@resolveio/server-lib 22.3.157 → 22.3.159

package/util/ai-runner-manager-policy.js

@@ -47,9 +47,14 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
     return to.concat(ar || Array.prototype.slice.call(from));
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.estimateResolveIOAIManagerRetryExpectedValue = estimateResolveIOAIManagerRetryExpectedValue;
+exports.decideResolveIOAIManagerAutonomyPolicy = decideResolveIOAIManagerAutonomyPolicy;
 exports.normalizeResolveIOAIManagerHotfixEvidence = normalizeResolveIOAIManagerHotfixEvidence;
+exports.evaluateResolveIOAIManagerHotfixGitProof = evaluateResolveIOAIManagerHotfixGitProof;
 exports.validateResolveIOAIManagerHotfixEvidence = validateResolveIOAIManagerHotfixEvidence;
+exports.buildResolveIOAIManagerHotfixEvidenceRecord = buildResolveIOAIManagerHotfixEvidenceRecord;
 exports.decideResolveIOAIManagerHotfixContinuation = decideResolveIOAIManagerHotfixContinuation;
+exports.decideResolveIOAIManagerHotfixCommitGuard = decideResolveIOAIManagerHotfixCommitGuard;
 exports.buildResolveIOAIManagerHotfixFirstReleasePolicy = buildResolveIOAIManagerHotfixFirstReleasePolicy;
 exports.isResolveIOAIManagerSafeAutoDispatch = isResolveIOAIManagerSafeAutoDispatch;
 exports.normalizeResolveIOAIManagerFailureClass = normalizeResolveIOAIManagerFailureClass;
@@ -114,6 +119,291 @@ var HOTFIX_CHANNELS = new Set([
 function cleanObject(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
+function normalizeAutonomyMode(value) {
+    var normalized = cleanText(value, 120).toLowerCase().replace(/[\s-]+/g, '_');
+    if (/^(monitor|monitor_only|watch|watch_only)$/.test(normalized)) {
+        return 'monitor_only';
+    }
+    if (/^(auto|auto_retry|auto_retry_within_budget|autonomous|within_budget)$/.test(normalized)) {
+        return 'auto_retry_within_budget';
+    }
+    return 'manual_only';
+}
+function normalizeManagerEvidenceStrength(value) {
+    var normalized = cleanText(value, 40).toLowerCase().replace(/[\s-]+/g, '_');
+    if (normalized === 'proof') {
+        return 'proof';
+    }
+    if (normalized === 'material' || normalized === 'strong') {
+        return 'material';
+    }
+    if (normalized === 'weak') {
+        return 'weak';
+    }
+    return 'none';
+}
+function nonNegativeMoney(value) {
+    var parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 0;
+}
+function finiteNumber(value) {
+    var parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function clampNumber(value, min, max) {
+    return Math.min(max, Math.max(min, value));
+}
+function isCheapEvidenceAutonomyAction(value) {
+    var action = cleanText(value, 120);
+    return !action || /^(run_evidence_probe|run_read_only_diagnosis|advance|continue_gate|park_manual)$/.test(action);
+}
+function estimateResolveIOAIManagerRetryExpectedValue(input) {
+    var e_2, _a;
+    if (input === void 0) { input = {}; }
+    var dispatchAction = cleanText(input.dispatchAction, 120);
+    var failureClass = normalizeResolveIOAIManagerFailureClass(input.failureClass);
+    var recoveryClass = cleanText(input.recoveryClass, 120);
+    var evidenceStrength = normalizeManagerEvidenceStrength(input.evidenceStrength);
+    var evidenceSignals = cleanList(input.evidenceSignals, 12, 120);
+    var projectedActionCostUsd = nonNegativeMoney(input.projectedActionCostUsd);
+    var budgetHardUsd = nonNegativeMoney(input.budgetHardUsd);
+    var materialEvidence = input.materialEvidence === true || evidenceStrength === 'material' || evidenceStrength === 'proof';
+    var newEvidence = input.newEvidence === true;
+    var signals = [];
+    var score = 0.1;
+    if (dispatchAction === 'run_evidence_probe') {
+        score = 0.75;
+        signals.push('cheap_evidence_probe');
+    }
+    else if (dispatchAction === 'run_read_only_diagnosis') {
+        score = 0.65;
+        signals.push('read_only_diagnosis');
+    }
+    else if (dispatchAction === 'advance' || dispatchAction === 'continue_gate') {
+        score = 0.55;
+        signals.push('gate_continuation');
+    }
+    else if (dispatchAction === 'run_infra_repair') {
+        score = 0.4;
+        signals.push('bounded_infra_repair');
+    }
+    else if (dispatchAction === 'run_compile_repair') {
+        score = 0.4;
+        signals.push('bounded_compile_repair');
+    }
+    else if (dispatchAction === 'run_release_repair') {
+        score = 0.3;
+        signals.push('bounded_release_repair');
+    }
+    else if (dispatchAction === 'run_journey_contract_repair' || dispatchAction === 'run_business_assertion_repair') {
+        score = 0.25;
+        signals.push('bounded_workflow_or_proof_repair');
+    }
+    else if (dispatchAction === 'run_targeted_product_repair') {
+        score = 0.15;
+        signals.push('targeted_product_repair');
+    }
+    if (evidenceStrength === 'proof') {
+        score += 0.3;
+        signals.push('proof_evidence');
+    }
+    else if (materialEvidence) {
+        score += 0.2;
+        signals.push('material_evidence');
+    }
+    else if (newEvidence) {
+        score += 0.1;
+        signals.push('new_evidence');
+    }
+    else if (evidenceStrength === 'weak') {
+        score -= 0.15;
+        signals.push('weak_evidence');
+    }
+    else if (!isCheapEvidenceAutonomyAction(dispatchAction)) {
+        score -= 0.25;
+        signals.push('no_material_evidence');
+    }
+    if ((failureClass === 'infra' || /infra/i.test(recoveryClass)) && dispatchAction === 'run_infra_repair') {
+        score += 0.15;
+        signals.push('failure_matches_infra_repair');
+    }
+    if ((failureClass === 'compile' || /compile/i.test(recoveryClass)) && dispatchAction === 'run_compile_repair') {
+        score += 0.15;
+        signals.push('failure_matches_compile_repair');
+    }
+    if (/release|publish|deploy/i.test("".concat(failureClass, " ").concat(recoveryClass)) && dispatchAction === 'run_release_repair') {
+        score += 0.1;
+        signals.push('failure_matches_release_repair');
+    }
+    if (projectedActionCostUsd >= 5) {
+        score -= 0.3;
+        signals.push('high_projected_cost');
+    }
+    else if (projectedActionCostUsd >= 2) {
+        score -= 0.18;
+        signals.push('medium_projected_cost');
+    }
+    else if (projectedActionCostUsd >= 1) {
+        score -= 0.08;
+        signals.push('low_projected_cost');
+    }
+    if (budgetHardUsd > 0 && projectedActionCostUsd > budgetHardUsd * 0.5) {
+        score -= 0.2;
+        signals.push('large_fraction_of_remaining_budget');
+    }
+    if (input.sameEvidenceAlreadyAttempted === true) {
+        score -= 0.35;
+        signals.push('same_evidence_already_attempted');
+    }
+    try {
+        for (var evidenceSignals_1 = __values(evidenceSignals), evidenceSignals_1_1 = evidenceSignals_1.next(); !evidenceSignals_1_1.done; evidenceSignals_1_1 = evidenceSignals_1.next()) {
+            var signal = evidenceSignals_1_1.value;
+            if (/passing_outcome|business|proof|diagnosis|compile|infra|release|artifact|fingerprint_changed|evidence_hash_changed/i.test(signal)) {
+                score += 0.03;
+                signals.push("evidence_signal:".concat(signal));
+            }
+        }
+    }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    finally {
+        try {
+            if (evidenceSignals_1_1 && !evidenceSignals_1_1.done && (_a = evidenceSignals_1.return)) _a.call(evidenceSignals_1);
+        }
+        finally { if (e_2) throw e_2.error; }
+    }
+    var rounded = Number(clampNumber(score, -1, 1).toFixed(2));
+    var minScore = 0;
+    return {
+        score: rounded,
+        minScore: minScore,
+        positive: rounded >= minScore,
+        source: 'estimated',
+        confidence: evidenceStrength === 'proof' || materialEvidence ? 'medium' : 'low',
+        reason: rounded >= minScore
+            ? 'estimated_retry_value_is_non_negative'
+            : 'estimated_retry_value_is_negative',
+        signals: Array.from(new Set(signals)).slice(0, 16)
+    };
+}
+function decideResolveIOAIManagerAutonomyPolicy(input) {
+    var _a;
+    if (input === void 0) { input = {}; }
+    var mode = normalizeAutonomyMode(input.mode);
+    var currentSpendUsd = nonNegativeMoney(input.currentSpendUsd);
+    var projectedActionCostUsd = nonNegativeMoney(input.projectedActionCostUsd);
+    var projectedSpendUsd = currentSpendUsd + projectedActionCostUsd;
+    var budgetSoftUsd = nonNegativeMoney(input.budgetSoftUsd);
