@pourkit/cli 0.0.0-next-20260621045826 → 0.0.0-next-20260621233457

package/dist/cli.js

@@ -442,6 +442,25 @@ function checkRemovedFields(raw) {
             );
           }
         }
+        const strategy = target.strategy;
+        if (strategy && typeof strategy === "object") {
+          const review = strategy.review;
+          if (review && typeof review === "object") {
+            if ("passWithNotesRefactorAttempts" in review) {
+              throw new Error(
+                `targets[${i}].strategy.review.passWithNotesRefactorAttempts has been removed; PASS_WITH_NOTES no longer triggers Refactor.`
+              );
+            }
+            const reviewer = review.reviewer;
+            if (reviewer && typeof reviewer === "object") {
+              if ("passWithNotesRefactorAttempts" in reviewer) {
+                throw new Error(
+                  `targets[${i}].strategy.review.reviewer.passWithNotesRefactorAttempts has been removed; PASS_WITH_NOTES no longer triggers Refactor.`
+                );
+              }
+            }
+          }
+        }
       }
     }
   }
@@ -773,14 +792,12 @@ function parseConfig(raw) {
                 reviewReviewer.outputRetries
               ),
               criteria: reviewReviewer.criteria,
-              includeReviewHistory: reviewReviewer.includeReviewHistory,
-              passWithNotesRefactorAttempts: reviewReviewer.passWithNotesRefactorAttempts
+              includeReviewHistory: reviewReviewer.includeReviewHistory
             },
             refactor: applyStageAgentDefaults(
               reviewRefactor
             ),
-            maxIterations: review.maxIterations,
-            passWithNotesRefactorAttempts: review.passWithNotesRefactorAttempts ?? 2
+            maxIterations: review.maxIterations
           },
           ...verifyLabeled ? { verify: { commands: verifyLabeled } } : {},
           issueFinalReview: {
@@ -880,11 +897,11 @@ var OBSOLETE_CONFIG_PATHS = [
 ];
 var CANONICAL_CONFIG_PATH = ".pourkit/config.json";
 async function loadRepoConfig(repoRoot2, _configFileName) {
-  const { existsSync: existsSync21 } = await import("fs");
+  const { existsSync: existsSync22 } = await import("fs");
   const { join: pjoin } = await import("path");
   for (const obPath of OBSOLETE_CONFIG_PATHS) {
     const fullPath = pjoin(repoRoot2, obPath);
-    if (existsSync21(fullPath)) {
+    if (existsSync22(fullPath)) {
       const isRootJson = obPath === "pourkit.json";
       throw new Error(
         isRootJson ? `Found root ${obPath}, but Pourkit config now lives at ${CANONICAL_CONFIG_PATH}. Move the file and update "$schema" to "./schema/pourkit.schema.json".` : `Found ${obPath}, but executable config is no longer supported. Move configuration to ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
@@ -892,7 +909,7 @@ async function loadRepoConfig(repoRoot2, _configFileName) {
     }
   }
   const configPath = pjoin(repoRoot2, CANONICAL_CONFIG_PATH);
-  if (!existsSync21(configPath)) {
+  if (!existsSync22(configPath)) {
     throw new Error(
       `No Pourkit config found at ${CANONICAL_CONFIG_PATH}. Run pourkit init or create ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
     );
@@ -1168,9 +1185,11 @@ function parseReviewVerdict(output) {
 }
 
 // commands/review.ts
+import { Effect as Effect3 } from "effect";
+
+// issues/issue-review-loop.ts
 import {
   existsSync as existsSync6,
-  mkdirSync as mkdirSync5,
   readFileSync as readFileSync6,
   readdirSync as readdirSync2,
   writeFileSync as writeFileSync3
@@ -1465,7 +1484,7 @@ function buildRunContextMarkdown(options) {
     );
   }
   if (sections.includes("verification-commands")) {
-    parts.push(...renderCommandList(target, "Verification Commands"));
+    parts.push(...renderCommandList(target, "Verification Commands", repoRoot2));
   }
   if (sections.includes("review-criteria")) {
     parts.push(...renderCriteria(reviewerCriteria));
@@ -1483,14 +1502,27 @@ function buildRunContextMarkdown(options) {
   }
   return parts.join("\n");
 }
-function renderCommandList(target, heading) {
+function renderCommandList(target, heading, repoRoot2) {
   const commands = getVerificationCommands(target);
+  const wrapperCommand = buildRunVerificationCommand(target);
   const parts = [
     `## ${heading}`,
     "",
-    `Run this command from the repository root: \`${buildRunVerificationCommand(target)}\``,
+    `Run this command from the repository root: \`${wrapperCommand}\``,
+    "",
+    "Use the wrapper as the configured verification method for Builder, Reviewer, Refactor, and Issue Final Review handoffs. Run the underlying commands directly only when no wrapper path can run, and record that degraded path in the role's artifact or handoff notes.",
     ""
   ];
+  if (isPourkitSourceRepo(repoRoot2)) {
+    parts.push(
+      "Pourkit self-development fallback:",
+      "",
+      `- If \`${wrapperCommand}\` fails before running configured commands because the installed CLI rejects this worktree's config schemaVersion, build and rerun the same target with the worktree-local CLI: \`npm run build --workspace pourkit\`, then \`node pourkit/dist/cli.js run-verification --target ${target.name}\`.`,
+      '- Treat local CLI wrapper success as valid configured verification and record it as `verification.method: "local-wrapper"` in Issue Final Review artifacts, or as local-wrapper verification in Builder/Reviewer/Refactor handoff notes.',
+      '- Fall back to the underlying configured commands only if the worktree-local CLI cannot be built or invoked; record that degraded path as `verification.method: "commands"` in Issue Final Review artifacts, or as direct-command verification in Builder/Reviewer/Refactor handoff notes, and explain why the wrapper path could not run.',
+      ""
+    );
+  }
   if (commands.length > 0) {
     parts.push(
       "Configured commands executed by the wrapper:",
@@ -1503,6 +1535,17 @@ function renderCommandList(target, heading) {
   }
   return parts;
 }
+function isPourkitSourceRepo(repoRoot2) {
+  if (!repoRoot2) return false;
+  const packagePath = join5(repoRoot2, "pourkit", "package.json");
+  if (!existsSync4(packagePath)) return false;
+  try {
+    const parsed = JSON.parse(readFileSync4(packagePath, "utf-8"));
+    return parsed.name === "@pourkit/cli";
+  } catch {
+    return false;
+  }
+}
 function renderParentPrdContext(issue, parentPrdIssue, repoRoot2) {
   const parent = extractIssueSection(issue.body, "Parent");
   const parentRef = parent?.match(/\bPRD-\d+\b/i)?.[0]?.toUpperCase() ?? issue.title.match(/^\s*(PRD-\d+)\s*\/\s*I-\d+\b/i)?.[1]?.toUpperCase();
@@ -1971,7 +2014,7 @@ function validateRecoveryDecision(artifact, allowedDecisions) {
   return { valid: true, decision };
 }
 
-// commands/review.ts
+// issues/issue-review-loop.ts
 import { Effect as Effect2, Layer as Layer2 } from "effect";
 var ReviewArtifactValidationError = class extends Error {
   constructor(message) {
@@ -2162,6 +2205,172 @@ function validateReviewArtifact(output, verdict, iteration, priorRefactorArtifac
     }
   }
 }
+function renderReviewHistory(reviewHistory) {
+  if (reviewHistory.length === 0) {
+    return "";
+  }
+  return `## Review History
+
+${reviewHistory.map((entry, index) => `### Iteration ${index + 1}
+
+${entry.trimEnd()}`).join("\n\n")}
+
+`;
+}
+function renderReviewCriteriaEffect(repoRoot2, criteria, fs) {
+  return Effect2.gen(function* () {
+    const parts = [];
+    for (const criterion of criteria) {
+      const snippetPath = join6(
+        repoRoot2,
+        ".pourkit",
+        "managed",
+        "prompts",
+        `reviewer-${criterion}.snippet.md`
+      );
+      const exists = yield* fs.exists(snippetPath).pipe(Effect2.orDie);
+      if (exists) {
+        const content = yield* fs.readFile(snippetPath).pipe(Effect2.orDie);
+        parts.push(content.trimEnd());
+      } else {
+        parts.push(`- ${criterion}`);
+      }
+    }
+    return parts.join("\n\n");
+  });
+}
+function loadReviewerPromptTemplateEffect(repoRoot2, promptTemplate, criteriaBlock, fs) {
+  return Effect2.gen(function* () {
+    const promptTemplatePath = resolvePromptTemplatePath(
+      repoRoot2,
+      promptTemplate
+    );
+    const exists = yield* fs.exists(promptTemplatePath).pipe(Effect2.orDie);
+    const promptBody = exists ? yield* fs.readFile(promptTemplatePath).pipe(Effect2.orDie) : promptTemplate;
+    const hasCriteriaPlaceholder = promptBody.includes("{{REVIEW_CRITERIA}}");
+    return {
+      content: promptBody.replace(/\{\{REVIEW_CRITERIA\}\}/g, criteriaBlock),
+      hasCriteriaPlaceholder
+    };
+  });
+}
+function buildReviewerPromptEffect(repoRoot2, promptTemplate, criteria, artifactPathInWorktree, iteration, fs, reviewHistory = [], priorRefactorArtifacts, humanHandoffResolved, priorReviewerArtifacts) {
+  return Effect2.gen(function* () {
+    const criteriaBlock = yield* renderReviewCriteriaEffect(
+      repoRoot2,
+      criteria,
+      fs
+    );
+    const { content: renderedTemplate, hasCriteriaPlaceholder } = yield* loadReviewerPromptTemplateEffect(
+      repoRoot2,
+      promptTemplate,
+      criteriaBlock,
+      fs
+    );
+    const priorRefactorBlock = priorRefactorArtifacts ? `${priorRefactorArtifacts}` : "";
+    const priorRefactorProtocolReminder = priorRefactorArtifacts ? `## Prior Refactor Protocol Reminder
+
+MANDATORY: because this prompt contains ## Prior Refactor Artifacts, your artifact must contain ## Prior Refactor Response Assessment exactly, before verdict. Section headings must match the names defined in this protocol exactly.
+
+` : "";
+    const priorReviewerBlock = priorReviewerArtifacts ? `${priorReviewerArtifacts}` : "";
+    const humanHandoffBoundary = humanHandoffResolved ? `## Human-Resolved Handoff Boundary
+
+A prior review emitted \`NEEDS_HUMAN\` and stopped the agent loop. The issue has since been moved back to \`ready-for-agent\`.
+
+Before carrying forward old blockers, inspect newer issue comments and the current worktree. Treat prior Reviewer and Refactor Artifacts as historical context, not active findings unless they still apply.
+
+` : "";
+    return appendProtectedWorkGuidance(`${renderedTemplate}
+
+## Shared Run Context
+
+Read the selected issue requirements, planning context (including plan and PRD content when present), branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
+
+## Initial Verification Pass
+
+- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
+- Before reviewing code, diffs, artifacts, or prior findings, run the configured verification wrapper yourself from the Worktree.
+- If ${RUN_CONTEXT_PATH_IN_WORKTREE} provides a worktree-local CLI fallback, use that fallback before considering direct command execution.
+- Run underlying verification commands directly only when no wrapper path can run, and record why verification used direct commands.
+- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
+- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
+- If no verification commands are configured, note that and proceed with normal review.
+
+## Scope Evidence Rules
+
+- Use the Run Context's canonical base ref, for example \`origin/<base>\`, for scope diffs and commit ranges.
+- Do not use bare PRD/base branch names such as \`PRD-0063\`, \`main\`, or \`dev\` for scope decisions; local branches with those names may be stale.
+- Only call a file or commit out of scope when it is part of the working branch's delta from the canonical base ref.
+- Do not recommend reverting accepted sibling/base work. If a file is present or changed on the canonical base ref, it is not this Issue's scope overreach.
+- If scope evidence is ambiguous, use \`NEEDS_HUMAN\` or ask for a runner/base mismatch decision instead of telling Refactor to revert files.
+
+${hasCriteriaPlaceholder ? "" : `## Review Criteria
+
+${criteriaBlock}
+
+`}${humanHandoffBoundary}${priorReviewerBlock}${renderReviewHistory(reviewHistory)}${priorRefactorBlock}${priorRefactorProtocolReminder}## Output
+
+Write your review to: ${artifactPathInWorktree}
+
+Before handoff, run: pourkit validate-artifact reviewer ${artifactPathInWorktree} --iteration ${iteration}${priorRefactorArtifacts ? " --prior-refactor-artifacts" : ""}
+
+Do not provide a separate chat response. The runner only reads the file above.
+
+End the file with exactly one wrapped verdict token: <verdict>PASS</verdict>, <verdict>PASS_WITH_NOTES</verdict>, <verdict>NEEDS_REFACTOR</verdict>, <verdict>FAIL</verdict>, or <verdict>NEEDS_HUMAN</verdict>. The verdict token must appear exactly once in the output.
+
+Findings must include an ID column with values in the format R${iteration}.F{findingNumber} (e.g., R${iteration}.F1, R${iteration}.F2) and a Supersedes column referencing the finding ID being superseded (or a hyphen for new findings).
+
+When verdict is NEEDS_HUMAN, include Human Handoff Summary and Human Handoff Reason sections before the final verdict token.`);
+  });
+}
+function recoverReviewOutputFromString(logContent) {
+  const startIndex = logContent.indexOf("## Findings");
+  if (startIndex === -1) return null;
+  const verdictMatch = logContent.slice(startIndex).match(
+    /<verdict>(PASS|PASS_WITH_NOTES|NEEDS_REFACTOR|FAIL|NEEDS_HUMAN)<\/verdict>/
+  );
+  if (!verdictMatch || verdictMatch.index === void 0) return null;
+  const recoveredOutput = logContent.slice(startIndex, startIndex + verdictMatch.index + verdictMatch[0].length).trim();
+  return recoveredOutput.length > 0 ? recoveredOutput : null;
+}
+function recoverReviewOutputFromLog(logPath) {
+  if (!existsSync6(logPath)) {
+    return null;
+  }
+  const logContent = readFileSync6(logPath, "utf-8");
+  return recoverReviewOutputFromString(logContent);
+}
+function readReviewArtifact(artifactPath, logPath) {
+  if (existsSync6(artifactPath)) {
+    const output = readFileSync6(artifactPath, "utf-8");
+    if (output.trim()) {
+      return output;
+    }
+  }
+  const recoveredOutput = logPath ? recoverReviewOutputFromLog(logPath) : null;
+  if (recoveredOutput) {
+    writeFileSync3(artifactPath, recoveredOutput, "utf-8");
+    return recoveredOutput;
+  }
+  if (!existsSync6(artifactPath)) {
+    throw new Error(`Reviewer did not produce output at ${artifactPath}`);
+  }
+  throw new Error(`Reviewer produced empty output at ${artifactPath}`);
+}
+function bridgeExecutionProvider(ep) {
+  return Layer2.succeed(
+    ExecutionProvider,
+    ExecutionProvider.of({
+      execute: (opts) => Effect2.tryPromise({
+        try: () => ep.execute(opts),
+        catch: (e) => new Error(
+          e instanceof Error ? e.message : `Execution failed: ${String(e)}`
+        )
+      })
+    })
+  );
+}
 function runReviewCommandEffect(options) {
   const {
     executionProvider,
@@ -2314,100 +2523,43 @@ function runReviewCommandEffect(options) {
     return { verdict: parsedVerdict, output, artifactPath };
   });
 }
-function bridgeExecutionProvider(ep) {
-  return Layer2.succeed(
-    ExecutionProvider,
-    ExecutionProvider.of({
-      execute: (opts) => Effect2.tryPromise({
-        try: () => ep.execute(opts),
-        catch: (e) => new Error(
-          e instanceof Error ? e.message : `Execution failed: ${String(e)}`
-        )
-      })
-    })
-  );
-}
-function buildReviewerPromptEffect(repoRoot2, promptTemplate, criteria, artifactPathInWorktree, iteration, fs, reviewHistory = [], priorRefactorArtifacts, humanHandoffResolved, priorReviewerArtifacts) {
+function buildRefactorPromptEffect(repoRoot2, promptTemplate, latestReview, artifactPathInWorktree, iteration, fs) {
   return Effect2.gen(function* () {
-    const criteriaBlock = yield* renderReviewCriteriaEffect(
-      repoRoot2,
-      criteria,
-      fs
-    );
-    const { content: renderedTemplate, hasCriteriaPlaceholder } = yield* loadReviewerPromptTemplateEffect(
+    const promptTemplatePath = resolvePromptTemplatePath(
       repoRoot2,
-      promptTemplate,
-      criteriaBlock,
-      fs
+      promptTemplate
     );
-    const priorRefactorBlock = priorRefactorArtifacts ? `${priorRefactorArtifacts}` : "";
-    const priorRefactorProtocolReminder = priorRefactorArtifacts ? `## Prior Refactor Protocol Reminder
-
-MANDATORY: because this prompt contains ## Prior Refactor Artifacts, your artifact must contain ## Prior Refactor Response Assessment exactly, before verdict. Section headings must match the names defined in this protocol exactly.
-
-` : "";
-    const priorReviewerBlock = priorReviewerArtifacts ? `${priorReviewerArtifacts}` : "";
-    const humanHandoffBoundary = humanHandoffResolved ? `## Human-Resolved Handoff Boundary
-
-A prior review emitted \`NEEDS_HUMAN\` and stopped the agent loop. The issue has since been moved back to \`ready-for-agent\`.
-
-Before carrying forward old blockers, inspect newer issue comments and the current worktree. Treat prior Reviewer and Refactor Artifacts as historical context, not active findings unless they still apply.
-
-` : "";
-    return appendProtectedWorkGuidance(`${renderedTemplate}
+    const exists = yield* fs.exists(promptTemplatePath).pipe(Effect2.orDie);
+    const promptBody = exists ? yield* fs.readFile(promptTemplatePath).pipe(Effect2.orDie) : promptTemplate;
+    const findingIds = extractLatestFindingIds(latestReview, iteration);
+    const findingArgs = findingIds.map((id) => ` --finding-id ${id}`).join("");
+    return appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
 
