFileName = "pourkit.config.ts") {
+var OBSOLETE_CONFIG_PATHS = [
+  "pourkit.config.ts",
+  "pourkit.config.mjs",
+  "pourkit.config.js",
+  "pourkit.json"
+];
+var CANONICAL_CONFIG_PATH = ".pourkit/config.json";
+async function loadRepoConfig(repoRoot2, _configFileName) {
   const { existsSync: existsSync19 } = await import("fs");
-  const { mkdir: mkdir6, writeFile: writeFile4, rm } = await import("fs/promises");
-  const { join: pjoin, basename } = await import("path");
-  const { pathToFileURL: pathToFileURL2 } = await import("url");
-  const { build } = await import("esbuild");
-  const configPath = pjoin(repoRoot2, configFileName);
+  const { join: pjoin } = await import("path");
+  for (const obPath of OBSOLETE_CONFIG_PATHS) {
+    const fullPath = pjoin(repoRoot2, obPath);
+    if (existsSync19(fullPath)) {
+      const isRootJson = obPath === "pourkit.json";
+      throw new Error(
+        isRootJson ? `Found root ${obPath}, but Pourkit config now lives at ${CANONICAL_CONFIG_PATH}. Move the file and update "$schema" to "./schema/pourkit.schema.json".` : `Found ${obPath}, but executable config is no longer supported. Move configuration to ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
+      );
+    }
+  }
+  const configPath = pjoin(repoRoot2, CANONICAL_CONFIG_PATH);
   if (!existsSync19(configPath)) {
     throw new Error(
-      `No config file found at ${configPath}. Create a ${configFileName} that exports a default PourkitConfig.`
+      `No Pourkit config found at ${CANONICAL_CONFIG_PATH}. Run pourkit init or create ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
     );
   }
-  const tmpDir = pjoin(repoRoot2, ".pourkit", ".tmp", "config");
-  await mkdir6(tmpDir, { recursive: true });
-  const tmpFile = pjoin(
-    tmpDir,
-    `pourkit-config-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.mjs`
-  );
+  const { readFile: readFile7 } = await import("fs/promises");
+  const raw = await readFile7(configPath, "utf-8");
+  let parsed;
   try {
-    await build({
-      entryPoints: [configPath],
-      bundle: true,
-      write: false,
-      platform: "node",
-      format: "esm",
-      external: ["node:*"]
-    }).then(async (result) => {
-      const output = result.outputFiles[0].text;
-      await writeFile4(tmpFile, output, "utf-8");
-    });
-    const imported = await import(pathToFileURL2(tmpFile).href);
-    const raw = imported.default;
-    if (raw === void 0) {
-      throw new Error("pourkit.config.ts must have a default export");
-    }
-    return parseConfig(raw);
-  } finally {
-    try {
-      await rm(tmpFile, { force: true });
-    } catch {
-    }
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    const message = err instanceof SyntaxError ? err.message : String(err);
+    throw new Error(`${CANONICAL_CONFIG_PATH}: Invalid JSON \u2014 ${message}`);
   }
+  return parseConfig(parsed);
 }
 function resolvePromptTemplatePath(repoRoot2, promptTemplate) {
   if (promptTemplate.includes("/")) {
@@ -872,8 +947,8 @@ function resolveTarget(config, explicitTarget) {
 init_common();
 
 // shared/worktree-run-state.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
-import { dirname, join as join2 } from "path";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
 var WORKTREE_RUN_STATE_PATH = ".pourkit/state.json";
 function readWorktreeRunState(worktreePath) {
   const statePath = join2(worktreePath, WORKTREE_RUN_STATE_PATH);
@@ -881,7 +956,7 @@ function readWorktreeRunState(worktreePath) {
     return null;
   }
   try {
-    const raw = JSON.parse(readFileSync(statePath, "utf-8"));
+    const raw = JSON.parse(readFileSync2(statePath, "utf-8"));
     if (isValidWorktreeRunState(raw)) {
       return raw;
     }
@@ -902,7 +977,7 @@ function isValidWorktreeRunState(raw) {
 }
 function writeWorktreeRunState(worktreePath, state) {
   const statePath = join2(worktreePath, WORKTREE_RUN_STATE_PATH);
-  mkdirSync2(dirname(statePath), { recursive: true });
+  mkdirSync2(dirname2(statePath), { recursive: true });
   writeFileSync(statePath, JSON.stringify(state, null, 2), "utf-8");
 }
 function updateWorktreeRunState(worktreePath, update) {
@@ -1049,8 +1124,8 @@ async function cleanupRepository(options) {
 // commands/artifact-validation.ts
 import { createHash } from "crypto";
 import { execSync } from "child_process";
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve2 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { isAbsolute as isAbsolute3, join as join7, resolve as resolve3 } from "path";
 
 // pr/review-verdict.ts
 var ReviewVerdictProtocolError = class extends Error {
@@ -1085,15 +1160,15 @@ function parseReviewVerdict(output) {
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   readdirSync as readdirSync2,
   writeFileSync as writeFileSync3
 } from "fs";
 import { join as join6 } from "path";
 
 // execution/agent-output-retry.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, rmSync } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
 async function executeWithMissingOrEmptyArtifactRetry({
   executionProvider,
   executionOptions,
@@ -1153,20 +1228,20 @@ function readArtifactOutput(artifactPath) {
   if (!existsSync2(artifactPath)) {
     return { _tag: "missing", path: artifactPath };
   }
-  const output = readFileSync2(artifactPath, "utf-8");
+  const output = readFileSync3(artifactPath, "utf-8");
   if (!output.trim()) {
     return { _tag: "empty", path: artifactPath };
   }
   return { _tag: "content", value: output, path: artifactPath };
 }
 function prepareArtifactPath(artifactPath) {
-  mkdirSync3(dirname2(artifactPath), { recursive: true });
+  mkdirSync3(dirname3(artifactPath), { recursive: true });
   rmSync(artifactPath, { recursive: true, force: true });
 }
 
 // shared/run-context.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync } from "fs";
-import { isAbsolute, join as join5, relative, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync } from "fs";
+import { isAbsolute as isAbsolute2, join as join5, relative, resolve as resolve2 } from "path";
 
 // commands/run-verification.ts
 init_common();
@@ -1314,13 +1389,6 @@ var STAGE_SECTIONS = {
     "branch",
     "verification-commands",
     "artifacts"
-  ],
-  prdReconciliation: [
-    "issue",
-    "comments",
-    "branch",
-    "verification-commands",
-    "artifacts"
   ]
 };
 function buildRunContextArtifact(options) {
@@ -1372,11 +1440,17 @@ function buildRunContextMarkdown(options) {
     }
   }
   if (sections.includes("branch")) {
+    const canonicalBaseRef = `origin/${target.baseBranch}`;
     parts.push(
       "## Branch",
       "",
       `- Base: ${target.baseBranch}`,
+      `- Canonical Base Ref: ${canonicalBaseRef}`,
       `- Working Branch: ${branchName}`,
+      "",
+      "Use the canonical base ref for scope checks, commit ranges, and diffs. Do not use a bare PRD/base branch name such as `PRD-0063`; local branches with those names may be stale.",
+      "",
+      "Runner-owned Git operations: do not run destructive history/worktree commands such as `git reset --hard`, `git checkout .`, `git clean`, `git rebase`, `git merge`, or `git branch -f`. Edit files only; the runner owns branch/base movement.",
       ""
     );
   }
@@ -1439,7 +1513,7 @@ function renderPrdContext(issue, parentPrdIssue, repoRoot2) {
       `### Parent PRD Content: \`${relative(repoRoot2, parentPrdPath)}\``,
       "",
       "```markdown",
-      readFileSync3(parentPrdPath, "utf-8").trimEnd(),
+      readFileSync4(parentPrdPath, "utf-8").trimEnd(),
       "```",
       ""
     );
@@ -1466,7 +1540,7 @@ function renderPrdContext(issue, parentPrdIssue, repoRoot2) {
       `### Document Content: \`${documentPath}\``,
       "",
       "```markdown",
-      readFileSync3(absolutePath, "utf-8").trimEnd(),
+      readFileSync4(absolutePath, "utf-8").trimEnd(),
       "```",
       ""
     );
@@ -1491,34 +1565,27 @@ function extractRepoPaths(section) {
   return Array.from(paths);
 }
 function resolveRepoPath(repoRoot2, path9) {
-  if (isAbsolute(path9) || path9.includes("\0")) return null;
-  const resolved = resolve(repoRoot2, path9);
+  if (isAbsolute2(path9) || path9.includes("\0")) return null;
+  const resolved = resolve2(repoRoot2, path9);
   const repoRelative2 = relative(repoRoot2, resolved);
-  if (repoRelative2.startsWith("..") || isAbsolute(repoRelative2)) return null;
+  if (repoRelative2.startsWith("..") || isAbsolute2(repoRelative2)) return null;
   return resolved;
 }
 function findParentPrdPath(repoRoot2, parentRef) {
-  const directPath = join5(
-    repoRoot2,
-    ".pourkit",
-    "architecture",
-    parentRef,
-    "PRD.md"
-  );
-  if (existsSync3(directPath)) return directPath;
-  const architectureRoot = join5(repoRoot2, ".pourkit", "architecture");
-  if (!existsSync3(architectureRoot)) return null;
-  return findPrdMirror(architectureRoot, parentRef);
+  const plansRoot = join5(repoRoot2, ".pourkit", "plans");
+  if (!existsSync3(plansRoot)) return null;
+  return findPrdInPlans(plansRoot, parentRef);
 }
-function findPrdMirror(directory, parentRef) {
+function findPrdInPlans(directory, parentRef) {
   for (const entry of readdirSync(directory, { withFileTypes: true })) {
     const entryPath = join5(directory, entry.name);
     if (entry.isDirectory()) {
-      if (entry.name.startsWith(parentRef)) {
+      const prdNumber = parentRef.match(/^PRD-(\d+)$/)?.[1];
+      if (entry.name.startsWith(parentRef) || prdNumber && entry.name.startsWith(`${prdNumber}-`)) {
         const prdPath = join5(entryPath, "PRD.md");
         if (existsSync3(prdPath)) return prdPath;
       }
-      const nested = findPrdMirror(entryPath, parentRef);
+      const nested = findPrdInPlans(entryPath, parentRef);
       if (nested) return nested;
     }
   }
@@ -1538,17 +1605,19 @@ function renderCriteria(criteria) {
 
 // shared/prompt-guidance.ts
 var PROTECTED_WORK_RULE = "Do **not** revert, delete, or substantially strip already-landed protected sibling/base work unless the issue explicitly requires those files.";
+var RUNNER_OWNED_GIT_RULE = "Do **not** move Git history or reset the Worktree. Do not run `git reset --hard`, `git checkout .`, `git clean`, `git rebase`, `git merge`, `git branch -f`, or equivalent destructive history/worktree commands; branch/base changes are runner-owned.";
 function appendProtectedWorkGuidance(promptBody) {
   return `${promptBody}
 
 ## Hard Rule
 
-- ${PROTECTED_WORK_RULE}`;
+- ${PROTECTED_WORK_RULE}
+- ${RUNNER_OWNED_GIT_RULE}`;
 }
 
 // shared/effect-services.ts
 import { Context, Effect, Layer } from "effect";
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "fs";
 var GitExecutionError = class extends Error {
   _tag = "GitExecutionError";
   message;
@@ -1564,7 +1633,7 @@ var FileSystemDefault = Layer.succeed(
   FileSystem,
   FileSystem.of({
     readFile: (path9) => Effect.try({
-      try: () => readFileSync4(path9, "utf-8"),
+      try: () => readFileSync5(path9, "utf-8"),
       catch: (error) => new Error(
         `Failed to read file ${path9}: ${error instanceof Error ? error.message : String(error)}`
       )
@@ -1965,7 +2034,7 @@ function validateRefactorArtifact(artifactPath, findingIds) {
       `Refactor artifact missing at ${artifactPath}`
     );
   }
-  const content = readFileSync5(artifactPath, "utf-8");
+  const content = readFileSync6(artifactPath, "utf-8");
   if (!content.trim()) {
     throw new RefactorArtifactValidationError("Refactor artifact is empty");
   }
@@ -2290,12 +2359,29 @@ A prior review emitted \`NEEDS_HUMAN\` and stopped the agent loop. The issue has
 Before carrying forward old blockers, inspect newer issue comments and the current worktree. Treat prior Reviewer and Refactor Artifacts as historical context, not active findings unless they still apply.
 