+    var budgetHardUsd = nonNegativeMoney(input.budgetHardUsd);
+    var softBudgetExceeded = budgetSoftUsd > 0 && projectedSpendUsd >= budgetSoftUsd;
+    var hardBudgetExceeded = budgetHardUsd > 0 && projectedSpendUsd > budgetHardUsd;
+    var dispatchAction = cleanText(input.dispatchAction, 120);
+    var evidenceStrength = normalizeManagerEvidenceStrength(input.evidenceStrength);
+    var evidenceSignals = cleanList(input.evidenceSignals, 12, 120);
+    var materialEvidence = input.materialEvidence === true || evidenceStrength === 'material' || evidenceStrength === 'proof';
+    var newEvidence = input.newEvidence === true;
+    var evidenceBacked = materialEvidence || newEvidence || evidenceSignals.some(function (signal) { return /material|proof|business|compile|infra|release|diagnosis|journey|workflow|artifact|hash_changed|fingerprint_changed/i.test(signal); });
+    var cheapEvidenceAction = isCheapEvidenceAutonomyAction(dispatchAction);
+    var expectedValueEstimate = estimateResolveIOAIManagerRetryExpectedValue({
+        dispatchAction: dispatchAction,
+        projectedActionCostUsd: projectedActionCostUsd,
+        currentSpendUsd: currentSpendUsd,
+        budgetHardUsd: budgetHardUsd,
+        evidenceStrength: evidenceStrength,
+        materialEvidence: materialEvidence,
+        newEvidence: newEvidence,
+        evidenceSignals: evidenceSignals,
+        sameEvidenceAlreadyAttempted: input.sameEvidenceAlreadyAttempted === true
+    });
+    var providedExpectedValue = finiteNumber(input.expectedValueScore);
+    var expectedValueKnown = providedExpectedValue !== undefined;
+    var expectedValueScore = expectedValueKnown ? providedExpectedValue : expectedValueEstimate.score;
+    var minExpectedValue = (_a = finiteNumber(input.minExpectedValueScore)) !== null && _a !== void 0 ? _a : expectedValueEstimate.minScore;
+    var expectedValuePositive = expectedValueScore >= minExpectedValue;
+    var expectedValueSource = expectedValueKnown ? 'provided' : 'estimated';
+    var requiredEvidence = __spreadArray(__spreadArray(__spreadArray(__spreadArray([
+        'mode',
+        'projectedActionCostUsd'
+    ], __read((budgetHardUsd > 0 ? ['budgetHardUsd'] : [])), false), __read((budgetSoftUsd > 0 ? ['budgetSoftUsd'] : [])), false), __read((dispatchAction ? ['dispatchAction'] : [])), false), __read((cheapEvidenceAction ? [] : ['materialEvidence or newEvidence', 'expectedValueScore when available'])), false);
+    var forbiddenActions = [];
+    var canAutoDispatch = false;
+    var canManualDispatch = true;
+    var blocked = false;
+    var requiresHumanApproval = true;
+    var reason = '';
+    var recommendedControl = mode;
+    if (mode === 'monitor_only') {
+        canManualDispatch = false;
+        reason = 'monitor_only_blocks_runner_dispatch';
+        forbiddenActions.push('Do not run recovery, repair, QA, publish, deploy, or customer reply actions while in Monitor Only mode.');
+    }
+    else if (mode === 'manual_only') {
+        reason = 'manual_only_requires_operator_dispatch';
+        forbiddenActions.push('Do not auto-dispatch manager recovery actions in Manual Only mode.');
+    }
+    else if (hardBudgetExceeded) {
+        blocked = true;
+        canAutoDispatch = false;
+        canManualDispatch = input.operatorApproved === true;
+        reason = 'auto_retry_budget_hard_cap_would_be_exceeded';
+        recommendedControl = 'increase_budget_or_manual';
+        forbiddenActions.push('Do not auto-dispatch because projected spend exceeds the hard budget.');
+    }
+    else if (!cheapEvidenceAction && !evidenceBacked) {
+        canAutoDispatch = false;
+        requiresHumanApproval = true;
+        reason = 'auto_retry_requires_material_evidence';
+        forbiddenActions.push('Do not auto-dispatch repair work until a deterministic artifact, changed blocker fingerprint, or material proof is recorded.');
+    }
+    else if (!cheapEvidenceAction && !expectedValuePositive) {
+        canAutoDispatch = false;
+        requiresHumanApproval = true;
+        reason = 'auto_retry_expected_value_not_positive';
+        forbiddenActions.push('Do not auto-dispatch repair work when the expected value score is below the configured minimum.');
+    }
+    else {
+        canAutoDispatch = true;
+        requiresHumanApproval = softBudgetExceeded;
+        reason = softBudgetExceeded
+            ? 'auto_retry_soft_budget_warning_requires_review'
+            : 'auto_retry_within_budget_allows_auto_dispatch';
+        if (softBudgetExceeded) {
+            forbiddenActions.push('Do not escalate to a more expensive model or broader repair without operator review after soft budget warning.');
+        }
+    }
+    return {
+        mode: mode,
+        canAutoDispatch: canAutoDispatch,
+        canManualDispatch: canManualDispatch,
+        blocked: blocked,
+        requiresHumanApproval: requiresHumanApproval,
+        reason: reason,
+        currentSpendUsd: currentSpendUsd,
+        projectedActionCostUsd: projectedActionCostUsd,
+        projectedSpendUsd: projectedSpendUsd,
+        budgetSoftUsd: budgetSoftUsd,
+        budgetHardUsd: budgetHardUsd,
+        softBudgetExceeded: softBudgetExceeded,
+        hardBudgetExceeded: hardBudgetExceeded,
+        dispatchAction: dispatchAction,
+        expectedValueScore: expectedValueScore,
+        minExpectedValueScore: minExpectedValue,
+        expectedValueKnown: expectedValueKnown,
+        expectedValueSource: expectedValueSource,
+        expectedValuePositive: expectedValuePositive,
+        evidenceStrength: evidenceStrength,
+        materialEvidence: materialEvidence,
+        newEvidence: newEvidence,
+        evidenceBacked: evidenceBacked,
+        evidenceSignals: evidenceSignals,
+        recommendedControl: recommendedControl,
+        forbiddenActions: forbiddenActions,
+        requiredEvidence: requiredEvidence
+    };
+}
+function cleanDateString(value) {
+    var date = value instanceof Date ? value : new Date(value || Date.now());
+    return Number.isNaN(date.getTime()) ? new Date().toISOString() : date.toISOString();
+}
 function normalizeHotfixChannel(value) {
     var normalized = cleanText(value, 120).toLowerCase().replace(/[\s-]+/g, '_');
     return HOTFIX_CHANNELS.has(normalized) ? normalized : '';
@@ -182,6 +472,11 @@ function normalizeResolveIOAIManagerHotfixEvidence(value, policy) {
         serviceRestartEvidence: cleanText(source.serviceRestartEvidence || source.service_restart_evidence, 1000),
         releaseArtifactFingerprint: cleanText(source.releaseArtifactFingerprint || source.release_artifact_fingerprint || source.artifactFingerprint || source.artifact_fingerprint, 240),
         lastReleaseArtifactFingerprint: cleanText(source.lastReleaseArtifactFingerprint || source.last_release_artifact_fingerprint || source.lastArtifactFingerprint || source.last_artifact_fingerprint, 240),
+        sourceCommitSha: cleanText(source.sourceCommitSha || source.source_commit_sha || source.gitCommitSha || source.git_commit_sha || source.commitSha || source.commit_sha, 120),
+        githubCommitUrl: cleanText(source.githubCommitUrl || source.github_commit_url || source.gitCommitUrl || source.git_commit_url || source.commitUrl || source.commit_url, 500),
+        gitCommitStatus: cleanText(source.gitCommitStatus || source.git_commit_status || source.githubCommitStatus || source.github_commit_status, 160),
+        gitPushStatus: cleanText(source.gitPushStatus || source.git_push_status || source.githubPushStatus || source.github_push_status || source.githubCommitReachableStatus || source.github_commit_reachable_status, 160),
+        committedAt: source.committedAt || source.committed_at,
         forceDeployReason: cleanText(source.forceDeployReason || source.force_deploy_reason, 1000),
         hotfixCannotResolveReason: cleanText(source.hotfixCannotResolveReason || source.hotfix_cannot_resolve_reason, 1000),
         fullDeployRequested: source.fullDeployRequested === true || source.full_deploy_requested === true,
@@ -197,6 +492,100 @@ function pushMissing(blockers, condition, message) {
         blockers.push(message);
     }
 }
+function hotfixRequiresGithubCommit(channel) {
+    return /^(backend_js|static_ui|config|seed_data|release_artifact|new_artifact_deploy|artifact_build)$/.test(channel);
+}
+function extractGithubCommitSha(value) {
+    var _a;