 Read the selected issue requirements, planning context (including plan and PRD content when present), branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
 
-## Initial Verification Pass
-
-- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
-- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
-- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
-- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
-- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
-- If no verification commands are configured, note that and proceed with normal review.
+## Verification Handoff
 
-## Scope Evidence Rules
+- Run the verification wrapper listed in ${RUN_CONTEXT_PATH_IN_WORKTREE} after making changes.
+- If ${RUN_CONTEXT_PATH_IN_WORKTREE} provides a worktree-local CLI fallback, use that fallback before considering direct command execution.
+- Run underlying verification commands directly only when no wrapper path can run, and record why verification used direct commands in the Refactor Artifact.
+- If configured verification fails because of fixable Issue work, fix the work and rerun verification before handoff.
+- Failed or blocked verification prohibits <promise>COMPLETE</promise>.
 
-- Use the Run Context's canonical base ref, for example \`origin/<base>\`, for scope diffs and commit ranges.
-- Do not use bare PRD/base branch names such as \`PRD-0063\`, \`main\`, or \`dev\` for scope decisions; local branches with those names may be stale.
-- Only call a file or commit out of scope when it is part of the working branch's delta from the canonical base ref.
-- Do not recommend reverting accepted sibling/base work. If a file is present or changed on the canonical base ref, it is not this Issue's scope overreach.
-- If scope evidence is ambiguous, use \`NEEDS_HUMAN\` or ask for a runner/base mismatch decision instead of telling Refactor to revert files.
-
-${hasCriteriaPlaceholder ? "" : `## Review Criteria
-
-${criteriaBlock}
-
-`}${humanHandoffBoundary}${priorReviewerBlock}${renderReviewHistory(reviewHistory)}${priorRefactorBlock}${priorRefactorProtocolReminder}## Output
-
-Write your review to: ${artifactPathInWorktree}
+## Latest Review
 
-Before handoff, run: pourkit validate-artifact reviewer ${artifactPathInWorktree} --iteration ${iteration}${priorRefactorArtifacts ? " --prior-refactor-artifacts" : ""}
+${latestReview.trimEnd()}
 
-Do not provide a separate chat response. The runner only reads the file above.
+## Output
 
-End the file with exactly one wrapped verdict token: <verdict>PASS</verdict>, <verdict>PASS_WITH_NOTES</verdict>, <verdict>NEEDS_REFACTOR</verdict>, <verdict>FAIL</verdict>, or <verdict>NEEDS_HUMAN</verdict>. The verdict token must appear exactly once in the output.
+Write your refactor artifact to: ${artifactPathInWorktree}
 
-Findings must include an ID column with values in the format R${iteration}.F{findingNumber} (e.g., R${iteration}.F1, R${iteration}.F2) and a Supersedes column referencing the finding ID being superseded (or a hyphen for new findings).
+Before handoff, run: pourkit validate-artifact refactor ${artifactPathInWorktree} --iteration ${iteration}${findingArgs}
 
-When verdict is NEEDS_HUMAN, include Human Handoff Summary and Human Handoff Reason sections before the final verdict token.`);
+When you are done, finish with <promise>COMPLETE</promise>.`);
   });
 }
-function renderReviewHistory(reviewHistory) {
-  if (reviewHistory.length === 0) {
-    return "";
-  }
-  return `## Review History
-
-${reviewHistory.map((entry, index) => `### Iteration ${index + 1}
-
-${entry.trimEnd()}`).join("\n\n")}
-
-`;
-}
 function renderPriorRefactorArtifactsEffect(worktreePath, currentIteration) {
   return Effect2.gen(function* () {
     const fb = yield* FileSystem;
@@ -2468,78 +2620,54 @@ ${iterationsBlocks}
 `;
   });
 }
-function loadReviewerPromptTemplateEffect(repoRoot2, promptTemplate, criteriaBlock, fs) {
-  return Effect2.gen(function* () {
-    const promptTemplatePath = resolvePromptTemplatePath(
-      repoRoot2,
-      promptTemplate
-    );
-    const exists = yield* fs.exists(promptTemplatePath).pipe(Effect2.orDie);
-    const promptBody = exists ? yield* fs.readFile(promptTemplatePath).pipe(Effect2.orDie) : promptTemplate;
-    const hasCriteriaPlaceholder = promptBody.includes("{{REVIEW_CRITERIA}}");
-    return {
-      content: promptBody.replace(/\{\{REVIEW_CRITERIA\}\}/g, criteriaBlock),
-      hasCriteriaPlaceholder
-    };
-  });
-}
-function renderReviewCriteriaEffect(repoRoot2, criteria, fs) {
-  return Effect2.gen(function* () {
-    const parts = [];
-    for (const criterion of criteria) {
-      const snippetPath = join6(
-        repoRoot2,
-        ".pourkit",
-        "managed",
-        "prompts",
-        `reviewer-${criterion}.snippet.md`
-      );
-      const exists = yield* fs.exists(snippetPath).pipe(Effect2.orDie);
-      if (exists) {
-        const content = yield* fs.readFile(snippetPath).pipe(Effect2.orDie);
-        parts.push(content.trimEnd());
-      } else {
-        parts.push(`- ${criterion}`);
-      }
-    }
-    return parts.join("\n\n");
-  });
-}
-function recoverReviewOutputFromString(logContent) {
-  const startIndex = logContent.indexOf("## Findings");
-  if (startIndex === -1) return null;
-  const verdictMatch = logContent.slice(startIndex).match(
-    /<verdict>(PASS|PASS_WITH_NOTES|NEEDS_REFACTOR|FAIL|NEEDS_HUMAN)<\/verdict>/
-  );
-  if (!verdictMatch || verdictMatch.index === void 0) return null;
-  const recoveredOutput = logContent.slice(startIndex, startIndex + verdictMatch.index + verdictMatch[0].length).trim();
-  return recoveredOutput.length > 0 ? recoveredOutput : null;
-}
-function recoverReviewOutputFromLog(logPath) {
-  if (!existsSync6(logPath)) {
-    return null;
-  }
-  const logContent = readFileSync6(logPath, "utf-8");
-  return recoverReviewOutputFromString(logContent);
+function persistIterationArtifactEffect(worktreePath, output, iteration, fs) {
+  return Effect2.gen(function* () {
+    const dir = join6(worktreePath, ".pourkit", ".tmp", "reviewers");
+    yield* fs.mkdir(dir).pipe(Effect2.catchAll(() => Effect2.void));
+    yield* fs.writeFile(join6(dir, `iteration-${iteration}.md`), output).pipe(Effect2.catchAll(() => Effect2.void));
+  });
 }
-function readReviewArtifact(artifactPath, logPath) {
-  if (existsSync6(artifactPath)) {
-    const output = readFileSync6(artifactPath, "utf-8");
-    if (output.trim()) {
-      return output;
-    }
+function mapResult(result) {
+  const base = {
+    output: result.output,
+    iterations: result.iterations,
+    lifetimeIterations: result.lifetimeIterations,
+    refactorCompletedForLastReview: result.refactorCompletedForLastReview,
+    refactorArtifactPaths: result.refactorArtifactPaths
+  };
+  if (result.exhaustedMaxIterations) {
+    return {
+      status: "exhausted_max_iterations",
+      reviewVerdict: result.verdict === "FAIL" ? "FAIL" : "NEEDS_REFACTOR",
+      reviewArtifactPath: result.artifactPath,
+      ...base,
+      reason: "max_iterations"
+    };
   }
-  const recoveredOutput = logPath ? recoverReviewOutputFromLog(logPath) : null;
-  if (recoveredOutput) {
-    writeFileSync3(artifactPath, recoveredOutput, "utf-8");
-    return recoveredOutput;
+  if (result.verdict === "NEEDS_HUMAN") {
+    return {
+      status: "needs_human",
+      reviewVerdict: "NEEDS_HUMAN",
+      reviewArtifactPath: result.artifactPath,
+      ...base
+    };
   }
-  if (!existsSync6(artifactPath)) {
-    throw new Error(`Reviewer did not produce output at ${artifactPath}`);
+  if (result.verdict === "FAIL") {
+    return {
+      status: "needs_human",
+      reviewVerdict: "NEEDS_HUMAN",
+      reviewArtifactPath: result.artifactPath,
+      ...base
+    };
   }
-  throw new Error(`Reviewer produced empty output at ${artifactPath}`);
+  return {
+    status: "passed",
+    reviewVerdict: result.verdict,
+    reviewArtifactPath: result.artifactPath,
+    ...base
+  };
 }
-function runReviewWithRefactorLoop(options) {
+function runIssueReviewLoop(options) {
   const {
     executionProvider,
     config,
@@ -2565,7 +2693,6 @@ function runReviewWithRefactorLoop(options) {
     return Effect2.die(new Error("No refactorer config found"));
   }
   const maxIterations = strategy.review.maxIterations;
-  const passWithNotesRefactorAttempts = strategy.review.passWithNotesRefactorAttempts;
   let resolvedStartingIteration = startingLifetimeIteration;
   {
     const reviewersDir = join6(worktreePath, ".pourkit", ".tmp", "reviewers");
@@ -2598,7 +2725,6 @@ function runReviewWithRefactorLoop(options) {
       iteration: 0,
       lastResult: null,
       reviewHistory: [],
-      passWithNotesRefactorAttemptsRemaining: passWithNotesRefactorAttempts,
       accumulatedRefactorPaths: [],
       doneResult: null
     };
@@ -2654,11 +2780,7 @@ function runReviewWithRefactorLoop(options) {
             }
           };
         }
-        if (reviewResult.verdict === "PASS_WITH_NOTES" && s.passWithNotesRefactorAttemptsRemaining === 0) {
-          logger.step(
-            "info",
-            "PASS_WITH_NOTES refactor attempts exhausted, treating as PASS"
-          );
+        if (reviewResult.verdict === "PASS_WITH_NOTES") {
           return {
             ...s,
             done: true,
@@ -2666,7 +2788,7 @@ function runReviewWithRefactorLoop(options) {
             lastResult: reviewResult,
             reviewHistory: updatedHistory,
             doneResult: {
-              verdict: "PASS",
+              verdict: reviewResult.verdict,
               output: reviewResult.output,
               artifactPath: reviewResult.artifactPath,
               iterations: iteration,
@@ -2677,14 +2799,6 @@ function runReviewWithRefactorLoop(options) {
             }
           };
         }
-        let updatedPassWithNotesRefactorAttemptsRemaining = s.passWithNotesRefactorAttemptsRemaining;
-        if (reviewResult.verdict === "PASS_WITH_NOTES") {
-          updatedPassWithNotesRefactorAttemptsRemaining--;
-          logger.step(
-            "info",
-            `PASS_WITH_NOTES refactor attempts remaining: ${updatedPassWithNotesRefactorAttemptsRemaining}`
-          );
-        }
         if (reviewResult.verdict === "NEEDS_HUMAN") {
           logger.step("info", "NEEDS_HUMAN verdict, stopping review loop");
           return {
@@ -2705,7 +2819,7 @@ function runReviewWithRefactorLoop(options) {
             }
           };
         }
-        if (reviewResult.verdict === "NEEDS_REFACTOR" || reviewResult.verdict === "PASS_WITH_NOTES" || reviewResult.verdict === "FAIL") {
+        if (reviewResult.verdict === "NEEDS_REFACTOR" || reviewResult.verdict === "FAIL") {
           logger.step("info", "Running refactor agent");
           const refactorArtifactPathInWorktree = join6(
             ".pourkit",
@@ -2861,7 +2975,6 @@ function runReviewWithRefactorLoop(options) {
             iteration,
             lastResult: reviewResult,
             reviewHistory: updatedHistory,
-            passWithNotesRefactorAttemptsRemaining: updatedPassWithNotesRefactorAttemptsRemaining,
             accumulatedRefactorPaths: updatedAccumulated,
             doneResult: null
           };
@@ -2871,7 +2984,6 @@ function runReviewWithRefactorLoop(options) {
           iteration,
           lastResult: reviewResult,
           reviewHistory: updatedHistory,
-          passWithNotesRefactorAttemptsRemaining: updatedPassWithNotesRefactorAttemptsRemaining,
           accumulatedRefactorPaths: s.accumulatedRefactorPaths,
           doneResult: null
         };
@@ -2882,7 +2994,7 @@ function runReviewWithRefactorLoop(options) {
     }
     logger.step("warn", `Max review iterations (${maxIterations}) exhausted`);
     return {
-      verdict: "FAIL",
+      verdict: finalState.lastResult?.verdict ?? "FAIL",
       output: finalState.lastResult?.output ?? "",
       artifactPath: finalState.lastResult?.artifactPath ?? "",
       iterations: finalState.iteration,
@@ -2894,45 +3006,10 @@ function runReviewWithRefactorLoop(options) {
   });
   const executionLayer = bridgeExecutionProvider(executionProvider);
   return program.pipe(
-    Effect2.provide(Layer2.merge(executionLayer, FileSystemDefault))
+    Effect2.provide(Layer2.merge(executionLayer, FileSystemDefault)),
+    Effect2.map(mapResult)
   );
 }
-function persistIterationArtifactEffect(worktreePath, output, iteration, fs) {
-  return Effect2.gen(function* () {
-    const dir = join6(worktreePath, ".pourkit", ".tmp", "reviewers");
-    yield* fs.mkdir(dir).pipe(Effect2.catchAll(() => Effect2.void));
-    yield* fs.writeFile(join6(dir, `iteration-${iteration}.md`), output).pipe(Effect2.catchAll(() => Effect2.void));
-  });
-}
-function buildRefactorPromptEffect(repoRoot2, promptTemplate, latestReview, artifactPathInWorktree, iteration, fs) {
-  return Effect2.gen(function* () {
-    const promptTemplatePath = resolvePromptTemplatePath(
-      repoRoot2,
-      promptTemplate
-    );
-    const exists = yield* fs.exists(promptTemplatePath).pipe(Effect2.orDie);
-    const promptBody = exists ? yield* fs.readFile(promptTemplatePath).pipe(Effect2.orDie) : promptTemplate;
-    const findingIds = extractLatestFindingIds(latestReview, iteration);
-    const findingArgs = findingIds.map((id) => ` --finding-id ${id}`).join("");
-    return appendProtectedWorkGuidance(`${promptBody}
-
-## Shared Run Context
-
-Read the selected issue requirements, planning context (including plan and PRD content when present), branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
-
-## Latest Review
-
-${latestReview.trimEnd()}
-
-## Output
-
-Write your refactor artifact to: ${artifactPathInWorktree}
-
-Before handoff, run: pourkit validate-artifact refactor ${artifactPathInWorktree} --iteration ${iteration}${findingArgs}
-
-When you are done, finish with <promise>COMPLETE</promise>.`);
-  });
-}
 