 ` : "";
-    return `${renderedTemplate}
+    return appendProtectedWorkGuidance(`${renderedTemplate}
 
 ## Shared Run Context
 
 Read the selected issue requirements, PRD context, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
 
+## Initial Verification Pass
+
+- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
+- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
+- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
+- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
+- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
+- If no verification commands are configured, note that and proceed with normal review.
+
+## Scope Evidence Rules
+
+- Use the Run Context's canonical base ref, for example \`origin/<base>\`, for scope diffs and commit ranges.
+- Do not use bare PRD/base branch names such as \`PRD-0063\`, \`main\`, or \`dev\` for scope decisions; local branches with those names may be stale.
+- Only call a file or commit out of scope when it is part of the working branch's delta from the canonical base ref.
+- Do not recommend reverting accepted sibling/base work. If a file is present or changed on the canonical base ref, it is not this Issue's scope overreach.
+- If scope evidence is ambiguous, use \`NEEDS_HUMAN\` or ask for a runner/base mismatch decision instead of telling Refactor to revert files.
+
 ${hasCriteriaPlaceholder ? "" : `## Review Criteria
 
 ${criteriaBlock}
@@ -2312,7 +2398,7 @@ End the file with exactly one wrapped verdict token: <verdict>PASS</verdict>, <v
 
 Findings must include an ID column with values in the format R${iteration}.F{findingNumber} (e.g., R${iteration}.F1, R${iteration}.F2) and a Supersedes column referencing the finding ID being superseded (or a hyphen for new findings).
 
-When verdict is NEEDS_HUMAN, include Human Handoff Summary and Human Handoff Reason sections before the final verdict token.`;
+When verdict is NEEDS_HUMAN, include Human Handoff Summary and Human Handoff Reason sections before the final verdict token.`);
   });
 }
 function renderReviewHistory(reviewHistory) {
@@ -2437,12 +2523,12 @@ function recoverReviewOutputFromLog(logPath) {
   if (!existsSync5(logPath)) {
     return null;
   }
-  const logContent = readFileSync5(logPath, "utf-8");
+  const logContent = readFileSync6(logPath, "utf-8");
   return recoverReviewOutputFromString(logContent);
 }
 function readReviewArtifact(artifactPath, logPath) {
   if (existsSync5(artifactPath)) {
-    const output = readFileSync5(artifactPath, "utf-8");
+    const output = readFileSync6(artifactPath, "utf-8");
     if (output.trim()) {
       return output;
     }
@@ -3091,194 +3177,6 @@ function parseConflictResolutionArtifact(output) {
   };
 }
 
-// prd-run/final-review-validation.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-function parseFinalReviewArtifact(artifactPath) {
-  if (!existsSync6(artifactPath)) {
-    return {
-      ok: false,
-      reason: "Final Review artifact not found.",
-      diagnostics: [`Artifact path: ${artifactPath}`]
-    };
-  }
-  let content;
-  try {
-    content = readFileSync6(artifactPath, "utf-8");
-  } catch (error) {
-    return {
-      ok: false,
-      reason: "Final Review artifact could not be read.",
-      diagnostics: [
-        error instanceof Error ? error.message : String(error),
-        `Artifact path: ${artifactPath}`
-      ]
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    return {
-      ok: false,
-      reason: "Final Review artifact is not valid JSON.",
-      diagnostics: [`Artifact path: ${artifactPath}`]
-    };
-  }
-  const verdict = parsed.verdict;
-  if (!verdict || typeof verdict !== "string") {
-    return {
-      ok: false,
-      reason: "Final Review artifact is missing a verdict field.",
-      diagnostics: [`Artifact content preview: ${content.slice(0, 300)}`]
-    };
-  }
-  const allowedVerdicts = [
-    "pass_no_changes",
-    "pass_with_retouch",
-    "needs_human_review",
-    "blocked"
-  ];
-  if (!allowedVerdicts.includes(verdict)) {
-    return {
-      ok: false,
-      reason: `Final Review artifact has unsupported verdict "${verdict}".`,
-      diagnostics: [`Allowed verdicts: ${allowedVerdicts.join(", ")}`]
-    };
-  }
-  const summary = typeof parsed.summary === "string" ? parsed.summary : typeof parsed.reason === "string" ? parsed.reason : String(verdict);
-  const diagnostics = Array.isArray(parsed.diagnostics) ? parsed.diagnostics : [];
-  const changedPaths = Array.isArray(parsed.changedPaths) ? parsed.changedPaths : void 0;
-  const isAutoSummary = !parsed.summary && !parsed.reason;
-  if (verdict === "pass_with_retouch" && (!changedPaths || changedPaths.length === 0) && isAutoSummary) {
-    return {
-      ok: false,
-      reason: 'Final Review artifact with "pass_with_retouch" verdict requires changed paths.',
-      diagnostics: [
-        "pass_with_retouch verdict must include a changedPaths array in the artifact or provide a summary/reason with enough context for git diff fallback.",
-        "Provide changedPaths or a descriptive summary in the artifact."
-      ]
-    };
-  }
-  const prdRef = typeof parsed.prdRef === "string" && parsed.prdRef.trim() ? parsed.prdRef.trim() : void 0;
-  const stage = typeof parsed.stage === "string" && parsed.stage.trim() ? parsed.stage.trim() : void 0;
-  const checkoutBase = typeof parsed.checkoutBase === "string" && parsed.checkoutBase.trim() ? parsed.checkoutBase.trim() : void 0;
-  const reviewBase = typeof parsed.reviewBase === "string" && parsed.reviewBase.trim() ? parsed.reviewBase.trim() : void 0;
-  return {
-    ok: true,
-    verdict,
-    summary,
-    diagnostics,
-    changedPaths,
-    prdRef,
-    stage,
-    checkoutBase,
-    reviewBase
-  };
-}
-function validateFinalReviewArtifactSemanticIds(artifact, context) {
-  const errors = [];
-  if (!artifact.prdRef) {
-    errors.push("Final Review artifact is missing prdRef.");
-  } else if (artifact.prdRef !== context.prdRef) {
-    errors.push(
-      `Final Review artifact prdRef "${artifact.prdRef}" does not match active PRD Run "${context.prdRef}".`
-    );
-  }
-  if (!artifact.stage) {
-    errors.push("Final Review artifact is missing stage field.");
-  } else if (artifact.stage !== "prdFinalReview") {
-    errors.push(
-      `Final Review artifact stage "${artifact.stage}" is not "prdFinalReview".`
-    );
-  }
-  if (!artifact.checkoutBase) {
-    errors.push("Final Review artifact is missing checkoutBase.");
-  } else if (artifact.checkoutBase !== context.prdBranch) {
-    errors.push(
-      `Final Review artifact checkoutBase "${artifact.checkoutBase}" does not match active PRD Branch "${context.prdBranch}".`
-    );
-  }
-  if (!artifact.reviewBase) {
-    errors.push("Final Review artifact is missing reviewBase.");
-  } else if (artifact.reviewBase !== context.mergeBase) {
-    errors.push(
-      `Final Review artifact reviewBase "${artifact.reviewBase}" does not match active merge base "${context.mergeBase}".`
-    );
-  }
-  if (errors.length > 0) {
-    return { ok: false, errors, blockedGate: "final-review" };
-  }
-  return { ok: true };
-}
-function validateFinalReviewRetouchScope(changedPaths) {
-  if (!changedPaths || changedPaths.length === 0) {
-    return {
-      ok: false,
-      reason: "Final Review retouch scope validation failed. No changed paths available. Provide changed paths or run Final Review with a summary that includes changed paths.",
-      diagnostics: ["Changed paths list is empty or undefined."],
-      offendingPaths: []
-    };
-  }
-  const offendingPaths = changedPaths.filter((p) => !isRetouchScopePath(p));
-  const allowedPaths = changedPaths.filter((p) => isRetouchScopePath(p));
-  if (allowedPaths.length === 0) {
-    return {
-      ok: false,
-      reason: "Final Review retouch scope validation failed. No implementation, test, or Changeset paths found for retouch.",
-      diagnostics: [
-        "All changed paths are prohibited for retouch.",
-        ...changedPaths.map((p) => `  - ${p}`)
-      ],
-      offendingPaths
-    };
-  }
-  if (offendingPaths.length > 0) {
-    return {
-      ok: false,
-      reason: "Final Review retouch scope validation failed. Prohibited paths cannot be included in retouch PR.",
-      diagnostics: [
-        "Prohibited paths found:",
-        ...offendingPaths.map((p) => `  - ${p}`)
-      ],
-      offendingPaths
-    };
-  }
-  return { ok: true, changedPaths };
-}
-function validateFinalReviewAgentOutputs(options) {
-  const artifact = parseFinalReviewArtifact(options.artifactPath);
-  if (!artifact.ok) {
-    return { ...artifact, offendingPaths: [] };
-  }
-  const semanticResult = validateFinalReviewArtifactSemanticIds(
-    artifact,
-    options.context
-  );
-  if (!semanticResult.ok) {
-    return {
-      ok: false,
-      reason: "Final Review artifact has mismatched semantic IDs.",
-      diagnostics: semanticResult.errors,
-      offendingPaths: []
-    };
-  }
-  if (artifact.verdict !== "pass_with_retouch") {
-    return { ok: true, artifact };
-  }
-  const changedPaths = options.changedPaths && options.changedPaths.length > 0 ? options.changedPaths : artifact.changedPaths;
-  const retouch = validateFinalReviewRetouchScope(changedPaths ?? []);
-  if (!retouch.ok) {
-    return retouch;
-  }
-  return { ok: true, artifact, retouch };
-}
-function isRetouchScopePath(path9) {
-  if (path9.startsWith(".pourkit/plans/") || path9 === ".pourkit/CONTEXT.md" || path9.startsWith(".pourkit/docs/") || /^\.pourkit\/prd-runs\/[^/]+\.json$/.test(path9)) {
-    return false;
-  }
-  return true;
-}
-
 // commands/artifact-validation.ts
 var CONFLICT_MARKER_PATTERN = /<<<<<<<|=======|>>>>>>>/m;
 function invalid(options, reason, diagnostics = []) {
@@ -3299,7 +3197,7 @@ function valid(options, diagnostics = []) {
   };
 }
 function readArtifact(options) {
-  if (!existsSync7(options.artifactPath)) {
+  if (!existsSync6(options.artifactPath)) {
     return {
       ok: false,
       result: invalid(options, `Artifact missing at ${options.artifactPath}`)
@@ -3376,7 +3274,7 @@ function validateIssueFinalReviewArtifact(parsed, options) {
   for (const p of parsed.changedPaths) {
     const normalized = p.replace(/\\/g, "/");
     const segments = normalized.split("/");
-    if (normalized.trim() === "" || normalized === "." || normalized === ".." || isAbsolute2(p) || normalized.startsWith("/") || segments.some((segment) => segment === "..")) {
+    if (normalized.trim() === "" || normalized === "." || normalized === ".." || isAbsolute3(p) || normalized.startsWith("/") || segments.some((segment) => segment === "..")) {
       return {
         ok: false,
         reason: `changedPaths must not contain absolute paths or path traversal: ${p}`,
@@ -3500,7 +3398,7 @@ function validateAgentArtifact(options) {
         if (options.checkConflictMarkers !== false && parsed.status === "resolved") {
           const base = options.worktreePath ?? process.cwd();
           const filesWithMarkers = parsed.files.filter((file) => {
-            const filePath = resolve2(base, file);
+            const filePath = resolve3(base, file);
             try {
               return CONFLICT_MARKER_PATTERN.test(
                 readFileSync7(filePath, "utf-8")
@@ -3519,29 +3417,6 @@ function validateAgentArtifact(options) {
         }
         return valid(options, [`status: ${parsed.status}`]);
       }
-      // QUARANTINED: Retained for Issue Final Review artifact validation via
-      // `runPrdRunValidateFinalReviewCommand`. Remove when Issue Final Review
-      // is migrated to its own dedicated validator kind.
-      case "final-review": {
-        if (!options.prdRef || !options.checkoutBase || !options.reviewBase) {
-          return invalid(
-            options,
-            "Final Review artifact validation requires --prd-ref, --checkout-base, and --review-base."
-          );
-        }
-        const result = validateFinalReviewAgentOutputs({
-          artifactPath: options.artifactPath,
-          context: {
-            prdRef: options.prdRef,
-            prdBranch: options.checkoutBase,
-            mergeBase: options.reviewBase
-          }
-        });
-        if (!result.ok) {
-          return invalid(options, result.reason, result.diagnostics);
-        }
-        return valid(options, [`verdict: ${result.artifact.verdict}`]);
-      }
       case "issue-final-review": {
         if (options.issueNumber === void 0 || !options.branchName) {
           return invalid(
@@ -3581,12 +3456,6 @@ function validateAgentArtifact(options) {
         }
         return valid(options, [`decision: ${parsed.json.recoveryDecision}`]);
       }
-      case "reconciliation":
-      case "planning-manifest":
-        return invalid(
-          options,
-          `Artifact kind "${options.kind}" has been removed from PRD Run validation`
-        );
       case "local-prd":
       case "local-issue":
       case "local-triage":
@@ -3608,8 +3477,8 @@ function validateAgentArtifact(options) {
   }
 }
 function runValidateArtifactCommand(options) {
-  const artifactPath = resolve2(options.repoRoot, options.artifactPath);
-  const latestReviewArtifactPath = options.latestReviewArtifactPath ? resolve2(options.repoRoot, options.latestReviewArtifactPath) : void 0;
+  const artifactPath = resolve3(options.repoRoot, options.artifactPath);
+  const latestReviewArtifactPath = options.latestReviewArtifactPath ? resolve3(options.repoRoot, options.latestReviewArtifactPath) : void 0;
   return validateAgentArtifact({
     ...options,
     artifactPath,
@@ -3618,9 +3487,9 @@ function runValidateArtifactCommand(options) {
   });
 }
 function runLocalValidateArtifactCommand(options) {
-  const resolvedPath = resolve2(options.repoRoot, options.artifactPath);
+  const resolvedPath = resolve3(options.repoRoot, options.artifactPath);
   const resolvedExtra = (options.extraArgs ?? []).map(
-    (p) => isAbsolute2(p) ? p : resolve2(options.repoRoot, p)
+    (p) => isAbsolute3(p) ? p : resolve3(options.repoRoot, p)
   );
   let localResult;
   switch (options.kind) {
@@ -4366,8 +4235,8 @@ function validateLocalTriage(prdPath, issuePaths) {
 }
 