+    var match = cleanText(value, 500).match(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/commit\/([a-f0-9]{40})(?:$|[?#/])/i);
+    return ((_a = match === null || match === void 0 ? void 0 : match[1]) === null || _a === void 0 ? void 0 : _a.toLowerCase()) || '';
+}
+function isFullGitCommitSha(value) {
+    return /^[a-f0-9]{40}$/i.test(cleanText(value, 120));
+}
+function isStrongRemoteChecksum(value) {
+    return /^[a-f0-9]{12,128}$/i.test(cleanText(value, 160));
+}
+function githubCommitProofBlockers(value, channel) {
+    var blockers = [];
+    var sourceCommitSha = cleanText(value.sourceCommitSha, 120);
+    var githubCommitUrl = cleanText(value.githubCommitUrl, 500);
+    var gitCommitStatus = cleanText(value.gitCommitStatus, 160);
+    var remoteCommitProofStatus = cleanText(value.gitPushStatus || value.gitCommitStatus, 160);
+    var urlCommitSha = extractGithubCommitSha(githubCommitUrl);
+    if (!sourceCommitSha || !githubCommitUrl) {
+        blockers.push("".concat(channel, " hotfix requires sourceCommitSha, githubCommitUrl, and passed gitPushStatus so live hotfixes are backed by a GitHub commit pushed before continuation."));
+        return blockers;
+    }
+    if (!isFullGitCommitSha(sourceCommitSha)) {
+        blockers.push("".concat(channel, " hotfix sourceCommitSha must be a full 40-character git SHA."));
+    }
+    if (!urlCommitSha) {
+        blockers.push("".concat(channel, " hotfix githubCommitUrl must be a GitHub commit URL ending in a full 40-character git SHA."));
+    }
+    else if (isFullGitCommitSha(sourceCommitSha) && urlCommitSha !== sourceCommitSha.toLowerCase()) {
+        blockers.push("".concat(channel, " hotfix githubCommitUrl commit SHA must match sourceCommitSha."));
+    }
+    if (!remoteCommitProofStatus) {
+        blockers.push("".concat(channel, " hotfix requires passed gitPushStatus or gitCommitStatus so the manager knows the hotfix commit is present on GitHub before continuation."));
+    }
+    else if (!hotfixStatusPassed(remoteCommitProofStatus)) {
+        blockers.push("".concat(channel, " hotfix gitPushStatus or gitCommitStatus must be passed before continuation."));
+    }
+    if (gitCommitStatus && gitCommitStatus !== remoteCommitProofStatus && !hotfixStatusPassed(gitCommitStatus)) {
+        blockers.push("".concat(channel, " hotfix gitCommitStatus must be passed when provided."));
+    }
+    return blockers;
+}
+function evaluateResolveIOAIManagerHotfixGitProof(value, channelHint) {
+    if (channelHint === void 0) { channelHint = ''; }
+    var normalized = normalizeResolveIOAIManagerHotfixEvidence(value);
+    var source = (normalized || cleanObject(value));
+    var channel = (channelHint || (normalized === null || normalized === void 0 ? void 0 : normalized.channel) || source.channel || '');
+    var required = hotfixRequiresGithubCommit(channel);
+    var sourceCommitSha = cleanText(source.sourceCommitSha || source.source_commit_sha || source.gitCommitSha || source.git_commit_sha || source.commitSha || source.commit_sha, 120);
+    var githubCommitUrl = cleanText(source.githubCommitUrl || source.github_commit_url || source.gitCommitUrl || source.git_commit_url || source.commitUrl || source.commit_url, 500);
+    var githubCommitSha = extractGithubCommitSha(githubCommitUrl);
+    var gitCommitStatus = cleanText(source.gitCommitStatus || source.git_commit_status || source.githubCommitStatus || source.github_commit_status, 160);
+    var gitPushStatus = cleanText(source.gitPushStatus || source.git_push_status || source.githubPushStatus || source.github_push_status || source.githubCommitReachableStatus || source.github_commit_reachable_status || gitCommitStatus, 160);
+    var blockers = required
+        ? githubCommitProofBlockers({
+            channel: channel,
+            target: (normalized === null || normalized === void 0 ? void 0 : normalized.target) || {},
+            sourceCommitSha: sourceCommitSha,
+            githubCommitUrl: githubCommitUrl,
+            gitCommitStatus: gitCommitStatus,
+            gitPushStatus: gitPushStatus
+        }, channel)
+        : [];
+    var status = !required
+        ? 'not_required'
+        : (!sourceCommitSha || !githubCommitUrl || !gitPushStatus)
+            ? 'missing'
+            : blockers.length
+                ? 'invalid'
+                : 'passed';
+    var passed = !required || status === 'passed';
+    return {
+        required: required,
+        status: status,
+        passed: passed,
+        managerMustCommitBeforeHotfix: required && !passed,
+        channel: channel,
+        sourceCommitSha: sourceCommitSha,
+        githubCommitUrl: githubCommitUrl,
+        githubCommitSha: githubCommitSha,
+        gitCommitStatus: gitCommitStatus,
+        gitPushStatus: gitPushStatus,
+        blockers: blockers,
+        nextCommands: required && !passed
+            ? ['commit_and_push_hotfix_to_github', 'verify_github_commit_url_and_push_status', 'record_hotfix_evidence']
+            : [],
+        requiredEvidence: required
+            ? ['full 40-character sourceCommitSha', 'matching GitHub commit URL', 'passed gitPushStatus or gitCommitStatus']
+            : []
+    };
+}
 function validateResolveIOAIManagerHotfixEvidence(value, options) {
     var _a, _b, _c, _d;
     if (options === void 0) { options = {}; }
@@ -214,6 +603,7 @@ function validateResolveIOAIManagerHotfixEvidence(value, options) {
             hotfixSatisfied: false,
             requiredEvidence: ((_b = (_a = policy === null || policy === void 0 ? void 0 : policy.hotfixPlan) === null || _a === void 0 ? void 0 : _a.steps) === null || _b === void 0 ? void 0 : _b.flatMap(function (step) { return step.requiredEvidence; })) || [],
             successEvidence: ((_d = (_c = policy === null || policy === void 0 ? void 0 : policy.hotfixPlan) === null || _c === void 0 ? void 0 : _c.steps) === null || _d === void 0 ? void 0 : _d.flatMap(function (step) { return step.successEvidence; })) || [],
+            githubCommitGuard: evaluateResolveIOAIManagerHotfixGitProof(value),
             policy: policy,
             nextAction: 'record_hotfix_evidence'
         };
@@ -227,17 +617,24 @@ function validateResolveIOAIManagerHotfixEvidence(value, options) {
     var successEvidence = (step === null || step === void 0 ? void 0 : step.successEvidence) || [];
     var policyAllowsFullDeploy = (policy === null || policy === void 0 ? void 0 : policy.fullDeployAllowed) === true;
     var policyBlocksDuplicate = (policy === null || policy === void 0 ? void 0 : policy.duplicateDeployBlocked) === true || (policy === null || policy === void 0 ? void 0 : policy.duplicatePublishBlocked) === true;
+    var githubCommitGuard = evaluateResolveIOAIManagerHotfixGitProof(normalized, channel);
     if (normalized.fullDeployRequested && !policyAllowsFullDeploy && channel !== 'force_deploy_review' && channel !== 'new_artifact_deploy') {
         blockers.push('Full deploy requested but hotfix-first policy does not allow a full deploy for this release state.');
     }
     if (normalized.fullDeployRequested && policyBlocksDuplicate && !normalized.forceDeployReason && channel !== 'force_deploy_review') {
         blockers.push('Duplicate deploy/publish fingerprint requires force deploy/publish evidence before any full deploy.');
     }
+    if (githubCommitGuard.required) {
+        blockers.push.apply(blockers, __spreadArray([], __read(githubCommitGuard.blockers), false));
+    }
     if (channel === 'backend_js') {
         pushMissing(blockers, !!normalized.compiledArtifactPath, 'Backend JS hotfix requires compiledArtifactPath.');
         pushMissing(blockers, !!target.host, 'Backend JS hotfix requires target.host.');
         pushMissing(blockers, !!target.path, 'Backend JS hotfix requires target.path.');
         pushMissing(blockers, !!(normalized.remoteChecksumAfter || normalized.remoteChecksum), 'Backend JS hotfix requires remote checksum after replacement.');
+        if ((normalized.remoteChecksumAfter || normalized.remoteChecksum) && !isStrongRemoteChecksum(normalized.remoteChecksumAfter || normalized.remoteChecksum || '')) {
+            blockers.push('Backend JS hotfix remote checksum after replacement must be a strong hex checksum, not a label or placeholder.');
+        }
         pushMissing(blockers, !!(normalized.restartEvidence || normalized.serviceRestartEvidence), 'Backend JS hotfix requires restart evidence.');