 // pr/pr-description.ts
 var CONVENTIONAL_TITLE_PATTERN = /^(feat|fix|perf|refactor|docs|test|chore|ci|build)(\([^)]+\))?!?:\s+\S/;
@@ -3183,6 +3260,12 @@ var ISSUE_FINAL_REVIEW_SCOPE_VERDICTS = [
   "incidental",
   "out-of-scope"
 ];
+var ISSUE_FINAL_REVIEW_VERIFICATION_METHODS = [
+  "wrapper",
+  "local-wrapper",
+  "commands",
+  "none"
+];
 function invalid(options, reason, diagnostics = []) {
   return {
     ok: false,
@@ -3490,9 +3573,47 @@ function validateIssueFinalReviewArtifact(parsed, options) {
       diagnostics
     };
   }
+  if ("method" in verification && !ISSUE_FINAL_REVIEW_VERIFICATION_METHODS.includes(
+    verification.method
+  )) {
+    return {
+      ok: false,
+      reason: 'verification.method must be "wrapper", "local-wrapper", "commands", or "none"',
+      diagnostics
+    };
+  }
   diagnostics.push("verification: present");
-  if (parsed.selfRetouched === true && parsed.verdict === "pass") {
+  const verificationWasRecorded = verification.required === true || Array.isArray(verification.commands) && verification.commands.length > 0;
+  if (parsed.verdict === "pass" && verificationWasRecorded) {
     if (verification.required !== true || verification.passed !== true) {
+      return {
+        ok: false,
+        reason: "Issue Final Review pass with verification evidence requires verification.required === true and verification.passed === true",
+        diagnostics: [
+          ...diagnostics,
+          `verification.required: ${verification.required}`,
+          `verification.passed: ${verification.passed}`
+        ]
+      };
+    }
+    if (typeof verification.method !== "string") {
+      return {
+        ok: false,
+        reason: "Issue Final Review pass with verification evidence requires verification.method",
+        diagnostics
+      };
+    }
+    if (verification.method === "none") {
+      return {
+        ok: false,
+        reason: 'Issue Final Review pass with verification evidence requires verification.method other than "none"',
+        diagnostics
+      };
+    }
+    diagnostics.push("pass verification: valid");
+  }
+  if (parsed.selfRetouched === true && parsed.verdict === "pass") {
+    if (!verificationWasRecorded) {
       return {
         ok: false,
         reason: "Self-retouched pass requires verification.required === true and verification.passed === true",
@@ -3672,7 +3793,7 @@ function shellQuote(value) {
 }
 
 // commands/issue-run.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
 import { isAbsolute as isAbsolute4, join as join15 } from "path";
 
 // pr/templates.ts
@@ -3693,10 +3814,10 @@ init_common();
 import { Exit as Exit3 } from "effect";
 
 // failure-resolution/effect-runtime.ts
-import { Effect as Effect4 } from "effect";
+import { Effect as Effect5 } from "effect";
 
 // shared/effect-runtime.ts
-import { Effect as Effect3, Exit } from "effect";
+import { Effect as Effect4, Exit } from "effect";
 import { UnknownException } from "effect/Cause";
 var initialized = false;
 function initializeEffectRuntime() {
@@ -3705,7 +3826,7 @@ function initializeEffectRuntime() {
 }
 function runEffect(program) {
   ensureEffectRuntime();
-  return Effect3.runPromiseExit(program);
+  return Effect4.runPromiseExit(program);
 }
 function ensureEffectRuntime() {
   if (!initialized) {
@@ -3883,23 +4004,23 @@ function recordStageAttempt(worktreePath, record) {
 
 // failure-resolution/effect-runtime.ts
 function baseRefreshEffect(options) {
-  return Effect4.promise(() => refreshStaleIssueBranch(options)).pipe(
-    Effect4.flatMap(
+  return Effect5.promise(() => refreshStaleIssueBranch(options)).pipe(
+    Effect5.flatMap(
       (result) => {
         switch (result.status) {
           case "refreshed":
-            return Effect4.succeed({ status: "refreshed" });
+            return Effect5.succeed({ status: "refreshed" });
           case "skipped-current":
-            return Effect4.succeed({ status: "skipped-current" });
+            return Effect5.succeed({ status: "skipped-current" });
           case "conflicted":
-            return Effect4.fail(
+            return Effect5.fail(
               new RebaseConflict({
                 conflictedPaths: result.conflictedPaths,
                 message: result.message
               })
             );
           case "refused-published-history":
-            return Effect4.fail(
+            return Effect5.fail(
               new PublishedHistoryRisk({
                 prNumber: result.prNumber,
                 prState: result.prState
@@ -3914,8 +4035,8 @@ async function runBaseRefreshAttempt(options) {
   const attemptId = createStageAttemptId();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const program = baseRefreshEffect(options).pipe(
-    Effect4.tapBoth({
-      onSuccess: (success) => Effect4.sync(() => {
+    Effect5.tapBoth({
+      onSuccess: (success) => Effect5.sync(() => {
         recordStageAttempt(options.worktreePath, {
           id: attemptId,
           stage: "baseRefresh",
@@ -3924,7 +4045,7 @@ async function runBaseRefreshAttempt(options) {
           outcome: "success"
         });
       }),
-      onFailure: (failure) => Effect4.sync(() => {
+      onFailure: (failure) => Effect5.sync(() => {
         recordStageAttempt(options.worktreePath, {
           id: attemptId,
           stage: "baseRefresh",
@@ -4395,6 +4516,10 @@ function writeFailureState(options, message) {
   }
 }
 
+// issues/issue-builder.ts
+init_common();
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
+
 // serena/baseline.ts
 init_common();
 import path3 from "path";
@@ -4647,82 +4772,258 @@ var SERENA_DASHBOARD_PORT = 24282;
 var SERENA_IMAGE = "ghcr.io/oraios/serena:latest";
 function sidecarOptions(paths, mcpUrl) {
   return {
-    baselineWorktreePath: paths.baselineWorktreePath,
-    dataDir: paths.dataDir,
-    mcpPort: SERENA_MCP_PORT,
-    dashboardPort: SERENA_DASHBOARD_PORT,
-    image: SERENA_IMAGE,
-    mcpUrl
+    baselineWorktreePath: paths.baselineWorktreePath,
+    dataDir: paths.dataDir,
+    mcpPort: SERENA_MCP_PORT,
+    dashboardPort: SERENA_DASHBOARD_PORT,
+    image: SERENA_IMAGE,
+    mcpUrl
+  };
+}
+async function canReachMcp(url) {
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    try {
+      await fetch(url, { method: "GET", signal: AbortSignal.timeout(500) });
+      return true;
+    } catch {
+      if (attempt < 9) {
+        await new Promise((resolve5) => setTimeout(resolve5, 100));
+      }
+    }
+  }
+  return false;
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function prepareSerenaForTarget(options) {
+  if (!options.enabled) {
+    return { enabled: false };
+  }
+  try {
+    const paths = await ensureBaselineWorktree({
+      repoRoot: options.repoRoot,
+      dataDir: options.dataDir
+    });
+    await prepareSerenaSidecarConfig({
+      baselineWorktreePath: paths.baselineWorktreePath,
+      dataDir: paths.dataDir
+    });
+    const status = options.autoStart ? await startSerenaSidecar(sidecarOptions(paths, options.mcpUrl)) : await getSerenaSidecarStatus(sidecarOptions(paths, options.mcpUrl));
+    const mcpReachable = await canReachMcp(options.mcpUrl);
+    if (!mcpReachable) {
+      return {
+        enabled: true,
+        available: false,
+        error: status.running ? `Serena MCP is not reachable at ${options.mcpUrl}` : `Serena sidecar is not running for target ${options.targetName}`
+      };
+    }
+    await refreshSerenaBaseline({
+      repoRoot: options.repoRoot,
+      dataDir: options.dataDir,
+      baseBranch: options.baseBranch
+    });
+    return {
+      enabled: true,
+      available: true,
+      mcpUrl: options.mcpUrl
+    };
+  } catch (error) {
+    return {
+      enabled: true,
+      available: false,
+      error: formatError(error)
+    };
+  }
+}
+
+// issues/issue-builder.ts
+async function runIssueBuilder(options) {
+  const {
+    repoRoot: repoRoot2,
+    issueNumber,
+    target,
+    config,
+    branchName,
+    worktreePath,
+    baseRef,
+    worktreeState,
+    restartBuilder,
+    executionProvider,
+    runContextArtifact,
+    logger,
+    memory,
+    prepareSerena,
+    onSerenaExecutionContext,
+    timeoutMs
+  } = options;
+  const serenaRuntimeConfig = {
+    enabled: target.serena?.enabled ?? config.serena.enabled,
+    required: target.serena?.required ?? config.serena.required,
+    autoStart: config.serena.autoStart,
+    dataDir: config.serena.dataDir,
+    mcpUrl: config.serena.mcpUrl,
+    sandboxMcpUrl: config.serena.sandboxMcpUrl
+  };
+  let serenaExecutionContext;
+  if (serenaRuntimeConfig.enabled || serenaRuntimeConfig.required) {
+    const serenaPreflight = await (prepareSerena ?? prepareSerenaForTarget)({
+      repoRoot: repoRoot2,
+      targetName: target.name,
+      baseBranch: target.baseBranch,
+      dataDir: serenaRuntimeConfig.dataDir,
+      mcpUrl: serenaRuntimeConfig.mcpUrl,
+      enabled: serenaRuntimeConfig.enabled || serenaRuntimeConfig.required,
+      required: serenaRuntimeConfig.required,
+      autoStart: serenaRuntimeConfig.autoStart,
+      logger
+    });
+    if (serenaPreflight.enabled && serenaPreflight.available) {
+      serenaExecutionContext = {
+        available: true,
+        sandboxMcpUrl: serenaRuntimeConfig.sandboxMcpUrl
+      };
+      onSerenaExecutionContext?.(serenaExecutionContext);
+    }
+    if (serenaPreflight.enabled && !serenaPreflight.available) {
+      const message = `Serena preflight unavailable for target ${target.name}: ${serenaPreflight.error}`;
+      if (serenaRuntimeConfig.required) {
+        throw new Error(message);
+      }
+      logger.step("warn", message);
+    }
+  }
+  const shouldRunBuilder = restartBuilder || worktreeState === null || !worktreeState.completedStages.builder;
+  if (!shouldRunBuilder) {
+    return {
+      status: "skipped",
+      ...worktreePath ? { worktreePath } : {},
+      worktreeState
+    };
+  }
+  const strategy = target.strategy;
+  const prompt = loadBuilderPrompt(
+    repoRoot2,
+    strategy.implement.builder.promptTemplate
+  );
+  const executionResult = await executionProvider.execute({
+    stage: "builder",
+    agent: strategy.implement.builder.agent,
+    model: strategy.implement.builder.model,
+    variant: strategy.implement.builder.variant,
+    env: strategy.implement.builder.env,
+    prompt,
+    target,
+    repoRoot: repoRoot2,
+    branchName,
+    ...baseRef ? { baseRef } : {},
+    sandbox: config.sandbox,
+    ...serenaExecutionContext ? { serena: serenaExecutionContext } : {},
+    ...memory ? { memory } : {},
+    autoApprove: true,
+    timeoutMs,
+    ...worktreePath ? { worktreePath } : {},
+    artifacts: [runContextArtifact],
+    logger
+  });
+  if (!executionResult.success) {
+    throw new Error(`Sandcastle failed: ${executionResult.error}`);
+  }
+  const effectiveWorktreePath = worktreePath ?? executionResult.worktreePath;
+  if (effectiveWorktreePath) {
+    await assertCanonicalBaseAncestor({
+      worktreePath: effectiveWorktreePath,
+      baseRef: `origin/${target.baseBranch}`,
+      stageName: "Builder",
+      logger
+    });
+    if (worktreeState) {
+      updateWorktreeRunState(effectiveWorktreePath, {
+        completedStages: { builder: true }
+      });
+    } else {
+      writeWorktreeRunState(effectiveWorktreePath, {
+        issueNumber,
+        targetName: target.name,
+        branchName,
+        baseBranch: target.baseBranch,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        completedStages: { builder: true },
+        review: { lifetimeIterations: 0 }
+      });
+    }
+  }
+  const refreshedState = effectiveWorktreePath ? readWorktreeRunState(effectiveWorktreePath) : worktreeState;
+  return {
+    status: "ran",
+    ...effectiveWorktreePath ? { worktreePath: effectiveWorktreePath } : {},
+    worktreeState: refreshedState
   };
 }
-async function canReachMcp(url) {
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    try {
-      await fetch(url, { method: "GET", signal: AbortSignal.timeout(500) });
-      return true;
-    } catch {
-      if (attempt < 9) {
-        await new Promise((resolve5) => setTimeout(resolve5, 100));
-      }
-    }
-  }
-  return false;
+function loadBuilderPrompt(repoRoot2, promptTemplate) {
+  const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
+  const promptBody = existsSync10(promptPath) ? readFileSync11(promptPath, "utf-8") : promptTemplate;
+  return appendProtectedWorkGuidance(`${promptBody}
+
+## Shared Run Context
+
+Read the selected issue requirements, planning context (including plan and PRD content when present), comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
+
+## Verification Handoff
+
+- Run the verification wrapper listed in ${RUN_CONTEXT_PATH_IN_WORKTREE}.
+- If ${RUN_CONTEXT_PATH_IN_WORKTREE} provides a worktree-local CLI fallback, use that fallback before considering direct command execution.
+- Run underlying verification commands directly only when no wrapper path can run, and report why verification used direct commands.
+- If configured verification fails because of fixable Issue work, fix the work and rerun verification before handoff.
+- Failed or blocked verification prohibits <promise>COMPLETE</promise>.`);
 }
-function formatError(error) {
-  return error instanceof Error ? error.message : String(error);
+async function syncRemoteBaseRef(worktreePath, baseRef, logger) {
+  const remoteBase = parseRemoteBaseRef(baseRef);
+  if (!remoteBase) {
+    return;
+  }
+  await execCapture("git", ["fetch", remoteBase.remote, remoteBase.branch], {
+    cwd: worktreePath,
+    logger,
+    label: "git fetch target"
+  });
 }
-async function prepareSerenaForTarget(options) {
-  if (!options.enabled) {
-    return { enabled: false };
+function parseRemoteBaseRef(baseRef) {
+  const [remote, ...branchParts] = baseRef.split("/");
+  const branch = branchParts.join("/");
+  if (!remote || !branch) {
+    return null;
   }
+  return { remote, branch };
+}
+async function assertCanonicalBaseAncestor(options) {
+  const { worktreePath, baseRef, stageName, logger } = options;
+  await syncRemoteBaseRef(worktreePath, baseRef, logger);
   try {
-    const paths = await ensureBaselineWorktree({
-      repoRoot: options.repoRoot,
-      dataDir: options.dataDir
-    });
-    await prepareSerenaSidecarConfig({
-      baselineWorktreePath: paths.baselineWorktreePath,
-      dataDir: paths.dataDir
-    });
-    const status = options.autoStart ? await startSerenaSidecar(sidecarOptions(paths, options.mcpUrl)) : await getSerenaSidecarStatus(sidecarOptions(paths, options.mcpUrl));
-    const mcpReachable = await canReachMcp(options.mcpUrl);
-    if (!mcpReachable) {
-      return {
-        enabled: true,
-        available: false,
-        error: status.running ? `Serena MCP is not reachable at ${options.mcpUrl}` : `Serena sidecar is not running for target ${options.targetName}`
-      };
-    }
-    await refreshSerenaBaseline({
-      repoRoot: options.repoRoot,
-      dataDir: options.dataDir,
-      baseBranch: options.baseBranch
+    await execCapture("git", ["merge-base", "--is-ancestor", baseRef, "HEAD"], {
+      cwd: worktreePath,
+      logger,
+      label: "git merge-base --is-ancestor"
     });
-    return {
-      enabled: true,
-      available: true,
-      mcpUrl: options.mcpUrl
-    };
-  } catch (error) {
-    return {
-      enabled: true,
-      available: false,
-      error: formatError(error)
-    };
+  } catch {
+    throw new Error(
+      `Cannot continue after ${stageName}: ${baseRef} is not an ancestor of HEAD. An agent may have moved the issue branch behind the canonical base; refresh the branch onto the latest target base before continuing.`
+    );
   }
 }
 