 // commands/issue-run.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
-import { isAbsolute as isAbsolute3, join as join15 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync14 } from "fs";
+import { isAbsolute as isAbsolute4, join as join15 } from "path";
 
 // pr/templates.ts
 init_common();
@@ -4502,17 +4371,17 @@ function runEffectAndMapExit(program) {
 }
 
 // shared/attempt-log.ts
-import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname3, join as join8 } from "path";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync8 } from "fs";
+import { dirname as dirname4, join as join8 } from "path";
 var ATTEMPT_LOG_PATH = ".pourkit/attempt-log.jsonl";
 function writeAttemptLog(worktreePath, entry) {
   const logPath = join8(worktreePath, ATTEMPT_LOG_PATH);
-  mkdirSync6(dirname3(logPath), { recursive: true });
+  mkdirSync6(dirname4(logPath), { recursive: true });
   appendFileSync(logPath, JSON.stringify(entry) + "\n", "utf-8");
 }
 function readAttemptLog(worktreePath) {
   const logPath = join8(worktreePath, ATTEMPT_LOG_PATH);
-  if (!existsSync8(logPath)) {
+  if (!existsSync7(logPath)) {
     return [];
   }
   const raw = readFileSync8(logPath, "utf-8");
@@ -4634,7 +4503,7 @@ async function runBaseRefreshAttempt(options) {
 }
 
 // commands/conflict-resolution.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
 import { join as join9 } from "path";
 init_common();
 var CONFLICT_MARKER_PATTERN2 = /<<<<<<<|=======|>>>>>>>/m;
@@ -4922,7 +4791,7 @@ async function canReachMcp(url) {
       return true;
     } catch {
       if (attempt < 9) {
-        await new Promise((resolve3) => setTimeout(resolve3, 100));
+        await new Promise((resolve5) => setTimeout(resolve5, 100));
       }
     }
   }
@@ -5543,7 +5412,7 @@ function persistGeneratedArtifactEffect(worktreePath, output, fs) {
 
 // prd-run/local-merge-coordinator.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
 import { join as join13 } from "path";
 
 // prd-run/local-branches.ts
@@ -5644,7 +5513,7 @@ function getIssueArtifactPath(repoRoot2, prdId, issueId) {
 }
 function readIssueBranchName(repoRoot2, prdId, issueId) {
   const issuePath = getIssueArtifactPath(repoRoot2, prdId, issueId);
-  if (!existsSync10(issuePath)) return null;
+  if (!existsSync9(issuePath)) return null;
   try {
     const content = readFileSync12(issuePath, "utf-8");
     const parsed = JSON.parse(content);
@@ -5656,7 +5525,7 @@ function readIssueBranchName(repoRoot2, prdId, issueId) {
 async function hasLocalIssueMergeReceipt(prdId, issueId, repoRoot2) {
   const root = repoRoot2 ?? process.cwd();
   const receiptPath = getMergeReceiptPath(root, prdId, issueId);
-  if (!existsSync10(receiptPath)) return null;
+  if (!existsSync9(receiptPath)) return null;
   try {
     const content = readFileSync12(receiptPath, "utf-8");
     const parsed = JSON.parse(content);
@@ -5671,7 +5540,7 @@ async function hasLocalIssueMergeReceipt(prdId, issueId, repoRoot2) {
 async function squashMergeLocalIssue(prdId, issueId, input, repoRoot2) {
   const root = repoRoot2 ?? process.cwd();
   const receiptPath = getMergeReceiptPath(root, prdId, issueId);
-  if (existsSync10(receiptPath)) {
+  if (existsSync9(receiptPath)) {
     try {
       const existing = JSON.parse(
         readFileSync12(receiptPath, "utf-8")
@@ -6083,7 +5952,7 @@ function runMergeCoordinator(options) {
 }
 
 // commands/issue-final-review-agent.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
 import { join as join14 } from "path";
 var ISSUE_FINAL_REVIEW_ARTIFACT_PATH = join14(
   ".pourkit",
@@ -6197,12 +6066,21 @@ async function runIssueFinalReviewAgent(options) {
 }
 function loadIssueFinalReviewPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync11(promptPath) ? readFileSync13(promptPath, "utf-8") : promptTemplate;
+  const promptBody = existsSync10(promptPath) ? readFileSync13(promptPath, "utf-8") : promptTemplate;
   return appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
 
-Read the selected issue requirements, PRD context, comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}`);
+Read the selected issue requirements, PRD context, comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
+
+## Initial Verification Pass
+
+- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
+- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
+- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
+- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
+- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
+- If no verification commands are configured, note that and proceed with normal review.`);
 }
 
 // issues/issue-transitions.ts
@@ -6405,7 +6283,7 @@ async function advanceIssueFinalReview(options) {
         "Issue Final Review state is incomplete: missing artifactPath"
       );
     }
-    const artifactPath = isAbsolute3(ifrFromState.artifactPath) ? ifrFromState.artifactPath : join15(worktreePath, ifrFromState.artifactPath);
+    const artifactPath = isAbsolute4(ifrFromState.artifactPath) ? ifrFromState.artifactPath : join15(worktreePath, ifrFromState.artifactPath);
     const validation = validateAgentArtifact({
       kind: "issue-final-review",
       artifactPath,
@@ -6437,6 +6315,12 @@ async function advanceIssueFinalReview(options) {
     logger,
     reviewArtifactPath
   });
+  await assertCanonicalBaseAncestor({
+    worktreePath,
+    baseRef: `origin/${target.baseBranch}`,
+    stageName: "Issue Final Review",
+    logger
+  });
   if (result.verdict === "pass") {
     updateWorktreeRunState(worktreePath, {
       issueFinalReview: {
@@ -6661,6 +6545,14 @@ async function startIssueRun(options) {
     };
   }
   if (executionResult.worktreePath) {
+    if (shouldRunBuilder) {
+      await assertCanonicalBaseAncestor({
+        worktreePath: executionResult.worktreePath,
+        baseRef: `origin/${effectiveBaseBranch}`,
+        stageName: "Builder",
+        logger
+      });
+    }
     if (worktreeState) {
       updateWorktreeRunState(executionResult.worktreePath, {
         completedStages: { builder: true }
@@ -6722,6 +6614,12 @@ async function advanceIssueRunReview(options) {
       }
     })
   );
+  await assertCanonicalBaseAncestor({
+    worktreePath: options.worktreePath,
+    baseRef: `origin/${options.target.baseBranch}`,
+    stageName: "Review/Refactor",
+    logger: options.logger
+  });
   updateWorktreeRunState(options.worktreePath, {
     review: {
       lifetimeIterations: reviewResult.lifetimeIterations,
@@ -6785,7 +6683,7 @@ async function completeIssueRun(options) {
           prTitle = finalizerFromState.title;
           prBody = finalizerFromState.body;
         } else if (finalizerFromState.artifactPath) {
-          if (!existsSync12(finalizerFromState.artifactPath)) {
+          if (!existsSync11(finalizerFromState.artifactPath)) {
             throw new FinalizerFailure({
               message: `Finalizer artifact missing at ${finalizerFromState.artifactPath}`
             });
@@ -6848,6 +6746,14 @@ async function completeIssueRun(options) {
       }
       prTitle = finalizerResult.title;
       prBody = finalizerResult.body;
+      if (executionResult.worktreePath) {
+        await assertCanonicalBaseAncestor({
+          worktreePath: executionResult.worktreePath,
+          baseRef: `origin/${effectiveBaseBranch}`,
+          stageName: "Finalizer",
+          logger
+        });
+      }
     }
     prTitle = ensureConventionalPrTitle(
       prTitle,
@@ -7216,18 +7122,12 @@ function getRefactorArtifactDir(artifactPath) {
 }
 async function finalizeWorktreeCommit(options) {
   const { worktreePath, baseRef, title, body, logger } = options;
-  await syncRemoteBaseRef(worktreePath, baseRef, logger);
-  try {
-    await execCapture("git", ["merge-base", "--is-ancestor", baseRef, "HEAD"], {
-      cwd: worktreePath,
-      logger,
-      label: "git merge-base --is-ancestor"
-    });
-  } catch {
-    throw new Error(
-      `Cannot finalize stale worktree: ${baseRef} is not an ancestor of HEAD. Refresh the branch onto the latest target base before creating the final commit.`
-    );
-  }
+  await assertCanonicalBaseAncestor({
+    worktreePath,
+    baseRef,
+    stageName: "final commit",
+    logger
+  });
   await execCapture("git", ["reset", "--soft", baseRef], {
     cwd: worktreePath,
     logger,
@@ -7244,6 +7144,21 @@ async function finalizeWorktreeCommit(options) {
     label: "git commit"
   });
 }
+async function assertCanonicalBaseAncestor(options) {
+  const { worktreePath, baseRef, stageName, logger } = options;
+  await syncRemoteBaseRef(worktreePath, baseRef, logger);
+  try {
+    await execCapture("git", ["merge-base", "--is-ancestor", baseRef, "HEAD"], {
+      cwd: worktreePath,
+      logger,
+      label: "git merge-base --is-ancestor"
+    });
+  } catch {
+    throw new Error(
+      `Cannot continue after ${stageName}: ${baseRef} is not an ancestor of HEAD. An agent may have moved the issue branch behind the canonical base; refresh the branch onto the latest target base before continuing.`
+    );
+  }
+}
 async function syncRemoteBaseRef(worktreePath, baseRef, logger) {
   const remoteBase = parseRemoteBaseRef(baseRef);
   if (!remoteBase) {
@@ -7487,7 +7402,7 @@ async function syncTargetBranch(root, baseBranch, logger) {
 }
 function loadBuilderPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync12(promptPath) ? readFileSync14(promptPath, "utf-8") : promptTemplate;
+  const promptBody = existsSync11(promptPath) ? readFileSync14(promptPath, "utf-8") : promptTemplate;
   return appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
@@ -7978,24 +7893,14 @@ async function runIssueCreateCommand(args, issueProvider, logger) {
 }
 