         pushMissing(blockers, hotfixStatusPassed(normalized.healthCheckStatus), 'Backend JS hotfix requires passed healthCheckStatus.');
         pushMissing(blockers, hotfixStatusPassed(normalized.selfTestStatus), 'Backend JS hotfix requires passed selfTestStatus.');
@@ -329,21 +726,228 @@ function validateResolveIOAIManagerHotfixEvidence(value, options) {
         requiredEvidence: requiredEvidence,
         successEvidence: successEvidence,
         normalized: normalized,
+        githubCommitGuard: githubCommitGuard,
         policy: policy,
         nextAction: nextAction
     };
 }
-function decideResolveIOAIManagerHotfixContinuation(input) {
+function mergeHotfixEvidenceRecordInput(input) {
+    var e_3, _a;
+    var merged = __assign({}, cleanObject(input.evidence));
+    var directFields = [
+        'channel',
+        'status',
+        'target',
+        'compiledArtifactPath',
+        'builtDistPath',
+        'remoteChecksumBefore',
+        'remoteChecksumAfter',
+        'remoteChecksum',
+        'restartEvidence',
+        'healthCheckStatus',
+        'selfTestStatus',
+        'releaseGateStatus',
+        's3UploadResult',
+        'cloudfrontInvalidationId',
+        'publicProof',
+        'configChangeEvidence',
+        'seedDataEvidence',
+        'cacheInvalidationEvidence',
+        'serviceRestartEvidence',
+        'releaseArtifactFingerprint',
+        'lastReleaseArtifactFingerprint',
+        'sourceCommitSha',
+        'githubCommitUrl',
+        'gitCommitStatus',
+        'gitPushStatus',
+        'committedAt',
+        'forceDeployReason',
+        'hotfixCannotResolveReason',
+        'fullDeployRequested',
+        'recordedAt'
+    ];
+    try {
+        for (var directFields_1 = __values(directFields), directFields_1_1 = directFields_1.next(); !directFields_1_1.done; directFields_1_1 = directFields_1.next()) {
+            var field = directFields_1_1.value;
+            var value = input[field];
+            if (value !== undefined && value !== null && value !== '') {
+                merged[field] = value;
+            }
+        }
+    }
+    catch (e_3_1) { e_3 = { error: e_3_1 }; }
+    finally {
+        try {
+            if (directFields_1_1 && !directFields_1_1.done && (_a = directFields_1.return)) _a.call(directFields_1);
+        }
+        finally { if (e_3) throw e_3.error; }
+    }
+    return merged;
+}
+function resolveHotfixEvidenceRequiredFields(channel) {
+    var fields = ['channel'];
+    if (hotfixRequiresGithubCommit(channel)) {
+        fields.push('sourceCommitSha', 'githubCommitUrl', 'gitPushStatus');
+    }
+    if (channel === 'backend_js') {
+        fields.push('compiledArtifactPath', 'target.host', 'target.path', 'remoteChecksumAfter', 'restartEvidence', 'healthCheckStatus', 'selfTestStatus');
+    }
+    else if (channel === 'static_ui') {
+        fields.push('builtDistPath', 'target.bucket', 'target.distributionId', 's3UploadResult', 'cloudfrontInvalidationId', 'publicProof');
+    }
+    else if (channel === 'config') {
+        fields.push('target.configKey', 'configChangeEvidence', 'releaseGateStatus');
+    }
+    else if (channel === 'seed_data') {
+        fields.push('target.seedKey', 'seedDataEvidence', 'releaseGateStatus');
+    }
+    else if (channel === 'cache_invalidation') {
+        fields.push('target.cacheKey', 'cacheInvalidationEvidence', 'releaseGateStatus_or_healthCheckStatus');
+    }
+    else if (channel === 'service_restart') {
+        fields.push('target.processName', 'serviceRestartEvidence', 'healthCheckStatus', 'selfTestStatus');
+    }
+    else if (channel === 'release_artifact') {
+        fields.push('releaseArtifactFingerprint', 'releaseGateStatus');
+    }
+    else if (channel === 'new_artifact_deploy') {
+        fields.push('releaseArtifactFingerprint', 'lastReleaseArtifactFingerprint', 'releaseGateStatus');
+    }
+    else if (channel === 'artifact_build') {
+        fields.push('releaseArtifactFingerprint');
+    }
+    else if (channel === 'force_deploy_review') {
+        fields.push('forceDeployReason', 'hotfixCannotResolveReason');
+    }
+    return Array.from(new Set(fields));
+}
+function hotfixEvidenceFieldPresent(evidence, field) {
+    if (!evidence) {
+        return false;
+    }
+    var target = evidence.target || {};
+    switch (field) {
+        case 'channel':
+            return !!evidence.channel;
+        case 'sourceCommitSha':
+            return isFullGitCommitSha(evidence.sourceCommitSha || '');
+        case 'githubCommitUrl':
+            return !!extractGithubCommitSha(evidence.githubCommitUrl || '');
+        case 'gitPushStatus':
+            return hotfixStatusPassed(evidence.gitPushStatus) || hotfixStatusPassed(evidence.gitCommitStatus);
+        case 'compiledArtifactPath':
+            return !!cleanText(evidence.compiledArtifactPath, 500);
+        case 'builtDistPath':
+            return !!cleanText(evidence.builtDistPath, 500);
+        case 'remoteChecksumAfter':
+            return !!cleanText(evidence.remoteChecksumAfter || evidence.remoteChecksum, 160);
+        case 'restartEvidence':
+            return !!cleanText(evidence.restartEvidence || evidence.serviceRestartEvidence, 1000);
+        case 'serviceRestartEvidence':
+            return !!cleanText(evidence.serviceRestartEvidence || evidence.restartEvidence, 1000);
+        case 'healthCheckStatus':
+            return hotfixStatusPassed(evidence.healthCheckStatus);
+        case 'selfTestStatus':
+            return hotfixStatusPassed(evidence.selfTestStatus);
+        case 'releaseGateStatus':
+            return hotfixStatusPassed(evidence.releaseGateStatus);
+        case 'releaseGateStatus_or_healthCheckStatus':
+            return hotfixStatusPassed(evidence.releaseGateStatus) || hotfixStatusPassed(evidence.healthCheckStatus);
+        case 's3UploadResult':
+            return !!cleanText(evidence.s3UploadResult, 1000);
+        case 'cloudfrontInvalidationId':
+            return !!cleanText(evidence.cloudfrontInvalidationId, 240);
+        case 'publicProof':
+            return !!cleanText(evidence.publicProof, 1000);
+        case 'configChangeEvidence':
+            return !!cleanText(evidence.configChangeEvidence, 1000);
+        case 'seedDataEvidence':
+            return !!cleanText(evidence.seedDataEvidence, 1000);
+        case 'cacheInvalidationEvidence':
+            return !!cleanText(evidence.cacheInvalidationEvidence, 1000);
+        case 'releaseArtifactFingerprint':
+            return !!cleanText(evidence.releaseArtifactFingerprint, 240);
+        case 'lastReleaseArtifactFingerprint':
+            return !!cleanText(evidence.lastReleaseArtifactFingerprint, 240);
+        case 'forceDeployReason':
+            return !!cleanText(evidence.forceDeployReason, 1000);
+        case 'hotfixCannotResolveReason':
+            return !!cleanText(evidence.hotfixCannotResolveReason, 1000);
+        case 'target.host':
+            return !!cleanText(target.host, 200);
+        case 'target.path':
+            return !!cleanText(target.path, 500);
+        case 'target.bucket':
+            return !!cleanText(target.bucket, 200);
+        case 'target.distributionId':
+            return !!cleanText(target.distributionId, 200);
+        case 'target.configKey':
+            return !!cleanText(target.configKey, 200);
+        case 'target.seedKey':
+            return !!cleanText(target.seedKey, 200);
+        case 'target.cacheKey':
+            return !!cleanText(target.cacheKey, 200);
+        case 'target.processName':
+            return !!cleanText(target.processName, 200);
+        default:
+            return false;
+    }
+}
+function buildResolveIOAIManagerHotfixEvidenceRecord(input) {
     var _a, _b;
     if (input === void 0) { input = {}; }
+    var merged = mergeHotfixEvidenceRecordInput(input);
+    var normalized = normalizeResolveIOAIManagerHotfixEvidence(merged, input.policy);
+    var validation = validateResolveIOAIManagerHotfixEvidence(merged, { policy: input.policy });
+    var channel = validation.channel || (normalized === null || normalized === void 0 ? void 0 : normalized.channel) || ((_b = (_a = input.policy) === null || _a === void 0 ? void 0 : _a.hotfixPlan) === null || _b === void 0 ? void 0 : _b.recommendedChannel) || '';
+    var requiredFields = resolveHotfixEvidenceRequiredFields(channel);
+    var missingFields = requiredFields.filter(function (field) { return !hotfixEvidenceFieldPresent(normalized, field); });