 // commands/pr-description-agent.ts
 import { join as join11 } from "path";
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 
 // pr/pr-description-context.ts
 init_common();
 import { join as join10 } from "path";
 import { readFile } from "fs/promises";
-import { Effect as Effect5 } from "effect";
+import { Effect as Effect6 } from "effect";
 function collectFinalizerContextEffect(options) {
-  return Effect5.gen(function* () {
+  return Effect6.gen(function* () {
     const git = yield* GitOperations;
     const fs = yield* FileSystem;
     const remoteBase = remoteTargetBase(options.targetBase);
@@ -4735,8 +5036,8 @@ function collectFinalizerContextEffect(options) {
       ],
       { cwd: options.worktreePath }
     ).pipe(
-      Effect5.catchAll(
-        (error) => Effect5.fail(
+      Effect6.catchAll(
+        (error) => Effect6.fail(
           new Error(`Failed to collect commit range: ${error.message}`)
         )
       )
@@ -4751,9 +5052,9 @@ function collectFinalizerContextEffect(options) {
     let reviewArtifact;
     if (options.reviewArtifactPath) {
       const content = yield* fs.readFile(options.reviewArtifactPath).pipe(
-        Effect5.catchIf(
+        Effect6.catchIf(
           (error) => error.message.includes("ENOENT") || error.message.includes("no such file"),
-          () => Effect5.fail(
+          () => Effect6.fail(
             new Error(
               `Review artifact not found at ${options.reviewArtifactPath}. Ensure the review stage completed before running finalizer generation.`
             )
@@ -4761,7 +5062,7 @@ function collectFinalizerContextEffect(options) {
         )
       );
       if (!content.trim()) {
-        return yield* Effect5.fail(
+        return yield* Effect6.fail(
           new Error(
             `Review artifact at ${options.reviewArtifactPath} is empty. Ensure the review stage produced output before running finalizer generation.`
           )
@@ -4837,12 +5138,12 @@ Before handoff, run: pourkit validate-artifact finalizer ${artifactPathInWorktre
 }
 
 // commands/pr-description-agent.ts
-import { Effect as Effect6, Layer as Layer3 } from "effect";
+import { Effect as Effect7, Layer as Layer3 } from "effect";
 function bridgeExecutionProvider2(ep) {
   return Layer3.succeed(
     ExecutionProvider,
     ExecutionProvider.of({
-      execute: (opts) => Effect6.tryPromise({
+      execute: (opts) => Effect7.tryPromise({
         try: () => ep.execute(opts),
         catch: (e) => new Error(
           e instanceof Error ? e.message : `Execution failed: ${String(e)}`
@@ -4860,7 +5161,7 @@ function runFinalizerAgent(options) {
     "agent-output.md"
   );
   const artifactPath = join11(options.worktreePath, artifactPathInWorktree);
-  const program = Effect6.gen(function* () {
+  const program = Effect7.gen(function* () {
     const fs = yield* FileSystem;
     const context = yield* collectFinalizerContextEffect({
       targetBase: options.targetBaseBranch,
@@ -4869,8 +5170,8 @@ function runFinalizerAgent(options) {
       reviewArtifactPath: options.reviewArtifactPath,
       logger: options.logger
     }).pipe(
-      Effect6.catchAll(
-        (error) => Effect6.fail(
+      Effect7.catchAll(
+        (error) => Effect7.fail(
           new FinalizerFailure({
             message: `Failed to collect finalizer context: ${error.message}`
           })
@@ -4909,13 +5210,13 @@ function runFinalizerAgent(options) {
       logger: options.logger,
       ...options.memory ? { memory: options.memory } : {}
     });
-    const output = readFileSync11(artifactPath, "utf-8");
+    const output = readFileSync12(artifactPath, "utf-8");
     yield* persistGeneratedArtifactEffect(options.worktreePath, output, fs);
     return result;
   });
   const executionLayer = bridgeExecutionProvider2(executionProvider);
   return program.pipe(
-    Effect6.provide(
+    Effect7.provide(
       Layer3.mergeAll(executionLayer, FileSystemDefault, GitOperationsDefault)
     )
   );
@@ -4925,11 +5226,11 @@ function runPrDescriptionFinalizerCore(options) {
     options.worktreePath,
     options.artifactPathInWorktree
   );
-  return Effect6.gen(function* () {
+  return Effect7.gen(function* () {
     let parsed;
     let lastValidationError;
     for (let protocolAttempt = 1; protocolAttempt <= options.maxAttempts; protocolAttempt++) {
-      const retryResult = yield* Effect6.tryPromise({
+      const retryResult = yield* Effect7.tryPromise({
         try: () => executeWithMissingOrEmptyArtifactRetry({
           executionProvider: options.executionProvider,
           missingOrEmptyRetries: resolveMissingOrEmptyOutputRetries(
@@ -4966,7 +5267,7 @@ function runPrDescriptionFinalizerCore(options) {
       });
       const executionResult = retryResult.executionResult;
       if (!executionResult.success) {
-        return yield* Effect6.fail(
+        return yield* Effect7.fail(
           new FinalizerFailure({
             message: `Finalizer agent execution failed: ${executionResult.error}`
           })
@@ -5004,7 +5305,7 @@ function runPrDescriptionFinalizerCore(options) {
       }
     }
     if (!parsed) {
-      return yield* Effect6.fail(
+      return yield* Effect7.fail(
         new FinalizerFailure({
           message: lastValidationError?.message ?? "Finalizer validation failed"
         })
@@ -5019,20 +5320,20 @@ function runPrDescriptionFinalizerCore(options) {
   });
 }
 function loadFinalizerPromptEffect(repoRoot2, promptTemplate, fs) {
-  return Effect6.gen(function* () {
+  return Effect7.gen(function* () {
     const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-    const exists = yield* fs.exists(promptPath).pipe(Effect6.orDie);
+    const exists = yield* fs.exists(promptPath).pipe(Effect7.orDie);
     if (exists) {
-      return yield* fs.readFile(promptPath).pipe(Effect6.orDie);
+      return yield* fs.readFile(promptPath).pipe(Effect7.orDie);
     }
     return promptTemplate;
   });
 }
 function persistGeneratedArtifactEffect(worktreePath, output, fs) {
-  return Effect6.gen(function* () {
+  return Effect7.gen(function* () {
     const dir = join11(worktreePath, ".pourkit", ".tmp", "finalizer");
-    yield* fs.mkdir(dir).pipe(Effect6.catchAll(() => Effect6.void));
-    yield* fs.writeFile(join11(dir, "generated.md"), output).pipe(Effect6.catchAll(() => Effect6.void));
+    yield* fs.mkdir(dir).pipe(Effect7.catchAll(() => Effect7.void));
+    yield* fs.writeFile(join11(dir, "generated.md"), output).pipe(Effect7.catchAll(() => Effect7.void));
   });
 }
 
@@ -5106,7 +5407,7 @@ function extractClosingRefs(body) {
 
 // issues/github-issue-publication.ts
 init_common();
-import { existsSync as existsSync10, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
 import { isAbsolute as isAbsolute3, join as join12 } from "path";
 
 // issues/issue-transitions.ts
@@ -5372,7 +5673,7 @@ function secondsRemaining(deadline, observedAt) {
 }
 
 // issues/merge-coordinator.ts
-import { Effect as Effect7, Either } from "effect";
+import { Effect as Effect8, Either } from "effect";
 import { UnknownException as UnknownException2 } from "effect/Cause";
 function unwrapError2(error) {
   if (error instanceof UnknownException2 && error.error !== void 0) {
@@ -5391,9 +5692,9 @@ function runMergeCoordinator(options) {
   } = options;
   const method = options.method ?? "squash";
   const waitForTargetGreen = options.waitForTargetGreen ?? true;
-  return Effect7.gen(function* () {
-    const checksEither = yield* Effect7.either(
-      Effect7.tryPromise(
+  return Effect8.gen(function* () {
+    const checksEither = yield* Effect8.either(
+      Effect8.tryPromise(
         () => prProvider.waitForPrChecks(prNumber, checkWaitOptions)
       )
     );
@@ -5406,8 +5707,8 @@ function runMergeCoordinator(options) {
         error: error instanceof Error ? error : new Error(String(error))
       };
     }
-    const mergeEither = yield* Effect7.either(
-      Effect7.tryPromise(
+    const mergeEither = yield* Effect8.either(
+      Effect8.tryPromise(
         () => prProvider.mergePr(prNumber, { method, matchHeadCommit })
       )
     );
@@ -5421,8 +5722,8 @@ function runMergeCoordinator(options) {
       };
     }
     if (waitForTargetGreen) {
-      const targetEither = yield* Effect7.either(
-        Effect7.tryPromise(
+      const targetEither = yield* Effect8.either(
+        Effect8.tryPromise(
           () => waitForBranchChecks(prProvider, logger, {
             branchName: targetBranch,
             checksFoundTimeoutMs: checkWaitOptions.checksFoundTimeoutMs,
@@ -5583,10 +5884,10 @@ function readIssueFinalReviewArtifact(worktreeState, worktreePath) {
     return null;
   }
   const artifactPath = isAbsolute3(configuredPath) ? configuredPath : join12(worktreePath, configuredPath);
-  if (!existsSync10(artifactPath)) return null;
+  if (!existsSync11(artifactPath)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(artifactPath, "utf-8"));
+    parsed = JSON.parse(readFileSync13(artifactPath, "utf-8"));
   } catch {
     return null;
   }
@@ -5621,6 +5922,9 @@ function buildIssueFinalReviewPrComment(artifact) {
       `- **Required:** ${formatBoolean(artifact.verification.required)}`,
       `- **Passed:** ${formatBoolean(artifact.verification.passed)}`
     );
+    if (typeof artifact.verification.method === "string") {
+      lines.push(`- **Method:** ${formatLabel(artifact.verification.method)}`);
+    }
     const commands = Array.isArray(artifact.verification.commands) ? artifact.verification.commands.filter(
       (command) => typeof command === "string"
     ) : [];
@@ -5818,7 +6122,7 @@ function findSecretLikeContent(source, content) {
   ];
   for (const { kind, regex } of patterns) {
     for (const match of content.matchAll(regex)) {
-      if (isAllowedSecretPlaceholder(match[0])) {
+      if (isAllowedSecretPlaceholder(match[0]) || isAllowedDocumentationTokenReference(match[0])) {
         continue;
       }
       findings.push({ source, kind });
@@ -5839,9 +6143,12 @@ function isAllowedSecretPlaceholder(value) {
     "xxxxx"
   ].some((allowed) => normalized.includes(allowed));
 }
+function isAllowedDocumentationTokenReference(value) {
+  return /^token\s*:\s*["']?<verdict>/i.test(value);
+}
 
 // commands/issue-final-review-agent.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
 import { join as join13 } from "path";
 var ISSUE_FINAL_REVIEW_ARTIFACT_PATH = join13(
   ".pourkit",
@@ -5868,7 +6175,9 @@ async function runIssueFinalReviewAgent(options) {
   const prompt = loadIssueFinalReviewPrompt({
     repoRoot: repoRoot2,
     promptTemplate: agent.promptTemplate,
-    validationCommand: `pourkit validate-artifact issue-final-review ${artifactPathInWorktree} --issue-number ${issue.number} --branch-name ${builderBranch} --base-ref origin/${target.baseBranch}`
+    validationCommand: `pourkit validate-artifact issue-final-review ${artifactPathInWorktree} --issue-number ${issue.number} --branch-name ${builderBranch} --base-ref origin/${target.baseBranch}`,
+    reviewArtifactPath: options.reviewArtifactPath,
+    reviewVerdict: options.reviewVerdict
   });
   const entry = await executeWithMissingOrEmptyArtifactRetry({
     executionProvider,
@@ -5964,10 +6273,16 @@ function extractChangedPaths(parsed) {
   ).filter((path9) => typeof path9 === "string") : [];
 }
 function loadIssueFinalReviewPrompt(options) {
-  const { repoRoot: repoRoot2, promptTemplate, validationCommand } = options;
+  const {
+    repoRoot: repoRoot2,
+    promptTemplate,
+    validationCommand,
+    reviewArtifactPath,
+    reviewVerdict
+  } = options;
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync11(promptPath) ? readFileSync13(promptPath, "utf-8") : promptTemplate;
-  return appendProtectedWorkGuidance(`${promptBody}
+  const promptBody = existsSync12(promptPath) ? readFileSync14(promptPath, "utf-8") : promptTemplate;
+  let prompt = appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
 
@@ -5976,9 +6291,12 @@ Read the selected issue requirements, planning context (including plan and PRD c
 ## Initial Verification Pass
 
 - First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
-- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
-- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
-- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
+- Before reviewing code, diffs, artifacts, or prior findings, run the verification wrapper from the Worktree.
+- If the installed Pourkit CLI rejects the worktree config schemaVersion and the Run Context provides a Pourkit self-development fallback, build and run the worktree-local CLI wrapper exactly as instructed.
+- Do not substitute direct underlying commands unless neither wrapper path can run; if you must use direct commands, record degraded verification with \`verification.method: "commands"\` and explain why in \`verification.summary\`.
+- Record successful wrapper verification with \`verification.method: "wrapper"\`, or worktree-local CLI wrapper verification with \`verification.method: "local-wrapper"\`.
+- If a configured verification command fails because of fixable Issue work, self-retouch the Worktree, then rerun all configured verification commands.
+- Do not return \`pass\` while any configured verification command is failing.
 - If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
 - If no verification commands are configured, note that and proceed with normal review.
 