 // commands/prd-run.ts
-import {
-  cpSync,
-  existsSync as existsSync16,
-  lstatSync,
-  mkdirSync as mkdirSync10,
-  mkdtempSync,
-  readFileSync as readFileSync17,
-  realpathSync,
-  rmSync as rmSync3
-} from "fs";
+import { existsSync as existsSync15, lstatSync, readFileSync as readFileSync18, realpathSync } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
-import { dirname as dirname4, join as join20, relative as relative2 } from "path";
-import { tmpdir } from "os";
+import { join as join19, relative as relative2 } from "path";
 import { Match, pipe } from "effect";
 
 // prd-run/state.ts
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync15,
   readdirSync as readdirSync4,
@@ -8003,14 +7908,14 @@ import {
 } from "fs";
 import { mkdir as mkdir4, readFile as readFile4, writeFile } from "fs/promises";
 import { join as join16 } from "path";
-import { z as z2 } from "zod";
+import { z } from "zod";
 var PRD_RUN_STATE_DIR = ".pourkit/prd-runs";
-var PrdRunRecordSchema = z2.object({
-  prdRef: z2.string().regex(
+var PrdRunRecordSchema = z.object({
+  prdRef: z.string().regex(
     /^PRD-\d{4}$/,
     "PRD ref must use four-digit format (e.g., PRD-0052)"
   ),
-  status: z2.enum([
+  status: z.enum([
     "blocked",
     "starting",
     "running",
@@ -8022,61 +7927,61 @@ var PrdRunRecordSchema = z2.object({
     "complete",
     "completed_local_branch"
   ]),
-  updatedAt: z2.string().min(1),
-  mode: z2.enum(["github", "local"]).optional(),
-  blockedGate: z2.enum(["receipt-check", "branch-state", "git", "queue", "final-review"]).optional(),
-  targetName: z2.string().min(1).optional(),
-  prdBranch: z2.string().min(1).optional(),
-  blockedReason: z2.string().min(1).optional(),
-  diagnostics: z2.array(z2.string()).optional(),
-  offendingPaths: z2.array(z2.string()).optional(),
-  start: z2.object({
-    status: z2.enum(["started", "succeeded", "adopted", "reused"]),
-    targetName: z2.string().min(1),
-    prdBranch: z2.string().min(1),
-    startBaseBranch: z2.string().min(1),
-    startBaseCommit: z2.string().min(1).optional(),
-    branchAction: z2.enum(["created", "reused", "adopted"]).optional(),
-    startedAt: z2.string().min(1).optional(),
-    queueStartedAt: z2.string().min(1).optional(),
-    queueDrainedAt: z2.string().min(1).optional(),
-    queueProcessedCount: z2.number().int().nonnegative().optional(),
-    queueCommand: z2.literal("queue-run").optional(),
-    refreshReceipts: z2.tuple([]).optional()
+  updatedAt: z.string().min(1),
+  mode: z.enum(["github", "local"]).optional(),
+  blockedGate: z.enum(["receipt-check", "branch-state", "git", "queue", "final-review"]).optional(),
+  targetName: z.string().min(1).optional(),
+  prdBranch: z.string().min(1).optional(),
+  blockedReason: z.string().min(1).optional(),
+  diagnostics: z.array(z.string()).optional(),
+  offendingPaths: z.array(z.string()).optional(),
+  start: z.object({
+    status: z.enum(["started", "succeeded", "adopted", "reused"]),
+    targetName: z.string().min(1),
+    prdBranch: z.string().min(1),
+    startBaseBranch: z.string().min(1),
+    startBaseCommit: z.string().min(1).optional(),
+    branchAction: z.enum(["created", "reused", "adopted"]).optional(),
+    startedAt: z.string().min(1).optional(),
+    queueStartedAt: z.string().min(1).optional(),
+    queueDrainedAt: z.string().min(1).optional(),
+    queueProcessedCount: z.number().int().nonnegative().optional(),
+    queueCommand: z.literal("queue-run").optional(),
+    refreshReceipts: z.tuple([]).optional()
   }).strict().optional(),
-  finalReview: z2.object({
-    status: z2.enum([
+  finalReview: z.object({
+    status: z.enum([
       "started",
       "succeeded",
       "blocked",
       "needs_human_review",
       "final_reviewed"
     ]),
-    targetName: z2.string().min(1),
-    prdBranch: z2.string().min(1),
-    mergeBase: z2.string().min(1).optional(),
-    verdict: z2.enum([
+    targetName: z.string().min(1),
+    prdBranch: z.string().min(1),
+    mergeBase: z.string().min(1).optional(),
+    verdict: z.enum([
       "pass_no_changes",
       "pass_with_retouch",
       "needs_human_review",
       "blocked"
     ]).optional(),
-    artifactPath: z2.string().min(1).optional(),
-    diagnostics: z2.array(z2.string()).optional(),
-    reviewedAt: z2.string().min(1).optional(),
-    retouchPrNumber: z2.number().int().positive().optional(),
-    retouchPrUrl: z2.string().url().optional(),
-    retouchMergeCommit: z2.string().min(1).optional(),
-    autoMerge: z2.boolean().optional(),
-    changedPaths: z2.array(z2.string()).optional()
+    artifactPath: z.string().min(1).optional(),
+    diagnostics: z.array(z.string()).optional(),
+    reviewedAt: z.string().min(1).optional(),
+    retouchPrNumber: z.number().int().positive().optional(),
+    retouchPrUrl: z.string().url().optional(),
+    retouchMergeCommit: z.string().min(1).optional(),
+    autoMerge: z.boolean().optional(),
+    changedPaths: z.array(z.string()).optional()
   }).strict().optional(),
-  scopeChanges: z2.array(
-    z2.object({
-      issueNumber: z2.number().int().positive(),
-      decision: z2.literal("accepted_scope_change"),
-      reason: z2.string().min(1),
-      acceptedBy: z2.string().min(1),
-      acceptedAt: z2.string().min(1)
+  scopeChanges: z.array(
+    z.object({
+      issueNumber: z.number().int().positive(),
+      decision: z.literal("accepted_scope_change"),
+      reason: z.string().min(1),
+      acceptedBy: z.string().min(1),
+      acceptedAt: z.string().min(1)
     }).strict()
   ).optional()
 }).strict();
@@ -8093,7 +7998,7 @@ function normalizePrdRunRef(ref) {
 function readPrdRun(repoRoot2, prdRef) {
   const normalized = normalizePrdRunRef(prdRef);
   const recordPath = getRecordPath(repoRoot2, normalized);
-  if (!existsSync13(recordPath)) {
+  if (!existsSync12(recordPath)) {
     return { record: null, diagnostics: [] };
   }
   try {
@@ -8124,7 +8029,7 @@ function readPrdRun(repoRoot2, prdRef) {
 }
 function listPrdRuns(repoRoot2) {
   const stateDir = join16(repoRoot2, PRD_RUN_STATE_DIR);
-  if (!existsSync13(stateDir)) {
+  if (!existsSync12(stateDir)) {
     return { records: [], diagnostics: [] };
   }
   const records = [];
@@ -8168,40 +8073,40 @@ function normalizeLegacyPrdRunRecord(record) {
     offendingPaths: void 0
   };
 }
-var LocalPrdRunRecordSchema = z2.object({
-  prdId: z2.string().regex(
+var LocalPrdRunRecordSchema = z.object({
+  prdId: z.string().regex(
     /^PRD-\d{4}$/,
     "PRD id must use four-digit format (e.g., PRD-0052)"
   ),
-  createdAt: z2.string().min(1),
-  receipts: z2.object({
-    start: z2.object({
-      startedAt: z2.string().min(1),
-      branch: z2.string().min(1),
-      baseCommit: z2.string().min(1)
+  createdAt: z.string().min(1),
+  receipts: z.object({
+    start: z.object({
+      startedAt: z.string().min(1),
+      branch: z.string().min(1),
+      baseCommit: z.string().min(1)
     }).strict().optional(),
-    queue: z2.object({ completedAt: z2.string().min(1) }).strict().optional(),
-    finalReview: z2.object({
-      completedAt: z2.string().min(1),
-      targetName: z2.string().optional(),
-      prdBranch: z2.string().optional(),
-      mergeBase: z2.string().optional(),
-      verdict: z2.enum([
+    queue: z.object({ completedAt: z.string().min(1) }).strict().optional(),
+    finalReview: z.object({
+      completedAt: z.string().min(1),
+      targetName: z.string().optional(),
+      prdBranch: z.string().optional(),
+      mergeBase: z.string().optional(),
+      verdict: z.enum([
         "pass_no_changes",
         "pass_with_retouch",
         "needs_human_review",
         "blocked"
       ]).optional(),
-      diagnostics: z2.array(z2.string()).optional(),
-      artifactPath: z2.string().optional()
+      diagnostics: z.array(z.string()).optional(),
+      artifactPath: z.string().optional()
     }).strict().optional(),
-    complete: z2.object({
-      completedAt: z2.string().min(1),
-      branch: z2.string().min(1),
-      stages: z2.array(z2.string())
+    complete: z.object({
+      completedAt: z.string().min(1),
+      branch: z.string().min(1),
+      stages: z.array(z.string())
     }).strict().optional()
   }).strict(),
-  metadata: z2.record(z2.unknown())
+  metadata: z.record(z.unknown())
 }).strict();
 function getRecordPath(repoRoot2, prdRef) {
   return join16(
@@ -8211,29 +8116,12 @@ function getRecordPath(repoRoot2, prdRef) {
   );
 }
 
-// prd-run/evidence-packet.ts
-import { createHash as createHash2 } from "crypto";
-import { z as z3 } from "zod";
-var PRD_REF_REGEX2 = /^PRD-\d{3,4}$/;
-var StageSchema = z3.enum(["prdFinalReview", "prdReconciliation"]);
-var EvidencePacketSchema = z3.object({
-  prdRef: z3.string().regex(PRD_REF_REGEX2),
-  prdBranch: z3.string().min(1),
-  mergeBase: z3.string().min(6),
-  planningManifestPath: z3.string().min(1),
-  planningManifestFacts: z3.object({
-    parentPrdIssueUrl: z3.string().min(1),
-    childIssueCount: z3.number().int().nonnegative()
-  }),
-  stage: StageSchema,
-  stageReceipts: z3.record(z3.string(), z3.unknown())
-}).strict();
-
-// commands/prd-run.ts
-init_common();
+// prd-run/local-queue-loop.ts
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
+import { join as join18 } from "path";
 