+    var recordedAt = cleanDateString(input.now || (normalized === null || normalized === void 0 ? void 0 : normalized.recordedAt) || new Date());
+    var githubCommitGuard = validation.githubCommitGuard || evaluateResolveIOAIManagerHotfixGitProof(normalized || merged, channel);
+    return {
+        recordId: cleanText(input.recordId, 160) || "hotfix-".concat(fingerprintResolveIOAIManagerBlocker("".concat(channel, ":").concat(githubCommitGuard.sourceCommitSha, ":").concat(recordedAt))),
+        recordedAt: recordedAt,
+        recordedBy: cleanText(input.recordedBy || 'manager', 160),
+        source: cleanText(input.source || 'unknown', 80),
+        reason: cleanText(input.reason, 1000),
+        channel: channel,
+        status: validation.status,
+        nextAction: validation.nextAction,
+        valid: validation.valid,
+        hotfixSatisfied: validation.hotfixSatisfied,
+        fullDeployAllowed: validation.fullDeployAllowed,
+        fullDeployBlocked: validation.fullDeployBlocked,
+        requiredFields: requiredFields,
+        missingFields: missingFields,
+        evidence: normalized,
+        validation: validation,
+        sourceCommitSha: githubCommitGuard.sourceCommitSha,
+        githubCommitUrl: githubCommitGuard.githubCommitUrl,
+        gitPushStatus: githubCommitGuard.gitPushStatus,
+        githubCommitRequired: githubCommitGuard.required,
+        githubCommitProofPassed: githubCommitGuard.passed,
+        commitProofStatus: githubCommitGuard.status,
+        managerMustCommitBeforeHotfix: githubCommitGuard.managerMustCommitBeforeHotfix,
+        githubCommitGuard: githubCommitGuard,
+        readyForReleaseGate: validation.valid === true && validation.nextAction === 'rerun_release_gate',
+        readyForContinuation: validation.valid === true && validation.hotfixSatisfied === true && hotfixStatusPassed(normalized === null || normalized === void 0 ? void 0 : normalized.releaseGateStatus)
+    };
+}
+function decideResolveIOAIManagerHotfixContinuation(input) {
+    var e_4, _a;
+    var _b, _c;
+    if (input === void 0) { input = {}; }
     var validation = validateResolveIOAIManagerHotfixEvidence(input.evidence, { policy: input.policy });
     var failureClass = cleanText(input.failureClass, 120) || 'release';
-    var blockerText = cleanText(input.blocker || validation.blockers.join('; ') || ((_a = validation.normalized) === null || _a === void 0 ? void 0 : _a.hotfixCannotResolveReason), 1000);
+    var blockerText = cleanText(input.blocker || validation.blockers.join('; ') || ((_b = validation.normalized) === null || _b === void 0 ? void 0 : _b.hotfixCannotResolveReason), 1000);
     var blockerFingerprint = fingerprintResolveIOAIManagerBlocker(blockerText || "".concat(validation.channel, ":").concat(validation.status, ":").concat(validation.nextAction));
     var baseBlockers = __spreadArray([], __read(validation.blockers), false);
+    var githubCommitGuard = validation.githubCommitGuard || evaluateResolveIOAIManagerHotfixGitProof(input.evidence, validation.channel);
+    var needsGithubCommitProof = githubCommitGuard.managerMustCommitBeforeHotfix
+        || validation.blockers.some(function (blocker) { return /sourceCommitSha|githubCommitUrl|gitPushStatus|gitCommitStatus|GitHub commit|pushed/i.test(blocker); });
     var repeatedFailure = input.repeatedFailure === true;
     var releaseGatePassed = input.releaseGatePassed === true
-        || hotfixStatusPassed((_b = validation.normalized) === null || _b === void 0 ? void 0 : _b.releaseGateStatus);
+        || hotfixStatusPassed((_c = validation.normalized) === null || _c === void 0 ? void 0 : _c.releaseGateStatus);
     var action = validation.nextAction;
     var canContinueRun = false;
     var canRunFullDeploy = validation.fullDeployAllowed;
@@ -351,13 +955,38 @@ function decideResolveIOAIManagerHotfixContinuation(input) {
     var shouldPark = false;
     var reason = '';
     var nextCommands = [];
-    if (!validation.valid || validation.status === 'missing' || validation.status === 'incomplete') {
+    if (githubCommitGuard.managerMustCommitBeforeHotfix) {
+        action = 'record_hotfix_evidence';
+        reason = githubCommitGuard.blockers.length
+            ? "Manager hotfix cannot continue until the hotfix is committed and pushed: ".concat(githubCommitGuard.blockers.join('; '))
+            : 'Manager hotfix cannot continue until sourceCommitSha, githubCommitUrl, and passed gitPushStatus prove the hotfix is on GitHub.';
+        nextCommands.push.apply(nextCommands, __spreadArray(__spreadArray([], __read(githubCommitGuard.nextCommands), false), ['rerun_hotfix_evidence_validator'], false));
+        try {
+            for (var _d = __values(githubCommitGuard.blockers), _e = _d.next(); !_e.done; _e = _d.next()) {
+                var blocker = _e.value;
+                if (!baseBlockers.includes(blocker)) {
+                    baseBlockers.push(blocker);
+                }
+            }
+        }
+        catch (e_4_1) { e_4 = { error: e_4_1 }; }
+        finally {
+            try {
+                if (_e && !_e.done && (_a = _d.return)) _a.call(_d);
+            }
+            finally { if (e_4) throw e_4.error; }
+        }
+    }
+    else if (!validation.valid || validation.status === 'missing' || validation.status === 'incomplete') {
         action = validation.nextAction === 'request_force_deploy_reason'
             ? 'request_force_deploy_reason'
             : 'record_hotfix_evidence';
         reason = validation.blockers.length
             ? "Hotfix evidence is not complete: ".concat(validation.blockers.join('; '))
             : 'Hotfix evidence is missing; record the hotfix target, checksum, restart, health, and self-test proof before continuing.';
+        if (needsGithubCommitProof) {
+            nextCommands.push('commit_and_push_hotfix_to_github', 'verify_github_commit_url_and_push_status');
+        }
         nextCommands.push('record_hotfix_evidence', 'rerun_hotfix_evidence_validator');
     }
     else if (validation.fullDeployAllowed) {
@@ -402,13 +1031,49 @@ function decideResolveIOAIManagerHotfixContinuation(input) {
         warnings: validation.warnings,
         requiredEvidence: validation.requiredEvidence,
         successEvidence: validation.successEvidence,
-        nextCommands: nextCommands,
+        nextCommands: Array.from(new Set(nextCommands)),
         failureClass: failureClass,
         blockerFingerprint: blockerFingerprint,
+        githubCommitGuard: githubCommitGuard,
         validation: validation,
         recordedAt: isoNow(input.now)
     };
 }
+function decideResolveIOAIManagerHotfixCommitGuard(input) {
+    if (input === void 0) { input = {}; }
+    var normalized = normalizeResolveIOAIManagerHotfixEvidence(input.evidence, input.policy);
+    var validation = validateResolveIOAIManagerHotfixEvidence(input.evidence, { policy: input.policy });
+    var githubCommitGuard = validation.githubCommitGuard || evaluateResolveIOAIManagerHotfixGitProof(input.evidence, validation.channel);
+    var active = !!normalized || githubCommitGuard.required === true;
+    var hotfixCommitBlockers = validation.blockers.filter(function (blocker) { return /sourceCommitSha|githubCommitUrl|gitPushStatus|gitCommitStatus|GitHub commit|pushed/i.test(blocker); });
+    var blockers = Array.from(new Set(__spreadArray(__spreadArray([], __read((githubCommitGuard.blockers || [])), false), __read(hotfixCommitBlockers), false)));
+    var blocked = active && (githubCommitGuard.managerMustCommitBeforeHotfix === true
+        || (githubCommitGuard.required === true && githubCommitGuard.passed !== true)
+        || hotfixCommitBlockers.length > 0);
+    var nextCommands = blocked
+        ? Array.from(new Set(__spreadArray(__spreadArray([], __read((githubCommitGuard.nextCommands || [])), false), [
+            'commit_and_push_hotfix_to_github',
+            'verify_github_commit_url_and_push_status',
+            'record_hotfix_evidence'
+        ], false)))
+        : [];
+    return {
+        active: active,
+        blocked: blocked,
+        reason: blocked
+            ? (blockers.length
+                ? "Hotfix continuation is blocked until GitHub commit proof is recorded: ".concat(blockers.join('; '))
+                : 'Hotfix continuation is blocked until sourceCommitSha, githubCommitUrl, and passed gitPushStatus prove the hotfix is pushed to GitHub.')