@@ -5998,6 +6316,19 @@ Read the selected issue requirements, planning context (including plan and PRD c
 - This validation checks both the artifact shape and \`changedFiles\` coverage against the canonical Git diff.
 - If validation fails, fix the artifact or safely retouch the worktree as needed, then rerun the same command.
 - Do not finish until the validation command passes.`);
+  if (reviewVerdict) {
+    prompt += `
+
+## Prior Review Context
+
+- Reviewer Artifact Path: ${reviewArtifactPath}
+- Prior Review Verdict: ${reviewVerdict}`;
+    if (reviewVerdict === "PASS_WITH_NOTES") {
+      prompt += `
+- This Issue passed the prior Reviewer with notes. Read the Reviewer Artifact and inspect its notes before making your final pass decision.`;
+    }
+  }
+  return prompt;
 }
 
 // issues/issue-worktree-resolution.ts
@@ -6167,16 +6498,6 @@ function checkIssueGates(issue, config, force) {
   }
   return { allowed: true, gates };
 }
-function resolveSerenaRuntimeConfig(config, target) {
-  return {
-    enabled: target.serena?.enabled ?? config.serena.enabled,
-    required: target.serena?.required ?? config.serena.required,
-    autoStart: config.serena.autoStart,
-    dataDir: config.serena.dataDir,
-    mcpUrl: config.serena.mcpUrl,
-    sandboxMcpUrl: config.serena.sandboxMcpUrl
-  };
-}
 function assertIssueFinalReviewPassed(worktreeState) {
   const ifr = worktreeState?.issueFinalReview;
   if (!ifr || !ifr.completed || ifr.verdict !== "pass") {
@@ -6197,6 +6518,7 @@ async function advanceIssueFinalReview(options) {
     repoRoot: repoRoot2,
     logger,
     reviewArtifactPath,
+    reviewVerdict,
     worktreeState
   } = options;
   const ifrFromState = worktreeState?.issueFinalReview;
@@ -6237,9 +6559,10 @@ async function advanceIssueFinalReview(options) {
     repoRoot: repoRoot2,
     logger,
     reviewArtifactPath,
+    reviewVerdict,
     ...options.memory ? { memory: options.memory } : {}
   });
-  await assertCanonicalBaseAncestor({
+  await assertCanonicalBaseAncestor2({
     worktreePath,
     baseRef: `origin/${target.baseBranch}`,
     stageName: "Issue Final Review",
@@ -6292,35 +6615,7 @@ async function startIssueRun(options) {
   const effectiveTarget = { ...target, baseBranch: effectiveBaseBranch };
   const branchName = renderBranchName(target.branchTemplate, issue);
   const strategy = target.strategy;
-  const serenaRuntimeConfig = resolveSerenaRuntimeConfig(config, target);
-  const shouldPrepareSerena = serenaRuntimeConfig.enabled || serenaRuntimeConfig.required;
   let serenaExecutionContext;
-  if (shouldPrepareSerena) {
-    const serenaPreflight = await prepareSerenaForTarget({
-      repoRoot: ROOT,
-      targetName: target.name,
-      baseBranch: target.baseBranch,
-      dataDir: serenaRuntimeConfig.dataDir,
-      mcpUrl: serenaRuntimeConfig.mcpUrl,
-      enabled: shouldPrepareSerena,
-      required: serenaRuntimeConfig.required,
-      autoStart: serenaRuntimeConfig.autoStart,
-      logger
-    });
-    if (serenaPreflight.enabled && serenaPreflight.available) {
-      serenaExecutionContext = {
-        available: true,
-        sandboxMcpUrl: serenaRuntimeConfig.sandboxMcpUrl
-      };
-    }
-    if (serenaPreflight.enabled && !serenaPreflight.available) {
-      const message = `Serena preflight unavailable for target ${target.name}: ${serenaPreflight.error}`;
-      if (serenaRuntimeConfig.required) {
-        throw new Error(message);
-      }
-      logger.step("warn", message);
-    }
-  }
   const memoryExecutionContext = config.memory?.enabled ? { available: true, sandboxDbPath: "/home/agent/.pourkit/icm/memories.db" } : void 0;
   if (options.resetWorktree) {
     const existingPr = await prProvider.getPr(branchName);
@@ -6332,10 +6627,6 @@ async function startIssueRun(options) {
     await resetIssueWorktree(ROOT, branchName, logger);
     await syncTargetBranch(ROOT, effectiveBaseBranch, logger);
   }
-  const prompt = loadBuilderPrompt(
-    ROOT,
-    strategy.implement.builder.promptTemplate
-  );
   const resolution = await resolveIssueWorktree(
     ROOT,
     branchName,
@@ -6380,68 +6671,33 @@ async function startIssueRun(options) {
   });
   await issueProvider.addLabels(issueNumber, [config.labels.agentInProgress]);
   await issueProvider.removeLabel(issueNumber, config.labels.readyForAgent);
-  let executionResult;
-  const shouldRunBuilder = resolution.mode === "new" ? true : worktreeState === null || !worktreeState.completedStages.builder;
-  if (shouldRunBuilder) {
-    executionResult = await executionProvider.execute({
-      stage: "builder",
-      agent: strategy.implement.builder.agent,
-      model: strategy.implement.builder.model,
-      variant: strategy.implement.builder.variant,
-      env: strategy.implement.builder.env,
-      prompt,
-      target: effectiveTarget,
-      repoRoot: ROOT,
-      branchName,
-      ...resolution.mode === "new" ? { baseRef: resolution.baseRef } : {},
-      sandbox: config.sandbox,
-      ...serenaExecutionContext ? { serena: serenaExecutionContext } : {},
-      ...memoryExecutionContext ? { memory: memoryExecutionContext } : {},
-      autoApprove: true,
-      timeoutMs: EXECUTION_TIMEOUT_MS,
-      ...resolution.worktreePath ? { worktreePath: resolution.worktreePath } : {},
-      artifacts: [runContextArtifact],
-      logger
-    });
-    if (!executionResult.success) {
-      throw new Error(`Sandcastle failed: ${executionResult.error}`);
-    }
-  } else {
-    executionResult = {
-      success: true,
-      branch: branchName,
-      worktreePath: resolution.worktreePath,
-      commits: [],
-      logPath: null
-    };
-  }
-  if (executionResult.worktreePath) {
-    if (shouldRunBuilder) {
-      await assertCanonicalBaseAncestor({
-        worktreePath: executionResult.worktreePath,
-        baseRef: `origin/${effectiveBaseBranch}`,
-        stageName: "Builder",
-        logger
-      });
-    }
-    if (worktreeState) {
-      updateWorktreeRunState(executionResult.worktreePath, {
-        completedStages: { builder: true }
-      });
-    } else {
-      writeWorktreeRunState(executionResult.worktreePath, {
-        issueNumber,
-        targetName: target.name,
-        branchName,
-        baseBranch: effectiveBaseBranch,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        completedStages: { builder: true },
-        review: { lifetimeIterations: 0 }
-      });
+  const builderResult = await runIssueBuilder({
+    repoRoot: ROOT,
+    issueNumber,
+    target: effectiveTarget,
+    config,
+    branchName,
+    ...resolution.worktreePath ? { worktreePath: resolution.worktreePath } : {},
+    ...resolution.mode === "new" ? { baseRef: resolution.baseRef } : {},
+    worktreeState,
+    restartBuilder: resolution.mode === "new",
+    executionProvider,
+    runContextArtifact,
+    logger,
+    ...memoryExecutionContext ? { memory: memoryExecutionContext } : {},
+    timeoutMs: EXECUTION_TIMEOUT_MS,
+    onSerenaExecutionContext: (context) => {
+      serenaExecutionContext = context;
     }
-  }
-  const finalWorktreeState = executionResult.worktreePath ? readWorktreeRunState(executionResult.worktreePath) : worktreeState;
+  });
+  const executionResult = {
+    success: true,
+    branch: branchName,
+    worktreePath: builderResult.worktreePath ?? issueWorktreePath(ROOT, branchName),
+    commits: [],
+    logPath: null
+  };
+  const finalWorktreeState = builderResult.worktreeState;
   return {
     issue,
     parentPrdIssue,
@@ -6469,7 +6725,7 @@ async function fetchParentPrdIssue(issue, issueProvider) {
 async function advanceIssueRunReview(options) {
   const accumulatedRefactorPaths = [];
   const reviewResult = await runEffectAndMapExit(
-    runReviewWithRefactorLoop({
+    runIssueReviewLoop({
       ...options,
       onRefactorProgress: (progress) => {
         if (progress.refactorArtifactPath) {
@@ -6486,22 +6742,35 @@ async function advanceIssueRunReview(options) {
       }
     })
   );
-  await assertCanonicalBaseAncestor({
+  await assertCanonicalBaseAncestor2({
     worktreePath: options.worktreePath,
     baseRef: `origin/${options.target.baseBranch}`,
     stageName: "Review/Refactor",
     logger: options.logger
   });
-  updateWorktreeRunState(options.worktreePath, {
-    review: {
-      lifetimeIterations: reviewResult.lifetimeIterations,
-      lastVerdict: reviewResult.verdict,
-      lastArtifactPath: reviewResult.artifactPath,
-      refactorCompletedForLastReview: reviewResult.refactorCompletedForLastReview,
-      exhaustedPreviousRun: reviewResult.exhaustedMaxIterations || reviewResult.verdict === "FAIL" || void 0,
-      refactorArtifactPaths: accumulatedRefactorPaths.length > 0 ? accumulatedRefactorPaths : void 0
-    }
-  });
+  const commonFields = {
+    lifetimeIterations: reviewResult.lifetimeIterations,
+    lastArtifactPath: reviewResult.reviewArtifactPath,
+    refactorCompletedForLastReview: reviewResult.refactorCompletedForLastReview,
+    refactorArtifactPaths: accumulatedRefactorPaths.length > 0 ? accumulatedRefactorPaths : void 0
+  };
+  if (reviewResult.status === "passed" || reviewResult.status === "needs_human") {
+    updateWorktreeRunState(options.worktreePath, {
+      review: {
+        ...commonFields,
+        lastVerdict: reviewResult.reviewVerdict,
+        exhaustedPreviousRun: void 0
+      }
+    });
+  } else {
+    updateWorktreeRunState(options.worktreePath, {
+      review: {
+        ...commonFields,
+        lastVerdict: reviewResult.reviewVerdict,
+        exhaustedPreviousRun: true
+      }
+    });
+  }
   return reviewResult;
 }
 async function completeIssueRun(options) {
@@ -6552,12 +6821,12 @@ async function completeIssueRun(options) {
         prTitle = finalizerFromState.title;
         prBody = finalizerFromState.body;
       } else if (finalizerFromState.artifactPath) {
-        if (!existsSync12(finalizerFromState.artifactPath)) {
+        if (!existsSync13(finalizerFromState.artifactPath)) {
           throw new FinalizerFailure({
             message: `Finalizer artifact missing at ${finalizerFromState.artifactPath}`
           });
         }
-        const artifactContent = readFileSync14(
+        const artifactContent = readFileSync15(
           finalizerFromState.artifactPath,
           "utf-8"
         );
@@ -6595,7 +6864,7 @@ async function completeIssueRun(options) {
     prTitle = finalizerResult.title;
     prBody = finalizerResult.body;
     if (executionResult.worktreePath) {
-      await assertCanonicalBaseAncestor({
+      await assertCanonicalBaseAncestor2({
         worktreePath: executionResult.worktreePath,
         baseRef: `origin/${effectiveBaseBranch}`,
         stageName: "Finalizer",
@@ -6699,14 +6968,14 @@ async function transitionIssueToHumanHandoff(options) {
   const transitions = makeIssueTransitions2(issueProvider, config);
   await transitions.moveToReadyForHuman(issueNumber);
   const summary = extractHumanHandoffSummary(reviewResult.output);
-  const refactorDir = getRefactorArtifactDir(reviewResult.artifactPath);
+  const refactorDir = getRefactorArtifactDir(reviewResult.reviewArtifactPath);
   const comment = [
     "Pourkit stopped the review/refactor loop because human input is needed.",
     "",
     summary,
     "",
     "Artifacts:",
-    `- Review: ${reviewResult.artifactPath}`,
+    `- Review: ${reviewResult.reviewArtifactPath}`,
     `- Refactors: ${refactorDir}`
   ].join("\n");
   await issueProvider.commentIssue(issueNumber, comment);
@@ -6735,7 +7004,7 @@ function getRefactorArtifactDir(artifactPath) {
 }
 async function finalizeWorktreeCommit(options) {
   const { worktreePath, baseRef, title, body, logger } = options;
-  await assertCanonicalBaseAncestor({
+  await assertCanonicalBaseAncestor2({
     worktreePath,
     baseRef,
     stageName: "final commit",
@@ -6757,9 +7026,9 @@ async function finalizeWorktreeCommit(options) {
     label: "git commit"
   });
 }
-async function assertCanonicalBaseAncestor(options) {
+async function assertCanonicalBaseAncestor2(options) {
   const { worktreePath, baseRef, stageName, logger } = options;
-  await syncRemoteBaseRef(worktreePath, baseRef, logger);
+  await syncRemoteBaseRef2(worktreePath, baseRef, logger);
   try {
     await execCapture("git", ["merge-base", "--is-ancestor", baseRef, "HEAD"], {
       cwd: worktreePath,
@@ -6821,8 +7090,8 @@ function normalizeGitPath2(path9) {
 function isIssueFinalReviewAuditedPath2(path9) {
   return path9 !== "" && path9 !== WORKTREE_RUN_STATE_PATH && !path9.startsWith(".pourkit/.tmp/") && !path9.startsWith(".pourkit/logs/");
 }
-async function syncRemoteBaseRef(worktreePath, baseRef, logger) {
-  const remoteBase = parseRemoteBaseRef(baseRef);
+async function syncRemoteBaseRef2(worktreePath, baseRef, logger) {
+  const remoteBase = parseRemoteBaseRef2(baseRef);
   if (!remoteBase) {
     return;
   }
@@ -6832,7 +7101,7 @@ async function syncRemoteBaseRef(worktreePath, baseRef, logger) {
     label: "git fetch target"
   });
 }
-function parseRemoteBaseRef(baseRef) {
+function parseRemoteBaseRef2(baseRef) {
   const [remote, ...branchParts] = baseRef.split("/");
   const branch = branchParts.join("/");
   if (!remote || !branch) {
@@ -6911,15 +7180,6 @@ async function closeNoOpIssue(provider, issueNumber, config, logger) {
     await maybeCloseParentAfterChildCompletion(provider, issueNumber, logger);
   }
 }
-function loadBuilderPrompt(repoRoot2, promptTemplate) {
-  const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync12(promptPath) ? readFileSync14(promptPath, "utf-8") : promptTemplate;
-  return appendProtectedWorkGuidance(`${promptBody}
-
-## Shared Run Context
-
-Read the selected issue requirements, planning context (including plan and PRD content when present), comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}`);
-}
 