 // prd-run/local-artifacts.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import { join as join17 } from "path";
 var REQUIRED_PRD_FIELDS = [
   "schemaVersion",
@@ -8286,7 +8174,7 @@ function hasRequiredFields(data, requiredFields) {
 async function resolveLocalPrdArtifact(prdId, repoRoot2) {
   const root = repoRoot2 ?? process.cwd();
   const prdPath = prdArtifactPath(root, prdId);
-  if (!existsSync14(prdPath)) {
+  if (!existsSync13(prdPath)) {
     return {
       ok: false,
       failureCode: "missing_prd_artifact",
@@ -8331,7 +8219,7 @@ async function resolveLocalIssueArtifacts(prdId, repoRoot2) {
   const issues = [];
   for (const childId of childIssueIds) {
     const issuePath = issueArtifactPath(root, prdId, childId);
-    if (!existsSync14(issuePath)) {
+    if (!existsSync13(issuePath)) {
       return {
         ok: false,
         failureCode: "missing_child_issue",
@@ -8348,100 +8236,33 @@ async function resolveLocalIssueArtifacts(prdId, repoRoot2) {
         message: `Failed to read or parse Issue artifact at ${issuePath}: ${result.message}`
       };
     }
-    const missing = hasRequiredFields(
-      result.data,
-      REQUIRED_ISSUE_FIELDS
-    );
-    if (missing) {
-      return {
-        ok: false,
-        failureCode: "invalid_artifact",
-        missingId: childId,
-        message: `Issue artifact at ${issuePath} is missing required field: ${missing}`
-      };
-    }
-    if (result.data.kind !== "issue") {
-      return {
-        ok: false,
-        failureCode: "invalid_artifact",
-        missingId: childId,
-        message: `Issue artifact at ${issuePath} has kind "${result.data.kind}", expected "issue"`
-      };
-    }
-    issues.push(result.data);
-  }
-  return { ok: true, data: issues };
-}
-
-// prd-run/local-issue-adapter.ts
-var VALID_TRIAGE_LABELS = /* @__PURE__ */ new Set([
-  "needs-triage",
-  "ready-for-agent",
-  "blocked",
-  "ready-for-human",
-  "wontfix"
-]);
-function countTypeLabels(labels) {
-  return labels.filter((l) => l.startsWith("type:")).length;
-}
-function countTriageLabels(labels) {
-  return labels.filter((l) => VALID_TRIAGE_LABELS.has(l)).length;
-}
-function countCategoryLabels(labels) {
-  const triageCount = countTriageLabels(labels);
-  const typeCount = countTypeLabels(labels);
-  return labels.length - triageCount - typeCount;
-}
-function hasValidLabels(labels) {
-  if (countTriageLabels(labels) !== 1) return false;
-  if (!labels.includes("ready-for-agent")) return false;
-  if (countTypeLabels(labels) !== 1) return false;
-  if (countCategoryLabels(labels) !== 1) return false;
-  return true;
-}
-function isIssueBlockedByDependencies(issue, issues) {
-  const blockers = [];
-  for (const depId of issue.dependencyIssueIds) {
-    const dep = issues.find((i) => i.id === depId);
-    if (!dep || dep.receipts.completedAt === null) {
-      blockers.push(depId);
-    }
-  }
-  return blockers;
-}
-async function getRunnableLocalIssues(prdId, repoRoot2) {
-  const issuesResult = await resolveLocalIssueArtifacts(prdId, repoRoot2);
-  if (!issuesResult.ok) return [];
-  const issues = issuesResult.data;
-  const runnable = [];
-  for (const issue of issues) {
-    if (!hasValidLabels(issue.labels)) continue;
-    if (issue.status !== "ready-for-agent") continue;
-    const blockers = isIssueBlockedByDependencies(issue, issues);
-    runnable.push({
-      id: issue.id,
-      title: issue.title,
-      labels: issue.labels,
-      blockedBy: blockers.length > 0 ? blockers : void 0
-    });
+    const missing = hasRequiredFields(
+      result.data,
+      REQUIRED_ISSUE_FIELDS
+    );
+    if (missing) {
+      return {
+        ok: false,
+        failureCode: "invalid_artifact",
+        missingId: childId,
+        message: `Issue artifact at ${issuePath} is missing required field: ${missing}`
+      };
+    }
+    if (result.data.kind !== "issue") {
+      return {
+        ok: false,
+        failureCode: "invalid_artifact",
+        missingId: childId,
+        message: `Issue artifact at ${issuePath} has kind "${result.data.kind}", expected "issue"`
+      };
+    }
+    issues.push(result.data);
   }
-  const filtered = runnable.filter(
-    (i) => !i.blockedBy || i.blockedBy.length === 0
-  );
-  return filtered;
+  return { ok: true, data: issues };
 }
 
-// prd-run/local-final-review.ts
-import { execFileSync as execFileSync3, execSync as execSync2 } from "child_process";
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync6 } from "fs";
-import { join as join18 } from "path";
-
-// prd-run/local-queue-loop.ts
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
-import { join as join19 } from "path";
-
 // prd-run/local-issue-run.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 init_common();
 async function createLocalIssueBranch(prdId, issueId, repoRoot2) {
   const root = repoRoot2 ?? process.cwd();
@@ -8465,7 +8286,7 @@ async function createLocalIssueBranch(prdId, issueId, repoRoot2) {
   }
   const localPrdBranch = `local/${prdId}`;
   try {
-    execFileSync4(
+    execFileSync3(
       "git",
       ["show-ref", "--verify", "--quiet", `refs/heads/${localPrdBranch}`],
       {
@@ -8481,7 +8302,7 @@ async function createLocalIssueBranch(prdId, issueId, repoRoot2) {
   }
   let branchExists = false;
   try {
-    execFileSync4(
+    execFileSync3(
       "git",
       ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
       {
@@ -8494,7 +8315,7 @@ async function createLocalIssueBranch(prdId, issueId, repoRoot2) {
   } catch {
   }
   if (!branchExists) {
-    execFileSync4("git", ["checkout", "-b", branchName, localPrdBranch], {
+    execFileSync3("git", ["checkout", "-b", branchName, localPrdBranch], {
       cwd: root,
       encoding: "utf8",
       stdio: "pipe"
@@ -8559,11 +8380,69 @@ async function runLocalIssue(prdId, issueId, builder, repoRoot2) {
   }
 }
 
+// prd-run/local-issue-adapter.ts
+var VALID_TRIAGE_LABELS = /* @__PURE__ */ new Set([
+  "needs-triage",
+  "ready-for-agent",
+  "blocked",
+  "ready-for-human",
+  "wontfix"
+]);
+function countTypeLabels(labels) {
+  return labels.filter((l) => l.startsWith("type:")).length;
+}
+function countTriageLabels(labels) {
+  return labels.filter((l) => VALID_TRIAGE_LABELS.has(l)).length;
+}
+function countCategoryLabels(labels) {
+  const triageCount = countTriageLabels(labels);
+  const typeCount = countTypeLabels(labels);
+  return labels.length - triageCount - typeCount;
+}
+function hasValidLabels(labels) {
+  if (countTriageLabels(labels) !== 1) return false;
+  if (!labels.includes("ready-for-agent")) return false;
+  if (countTypeLabels(labels) !== 1) return false;
+  if (countCategoryLabels(labels) !== 1) return false;
+  return true;
+}
+function isIssueBlockedByDependencies(issue, issues) {
+  const blockers = [];
+  for (const depId of issue.dependencyIssueIds) {
+    const dep = issues.find((i) => i.id === depId);
+    if (!dep || dep.receipts.completedAt === null) {
+      blockers.push(depId);
+    }
+  }
+  return blockers;
+}
+async function getRunnableLocalIssues(prdId, repoRoot2) {
+  const issuesResult = await resolveLocalIssueArtifacts(prdId, repoRoot2);
+  if (!issuesResult.ok) return [];
+  const issues = issuesResult.data;
+  const runnable = [];
+  for (const issue of issues) {
+    if (!hasValidLabels(issue.labels)) continue;
+    if (issue.status !== "ready-for-agent") continue;
+    const blockers = isIssueBlockedByDependencies(issue, issues);
+    runnable.push({
+      id: issue.id,
+      title: issue.title,
+      labels: issue.labels,
+      blockedBy: blockers.length > 0 ? blockers : void 0
+    });
+  }
+  const filtered = runnable.filter(
+    (i) => !i.blockedBy || i.blockedBy.length === 0
+  );
+  return filtered;
+}
+
 // prd-run/local-queue-loop.ts
 var CHILD_CLEANUP_LABELS = ["agent-in-progress", "pr-open-awaiting-merge"];
 var LOCAL_ISSUE_ID_REGEX = /^I-(\d+)$/i;
 function getIssueArtifactPath2(repoRoot2, prdId, issueId) {
-  return join19(
+  return join18(
     repoRoot2,
     ".pourkit",
     "local-prd-runs",
@@ -8584,7 +8463,7 @@ function readIssueArtifact(repoRoot2, prdId, issueId) {
   }
 }
 function writeIssueArtifact(repoRoot2, prdId, issue) {
-  writeFileSync7(
+  writeFileSync6(
     getIssueArtifactPath2(repoRoot2, prdId, issue.id),
     JSON.stringify(issue, null, 2),
     "utf-8"
@@ -9250,6 +9129,9 @@ async function runQueueCommand(options) {
   return runEffectAndMapExit(runQueueLoop(queueOptions));
 }
 
+// prd-run/final-review-validation.ts
+import { existsSync as existsSync14, readFileSync as readFileSync17 } from "fs";
+
 // commands/prd-run.ts
 function planLaunchResume(record) {
   if (!record) return { attempted: [], skipped: [], resumed: [] };
@@ -9311,18 +9193,18 @@ function planLaunchResume(record) {
   );
 }
 function validateLocalStartStore(repoRoot2, prdRef) {
-  const localStoreDir = join20(repoRoot2, ".pourkit", "local-prd-runs", prdRef);
+  const localStoreDir = join19(repoRoot2, ".pourkit", "local-prd-runs", prdRef);
   let localStoreReady = false;
-  if (existsSync16(localStoreDir)) {
-    const localStorePath = join20(localStoreDir, "prd.json");
+  if (existsSync15(localStoreDir)) {
+    const localStorePath = join19(localStoreDir, "prd.json");
     try {
-      const content = JSON.parse(readFileSync17(localStorePath, "utf8"));
+      const content = JSON.parse(readFileSync18(localStorePath, "utf8"));
       localStoreReady = content?.id === prdRef && content?.kind === "prd";
     } catch {
       localStoreReady = false;
     }
   }
-  if (existsSync16(localStoreDir) && !localStoreReady) {
+  if (existsSync15(localStoreDir) && !localStoreReady) {
     return {
       ok: false,
       gate: "branch-state",
@@ -9486,13 +9368,13 @@ async function runPrdRunLaunchCommand(options) {
     attempted.push("queue");
   }
   const currentRecord = readPrdRun(options.repoRoot, prdRef).record;
-  const localStorePath = join20(
+  const localStorePath = join19(
     options.repoRoot,
     ".pourkit",
     "local-prd-runs",
     prdRef
   );
-  if (existsSync16(localStorePath)) {
+  if (existsSync15(localStorePath)) {
     writePrdRunRecord(options.repoRoot, {
       prdRef,
       status: "completed_local_branch",
@@ -10003,8 +9885,8 @@ async function processStartResult(startResult, options) {
     start,
     mode: modeForRecord
   });
-  const localStorePath = join20(repoRoot2, ".pourkit", "local-prd-runs", prdRef);
-  if (existsSync16(localStorePath)) {
+  const localStorePath = join19(repoRoot2, ".pourkit", "local-prd-runs", prdRef);
+  if (existsSync15(localStorePath)) {
     const queueResult = await runLocalQueueLoop(
       prdRef,
       repoRoot2,
@@ -10892,7 +10774,7 @@ async function runPrMergeCommand(args, logger, prProvider, config) {
 }
 