+            : (active ? 'Hotfix GitHub commit proof is recorded.' : 'No hotfix commit guard is active.'),
+        nextAction: blocked ? 'record_hotfix_evidence' : 'continue',
+        channel: validation.channel || githubCommitGuard.channel || '',
+        blockers: blockers,
+        nextCommands: nextCommands,
+        requiredEvidence: githubCommitGuard.requiredEvidence,
+        githubCommitGuard: githubCommitGuard,
+        validation: validation
+    };
+}
 function releaseStatusIsBlocked(value) {
     return /fail|error|blocked|missing|empty|not ready|not_ready|denied|invalid|timeout|stale/i.test(value);
 }
@@ -550,17 +1215,17 @@ function buildHotfixFirstReleasePlan(input) {
         steps: [
             hotfixStep('static_ui_hotfix', 'Static UI hotfix', 'static_ui', {
                 safeToAutoRun: true,
-                requiredEvidence: ['built dist path', 'target S3 bucket and CloudFront distribution', 'changed frontend bundle or asset list'],
-                successEvidence: ['S3 upload result', 'CloudFront invalidation id', 'public bundle contains expected hotfix marker']
+                requiredEvidence: ['sourceCommitSha, githubCommitUrl, and passed gitPushStatus', 'built dist path', 'target S3 bucket and CloudFront distribution', 'changed frontend bundle or asset list'],
+                successEvidence: ['GitHub commit and push proof', 'S3 upload result', 'CloudFront invalidation id', 'public bundle contains expected hotfix marker']
             }),
             hotfixStep('backend_js_hotfix', 'Backend JS hotfix', 'backend_js', {
-                requiredEvidence: ['compiled JS artifact path', 'target backend host', 'diff limited to runner/operator code'],
-                successEvidence: ['remote file checksum', 'service restart or process reload evidence', 'self-test passes']
+                requiredEvidence: ['sourceCommitSha, githubCommitUrl, and passed gitPushStatus', 'compiled JS artifact path', 'target backend host', 'diff limited to runner/operator code'],
+                successEvidence: ['GitHub commit and push proof', 'remote file checksum', 'service restart or process reload evidence', 'self-test passes']
             }),
             hotfixStep('config_seed_cache_restart', 'Config, seed, cache, or restart repair', 'config', {
                 safeToAutoRun: true,
-                requiredEvidence: ['exact config/seed/cache key or process name', 'why no product artifact changed'],
-                successEvidence: ['release gate rerun result', 'operator console release snapshot refreshed']
+                requiredEvidence: ['sourceCommitSha, githubCommitUrl, and passed gitPushStatus', 'exact config/seed/cache key or process name', 'why no product artifact changed'],
+                successEvidence: ['GitHub commit and push proof', 'release gate rerun result', 'operator console release snapshot refreshed']
             })
         ],
         acceptanceEvidence: commonAcceptance,
@@ -1017,6 +1682,48 @@ function recoveryActionAutoRunnable(mode, probe) {
     }
     return probe.steps.some(function (step) { return step.commandHint || step.kind === 'rerun_same_gate' || step.kind === 'release_status' || step.kind === 'diff_scope_check'; });
 }
+function recoveryActionCostCeilingUsd(mode) {
+    var _a;
+    var map = {
+        advance: 0,
+        collect_evidence: 0.25,
+        read_only_diagnosis: 1,
+        repair_infra: 0.5,
+        repair_compile: 1.5,
+        repair_journey_contract: 2,
+        repair_business_assertion: 1.5,
+        repair_release: 0.75,
+        targeted_product_repair: 5,
+        manual_review: 0,
+        continue_gate: 0
+    };
+    return (_a = map[mode]) !== null && _a !== void 0 ? _a : 1;
+}
+function recoveryActionRequiredStateTransition(mode) {
+    var map = {
+        advance: 'current gate advances without repair after existing proof is accepted',
+        collect_evidence: 'blockerFingerprint or evidenceHash changes with material proof, or run remains parked',
+        read_only_diagnosis: 'diagnosis gate becomes valid or records a blocked-reproduction reason',
+        repair_infra: 'infra preflight changes from failed/blocked to passed, or records a new infra blocker',
+        repair_compile: 'compile/startup status changes from failed to passed, or records a new compile blocker',
+        repair_journey_contract: 'journey contract validates with first/next/last workflow proof',
+        repair_business_assertion: 'business assertion changes from missing/failed to passed with artifact proof',
+        repair_release: 'hotfix/release gate changes from blocked to passed, rerun_release_gate, or parked manual',
+        targeted_product_repair: 'owner-scoped diff is produced and deterministic proof advances to QA',
+        manual_review: 'operator records one explicit decision',
+        continue_gate: 'current gate records accepted proof and advances'
+    };
+    return map[mode] || 'runner records a validated state transition before continuing';
+}
+function recoveryActionProofRequiredBeforeContinuation(mode) {
+    return mode !== 'advance' && mode !== 'continue_gate' && mode !== 'manual_review';
+}
+function recoveryActionExitCriteria(input) {
+    return Array.from(new Set(__spreadArray(__spreadArray([
+        "exact dispatch action ".concat(input.dispatchAction, " completed or was parked"),
+        input.requiredStateTransition
+    ], __read((recoveryActionProofRequiredBeforeContinuation(input.mode) ? ['do not continue runner until required proof artifact is attached'] : [])), false), __read(input.stopWhen), false).map(function (entry) { return cleanText(entry, 500); }).filter(Boolean))).slice(0, 30);
+}
 function buildResolveIOAIManagerRecoveryActionPacket(input) {
     var checkpoint = input.checkpoint;
     var probe = input.probe || buildResolveIOAIManagerRecoveryEvidenceProbe({
@@ -1048,6 +1755,15 @@ function buildResolveIOAIManagerRecoveryActionPacket(input) {
             publishStatus: checkpoint.lane
         })
         : undefined;
+    var allowedDispatchAction = dispatchActionForMode(mode);
+    var requiredStateTransition = recoveryActionRequiredStateTransition(mode);
+    var proofRequiredBeforeContinuation = recoveryActionProofRequiredBeforeContinuation(mode);
+    var exitCriteria = recoveryActionExitCriteria({
+        mode: mode,
+        dispatchAction: allowedDispatchAction,
+        requiredStateTransition: requiredStateTransition,
+        stopWhen: stopWhen
+    });
     var now = isoNow(input.now);
     return __assign(__assign(__assign({ actionId: stableHash('mgr-action', {
             checkpointId: checkpoint.checkpointId,
@@ -1055,13 +1771,13 @@ function buildResolveIOAIManagerRecoveryActionPacket(input) {
             mode: mode,
             evidenceHash: checkpoint.evidenceHash,
             blockerFingerprint: checkpoint.blockerFingerprint
-        }), checkpointId: checkpoint.checkpointId, probeId: probe.probeId, recoveryClass: checkpoint.recoveryClass, mode: mode, label: recoveryActionLabelFor(mode, checkpoint), lane: checkpoint.lane, stepType: checkpoint.stepType, primaryStepKind: (primaryStep === null || primaryStep === void 0 ? void 0 : primaryStep.kind) || 'none', objective: mode === 'collect_evidence'
+        }), checkpointId: checkpoint.checkpointId, probeId: probe.probeId, recoveryClass: checkpoint.recoveryClass, mode: mode, singleActionOnly: true, allowedDispatchAction: allowedDispatchAction, label: recoveryActionLabelFor(mode, checkpoint), lane: checkpoint.lane, stepType: checkpoint.stepType, primaryStepKind: (primaryStep === null || primaryStep === void 0 ? void 0 : primaryStep.kind) || 'none', objective: mode === 'collect_evidence'
             ? probe.objective
-            : cleanText(checkpoint.objective || probe.objective, 1000), evidenceOnly: evidenceOnly, autoRunnable: recoveryActionAutoRunnable(mode, probe), productRepairAllowed: checkpoint.productRepairAllowed && !evidenceOnly && checkpoint.status !== 'parked', expensiveModelAllowed: checkpoint.expensiveModelAllowed && checkpoint.status !== 'parked', canResetLoopAfterEvidence: resetLoopWhen.length > 0, maxAttemptsBeforePark: checkpoint.maxAttemptsBeforePark, requiredArtifacts: probe.requiredArtifacts.slice(0, 20), nextCommands: releasePolicy