 // issues/issue-run-lifecycle.ts
 var IssueRunHumanHandoffStop = class extends Error {
@@ -6933,8 +7193,10 @@ async function runIssueLifecycle(options) {
     const startResult = await options.deps.startIssueRun(options.runOptions);
     const reviewAlreadyPassed = startResult.worktreeState?.review.lastVerdict && !startResult.worktreeState.review.exhaustedPreviousRun && (startResult.worktreeState.review.lastVerdict === "PASS" || startResult.worktreeState.review.lastVerdict === "PASS_WITH_NOTES");
     let reviewArtifactPath;
+    let reviewVerdict = void 0;
     if (reviewAlreadyPassed) {
       reviewArtifactPath = startResult.worktreeState.review.lastArtifactPath;
+      reviewVerdict = startResult.worktreeState.review.lastVerdict;
     } else {
       const reviewResult = await options.deps.advanceIssueRunReview({
         executionProvider: options.runOptions.executionProvider,
@@ -6951,28 +7213,34 @@ async function runIssueLifecycle(options) {
         serena: startResult.serena,
         memory: startResult.memory
       });
-      if (reviewResult.exhaustedMaxIterations) {
-        throw new Error(
-          "Review loop exhausted maximum iterations without passing"
-        );
-      }
-      if (reviewResult.verdict === "FAIL") {
-        const summary = reviewResult.output?.trim() || "no summary provided";
-        throw new Error(`Review loop failed: ${summary}`);
-      }
-      if (reviewResult.verdict === "NEEDS_HUMAN") {
-        await options.deps.transitionReviewNeedsHumanToHandoff({
-          issueProvider: options.issueProvider,
-          issueNumber: options.issueNumber,
-          config: options.config,
-          logger: options.logger,
-          reviewResult
-        });
-        throw new IssueRunHumanHandoffStop(
-          "Review requires human handoff: NEEDS_HUMAN verdict"
-        );
+      switch (reviewResult.status) {
+        case "passed":
+          reviewArtifactPath = reviewResult.reviewArtifactPath;
+          reviewVerdict = reviewResult.reviewVerdict;
+          break;
+        case "needs_human":
+          await options.deps.transitionReviewNeedsHumanToHandoff({
+            issueProvider: options.issueProvider,
+            issueNumber: options.issueNumber,
+            config: options.config,
+            logger: options.logger,
+            reviewResult
+          });
+          throw new IssueRunHumanHandoffStop(
+            "Review requires human handoff: NEEDS_HUMAN verdict"
+          );
+        case "exhausted_max_iterations":
+          await options.deps.transitionReviewNeedsHumanToHandoff({
+            issueProvider: options.issueProvider,
+            issueNumber: options.issueNumber,
+            config: options.config,
+            logger: options.logger,
+            reviewResult
+          });
+          throw new IssueRunHumanHandoffStop(
+            "Review exhausted maximum iterations - requires human handoff"
+          );
       }
-      reviewArtifactPath = reviewResult.artifactPath;
     }
     const finalReviewResult = await options.deps.advanceIssueFinalReview({
       executionProvider: options.runOptions.executionProvider,
@@ -6985,6 +7253,7 @@ async function runIssueLifecycle(options) {
       repoRoot: options.repoRoot,
       logger: options.logger,
       reviewArtifactPath,
+      reviewVerdict,
       worktreeState: startResult.worktreeState,
       memory: startResult.memory
     });
@@ -7186,9 +7455,9 @@ import { join as join17 } from "path";
 
 // prd-run/state.ts
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   readdirSync as readdirSync3,
   writeFileSync as writeFileSync4
 } from "fs";
@@ -7277,16 +7546,16 @@ function normalizePrdRunRef(ref) {
 function readPrdRun(repoRoot2, prdRef) {
   const normalized = normalizePrdRunRef(prdRef);
   const recordPath = getRecordPath(repoRoot2, normalized);
-  if (!existsSync13(recordPath)) {
+  if (!existsSync14(recordPath)) {
     return { record: null, diagnostics: [] };
   }
   try {
-    const raw = JSON.parse(readFileSync15(recordPath, "utf-8"));
+    const raw = JSON.parse(readFileSync16(recordPath, "utf-8"));
     const parsed = PrdRunRecordSchema.parse(raw);
     return { record: parsed, diagnostics: [] };
   } catch (error) {
     try {
-      const raw = JSON.parse(readFileSync15(recordPath, "utf-8"));
+      const raw = JSON.parse(readFileSync16(recordPath, "utf-8"));
       if (raw && typeof raw === "object" && raw.start && typeof raw.start === "object" && raw.start.startBaseBranch === void 0) {
         return {
           record: raw,
@@ -7308,7 +7577,7 @@ function readPrdRun(repoRoot2, prdRef) {
 }
 function listPrdRuns(repoRoot2) {
   const stateDir = join16(repoRoot2, PRD_RUN_STATE_DIR);
-  if (!existsSync13(stateDir)) {
+  if (!existsSync14(stateDir)) {
     return { records: [], diagnostics: [] };
   }
   const records = [];
@@ -7320,7 +7589,7 @@ function listPrdRuns(repoRoot2) {
     const recordPath = join16(stateDir, entry.name);
     try {
       const record = PrdRunRecordSchema.parse(
-        JSON.parse(readFileSync15(recordPath, "utf-8"))
+        JSON.parse(readFileSync16(recordPath, "utf-8"))
       );
       records.push(record);
     } catch (error) {
@@ -7356,7 +7625,7 @@ import { Match, pipe } from "effect";
 
 // commands/queue.ts
 init_common();
-import { Effect as Effect8 } from "effect";
+import { Effect as Effect9 } from "effect";
 
 // issues/select-issue.ts
 init_common();
@@ -7529,8 +7798,8 @@ function issueDataToCandidate(issue) {
 function selectNextQueueIssue(options) {
   const { config, issueProvider, logger, prdRef } = options;
   logger.step("info", "Loading candidate issues from provider");
-  return Effect8.gen(function* () {
-    const candidates = yield* Effect8.tryPromise({
+  return Effect9.gen(function* () {
+    const candidates = yield* Effect9.tryPromise({
       try: () => issueProvider.listCandidates(),
       catch: (e) => {
         if (e instanceof Error) {
@@ -7601,7 +7870,7 @@ function selectNextQueueIssue(options) {
       (c) => c.number === selection.issue.number
     );
     if (!selected) {
-      return yield* Effect8.die(
+      return yield* Effect9.die(
         new Error(
           `Selected issue #${selection.issue.number} not found in candidate list`
         )
@@ -7656,8 +7925,8 @@ function makeReconcileDeps(options) {
   };
 }
 function reconcileBlockedEffect(options) {
-  return Effect8.gen(function* () {
-    const blocked2 = yield* Effect8.tryPromise({
+  return Effect9.gen(function* () {
+    const blocked2 = yield* Effect9.tryPromise({
       try: () => options.issueProvider.listBlockedIssues(),
       catch: (e) => {
         if (e instanceof Error) {
@@ -7671,7 +7940,7 @@ function reconcileBlockedEffect(options) {
         "info",
         `Reconciling ${blocked2.length} blocked issue(s)`
       );
-      yield* Effect8.tryPromise({
+      yield* Effect9.tryPromise({
         try: () => reconcileBlockedIssues(blocked2, makeReconcileDeps(options)),
         catch: (e) => {
           if (e instanceof Error) {
@@ -7695,7 +7964,7 @@ function runOneQueueIssueEffect(options) {
     repoRoot: repoRoot2,
     prdRef
   } = options;
-  return Effect8.gen(function* () {
+  return Effect9.gen(function* () {
     const outcome = yield* selectNextQueueIssue({
       config,
       issueProvider,
@@ -7711,7 +7980,7 @@ function runOneQueueIssueEffect(options) {
     }
     const { issue: selected } = outcome;
     const baseBranchOverride = options.queueRunContext?.prdBranch;
-    const runResult = yield* Effect8.tryPromise({
+    const runResult = yield* Effect9.tryPromise({
       try: () => runIssueCommand({
         issueNumber: selected.number,
         targetName,
@@ -7751,7 +8020,7 @@ function runQueue(options) {
   return runOneQueueIssueEffect(options);
 }
 function runQueueLoopEffect(options, results) {
-  return Effect8.gen(function* () {
+  return Effect9.gen(function* () {
     yield* reconcileBlockedEffect(options);
     const outcome = yield* runOneQueueIssueEffect(options);
     if (outcome.selected === null) {
@@ -7768,7 +8037,7 @@ function runQueueLoopEffect(options, results) {
       };
     }
     const newResults = [...results, outcome];
-    const processedIssue = yield* Effect8.tryPromise({
+    const processedIssue = yield* Effect9.tryPromise({
       try: () => options.issueProvider.fetchIssue(outcome.selected.number),
       catch: (e) => {
         if (e instanceof Error) {
@@ -9103,7 +9372,7 @@ async function launchGithubQueueDrain(options, prdRef, startReceipt, targetName,
 }
 
 // prd-run/final-review-validation.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync17 } from "fs";
 
 // commands/prd-run.ts
 async function runPrdRunLaunchCommand(options) {
@@ -9613,7 +9882,7 @@ async function runPrMergeCommand(args, logger, prProvider, config) {
 }
 
 // commands/init.ts
-import { existsSync as existsSync15, statSync } from "fs";
+import { existsSync as existsSync16, statSync } from "fs";
 import {
   copyFile,
   mkdir as mkdir4,
@@ -9819,7 +10088,17 @@ function buildManagedAgentInstructions(options) {
 
 Use \`fd\` for file discovery, \`rg\` for text search, and direct file reads for focused context.
 
-Use \`opensrc path <package>\` when implementation requires source code for repo dependencies, instead of relying only on package docs or generated type declarations. Search or read files under the returned source path with \`rg\` and direct file reads.
+For multi-step exploration, prefer the dedicated subagents in \`.opencode/agents\`:
+
+- Use \`codebase-locator\` when you need to find relevant files, directories, or entry points.
+- Use \`codebase-analyzer\` when you need to understand how a specific component or flow works.
+- Use \`codebase-pattern-finder\` when you need examples of similar implementations or test patterns.
+- Use \`pourkit-docs-locator\` when searching \`.pourkit/\` context docs or ADRs.
+- Use \`pourkit-docs-analyzer\` to explain specific context docs or ADRs after locating them.
+
+Use direct \`fd\`/\`rg\`/reads for focused checks; use subagents when the search would otherwise require several discovery/read steps.
+
+Use \`opensrc path <package-or-repo>\` whenever implementation requires reading external source code, not only package dependencies. If you would otherwise clone a repository to inspect its source, use \`opensrc\` first, then search or read files under the returned source path with \`rg\` and direct file reads.
 
 Follow the project's domain docs and workflow routes documented in the Pourkit managed block below.
 