 // commands/init.ts
-import { existsSync as existsSync17, statSync } from "fs";
+import { existsSync as existsSync16, statSync } from "fs";
 import {
   copyFile,
   mkdir as mkdir5,
@@ -10901,7 +10783,7 @@ import {
   rename,
   writeFile as writeFile2
 } from "fs/promises";
-import { createHash as createHash3, randomUUID } from "crypto";
+import { createHash as createHash2, randomUUID } from "crypto";
 import path5 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -11115,135 +10997,120 @@ function inferVerificationCommands(scripts, pm) {
 }
 function generateConfigTemplate(options) {
   const {
-    sourceRoot,
-    targetRoot,
-    packageManager,
     baseBranch,
+    packageManager,
     verificationCommands,
     hasPackageJson = true,
     labels: maybeLabels
   } = options;
   const labels = maybeLabels ?? DEFAULT_RUNNER_LABELS;
-  const relPath = path5.relative(targetRoot, sourceRoot).replace(/\\/g, "/");
-  const importPath = relPath || ".";
   const setupCommand = `${packageManager} install`;
-  let setupSection;
-  if (hasPackageJson) {
-    setupSection = [
-      "      setupCommands: [",
-      `        { command: "${setupCommand}", label: "install" },`,
-      "      ],"
-    ].join("\n");
-  } else {
-    setupSection = "";
-  }
-  let verifySection;
-  if (verificationCommands.length > 0) {
-    const cmdLines = verificationCommands.map((vc) => `        { command: "${vc.command}", label: "${vc.label}" }`).join(",\n");
-    verifySection = [
-      "        verify: {",
-      "          commands: [",
-      cmdLines,
-      "          ],",
-      "        },"
-    ].join("\n");
-  } else {
-    verifySection = [
-      "        // verify: {",
-      "        //   commands: [",
-      "        //     No matching scripts found in package.json.",
-      "        //   ],",
-      "        // },"
-    ].join("\n");
-  }
-  return `import { definePourkitConfig } from "${importPath}/pourkit/shared/config";
-import type { PourkitConfig } from "${importPath}/pourkit/shared/config";
-
-export default definePourkitConfig({
-  targets: [
-    {
-      name: "default",
-      baseBranch: "${baseBranch}",
-      branchTemplate: "pourkit/{{issue.number}}/{{issue.slug}}",
-      autoMerge: false,
-${setupSection}
-      strategy: {
-        type: "review-refactor-loop",
-        implement: {
-          builder: {
-            agent: "pourkit-builder",
-            model: "opencode-go/deepseek-v4-flash",
-            promptTemplate: ".pourkit/prompts/builder.prompt.md",
-          },
-        },
-        review: {
-          reviewer: {
-            agent: "pourkit-reviewer",
-            model: "opencode-go/deepseek-v4-pro",
-            promptTemplate: ".pourkit/prompts/reviewer.prompt.md",
-            criteria: ["correctness", "scope", "tests", "quality"],
-          },
-          refactor: {
-            agent: "pourkit-refactor",
-            model: "opencode-go/qwen3.6-plus",
-            promptTemplate: ".pourkit/prompts/refactor.prompt.md",
-          },
-          maxIterations: 3,
-          passWithNotesRefactorAttempts: 2,
+  const target = {
+    name: "default",
+    baseBranch,
+    branchTemplate: "pourkit/{{issue.number}}/{{issue.slug}}",
+    autoMerge: false,
+    strategy: {
+      type: "review-refactor-loop",
+      implement: {
+        builder: {
+          agent: "pourkit-builder",
+          model: "opencode-go/deepseek-v4-flash",
+          promptTemplate: ".pourkit/prompts/builder.prompt.md"
+        }
+      },
+      failureResolution: {
+        agent: "pourkit-failure-resolution-agent",
+        model: "opencode-go/mimo-v2.5",
+        promptTemplate: ".pourkit/prompts/failure-resolution.prompt.md",
+        maxAttemptsPerFailure: 1
+      },
+      review: {
+        reviewer: {
+          agent: "pourkit-reviewer",
+          model: "opencode-go/deepseek-v4-pro",
+          promptTemplate: ".pourkit/prompts/reviewer.prompt.md",
+          criteria: ["correctness", "scope", "tests", "quality"]
         },
-${verifySection}
-        finalize: {
-          prDescriptionAgent: {
-            agent: "pourkit-pr-description",
-            model: "opencode-go/deepseek-v4-flash",
-            promptTemplate: ".pourkit/prompts/pr-description.prompt.md",
-          },
-          maxAttempts: 2,
+        refactor: {
+          agent: "pourkit-refactor",
+          model: "opencode-go/qwen3.6-plus",
+          promptTemplate: ".pourkit/prompts/refactor.prompt.md"
         },
+        maxIterations: 3,
+        passWithNotesRefactorAttempts: 2
       },
-    },
-  ],
-  labels: {
-    readyForAgent: ${JSON.stringify(labels.readyForAgent)},
-    agentInProgress: ${JSON.stringify(labels.agentInProgress)},
-    blocked: ${JSON.stringify(labels.blocked)},
-    prOpenAwaitingMerge: ${JSON.stringify(labels.prOpenAwaitingMerge)},
-    readyForHuman: ${JSON.stringify(labels.readyForHuman)},
-  },
-  sandbox: {
-    provider: "docker",
-    copyToWorktree: ["node_modules"],
-    mounts: [
-      {
-        hostPath: "~/.local/share/opencode",
-        sandboxPath: "/home/agent/.local/share/opencode",
-        readonly: false,
+      issueFinalReview: {
+        agent: "pourkit-reviewer",
+        model: "opencode-go/deepseek-v4-pro",
+        promptTemplate: ".pourkit/prompts/issue-final-review.prompt.md",
+        maxAttempts: 3
       },
-      {
-        hostPath: "~/.config/opencode",
-        sandboxPath: "/home/agent/.config/opencode",
-        readonly: true,
+      finalize: {
+        prDescriptionAgent: {
+          agent: "pourkit-pr-description",
+          model: "opencode-go/deepseek-v4-flash",
+          promptTemplate: ".pourkit/prompts/pr-description.prompt.md"
+        },
+        maxAttempts: 2
+      }
+    }
+  };
+  if (hasPackageJson) {
+    target.setupCommands = [
+      { command: setupCommand, label: "install" }
+    ];
+  }
+  if (verificationCommands.length > 0) {
+    target.strategy.verify = {
+      commands: verificationCommands
+    };
+  }
+  const config = {
+    $schema: "./schema/pourkit.schema.json",
+    schemaVersion: 1,
+    targets: [target],
+    labels: {
+      readyForAgent: labels.readyForAgent,
+      agentInProgress: labels.agentInProgress,
+      blocked: labels.blocked,
+      prOpenAwaitingMerge: labels.prOpenAwaitingMerge,
+      readyForHuman: labels.readyForHuman
+    },
+    sandbox: {
+      provider: "docker",
+      copyToWorktree: ["node_modules"],
+      mounts: [
+        {
+          hostPath: "~/.local/share/opencode",
+          sandboxPath: "/home/agent/.local/share/opencode",
+          readonly: false
+        },
+        {
+          hostPath: "~/.config/opencode",
+          sandboxPath: "/home/agent/.config/opencode",
+          readonly: true
+        }
+      ],
+      env: {
+        HOME: "/home/agent",
+        XDG_DATA_HOME: "/home/agent/.local/share",
+        XDG_CONFIG_HOME: "/home/agent/.config",
+        XDG_STATE_HOME: "/home/agent/.local/state",
+        XDG_CACHE_HOME: "/home/agent/.cache"
       },
-    ],
-    env: {
-      HOME: "/home/agent",
-      XDG_DATA_HOME: "/home/agent/.local/share",
-      XDG_CONFIG_HOME: "/home/agent/.config",
-      XDG_STATE_HOME: "/home/agent/.local/state",
-      XDG_CACHE_HOME: "/home/agent/.cache",
+      idleTimeoutSeconds: 300
     },
-    idleTimeoutSeconds: 300,
-  },
-  checks: {
-    requiredLabels: [],
-    allowedAuthors: [],
-    checksFoundTimeoutSeconds: 60,
-    checksCompletionTimeoutSeconds: 1800,
-    pollIntervalSeconds: 15,
-    issueListLimit: 50,
-  },
-});
-`;
+    checks: {
+      requiredLabels: [],
+      allowedAuthors: [],
+      checksFoundTimeoutSeconds: 60,
+      checksCompletionTimeoutSeconds: 1800,
+      pollIntervalSeconds: 15,
+      issueListLimit: 50
+    }
+  };
+  return JSON.stringify(config, null, 2) + "\n";
 }
 function generateOpenCodeConfig(existingConfig = {}) {
   const { $schema, ...rest } = existingConfig;
@@ -11392,10 +11259,10 @@ async function walkDir(dir) {
 }
 async function computeFileChecksum(filePath) {
   const content = await readFile5(filePath);
-  return createHash3("sha256").update(content).digest("hex");
+  return createHash2("sha256").update(content).digest("hex");
 }
 function lockfileExists(root, name) {
-  return existsSync17(path5.join(root, name));
+  return existsSync16(path5.join(root, name));
 }
 function detectPackageManager(root) {
   if (lockfileExists(root, "pnpm-lock.yaml")) return "pnpm";
@@ -11439,7 +11306,7 @@ async function discoverLocalSource(sourcePath) {
 async function discoverReadme(root) {
   for (const name of ["README.md", "readme.md"]) {
     const p = path5.join(root, name);
-    if (existsSync17(p)) {
+    if (existsSync16(p)) {
       return p;
     }
   }
@@ -11449,7 +11316,7 @@ async function discoverAgentFiles(root) {
   const files = [];
   for (const name of ["AGENTS.md", "CLAUDE.md"]) {
     const p = path5.join(root, name);
-    if (existsSync17(p)) {
+    if (existsSync16(p)) {
       files.push(p);
     }
   }
@@ -11457,7 +11324,7 @@ async function discoverAgentFiles(root) {
 }
 async function discoverMerlleState(root) {
   const p = path5.join(root, ".pourkit", "state.json");
-  return existsSync17(p) ? p : null;
+  return existsSync16(p) ? p : null;
 }
 async function discoverAgentSkills(root) {
   const dirs = [
@@ -11466,7 +11333,7 @@ async function discoverAgentSkills(root) {
   ];
   const found = [];
   for (const d of dirs) {
-    if (existsSync17(d)) {
+    if (existsSync16(d)) {
       found.push(d);
     }
   }
@@ -11476,12 +11343,12 @@ async function discoverRootDomainDocs(root) {
   const docs = [];
   for (const name of ["CONTEXT.md", "CONTEXT-MAP.md"]) {
     const p = path5.join(root, name);
-    if (existsSync17(p)) {
+    if (existsSync16(p)) {
       docs.push(p);
     }
   }
   const adrDir = path5.join(root, "docs", "adr");
-  if (existsSync17(adrDir)) {
+  if (existsSync16(adrDir)) {
     const entries = await readdir(adrDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -11624,7 +11491,7 @@ async function planInit(options) {
       for (const file of skillFiles) {
         const relPath = path5.relative(s, file);
         const destPath = path5.join(targetRoot, ".agents", "skills", relPath);
-        if (!existsSync17(destPath)) {
+        if (!existsSync16(destPath)) {
           operations.push({
             kind: "copy",
             sourcePath: file,
@@ -11687,7 +11554,7 @@ async function planInit(options) {
     });
   }
   if (sourceRoot) {
-    if (!existsSync17(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
+    if (!existsSync16(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
       warnings.push(
         `--from-local path does not exist or is not a directory: ${sourceRoot}`
       );
@@ -11806,7 +11673,7 @@ async function planInit(options) {
             requiresConfirmation: false,
             destructive: false
           });
-        } else if (existsSync17(destPath)) {
+        } else if (existsSync16(destPath)) {
           operations.push({
             kind: "skip",
             path: destPath,
@@ -11864,7 +11731,7 @@ async function planInit(options) {
         }
       }
       const contextPath = path5.join(targetRoot, ".pourkit", "CONTEXT.md");
-      if (!existsSync17(contextPath) && !merleDestPaths.has(contextPath)) {
+      if (!existsSync16(contextPath) && !merleDestPaths.has(contextPath)) {
         operations.push({
           kind: "create",
           path: contextPath,
@@ -11882,7 +11749,7 @@ async function planInit(options) {
         "adr",
         ".gitkeep"
       );
-      if (!existsSync17(adrGitkeep)) {
+      if (!existsSync16(adrGitkeep)) {
         operations.push({
           kind: "create",
           path: adrGitkeep,
@@ -11894,7 +11761,7 @@ async function planInit(options) {
       }
       const srcDocAgents = path5.join(sourceRoot, ".pourkit", "docs", "agents");
       const tgtDocAgents = path5.join(targetRoot, ".pourkit", "docs", "agents");
-      if (existsSync17(srcDocAgents) && !existsSync17(tgtDocAgents)) {
+      if (existsSync16(srcDocAgents) && !existsSync16(tgtDocAgents)) {
         const docFiles = await walkDir(srcDocAgents);
         for (const file of docFiles) {
           const relPath = path5.relative(srcDocAgents, file);
@@ -11927,7 +11794,7 @@ async function planInit(options) {
       }
       const srcPrompts = path5.join(sourceRoot, ".pourkit", "prompts");
       const tgtPrompts = path5.join(targetRoot, ".pourkit", "prompts");
-      if (existsSync17(srcPrompts) && !existsSync17(tgtPrompts)) {
+      if (existsSync16(srcPrompts) && !existsSync16(tgtPrompts)) {
         const promptFiles = await walkDir(srcPrompts);
         for (const file of promptFiles) {
           const relPath = path5.relative(srcPrompts, file);
@@ -11954,7 +11821,7 @@ async function planInit(options) {
         ".sandcastle",
         "Dockerfile"
       );
-      if (existsSync17(tgtSandboxDockerfile)) {
+      if (existsSync16(tgtSandboxDockerfile)) {
         operations.push({
           kind: "skip",
           path: tgtSandboxDockerfile,
@@ -11963,7 +11830,7 @@ async function planInit(options) {
           requiresConfirmation: false,
           destructive: false
         });
-      } else if (existsSync17(srcSandboxDockerfile)) {
+      } else if (existsSync16(srcSandboxDockerfile)) {
         const checksum = await computeFileChecksum(srcSandboxDockerfile);
         operations.push({
           kind: "copy",
@@ -11976,15 +11843,13 @@ async function planInit(options) {
           checksum
         });
       }
-      const configTsPath = path5.join(targetRoot, "pourkit.config.ts");
-      if (!existsSync17(configTsPath)) {
+      const configJsonPath = path5.join(targetRoot, ".pourkit", "config.json");
+      if (!existsSync16(configJsonPath)) {
         const verifyCommands = inferVerificationCommands(
           packageScripts,
           pm || "npm"
         );
         const configContent = generateConfigTemplate({
-          targetRoot,
-          sourceRoot,
           packageManager: pm || "npm",
           baseBranch,
           verificationCommands: verifyCommands,
@@ -11993,9 +11858,9 @@ async function planInit(options) {
         });
         operations.push({
           kind: "create",
-          path: configTsPath,
+          path: configJsonPath,
           ownership: "managed",
-          reason: "Init pourkit.config.ts template",
+          reason: "Init .pourkit/config.json template",
           requiresConfirmation: false,
           destructive: false,
           content: configContent
@@ -12003,18 +11868,90 @@ async function planInit(options) {
       } else {
         operations.push({
           kind: "skip",
-          path: configTsPath,
+          path: configJsonPath,
           ownership: "project-owned",
-          reason: "Existing pourkit.config.ts (project-owned)",
+          reason: "Existing .pourkit/config.json (project-owned)",
           requiresConfirmation: false,
           destructive: false
         });
       }
+      const schemaJsonPath = path5.join(
+        targetRoot,
+        ".pourkit",
+        "schema",
+        "pourkit.schema.json"
+      );
+      const srcSchemaJson = path5.join(
+        sourceRoot,
+        "pourkit",
+        "schema",
+        "pourkit.schema.json"
+      );
+      if (existsSync16(srcSchemaJson)) {
+        const checksum = await computeFileChecksum(srcSchemaJson);
+        if (!existsSync16(schemaJsonPath)) {
+          operations.push({
+            kind: "copy",
+            sourcePath: srcSchemaJson,
+            path: schemaJsonPath,
+            ownership: "managed",
+            reason: "Copy schema: pourkit.schema.json",
+            requiresConfirmation: false,
+            destructive: false,
+            checksum
+          });
+        } else {
+          operations.push({
+            kind: "skip",
+            path: schemaJsonPath,
+            ownership: "project-owned",
+            reason: "Existing .pourkit/schema/pourkit.schema.json (project-owned)",
+            requiresConfirmation: false,
+            destructive: false
+          });
+        }
+      }
+      const schemaHashPath = path5.join(
+        targetRoot,
+        ".pourkit",
+        "schema",
+        "pourkit.schema.hash"
+      );
+      const srcSchemaHash = path5.join(
+        sourceRoot,
+        "pourkit",
+        "schema",
+        "pourkit.schema.hash"
+      );
+      if (existsSync16(srcSchemaHash)) {
+        const checksum = await computeFileChecksum(srcSchemaHash);
+        if (!existsSync16(schemaHashPath)) {
+          operations.push({
+            kind: "copy",
+            sourcePath: srcSchemaHash,
+            path: schemaHashPath,
+            ownership: "managed",
+            reason: "Copy schema hash: pourkit.schema.hash",
+            requiresConfirmation: false,
+            destructive: false,
+            checksum
+          });
+        } else {
+          operations.push({
+            kind: "skip",
+            path: schemaHashPath,
+            ownership: "project-owned",
+            reason: "Existing .pourkit/schema/pourkit.schema.hash (project-owned)",
+            requiresConfirmation: false,
+            destructive: false
+          });
+        }
+      }
       const agentFileMode = options.conflictPolicy?.agentFile ?? "both";
       const hasExistingAgents = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("AGENTS.md")
       );
-      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync17(path5.join(targetRoot, "AGENTS.md"))) {
+      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync16(path5.join(targetRoot, "AGENTS.md"))) {
         operations.push({
           kind: "create",
           path: path5.join(targetRoot, "AGENTS.md"),
@@ -12030,7 +11967,7 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
       const hasExistingClaude = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("CLAUDE.md")
       );
-      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync17(path5.join(targetRoot, "CLAUDE.md"))) {
+      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync16(path5.join(targetRoot, "CLAUDE.md"))) {
         operations.push({
           kind: "create",
           path: path5.join(targetRoot, "CLAUDE.md"),
@@ -12045,7 +11982,7 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
       }
       const gitignoreTarget = path5.join(targetRoot, ".gitignore");
       const gitignoreContent = generateGitignoreBlock();
-      if (!existsSync17(gitignoreTarget)) {
+      if (!existsSync16(gitignoreTarget)) {
         operations.push({
           kind: "create",
           path: gitignoreTarget,
@@ -12069,7 +12006,7 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
         });
       }
       const openCodePath = path5.join(targetRoot, "opencode.json");
-      if (!existsSync17(openCodePath)) {
+      if (!existsSync16(openCodePath)) {
         operations.push({
           kind: "create",
           path: openCodePath,
@@ -12126,7 +12063,7 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
         }
       }
       const manifestPath = path5.join(targetRoot, ".pourkit", "manifest.json");
-      if (existsSync17(manifestPath)) {
+      if (existsSync16(manifestPath)) {
         operations.push({
           kind: "skip",
           path: manifestPath,
@@ -12445,7 +12382,7 @@ async function updateManagedBlock(filePath, content) {
   const blockContent = `${MANAGED_BLOCK_BEGIN}
 ${content}${MANAGED_BLOCK_END}
 `;
-  if (!existsSync17(filePath)) {
+  if (!existsSync16(filePath)) {
     const dir = path5.dirname(filePath);
     await mkdir5(dir, { recursive: true });
     await writeFileAtomic(filePath, blockContent);
@@ -12474,7 +12411,7 @@ async function writeManifest(plan, sourceMeta, agentFiles, packageManager) {
     if (op.requiresConfirmation) continue;
     const relPath = path5.relative(plan.targetRoot, op.path);
     if (relPath === ".pourkit/manifest.json") continue;
-    if (existsSync17(op.path)) {
+    if (existsSync16(op.path)) {
       const sha256 = await computeFileChecksum(op.path);
       assets[relPath] = {
         ownership: op.ownership || "managed",
@@ -12519,7 +12456,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync17(op.path) && !op.destructive) {
+          if (existsSync16(op.path) && !op.destructive) {
             skipped++;
             continue;
           }
@@ -12534,7 +12471,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync17(op.path)) {
+          if (existsSync16(op.path)) {
             skipped++;
             continue;
           }
@@ -12563,7 +12500,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync17(op.path)) {
+          if (existsSync16(op.path)) {
             skipped++;
             continue;
           }
@@ -12703,7 +12640,7 @@ async function applyInitFromSource(options) {
     if (!manifestSkipped) {
       const agentFiles = [];
       for (const name of ["AGENTS.md", "CLAUDE.md"]) {
-        if (existsSync17(path5.join(targetRoot, name))) {
+        if (existsSync16(path5.join(targetRoot, name))) {
           agentFiles.push(path5.join(targetRoot, name));
         }
       }
@@ -12994,6 +12931,165 @@ async function runSerenaStatusCommand(options) {
   logSerenaSidecarStatus("Serena sidecar status", status);
 }
 