+            : cleanText(checkpoint.objective || probe.objective, 1000), evidenceOnly: evidenceOnly, autoRunnable: recoveryActionAutoRunnable(mode, probe), productRepairAllowed: checkpoint.productRepairAllowed && !evidenceOnly && checkpoint.status !== 'parked', expensiveModelAllowed: checkpoint.expensiveModelAllowed && checkpoint.status !== 'parked', costCeilingUsd: recoveryActionCostCeilingUsd(mode), requiredStateTransition: requiredStateTransition, proofRequiredBeforeContinuation: proofRequiredBeforeContinuation, canResetLoopAfterEvidence: resetLoopWhen.length > 0, maxAttemptsBeforePark: checkpoint.maxAttemptsBeforePark, requiredArtifacts: probe.requiredArtifacts.slice(0, 20), nextCommands: releasePolicy
             ? Array.from(new Set(__spreadArray(__spreadArray([], __read(nextCommands), false), __read(releasePolicy.allowedActions), false))).slice(0, 12)
             : nextCommands, successCriteria: releasePolicy
             ? Array.from(new Set(__spreadArray(__spreadArray([], __read(probe.acceptanceEvidence), false), __read(releasePolicy.requiredEvidence), false))).slice(0, 20)
-            : probe.acceptanceEvidence.slice(0, 20), retryPolicy: {
+            : probe.acceptanceEvidence.slice(0, 20), exitCriteria: exitCriteria, retryPolicy: {
             allowImmediateRetry: checkpoint.status !== 'parked' && mode !== 'manual_review',
             requireNewEvidence: requireNewEvidence,
             resetLoopWhen: resetLoopWhen,
@@ -1098,6 +1814,7 @@ function buildRecoveryDispatchRecord(action, dispatchAction, status, reason, cur
         }), actionId: action.actionId, checkpointId: action.checkpointId, probeId: action.probeId, mode: action.mode, dispatchAction: dispatchAction, status: status, evidenceHash: evidenceHash, blockerFingerprint: blockerFingerprint, productRepairAllowed: action.productRepairAllowed && dispatchAction === 'run_targeted_product_repair', expensiveModelAllowed: action.expensiveModelAllowed && dispatchAction !== 'run_evidence_probe', reason: reason, artifactPaths: artifactPaths }, (status === 'started' ? { startedAt: createdAt } : {})), (status === 'completed' ? { completedAt: createdAt } : {})), { createdAt: createdAt });
 }
 function decideResolveIOAIManagerRecoveryActionDispatch(input) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
     var action = input.action;
     var history = Array.isArray(input.history) ? input.history.filter(Boolean).slice(-50) : [];
     var current = input.current || {};
@@ -1115,6 +1832,7 @@ function decideResolveIOAIManagerRecoveryActionDispatch(input) {
         };
     }
     var dispatchAction = dispatchActionForMode(action.mode);
+    var allowedDispatchAction = action.allowedDispatchAction || dispatchAction;
     var evidenceHash = current.evidenceHash || action.checkpointId || action.actionId;
     var blockerFingerprint = resolveResolveIOAIManagerBlockerFingerprint(current, action.objective);
     var sameActionHistory = history.filter(function (entry) { return entry.actionId === action.actionId; });
@@ -1124,11 +1842,20 @@ function decideResolveIOAIManagerRecoveryActionDispatch(input) {
     var completedDispatch = sameEvidenceHistory.find(function (entry) { return entry.status === 'completed' || entry.status === 'failed'; });
     var newEvidence = sameActionHistory.length > 0 && sameEvidenceHistory.length === 0;
     var requiresNewEvidence = action.retryPolicy.requireNewEvidence === true;
+    var sameEvidenceAlreadyAttempted = !!completedDispatch && requiresNewEvidence && !newEvidence;
     var manualOnly = action.mode === 'manual_review' || !action.autoRunnable;
     var productDispatch = dispatchAction === 'run_targeted_product_repair';
     var expensiveDispatch = !['run_evidence_probe', 'advance', 'continue_gate', 'park_manual'].includes(dispatchAction);
-    if (manualOnly && input.operatorApproved !== true) {
-        var record_1 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', 'recovery_dispatch_requires_manual_review', current, input.now);
+    var evidenceAssessment = assessResolveIOAIManagerEvidenceChange(undefined, current, action.objective);
+    var autonomyPolicy = input.autonomyPolicy
+        ? decideResolveIOAIManagerAutonomyPolicy(__assign(__assign({}, (input.autonomyPolicy || {})), { dispatchAction: dispatchAction, projectedActionCostUsd: (_b = (_a = input.autonomyPolicy) === null || _a === void 0 ? void 0 : _a.projectedActionCostUsd) !== null && _b !== void 0 ? _b : action.costCeilingUsd, newEvidence: (_d = (_c = input.autonomyPolicy) === null || _c === void 0 ? void 0 : _c.newEvidence) !== null && _d !== void 0 ? _d : newEvidence, materialEvidence: (_f = (_e = input.autonomyPolicy) === null || _e === void 0 ? void 0 : _e.materialEvidence) !== null && _f !== void 0 ? _f : evidenceAssessment.material, evidenceStrength: (_h = (_g = input.autonomyPolicy) === null || _g === void 0 ? void 0 : _g.evidenceStrength) !== null && _h !== void 0 ? _h : evidenceAssessment.strength, evidenceSignals: (_k = (_j = input.autonomyPolicy) === null || _j === void 0 ? void 0 : _j.evidenceSignals) !== null && _k !== void 0 ? _k : evidenceAssessment.signals, sameEvidenceAlreadyAttempted: (_m = (_l = input.autonomyPolicy) === null || _l === void 0 ? void 0 : _l.sameEvidenceAlreadyAttempted) !== null && _m !== void 0 ? _m : sameEvidenceAlreadyAttempted, operatorApproved: input.operatorApproved }))
+        : undefined;
+    var autonomyBlocksDispatch = !!autonomyPolicy && (autonomyPolicy.mode === 'monitor_only'
+        || (autonomyPolicy.requiresHumanApproval === true && input.operatorApproved !== true)
+        || (autonomyPolicy.canAutoDispatch !== true && input.operatorApproved !== true)
+        || (autonomyPolicy.blocked === true && autonomyPolicy.canManualDispatch !== true));
+    if (autonomyBlocksDispatch) {
+        var record_1 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', "recovery_dispatch_blocked_by_autonomy_policy:".concat((autonomyPolicy === null || autonomyPolicy === void 0 ? void 0 : autonomyPolicy.reason) || 'unknown'), current, input.now);
         return {
             dispatchAction: 'park_manual',
             allowed: false,
@@ -1139,11 +1866,12 @@ function decideResolveIOAIManagerRecoveryActionDispatch(input) {
             shouldRecordDispatch: true,
             requiresNewEvidence: requiresNewEvidence,
             newEvidence: newEvidence,
+            autonomyPolicy: autonomyPolicy,
             dispatchRecord: record_1
         };
     }
-    if (productDispatch && action.productRepairAllowed !== true) {
-        var record_2 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', 'recovery_dispatch_product_repair_not_allowed', current, input.now);
+    if (action.singleActionOnly === true && allowedDispatchAction !== dispatchAction) {
+        var record_2 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', 'recovery_dispatch_action_not_in_packet_contract', current, input.now);
         return {
             dispatchAction: 'park_manual',
             allowed: false,
@@ -1154,9 +1882,42 @@ function decideResolveIOAIManagerRecoveryActionDispatch(input) {
             shouldRecordDispatch: true,
             requiresNewEvidence: true,
             newEvidence: newEvidence,
+            autonomyPolicy: autonomyPolicy,
             dispatchRecord: record_2
         };
     }
+    if (manualOnly && input.operatorApproved !== true) {
+        var record_3 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', 'recovery_dispatch_requires_manual_review', current, input.now);
+        return {
+            dispatchAction: 'park_manual',
+            allowed: false,
+            reason: record_3.reason,
+            status: 'parked',
+            canRunProductRepair: false,
+            canRunExpensiveModel: false,
+            shouldRecordDispatch: true,
+            requiresNewEvidence: requiresNewEvidence,
+            newEvidence: newEvidence,
+            autonomyPolicy: autonomyPolicy,
+            dispatchRecord: record_3
+        };
+    }
+    if (productDispatch && action.productRepairAllowed !== true) {
+        var record_4 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', 'recovery_dispatch_product_repair_not_allowed', current, input.now);
+        return {
+            dispatchAction: 'park_manual',
+            allowed: false,
+            reason: record_4.reason,
+            status: 'parked',
+            canRunProductRepair: false,
+            canRunExpensiveModel: false,
+            shouldRecordDispatch: true,
+            requiresNewEvidence: true,
+            newEvidence: newEvidence,
+            autonomyPolicy: autonomyPolicy,
+            dispatchRecord: record_4
+        };
+    }
     if (activeDispatch) {
         return {
             dispatchAction: 'park_manual',