@@ -9928,7 +10207,7 @@ function resolveSourceAssetPath(sourceRoot, ...segments) {
     path5.join(sourceRoot, "dist", ...segments)
   ];
   for (const candidatePath of candidatePaths) {
-    if (existsSync15(candidatePath)) return candidatePath;
+    if (existsSync16(candidatePath)) return candidatePath;
   }
   return path5.join(sourceRoot, "pourkit", ...segments);
 }
@@ -10113,8 +10392,7 @@ function generateConfigTemplate(options) {
           model: "opencode-go/qwen3.6-plus",
           promptTemplate: ".pourkit/managed/prompts/refactor.prompt.md"
         },
-        maxIterations: 3,
-        passWithNotesRefactorAttempts: 2
+        maxIterations: 3
       },
       issueFinalReview: {
         agent: "pourkit-reviewer",
@@ -10144,7 +10422,7 @@ function generateConfigTemplate(options) {
   }
   const config = {
     $schema: "./schema/pourkit.schema.json",
-    schemaVersion: 2,
+    schemaVersion: 3,
     targets: [target],
     workflowPack: {
       version: "1.0.0",
@@ -10291,7 +10569,7 @@ async function computeFileChecksum(filePath) {
   return createHash("sha256").update(content).digest("hex");
 }
 function lockfileExists(root, name) {
-  return existsSync15(path5.join(root, name));
+  return existsSync16(path5.join(root, name));
 }
 function detectPackageManager(root) {
   if (lockfileExists(root, "pnpm-lock.yaml")) return "pnpm";
@@ -10335,7 +10613,7 @@ async function discoverLocalSource(sourcePath) {
 async function discoverReadme(root) {
   for (const name of ["README.md", "readme.md"]) {
     const p = path5.join(root, name);
-    if (existsSync15(p)) {
+    if (existsSync16(p)) {
       return p;
     }
   }
@@ -10345,7 +10623,7 @@ async function discoverAgentFiles(root) {
   const files = [];
   for (const name of ["AGENTS.md", "CLAUDE.md"]) {
     const p = path5.join(root, name);
-    if (existsSync15(p)) {
+    if (existsSync16(p)) {
       files.push(p);
     }
   }
@@ -10353,7 +10631,7 @@ async function discoverAgentFiles(root) {
 }
 async function discoverMerlleState(root) {
   const p = path5.join(root, ".pourkit", "state.json");
-  return existsSync15(p) ? p : null;
+  return existsSync16(p) ? p : null;
 }
 async function discoverAgentSkills(root) {
   const dirs = [
@@ -10362,7 +10640,7 @@ async function discoverAgentSkills(root) {
   ];
   const found = [];
   for (const d of dirs) {
-    if (existsSync15(d)) {
+    if (existsSync16(d)) {
       found.push(d);
     }
   }
@@ -10373,7 +10651,7 @@ async function discoverOpenCodeAgentFiles(sourceRoot) {
     resolveSourceAssetPath(sourceRoot, ".opencode", "agents"),
     path5.join(sourceRoot, "..", ".opencode", "agents")
   ].find(
-    (candidate) => existsSync15(candidate) && statSync(candidate).isDirectory()
+    (candidate) => existsSync16(candidate) && statSync(candidate).isDirectory()
   );
   if (!agentsDir) return [];
   const entries = await readdir(agentsDir, { withFileTypes: true });
@@ -10383,12 +10661,12 @@ async function discoverRootDomainDocs(root) {
   const docs = [];
   for (const name of ["CONTEXT.md", "CONTEXT-MAP.md"]) {
     const p = path5.join(root, name);
-    if (existsSync15(p)) {
+    if (existsSync16(p)) {
       docs.push(p);
     }
   }
   const adrDir = path5.join(root, "docs", "adr");
-  if (existsSync15(adrDir)) {
+  if (existsSync16(adrDir)) {
     const entries = await readdir(adrDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -10530,7 +10808,7 @@ async function planInit(options) {
       for (const file of skillFiles) {
         const relPath = path5.relative(s, file);
         const destPath = path5.join(targetRoot, ".agents", "skills", relPath);
-        if (!existsSync15(destPath)) {
+        if (!existsSync16(destPath)) {
           operations.push({
             kind: "copy",
             sourcePath: file,
@@ -10593,7 +10871,7 @@ async function planInit(options) {
     });
   }
   if (sourceRoot) {
-    if (!existsSync15(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
+    if (!existsSync16(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
       warnings.push(
         `--from-local path does not exist or is not a directory: ${sourceRoot}`
       );
@@ -10658,9 +10936,9 @@ async function planInit(options) {
         "release",
         "skills"
       );
-      const srcSkills = existsSync15(packagedManagedSkills) ? [
+      const srcSkills = existsSync16(packagedManagedSkills) ? [
         packagedManagedSkills,
-        ...existsSync15(packagedReleaseAddonSkills) ? [packagedReleaseAddonSkills] : []
+        ...existsSync16(packagedReleaseAddonSkills) ? [packagedReleaseAddonSkills] : []
       ] : await discoverAgentSkills(sourceRoot);
       for (const s of srcSkills) {
         const isOpenCode = s.includes(".opencode");
@@ -10683,7 +10961,7 @@ async function planInit(options) {
               "skills",
               relPath
             );
-            if (!existsSync15(destPath)) {
+            if (!existsSync16(destPath)) {
               operations.push({
                 kind: "copy",
                 sourcePath: file,
@@ -10815,7 +11093,7 @@ async function planInit(options) {
             requiresConfirmation: false,
             destructive: false
           });
-        } else if (existsSync15(destPath)) {
+        } else if (existsSync16(destPath)) {
           operations.push({
             kind: "skip",
             path: destPath,
@@ -10873,7 +11151,7 @@ async function planInit(options) {
         }
       }
       const contextPath = path5.join(targetRoot, ".pourkit", "CONTEXT.md");
-      if (!existsSync15(contextPath) && !merleDestPaths.has(contextPath)) {
+      if (!existsSync16(contextPath) && !merleDestPaths.has(contextPath)) {
         operations.push({
           kind: "create",
           path: contextPath,
@@ -10891,7 +11169,7 @@ async function planInit(options) {
         "adr",
         ".gitkeep"
       );
-      if (!existsSync15(adrGitkeep)) {
+      if (!existsSync16(adrGitkeep)) {
         operations.push({
           kind: "create",
           path: adrGitkeep,
@@ -10913,7 +11191,7 @@ async function planInit(options) {
         "docs",
         "agents"
       );
-      const srcDocAgents = existsSync15(packagedManagedDocAgents) ? packagedManagedDocAgents : legacyDocAgents;
+      const srcDocAgents = existsSync16(packagedManagedDocAgents) ? packagedManagedDocAgents : legacyDocAgents;
       const tgtManagedDocAgents = path5.join(
         targetRoot,
         ".pourkit",
@@ -10927,12 +11205,12 @@ async function planInit(options) {
         "docs",
         "agents"
       );
-      if (existsSync15(srcDocAgents)) {
+      if (existsSync16(srcDocAgents)) {
         const docFiles = await walkDir(srcDocAgents);
         for (const file of docFiles) {
           const relPath = path5.relative(srcDocAgents, file);
           const managedDocDest = path5.join(tgtManagedDocAgents, relPath);
-          if (!existsSync15(managedDocDest) && relPath === "triage-labels.md") {
+          if (!existsSync16(managedDocDest) && relPath === "triage-labels.md") {
             operations.push({
               kind: "create",
               path: managedDocDest,
@@ -10944,7 +11222,7 @@ async function planInit(options) {
                 options.labels ?? DEFAULT_RUNNER_LABELS
               )
             });
-          } else if (!existsSync15(managedDocDest)) {
+          } else if (!existsSync16(managedDocDest)) {
             const checksum = await computeFileChecksum(file);
             operations.push({
               kind: "copy",
@@ -10966,7 +11244,7 @@ async function planInit(options) {
             relPath
           );
           const stubDocDest = path5.join(tgtStubDocAgents, relPath);
-          if (existsSync15(stubDocDest)) continue;
+          if (existsSync16(stubDocDest)) continue;
           operations.push({
             kind: "create",
             path: stubDocDest,
@@ -11000,7 +11278,7 @@ Do not edit this file.
           "docs",
           "agents"
         );
-        if (existsSync15(packagedReleaseAddonDocs)) {
+        if (existsSync16(packagedReleaseAddonDocs)) {
           const docFiles = await walkDir(packagedReleaseAddonDocs);
           for (const file of docFiles) {
             const relPath = path5.relative(packagedReleaseAddonDocs, file);
@@ -11024,19 +11302,19 @@ Do not edit this file.
         "prompts"
       );
       const legacyPrompts = path5.join(sourceRoot, ".pourkit", "prompts");
-      const srcPrompts = existsSync15(packagedManagedPrompts) ? packagedManagedPrompts : legacyPrompts;
+      const srcPrompts = existsSync16(packagedManagedPrompts) ? packagedManagedPrompts : legacyPrompts;
       const tgtManagedPrompts = path5.join(
         targetRoot,
         ".pourkit",
         "managed",
         "prompts"
       );
-      if (existsSync15(srcPrompts)) {
+      if (existsSync16(srcPrompts)) {
         const promptFiles = await walkDir(srcPrompts);
         for (const file of promptFiles) {
           const relPath = path5.relative(srcPrompts, file);
           const promptDest = path5.join(tgtManagedPrompts, relPath);
-          if (existsSync15(promptDest)) continue;
+          if (existsSync16(promptDest)) continue;
           const checksum = await computeFileChecksum(file);
           operations.push({
             kind: "copy",
@@ -11060,7 +11338,7 @@ Do not edit this file.
         ".sandcastle",
         "Dockerfile"
       );
-      if (existsSync15(tgtSandboxDockerfile)) {
+      if (existsSync16(tgtSandboxDockerfile)) {
         operations.push({
           kind: "skip",
           path: tgtSandboxDockerfile,
@@ -11069,7 +11347,7 @@ Do not edit this file.
           requiresConfirmation: false,
           destructive: false
         });
-      } else if (existsSync15(srcSandboxDockerfile)) {
+      } else if (existsSync16(srcSandboxDockerfile)) {
         const checksum = await computeFileChecksum(srcSandboxDockerfile);
         operations.push({
           kind: "copy",
@@ -11083,7 +11361,7 @@ Do not edit this file.
         });
       }
       const configJsonPath = path5.join(targetRoot, ".pourkit", "config.json");
-      if (!existsSync15(configJsonPath)) {
+      if (!existsSync16(configJsonPath)) {
         const verifyCommands = inferVerificationCommands(
           packageScripts,
           pm || "npm"
@@ -11127,9 +11405,9 @@ Do not edit this file.
         "schema",
         "pourkit.schema.json"
       );
-      if (existsSync15(srcSchemaJson)) {
+      if (existsSync16(srcSchemaJson)) {
         const checksum = await computeFileChecksum(srcSchemaJson);
-        if (!existsSync15(schemaJsonPath)) {
+        if (!existsSync16(schemaJsonPath)) {
           operations.push({
             kind: "copy",
             sourcePath: srcSchemaJson,
@@ -11162,9 +11440,9 @@ Do not edit this file.
         "schema",
         "pourkit.schema.hash"
       );
-      if (existsSync15(srcSchemaHash)) {
+      if (existsSync16(srcSchemaHash)) {
         const checksum = await computeFileChecksum(srcSchemaHash);
-        if (!existsSync15(schemaHashPath)) {
+        if (!existsSync16(schemaHashPath)) {
           operations.push({
             kind: "copy",
             sourcePath: srcSchemaHash,
@@ -11190,7 +11468,7 @@ Do not edit this file.
       const hasExistingAgents = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("AGENTS.md")
       );
-      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync15(path5.join(targetRoot, "AGENTS.md"))) {
+      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync16(path5.join(targetRoot, "AGENTS.md"))) {
         operations.push({
           kind: "create",
           path: path5.join(targetRoot, "AGENTS.md"),
@@ -11206,7 +11484,7 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
       const hasExistingClaude = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("CLAUDE.md")
       );
-      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync15(path5.join(targetRoot, "CLAUDE.md"))) {
+      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync16(path5.join(targetRoot, "CLAUDE.md"))) {
         operations.push({
           kind: "create",
           path: path5.join(targetRoot, "CLAUDE.md"),
@@ -11221,7 +11499,7 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
       }
       const gitignoreTarget = path5.join(targetRoot, ".gitignore");
       const gitignoreContent = generateGitignoreBlock();
-      if (!existsSync15(gitignoreTarget)) {
+      if (!existsSync16(gitignoreTarget)) {
         operations.push({
           kind: "create",
           path: gitignoreTarget,
@@ -11252,7 +11530,7 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
           "agents",
           path5.basename(agentFile)
         );
-        if (!existsSync15(targetPath)) {
+        if (!existsSync16(targetPath)) {
           operations.push({
             kind: "copy",
             sourcePath: agentFile,
@@ -11275,7 +11553,7 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
         }
       }
       const manifestPath = path5.join(targetRoot, ".pourkit", "manifest.json");
-      if (existsSync15(manifestPath)) {
+      if (existsSync16(manifestPath)) {
         operations.push({
           kind: "skip",
           path: manifestPath,
@@ -11665,7 +11943,7 @@ async function updateManagedBlock(filePath, content) {
   const blockContent = `${MANAGED_BLOCK_BEGIN}
 ${content}${MANAGED_BLOCK_END}
 `;
-  if (!existsSync15(filePath)) {
+  if (!existsSync16(filePath)) {
     const dir = path5.dirname(filePath);
     await mkdir4(dir, { recursive: true });
     await writeFileAtomic(filePath, blockContent);
@@ -11694,7 +11972,7 @@ async function writeManifest(plan, sourceMeta, agentFiles, packageManager) {
     if (op.requiresConfirmation) continue;
     const relPath = path5.relative(plan.targetRoot, op.path);
     if (relPath === ".pourkit/manifest.json") continue;
-    if (existsSync15(op.path)) {
+    if (existsSync16(op.path)) {
       const sha256 = await computeFileChecksum(op.path);
       assets[relPath] = {
         ownership: op.ownership || "managed",
@@ -11740,7 +12018,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync15(op.path) && !op.destructive) {
+          if (existsSync16(op.path) && !op.destructive) {
             skipped++;
             continue;
           }
@@ -11755,7 +12033,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync15(op.path)) {
+          if (existsSync16(op.path)) {
             skipped++;
             continue;
           }
@@ -11784,7 +12062,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync15(op.path)) {
+          if (existsSync16(op.path)) {
             skipped++;
             continue;
           }
@@ -11928,7 +12206,7 @@ async function applyInitFromSource(options) {
     if (!manifestSkipped) {
       const agentFiles = [];
       for (const name of ["AGENTS.md", "CLAUDE.md"]) {
-        if (existsSync15(path5.join(targetRoot, name))) {
+        if (existsSync16(path5.join(targetRoot, name))) {
           agentFiles.push(path5.join(targetRoot, name));
         }
       }
@@ -12104,18 +12382,18 @@ Init applied: ${result.applied} operations applied, ${result.skipped} skipped.`
 }
 
 // commands/memory-init.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync18, writeFileSync as writeFileSync5 } from "fs";
 import { join as join18 } from "path";
 async function runMemoryInitCommand(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = join18(cwd, ".pourkit", "config.json");
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     return {
       ok: false,
       message: "No .pourkit/config.json found. Run `pourkit init` first to initialize Pourkit, then run `pourkit memory init`."
     };
   }
-  const raw = JSON.parse(readFileSync17(configPath, "utf8"));
+  const raw = JSON.parse(readFileSync18(configPath, "utf8"));
   let alreadyEnabled = false;
   if (Object.prototype.hasOwnProperty.call(raw, "memory")) {
     const m = raw.memory;
@@ -12150,7 +12428,7 @@ async function runMemoryInitCommand(options) {
   let updatedAgentFile = false;
   for (const fileName of ["AGENTS.md", "CLAUDE.md"]) {
     const agentPath = join18(cwd, fileName);
-    if (existsSync16(agentPath)) {
+    if (existsSync17(agentPath)) {
       updateManagedBlockSync(agentPath, managed);
       updatedAgentFile = true;
     }
@@ -12168,11 +12446,11 @@ function updateManagedBlockSync(filePath, content) {
   const blockContent = `${MANAGED_BLOCK_BEGIN}
 ${content}${MANAGED_BLOCK_END}
 `;
-  if (!existsSync16(filePath)) {
+  if (!existsSync17(filePath)) {
     writeFileSync5(filePath, blockContent);
     return;
   }
-  const existing = readFileSync17(filePath, "utf8");
+  const existing = readFileSync18(filePath, "utf8");
   const beginIdx = existing.indexOf(MANAGED_BLOCK_BEGIN);
   const endIdx = existing.indexOf(MANAGED_BLOCK_END);
   if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
@@ -12301,7 +12579,7 @@ async function runSerenaStatusCommand(options) {
 }
 