+// commands/config-schema.ts
+import { readFileSync as readFileSync19, existsSync as existsSync17 } from "fs";
+import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { resolve as resolve4, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import Ajv2 from "ajv";
+var __filename2 = fileURLToPath2(import.meta.url);
+var __dirname2 = dirname5(__filename2);
+var PACKAGED_SCHEMA_PATH = resolve4(
+  __dirname2,
+  "../schema/pourkit.schema.json"
+);
+var PACKAGED_HASH_PATH = resolve4(__dirname2, "../schema/pourkit.schema.hash");
+var _schemaValidator = null;
+var _schemaErrors = null;
+function getSchemaValidator() {
+  if (!_schemaValidator) {
+    const schema = JSON.parse(readFileSync19(PACKAGED_SCHEMA_PATH, "utf-8"));
+    const ajv = new Ajv2({ strict: true });
+    ajv.addKeyword("x-pourkit-schema-version");
+    const validate = ajv.compile(schema);
+    _schemaValidator = (data) => {
+      _schemaErrors = null;
+      const valid2 = validate(data);
+      if (!valid2) _schemaErrors = validate.errors;
+      return valid2;
+    };
+  }
+  return _schemaValidator;
+}
+function readPackagedHash() {
+  return readFileSync19(PACKAGED_HASH_PATH, "utf-8");
+}
+function localSchemaDir(repoRoot2) {
+  return resolve4(repoRoot2, ".pourkit/schema");
+}
+async function runDoctorCommand(options) {
+  const repoRootPath = options.cwd ?? process.cwd();
+  const schemaDir = localSchemaDir(repoRootPath);
+  const localSchemaPath = resolve4(schemaDir, "pourkit.schema.json");
+  const localHashPath = resolve4(schemaDir, "pourkit.schema.hash");
+  const localSchemaExists = existsSync17(localSchemaPath);
+  const localHashExists = existsSync17(localHashPath);
+  let packagedHash = null;
+  try {
+    packagedHash = readPackagedHash();
+  } catch {
+  }
+  let localHashContent = null;
+  if (localHashExists) {
+    try {
+      localHashContent = await readFile6(localHashPath, "utf-8");
+    } catch {
+    }
+  }
+  const schema = !localSchemaExists ? "missing" : !packagedHash || !localHashContent ? "missing" : localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
+  const hash = !localHashExists ? "missing" : !packagedHash ? "missing" : localHashContent && localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
+  const overall = schema === "fresh" && hash === "fresh" ? "fresh" : schema === "missing" || hash === "missing" ? "missing" : "stale";
+  const configPath = resolve4(repoRootPath, ".pourkit/config.json");
+  let configValidation;
+  if (existsSync17(configPath)) {
+    try {
+      const raw = JSON.parse(readFileSync19(configPath, "utf-8"));
+      const validate = getSchemaValidator();
+      const valid2 = validate(raw);
+      if (valid2) {
+        configValidation = { ok: true, errors: [] };
+      } else {
+        const errors = _schemaErrors;
+        configValidation = {
+          ok: false,
+          errors: (errors ?? []).map(
+            (e) => `${e.instancePath || "(root)"}: ${e.message ?? "validation failed"}`
+          )
+        };
+      }
+    } catch (err) {
+      const msg = err instanceof SyntaxError ? err.message : String(err);
+      configValidation = {
+        ok: false,
+        errors: [`.pourkit/config.json: ${msg}`]
+      };
+    }
+  } else {
+    configValidation = {
+      ok: false,
+      errors: [".pourkit/config.json not found"]
+    };
+  }
+  const obsoleteConfigs = [
+    "pourkit.config.ts",
+    "pourkit.config.mjs",
+    "pourkit.config.js",
+    "pourkit.json"
+  ].filter((p) => existsSync17(resolve4(repoRootPath, p)));
+  let recommendation = null;
+  if (!configValidation.ok || overall !== "fresh" || obsoleteConfigs.length > 0) {
+    const parts = [];
+    if (obsoleteConfigs.length > 0) {
+      parts.push(
+        `Found obsolete config files: ${obsoleteConfigs.join(", ")}. Move configuration to .pourkit/config.json with "$schema": "./schema/pourkit.schema.json".`
+      );
+    }
+    if (!configValidation.ok) {
+      parts.push(
+        "Config validation failed; fix errors in .pourkit/config.json."
+      );
+    }
+    if (overall !== "fresh") {
+      parts.push(
+        'Run "pourkit config sync-schema" to update local schema assets.'
+      );
+    }
+    recommendation = parts.join(" ");
+  }
+  return {
+    configValidation,
+    obsoleteConfigs,
+    schemaAssets: { schema, hash, overall },
+    recommendation
+  };
+}
+async function runConfigSyncSchemaCommand(options) {
+  const repoRootPath = options.cwd ?? process.cwd();
+  const schemaDir = localSchemaDir(repoRootPath);
+  await mkdir6(schemaDir, { recursive: true });
+  const packagedSchema = await readFile6(PACKAGED_SCHEMA_PATH, "utf-8");
+  const packagedHash = await readFile6(PACKAGED_HASH_PATH, "utf-8");
+  const localSchemaPath = resolve4(schemaDir, "pourkit.schema.json");
+  const localHashPath = resolve4(schemaDir, "pourkit.schema.hash");
+  let schemaWritten = false;
+  let hashWritten = false;
+  if (existsSync17(localSchemaPath)) {
+    const existing = await readFile6(localSchemaPath, "utf-8");
+    if (existing !== packagedSchema) {
+      await writeFile3(localSchemaPath, packagedSchema, "utf-8");
+      schemaWritten = true;
+    }
+  } else {
+    await writeFile3(localSchemaPath, packagedSchema, "utf-8");
+    schemaWritten = true;
+  }
+  if (existsSync17(localHashPath)) {
+    const existing = await readFile6(localHashPath, "utf-8");
+    if (existing !== packagedHash) {
+      await writeFile3(localHashPath, packagedHash, "utf-8");
+      hashWritten = true;
+    }
+  } else {
+    await writeFile3(localHashPath, packagedHash, "utf-8");
+    hashWritten = true;
+  }
+  return {
+    changed: schemaWritten || hashWritten,
+    schemaWritten,
+    hashWritten
+  };
+}
+
 // providers/github-provider.ts
 var GitHubIssueProvider = class {
   client;
@@ -13523,22 +13619,22 @@ function formatChecks2(checks) {
 init_common();
 