@@ -1167,22 +1928,24 @@ function decideResolveIOAIManagerRecoveryActionDispatch(input) {
             canRunExpensiveModel: false,
             shouldRecordDispatch: false,
             requiresNewEvidence: true,
-            newEvidence: false
+            newEvidence: false,
+            autonomyPolicy: autonomyPolicy
         };
     }
-    if (completedDispatch && requiresNewEvidence && !newEvidence) {
-        var record_3 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', 'recovery_dispatch_same_evidence_already_attempted', current, input.now);
+    if (sameEvidenceAlreadyAttempted) {
+        var record_5 = buildRecoveryDispatchRecord(action, 'park_manual', 'parked', 'recovery_dispatch_same_evidence_already_attempted', current, input.now);
         return {
             dispatchAction: 'park_manual',
             allowed: false,
-            reason: record_3.reason,
+            reason: record_5.reason,
             status: 'parked',
             canRunProductRepair: false,
             canRunExpensiveModel: false,
             shouldRecordDispatch: true,
             requiresNewEvidence: true,
             newEvidence: false,
-            dispatchRecord: record_3
+            autonomyPolicy: autonomyPolicy,
+            dispatchRecord: record_5
         };
     }
     var status = dispatchAction === 'advance' || dispatchAction === 'continue_gate'
@@ -1199,6 +1962,7 @@ function decideResolveIOAIManagerRecoveryActionDispatch(input) {
         shouldRecordDispatch: true,
         requiresNewEvidence: requiresNewEvidence,
         newEvidence: newEvidence,
+        autonomyPolicy: autonomyPolicy,
         dispatchRecord: record
     };
 }
@@ -1245,6 +2009,7 @@ function buildResolveIOAIManagerRecoveryExecutionDirective(input) {
     var dispatchDecision = input.dispatchDecision || decideResolveIOAIManagerRecoveryActionDispatch({
         action: action,
         current: input.current,
+        autonomyPolicy: input.autonomyPolicy,
         now: input.now
     });
     var dispatchAction = dispatchDecision.dispatchAction;
@@ -1254,17 +2019,17 @@ function buildResolveIOAIManagerRecoveryExecutionDirective(input) {
     var stepType = cleanText((action === null || action === void 0 ? void 0 : action.stepType) || ((_b = input.current) === null || _b === void 0 ? void 0 : _b.stepType) || '', 120);
     var rerunReason = recoveryDirectiveReason(action, dispatchDecision, input.current);
     var surface = cleanText(input.surface || 'runner', 120);
-    return __assign(__assign(__assign({ directiveId: stableHash('mgr-directive', {
+    return __assign(__assign(__assign(__assign(__assign({ directiveId: stableHash('mgr-directive', {
             surface: surface,
             actionId: (action === null || action === void 0 ? void 0 : action.actionId) || '',
             dispatchAction: dispatchAction,
             reason: dispatchDecision.reason,
             evidenceHash: ((_c = dispatchDecision.dispatchRecord) === null || _c === void 0 ? void 0 : _c.evidenceHash) || ((_d = input.current) === null || _d === void 0 ? void 0 : _d.evidenceHash) || ''
-        }), surface: surface, dispatchAction: dispatchAction, phase: phase, allowed: dispatchDecision.allowed, status: dispatchDecision.status, reason: dispatchDecision.reason, lane: lane, stepType: stepType, nextActionLabel: cleanText(action === null || action === void 0 ? void 0 : action.label, 160) || dispatchAction, rerunReason: rerunReason, evidenceOnly: (action === null || action === void 0 ? void 0 : action.evidenceOnly) !== false || dispatchAction === 'run_evidence_probe', autoRunnable: (action === null || action === void 0 ? void 0 : action.autoRunnable) === true, productRepairAllowed: (action === null || action === void 0 ? void 0 : action.productRepairAllowed) === true, expensiveModelAllowed: (action === null || action === void 0 ? void 0 : action.expensiveModelAllowed) === true, canRunProductRepair: dispatchDecision.canRunProductRepair, canRunExpensiveModel: dispatchDecision.canRunExpensiveModel, canResetLoopAfterEvidence: (action === null || action === void 0 ? void 0 : action.canResetLoopAfterEvidence) === true, requiresNewEvidence: dispatchDecision.requiresNewEvidence, newEvidence: dispatchDecision.newEvidence, maxAttemptsBeforePark: Math.max(1, Number((action === null || action === void 0 ? void 0 : action.maxAttemptsBeforePark) || 1) || 1), requiredArtifacts: cleanList(action === null || action === void 0 ? void 0 : action.requiredArtifacts, 20, 500), nextCommands: cleanList(action === null || action === void 0 ? void 0 : action.nextCommands, 20, 500), successCriteria: cleanList(action === null || action === void 0 ? void 0 : action.successCriteria, 20, 500), forbiddenActions: (action === null || action === void 0 ? void 0 : action.productRepairAllowed) === true
+        }), surface: surface, dispatchAction: dispatchAction, phase: phase, allowed: dispatchDecision.allowed, status: dispatchDecision.status, reason: dispatchDecision.reason, singleActionOnly: (action === null || action === void 0 ? void 0 : action.singleActionOnly) !== false, allowedDispatchAction: (action === null || action === void 0 ? void 0 : action.allowedDispatchAction) || dispatchAction, lane: lane, stepType: stepType, nextActionLabel: cleanText(action === null || action === void 0 ? void 0 : action.label, 160) || dispatchAction, rerunReason: rerunReason, evidenceOnly: (action === null || action === void 0 ? void 0 : action.evidenceOnly) !== false || dispatchAction === 'run_evidence_probe', autoRunnable: (action === null || action === void 0 ? void 0 : action.autoRunnable) === true, productRepairAllowed: (action === null || action === void 0 ? void 0 : action.productRepairAllowed) === true, expensiveModelAllowed: (action === null || action === void 0 ? void 0 : action.expensiveModelAllowed) === true, costCeilingUsd: Math.max(0, Number((action === null || action === void 0 ? void 0 : action.costCeilingUsd) || 0) || 0), requiredStateTransition: cleanText(action === null || action === void 0 ? void 0 : action.requiredStateTransition, 500), proofRequiredBeforeContinuation: (action === null || action === void 0 ? void 0 : action.proofRequiredBeforeContinuation) === true, canRunProductRepair: dispatchDecision.canRunProductRepair, canRunExpensiveModel: dispatchDecision.canRunExpensiveModel, canResetLoopAfterEvidence: (action === null || action === void 0 ? void 0 : action.canResetLoopAfterEvidence) === true, requiresNewEvidence: dispatchDecision.requiresNewEvidence, newEvidence: dispatchDecision.newEvidence }, (dispatchDecision.autonomyPolicy ? { autonomyPolicy: dispatchDecision.autonomyPolicy } : {})), { maxAttemptsBeforePark: Math.max(1, Number((action === null || action === void 0 ? void 0 : action.maxAttemptsBeforePark) || 1) || 1), requiredArtifacts: cleanList(action === null || action === void 0 ? void 0 : action.requiredArtifacts, 20, 500), nextCommands: cleanList(action === null || action === void 0 ? void 0 : action.nextCommands, 20, 500), successCriteria: cleanList(action === null || action === void 0 ? void 0 : action.successCriteria, 20, 500), exitCriteria: cleanList(action === null || action === void 0 ? void 0 : action.exitCriteria, 30, 500), forbiddenActions: (action === null || action === void 0 ? void 0 : action.productRepairAllowed) === true
             ? []
             : Array.from(new Set(__spreadArray([
                 'Do not run product-code repair from this directive unless canRunProductRepair is true.'
-            ], __read((((_e = action === null || action === void 0 ? void 0 : action.releasePolicy) === null || _e === void 0 ? void 0 : _e.forbiddenActions) || [])), false))).slice(0, 20) }, (dispatchDecision.dispatchRecord ? { dispatchRecord: dispatchDecision.dispatchRecord } : {})), ((action === null || action === void 0 ? void 0 : action.releasePolicy) ? { releasePolicy: action.releasePolicy } : {})), { createdAt: now });
+            ], __read((((_e = action === null || action === void 0 ? void 0 : action.releasePolicy) === null || _e === void 0 ? void 0 : _e.forbiddenActions) || [])), false))).slice(0, 20) }), (dispatchDecision.dispatchRecord ? { dispatchRecord: dispatchDecision.dispatchRecord } : {})), ((action === null || action === void 0 ? void 0 : action.releasePolicy) ? { releasePolicy: action.releasePolicy } : {})), { createdAt: now });
 }
 function newListEntries(current, previous) {
     var existing = new Set(previous.map(function (entry) { return cleanText(entry, 500); }).filter(Boolean));