 // commands/config-schema.ts
-import { readFileSync as readFileSync18, existsSync as existsSync17 } from "fs";
+import { readFileSync as readFileSync19, existsSync as existsSync18 } from "fs";
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile2, readdir as readdir2 } from "fs/promises";
 import { resolve as resolve3, dirname as dirname5, relative as relative2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -12314,7 +12592,7 @@ function resolvePackagedAssetPath2(fileName) {
     resolve3(__dirname3, "schema", fileName),
     resolve3(__dirname3, "../schema", fileName)
   ];
-  return candidates.find((candidate) => existsSync17(candidate)) ?? candidates[0];
+  return candidates.find((candidate) => existsSync18(candidate)) ?? candidates[0];
 }
 var PACKAGED_SCHEMA_PATH = resolvePackagedAssetPath2("pourkit.schema.json");
 var PACKAGED_HASH_PATH = resolvePackagedAssetPath2("pourkit.schema.hash");
@@ -12322,7 +12600,7 @@ var _schemaValidator = null;
 var _schemaErrors = null;
 function getSchemaValidator() {
   if (!_schemaValidator) {
-    const schema = JSON.parse(readFileSync18(PACKAGED_SCHEMA_PATH, "utf-8"));
+    const schema = JSON.parse(readFileSync19(PACKAGED_SCHEMA_PATH, "utf-8"));
     const ajv = new Ajv2({ strict: true });
     ajv.addKeyword("x-pourkit-schema-version");
     const validate = ajv.compile(schema);
@@ -12336,7 +12614,7 @@ function getSchemaValidator() {
   return _schemaValidator;
 }
 function readPackagedHash() {
-  return readFileSync18(PACKAGED_HASH_PATH, "utf-8");
+  return readFileSync19(PACKAGED_HASH_PATH, "utf-8");
 }
 function localSchemaDir(repoRoot2) {
   return resolve3(repoRoot2, ".pourkit/schema");
@@ -12457,7 +12735,7 @@ async function validateWorkflowPack(cwd) {
   const baselineSkills = getBaselineManagedSkillNames();
   for (const docName of catalog.docs) {
     const localPath = resolve3(cwd, `.pourkit/managed/docs/agents/${docName}`);
-    if (!existsSync17(localPath)) {
+    if (!existsSync18(localPath)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
@@ -12475,7 +12753,7 @@ async function validateWorkflowPack(cwd) {
               cwd,
               `.pourkit/overrides/docs/agents/${docName}`
             );
-            if (existsSync17(overridePath)) {
+            if (existsSync18(overridePath)) {
               warnings.push({
                 severity: "warning",
                 kind: "overridden",
@@ -12498,7 +12776,7 @@ async function validateWorkflowPack(cwd) {
   }
   for (const skillName of baselineSkills) {
     const skillDir = resolve3(cwd, `.pourkit/managed/skills/${skillName}`);
-    if (!existsSync17(skillDir)) {
+    if (!existsSync18(skillDir)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
@@ -12507,7 +12785,7 @@ async function validateWorkflowPack(cwd) {
       });
     } else {
       const skillSourcePath = resolve3(skillDir, "SKILL.md");
-      if (existsSync17(skillSourcePath)) {
+      if (existsSync18(skillSourcePath)) {
         const packagedSkillPath = resolvePackagedManagedPath(
           "skills",
           skillName,
@@ -12522,7 +12800,7 @@ async function validateWorkflowPack(cwd) {
                 cwd,
                 `.pourkit/overrides/skills/${skillName}/SKILL.md`
               );
-              if (existsSync17(overridePath)) {
+              if (existsSync18(overridePath)) {
                 warnings.push({
                   severity: "warning",
                   kind: "overridden",
@@ -12546,7 +12824,7 @@ async function validateWorkflowPack(cwd) {
   }
   for (const promptName of catalog.prompts) {
     const promptPath = resolve3(cwd, `.pourkit/managed/prompts/${promptName}`);
-    if (!existsSync17(promptPath)) {
+    if (!existsSync18(promptPath)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
@@ -12557,7 +12835,7 @@ async function validateWorkflowPack(cwd) {
   }
   for (const skillName of baselineSkills) {
     const projectionDir = resolve3(cwd, `.agents/skills/${skillName}`);
-    if (!existsSync17(projectionDir)) {
+    if (!existsSync18(projectionDir)) {
       warnings.push({
         severity: "warning",
         kind: "projection_stale",
@@ -12566,7 +12844,7 @@ async function validateWorkflowPack(cwd) {
       });
     } else {
       const projectionPath = resolve3(projectionDir, "SKILL.md");
-      if (existsSync17(projectionPath)) {
+      if (existsSync18(projectionPath)) {
         const managedSourcePath = resolvePackagedManagedPath(
           "skills",
           skillName,
@@ -12595,7 +12873,7 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const agentsPath = resolve3(cwd, "AGENTS.md");
-  if (existsSync17(agentsPath)) {
+  if (existsSync18(agentsPath)) {
     try {
       const agentsContent = await readFile5(agentsPath, "utf-8");
       if (agentsContent.includes(OLD_DOCS_PATH_PATTERN)) {
@@ -12618,7 +12896,7 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const overridesDir = resolve3(cwd, ".pourkit/overrides");
-  if (existsSync17(overridesDir)) {
+  if (existsSync18(overridesDir)) {
     const overrideFiles = await walkDir2(overridesDir);
     for (const file of overrideFiles) {
       const relPath = relative2(cwd, file);
@@ -12633,7 +12911,7 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const configPath = resolve3(cwd, ".pourkit/config.json");
-  if (existsSync17(configPath)) {
+  if (existsSync18(configPath)) {
     try {
       const configContent = await readFile5(configPath, "utf-8");
       const parsed = JSON.parse(configContent);
@@ -12644,7 +12922,7 @@ async function validateWorkflowPack(cwd) {
             cwd,
             `.pourkit/managed/addons/release/skills/${skillName}`
           );
-          if (!existsSync17(addonDir)) {
+          if (!existsSync18(addonDir)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -12658,7 +12936,7 @@ async function validateWorkflowPack(cwd) {
             cwd,
             `.pourkit/managed/addons/release/docs/agents/${docName}`
           );
-          if (!existsSync17(addonDocPath)) {
+          if (!existsSync18(addonDocPath)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -12703,7 +12981,7 @@ async function validateWorkflowPack(cwd) {
             cwd,
             `.pourkit/managed/addons/release/skills/${skillName}`
           );
-          if (existsSync17(addonDir)) {
+          if (existsSync18(addonDir)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -12717,7 +12995,7 @@ async function validateWorkflowPack(cwd) {
             cwd,
             `.pourkit/managed/addons/release/docs/agents/${docName}`
           );
-          if (existsSync17(addonDocPath)) {
+          if (existsSync18(addonDocPath)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -12731,7 +13009,7 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const manifestPath = resolve3(cwd, ".pourkit/manifest.json");
-  if (existsSync17(manifestPath)) {
+  if (existsSync18(manifestPath)) {
     try {
       const manifestContent = await readFile5(manifestPath, "utf-8");
       const manifest = JSON.parse(manifestContent);
@@ -12754,7 +13032,7 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const pathEscapeOverrideDir = resolve3(cwd, ".pourkit/overrides");
-  if (existsSync17(pathEscapeOverrideDir)) {
+  if (existsSync18(pathEscapeOverrideDir)) {
     const overrideFiles = await walkDir2(pathEscapeOverrideDir);
     for (const file of overrideFiles) {
       if (!isPathContained(cwd, file)) {
@@ -12768,7 +13046,7 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const managedDocsDir = resolve3(cwd, ".pourkit/managed/docs/agents");
-  if (existsSync17(managedDocsDir)) {
+  if (existsSync18(managedDocsDir)) {
     const docFiles = await walkDir2(managedDocsDir);
     for (const file of docFiles) {
       if (!file.endsWith(".md")) continue;
@@ -12789,12 +13067,12 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const managedSkillsDir = resolve3(cwd, ".pourkit/managed/skills");
-  if (existsSync17(managedSkillsDir)) {
+  if (existsSync18(managedSkillsDir)) {
     const skillDirs = await readdir2(managedSkillsDir, { withFileTypes: true });
     for (const entry of skillDirs) {
       if (!entry.isDirectory()) continue;
       const skillFile = resolve3(managedSkillsDir, entry.name, "SKILL.md");
-      if (!existsSync17(skillFile)) continue;
+      if (!existsSync18(skillFile)) continue;
       try {
         const content = await readFile5(skillFile, "utf-8");
         const relPath = relative2(cwd, skillFile);
@@ -12812,10 +13090,10 @@ async function validateWorkflowPack(cwd) {
     }
   }
   const managedPromptsDir = resolve3(cwd, ".pourkit/managed/prompts");
-  if (existsSync17(managedPromptsDir)) {
+  if (existsSync18(managedPromptsDir)) {
     for (const promptName of catalog.prompts) {
       const promptFile = resolve3(managedPromptsDir, promptName);
-      if (!existsSync17(promptFile)) continue;
+      if (!existsSync18(promptFile)) continue;
       try {
         const content = await readFile5(promptFile, "utf-8");
         const relPath = relative2(cwd, promptFile);
@@ -12837,7 +13115,7 @@ async function validateWorkflowPack(cwd) {
       cwd,
       `.pourkit/managed/addons/release/skills/${skillName}/SKILL.md`
     );
-    if (!existsSync17(addonSkillFile)) continue;
+    if (!existsSync18(addonSkillFile)) continue;
     try {
       const content = await readFile5(addonSkillFile, "utf-8");
       const relPath = relative2(cwd, addonSkillFile);
@@ -12858,7 +13136,7 @@ async function validateWorkflowPack(cwd) {
       cwd,
       `.pourkit/managed/addons/release/docs/agents/${docName}`
     );
-    if (!existsSync17(addonDocFile)) continue;
+    if (!existsSync18(addonDocFile)) continue;
     try {
       const content = await readFile5(addonDocFile, "utf-8");
       const relPath = relative2(cwd, addonDocFile);
@@ -12892,7 +13170,7 @@ async function validateMemoryHealth(cwd, memoryConfig) {
     detail: icmPath !== null ? icmPath : "icm not found on PATH"
   });
   const gitignorePath = resolve3(cwd, ".gitignore");
-  const gitignoreContent = existsSync17(gitignorePath) ? readFileSync18(gitignorePath, "utf-8") : "";
+  const gitignoreContent = existsSync18(gitignorePath) ? readFileSync19(gitignorePath, "utf-8") : "";
   const hasGitignoreEntry = gitignoreContent.includes(".pourkit/icm/");
   checks.push({
     name: "icm-gitignore",
@@ -12919,8 +13197,8 @@ async function runDoctorCommand(options) {
   const schemaDir = localSchemaDir(repoRootPath);
   const localSchemaPath = resolve3(schemaDir, "pourkit.schema.json");
   const localHashPath = resolve3(schemaDir, "pourkit.schema.hash");
-  const localSchemaExists = existsSync17(localSchemaPath);
-  const localHashExists = existsSync17(localHashPath);
+  const localSchemaExists = existsSync18(localSchemaPath);
+  const localHashExists = existsSync18(localHashPath);
   let packagedHash = null;
   try {
     packagedHash = readPackagedHash();
@@ -12939,9 +13217,9 @@ async function runDoctorCommand(options) {
   const configPath = resolve3(repoRootPath, ".pourkit/config.json");
   let configValidation;
   let rawMemoryConfig;
-  if (existsSync17(configPath)) {
+  if (existsSync18(configPath)) {
     try {
-      const raw = JSON.parse(readFileSync18(configPath, "utf-8"));
+      const raw = JSON.parse(readFileSync19(configPath, "utf-8"));
       rawMemoryConfig = raw.memory;
       const validate = getSchemaValidator();
       const valid2 = validate(raw);
@@ -12974,7 +13252,7 @@ async function runDoctorCommand(options) {
     "pourkit.config.mjs",
     "pourkit.config.js",
     "pourkit.json"
-  ].filter((p) => existsSync17(resolve3(repoRootPath, p)));
+  ].filter((p) => existsSync18(resolve3(repoRootPath, p)));
   const workflowPack = await validateWorkflowPack(repoRootPath);
   const memory = await validateMemoryHealth(repoRootPath, rawMemoryConfig);
   let recommendation = null;
@@ -13024,7 +13302,7 @@ async function runConfigSyncSchemaCommand(options) {
   const localHashPath = resolve3(schemaDir, "pourkit.schema.hash");
   let schemaWritten = false;
   let hashWritten = false;
-  if (existsSync17(localSchemaPath)) {
+  if (existsSync18(localSchemaPath)) {
     const existing = await readFile5(localSchemaPath, "utf-8");
     if (existing !== packagedSchema) {
       await writeFile2(localSchemaPath, packagedSchema, "utf-8");
@@ -13034,7 +13312,7 @@ async function runConfigSyncSchemaCommand(options) {
     await writeFile2(localSchemaPath, packagedSchema, "utf-8");
     schemaWritten = true;
   }
-  if (existsSync17(localHashPath)) {
+  if (existsSync18(localHashPath)) {
     const existing = await readFile5(localHashPath, "utf-8");
     if (existing !== packagedHash) {
       await writeFile2(localHashPath, packagedHash, "utf-8");
@@ -13052,7 +13330,7 @@ async function runConfigSyncSchemaCommand(options) {
 }
 
 // commands/workflow-pack-sync.ts
-import { existsSync as existsSync18, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync4 } from "fs";
 import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile3, readdir as readdir3 } from "fs/promises";
 import { resolve as resolve4, dirname as dirname6, relative as relative3, normalize as normalize2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -13175,7 +13453,7 @@ async function syncFile(cwd, targetRelativePath, sourceContent, errors) {
     return false;
   }
   await mkdir6(resolve4(targetPath, ".."), { recursive: true });
-  if (existsSync18(targetPath)) {
+  if (existsSync19(targetPath)) {
     const existing = await readFile6(targetPath, "utf-8");
     if (existing === sourceContent) {
       return false;
@@ -13202,7 +13480,7 @@ function walkDirSync(dir) {
 }
 async function detectOverrides(cwd) {
   const overridesDir = resolve4(cwd, OVERRIDES_DIR);
-  if (!existsSync18(overridesDir)) {
+  if (!existsSync19(overridesDir)) {
     return [];
   }
   const files = await walkDir3(overridesDir);
@@ -13212,13 +13490,13 @@ async function detectProjectOwnedFiles(cwd) {
   const found = [];
   for (const ownedPath of PROJECT_OWNED_PATHS) {
     const fullPath = resolve4(cwd, ownedPath);
-    if (existsSync18(fullPath)) {
+    if (existsSync19(fullPath)) {
       found.push(ownedPath);
     }
   }
   for (const ownedDir of PROJECT_OWNED_DIRECTORIES) {
     const fullDir = resolve4(cwd, ownedDir);
-    if (existsSync18(fullDir)) {
+    if (existsSync19(fullDir)) {
       const files = await walkDir3(fullDir);
       for (const file of files) {
         found.push(relative3(cwd, file));
@@ -13370,7 +13648,7 @@ async function runWorkflowPackSyncCommand(options) {
   const fullManagedBlock = `${MANAGED_BLOCK_BEGIN3}${managedBlockContent}${MANAGED_BLOCK_END2}`;
   async function syncManagedAgentFile(fileName, options2) {
     const filePath = resolve4(cwd, fileName);
-    if (!existsSync18(filePath)) {
+    if (!existsSync19(filePath)) {
       if (!options2.createIfMissing) return false;
       await writeFile3(filePath, fullManagedBlock + "\n", "utf-8");
       return true;
@@ -14152,7 +14430,7 @@ function formatChecks2(checks) {
 init_common();
 
 // execution/sandcastle-execution.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join21 } from "path";
 import { createWorktree, opencode } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
@@ -14180,18 +14458,18 @@ import path7 from "path";
 
 // execution/sandbox-image.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync19, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
 import path6 from "path";
 function sandboxImageName(repoRoot2, installIcm) {
   const dirName = path6.basename(repoRoot2.replace(/[\\/]+$/, "")) || "local";
   const sanitized = dirName.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
   const baseName = sanitized || "local";
   const dockerfilePath = path6.join(repoRoot2, ".sandcastle", "Dockerfile");
-  if (!existsSync19(dockerfilePath)) {
+  if (!existsSync20(dockerfilePath)) {
     const base2 = `sandcastle:${baseName}`;
     return installIcm ? `${base2}-icm` : base2;
   }
-  const fingerprint = createHash2("sha256").update(readFileSync19(dockerfilePath)).digest("hex").slice(0, 8);
+  const fingerprint = createHash2("sha256").update(readFileSync20(dockerfilePath)).digest("hex").slice(0, 8);
   const base = `sandcastle:${baseName}-${fingerprint}`;
   return installIcm ? `${base}-icm` : base;
 }
@@ -14376,7 +14654,7 @@ var SandcastleExecutionSession = class {
           );
         }
         const hostMemoryDir = join21(repoRoot2, ".pourkit", "icm");
-        if (!existsSync20(hostMemoryDir) || !statSync2(hostMemoryDir).isDirectory()) {
+        if (!existsSync21(hostMemoryDir) || !statSync2(hostMemoryDir).isDirectory()) {
           throw new MissingHostMemoryDirError(
             "Memory enabled but host .pourkit/icm/ directory is missing. Run `pourkit memory init` to create the repo-scoped memory store."
           );
@@ -14541,7 +14819,7 @@ function sanitizeBranch(branchName) {
 function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
   return paths.filter((relativePath) => {
     const source = join21(repoRoot2, relativePath);
-    if (!existsSync20(source)) {
+    if (!existsSync21(source)) {
       return true;
     }
     try {
@@ -14552,7 +14830,7 @@ function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
       return true;
     }
     const destination = join21(worktreePath, relativePath);
-    return !existsSync20(destination);
+    return !existsSync21(destination);
   });
 }
 function formatAgentStreamEvent(event) {
@@ -15342,11 +15620,11 @@ function createCliProgram(version) {
   return program;
 }
 async function resolveCliVersion() {
-  if (isPackageVersion("0.0.0-next-20260621045826")) {
-    return "0.0.0-next-20260621045826";
+  if (isPackageVersion("0.0.0-next-20260621233457")) {
+    return "0.0.0-next-20260621233457";
   }
-  if (isReleaseVersion("0.0.0-next-20260621045826")) {
-    return "0.0.0-next-20260621045826";
+  if (isReleaseVersion("0.0.0-next-20260621233457")) {
+    return "0.0.0-next-20260621233457";
   }
   try {
     const root = repoRoot();