 // execution/sandcastle-execution.ts
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync8 } from "fs";
-import { join as join22 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync7 } from "fs";
+import { join as join21 } from "path";
 import { createWorktree, opencode } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
 
 // execution/execution-provider.ts
 init_common();
-import { mkdtempSync as mkdtempSync2 } from "fs";
-import { writeFile as writeFile3 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname5, join as join21 } from "path";
+import { mkdtempSync } from "fs";
+import { writeFile as writeFile4 } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname as dirname6, join as join20 } from "path";
 async function writeExecutionArtifacts(worktreePath, artifacts) {
   for (const artifact of artifacts) {
-    const filePath = join21(worktreePath, artifact.path);
-    await ensureDir(dirname5(filePath));
-    await writeFile3(filePath, artifact.content, "utf-8");
+    const filePath = join20(worktreePath, artifact.path);
+    await ensureDir(dirname6(filePath));
+    await writeFile4(filePath, artifact.content, "utf-8");
   }
 }
 
@@ -13547,8 +13643,8 @@ init_common();
 import path7 from "path";
 
 // execution/sandbox-image.ts
-import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync18, readFileSync as readFileSync20 } from "fs";
 import path6 from "path";
 function sandboxImageName(repoRoot2) {
   const dirName = path6.basename(repoRoot2.replace(/[\\/]+$/, "")) || "local";
@@ -13558,7 +13654,7 @@ function sandboxImageName(repoRoot2) {
   if (!existsSync18(dockerfilePath)) {
     return `sandcastle:${baseName}`;
   }
-  const fingerprint = createHash4("sha256").update(readFileSync18(dockerfilePath)).digest("hex").slice(0, 8);
+  const fingerprint = createHash3("sha256").update(readFileSync20(dockerfilePath)).digest("hex").slice(0, 8);
   return `sandcastle:${baseName}-${fingerprint}`;
 }
 
@@ -13854,13 +13950,13 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function savePromptToFile(repoRoot2, stage, iteration, prompt) {
-  const promptsDir = join22(repoRoot2, ".pourkit", ".tmp", "prompts");
-  mkdirSync11(promptsDir, { recursive: true });
+  const promptsDir = join21(repoRoot2, ".pourkit", ".tmp", "prompts");
+  mkdirSync9(promptsDir, { recursive: true });
   const timestamp2 = Date.now();
   const iterationSuffix = iteration !== void 0 ? `-iteration-${iteration}` : "";
   const filename = `${stage}${iterationSuffix}-${timestamp2}.md`;
-  const filePath = join22(promptsDir, filename);
-  writeFileSync8(filePath, prompt, "utf-8");
+  const filePath = join21(promptsDir, filename);
+  writeFileSync7(filePath, prompt, "utf-8");
 }
 
 // cli.ts
@@ -13960,7 +14056,7 @@ function createCliProgram(version) {
   });
   program.command("validate-artifact").description("Validate an agent handoff artifact").argument(
     "<kind>",
-    "artifact kind: reviewer, refactor, finalizer, conflict-resolution, final-review (retained for Issue Final Review validation), failure-resolution, local-prd, local-issue, local-triage, or issue-final-review"
+    "artifact kind: reviewer, refactor, finalizer, conflict-resolution, failure-resolution, local-prd, local-issue, local-triage, or issue-final-review"
   ).argument("<artifactPath>", "artifact path to validate").argument("[extraPaths...]", "additional artifact paths (for local-triage)").option("--iteration <number>", "review/refactor iteration", (value) => {
     const parsed = Number.parseInt(value, 10);
     if (!Number.isInteger(parsed) || parsed < 1) {
@@ -13993,12 +14089,6 @@ function createCliProgram(version) {
       return previous;
     },
     []
-  ).option("--prd-ref <ref>", "PRD ref for final-review artifacts").option(
-    "--checkout-base <ref>",
-    "checkout base / PRD branch for final-review artifacts"
-  ).option(
-    "--review-base <ref>",
-    "review merge base for final-review artifacts"
   ).option(
     "--issue-number <number>",
     "issue number for issue-final-review artifacts",
@@ -14023,7 +14113,6 @@ function createCliProgram(version) {
         "refactor",
         "finalizer",
         "conflict-resolution",
-        "final-review",
         "failure-resolution",
         "local-prd",
         "local-issue",
@@ -14057,9 +14146,6 @@ function createCliProgram(version) {
         findingIds: options.findingId,
         latestReviewArtifactPath: options.latestReviewArtifact,
         allowedDecisions: options.allowedDecision,
-        prdRef: options.prdRef,
-        checkoutBase: options.checkoutBase,
-        reviewBase: options.reviewBase,
         issueNumber: options.issueNumber,
         branchName: options.branchName,
         checkConflictMarkers: options.checkConflictMarkers
@@ -14418,6 +14504,26 @@ function createCliProgram(version) {
       await runInitCommand(initOptions);
     }
   );
+  program.command("doctor").description("Report Config Schema drift without mutating files").option("--cwd <path>", "target repository directory").action(async (options) => {
+    const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+    const report = await runDoctorCommand({ cwd: targetRepoRoot });
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.configValidation.ok || report.obsoleteConfigs.length > 0 || report.schemaAssets.overall !== "fresh") {
+      process.exitCode = 1;
+    }
+  });
+  const configCommand = program.command("config").description("Config management commands");
+  configCommand.command("sync-schema").description("Copy packaged Config Schema assets to .pourkit/schema/").option("--cwd <path>", "target repository directory").action(async (options) => {
+    const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+    const result = await runConfigSyncSchemaCommand({ cwd: targetRepoRoot });
+    if (result.changed) {
+      console.log(
+        `Schema assets updated (schema: ${result.schemaWritten ? "written" : "unchanged"}, hash: ${result.hashWritten ? "written" : "unchanged"}).`
+      );
+    } else {
+      console.log("Schema assets are up to date.");
+    }
+  });
   const serena = program.command("serena").description("Serena baseline and sidecar commands");
   serena.command("init").requiredOption("--target <name>", "target name").option("--cwd <path>", "target repository directory").action(async (options) => {
     await runSerenaInitCommand({
@@ -14543,11 +14649,11 @@ function createCliProgram(version) {
   return program;
 }
 async function resolveCliVersion() {
-  if (isPackageVersion("0.0.0-next-20260614002607")) {
-    return "0.0.0-next-20260614002607";
+  if (isPackageVersion("0.0.0-next-20260614182520")) {
+    return "0.0.0-next-20260614182520";
   }
-  if (isReleaseVersion("0.0.0-next-20260614002607")) {
-    return "0.0.0-next-20260614002607";
+  if (isReleaseVersion("0.0.0-next-20260614182520")) {
+    return "0.0.0-next-20260614182520";
   }
   try {
     const root = repoRoot();