@smartergpt/lexrunner 2.0.1 → 2.1.0

package/dist/cli.js

@@ -24,7 +24,7 @@ import {
   finalizeAudit,
   initAuditEmitter,
   redactSecrets
-} from "./chunk-6PZDSWCG.js";
+} from "./chunk-37UC53OG.js";
 import "./chunk-6KK5JFFE.js";
 import {
   simulateBatchMerges
@@ -83,7 +83,7 @@ import {
   validateWriteOperation,
   verifyToolchainPins,
   writeRunState
-} from "./chunk-ARDKZW7F.js";
+} from "./chunk-SHSL643G.js";
 import {
   ExecutionState,
   generateMarkdownSummary,
@@ -135,9 +135,13 @@ import "./chunk-AXOAVRTU.js";
 import {
   __esm,
   __export,
+  __privateAdd,
+  __privateGet,
+  __privateMethod,
+  __privateSet,
   __require,
   __toCommonJS
-} from "./chunk-V3BU2VDU.js";
+} from "./chunk-PDDULIDL.js";
 
 // src/metrics/export.ts
 var export_exports = {};
@@ -470,7 +474,7 @@ import "dotenv/config";
 // package.json
 var package_default = {
   name: "@smartergpt/lexrunner",
-  version: "2.0.1",
+  version: "2.1.0",
   type: "module",
   engines: {
     node: ">=24"
@@ -483,10 +487,10 @@ var package_default = {
     url: "git+https://github.com/Guffawaffle/lexrunner.git"
   },
   publishConfig: {
-    access: "restricted",
+    access: "public",
     registry: "https://registry.npmjs.org/"
   },
-  license: "SEE LICENSE IN LICENSE.md",
+  license: "Apache-2.0",
   files: [
     "dist/",
     "schemas/",
@@ -495,7 +499,9 @@ var package_default = {
     "README.mcp.md",
     "CHANGELOG.md",
     "NOTICE.md",
-    "LICENSE.md"
+    "LICENSE.md",
+    "GOVERNANCE.md",
+    "BRAND.md"
   ],
   bin: {
     lexrunner: "dist/cli.js",
@@ -649,7 +655,7 @@ var package_default = {
 // src/cli.ts
 import { Command as Command6, CommanderError } from "commander";
 import { fileURLToPath as fileURLToPath6 } from "url";
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 import chalk11 from "chalk";
 
 // src/core/inputs.ts
@@ -1106,8 +1112,8 @@ function generateSnapshot(plan, inputs) {
 }
 function getPackageVersion() {
   try {
-    const fs50 = __require("fs");
-    const packageJson = JSON.parse(fs50.readFileSync("package.json", "utf8"));
+    const fs51 = __require("fs");
+    const packageJson = JSON.parse(fs51.readFileSync("package.json", "utf8"));
     return packageJson.version || "unknown";
   } catch {
     return "unknown";
@@ -2432,10 +2438,10 @@ async function promptGitHubToken() {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     rl.question("GitHub token (optional, press Enter to skip): ", (answer) => {
       rl.close();
-      resolve15(answer.trim());
+      resolve16(answer.trim());
     });
   });
 }
@@ -2639,6 +2645,7 @@ function installUnhandledRejectionHandler() {
 }
 
 // src/core/githubPlan.ts
+var STANDARD_TEST_GATE_TIMEOUT_MS = 5 * 60 * 1e3;
 async function generatePlanFromGitHub(client, options = {}) {
   const repoInfo = await client.validateRepository();
   const target = options.target || repoInfo.defaultBranch;
@@ -2743,7 +2750,8 @@ function createStandardGate(gateName, pr) {
       return {
         ...baseGate,
         run: "npm test",
-        artifacts: ["test-results.xml", "coverage/"]
+        artifacts: ["test-results.xml", "coverage/"],
+        timeoutMs: STANDARD_TEST_GATE_TIMEOUT_MS
       };
     case "typecheck":
       return {
@@ -2792,6 +2800,7 @@ function validateGitHubDependencies(planItems, prDetails) {
 }
 
 // src/core/multiRepoPlan.ts
+var STANDARD_TEST_GATE_TIMEOUT_MS2 = 5 * 60 * 1e3;
 async function generateMultiRepoPlan(repos, options = {}) {
   if (repos.length === 0) {
     throw new Error("At least one repository is required");
@@ -2928,7 +2937,8 @@ function generateGatesForMultiRepoPR(pr, options) {
         REPO_NAME: pr.repoName
       },
       runtime: "local",
-      artifacts: getGateArtifacts(gateName)
+      artifacts: getGateArtifacts(gateName),
+      ...isStandardTestGate(gateName) ? { timeoutMs: STANDARD_TEST_GATE_TIMEOUT_MS2 } : {}
     });
   }
   gates.sort((a, b) => a.name.localeCompare(b.name));
@@ -2938,6 +2948,7 @@ function getGateCommand(gateName) {
   const commands = {
     lint: "npm run lint",
     test: "npm test",
+    unit: "npm test",
     typecheck: "npm run typecheck",
     build: "npm run build"
   };
@@ -2947,11 +2958,15 @@ function getGateArtifacts(gateName) {
   const artifacts = {
     lint: ["lint-results.txt"],
     test: ["test-results.xml", "coverage/"],
+    unit: ["test-results.xml", "coverage/"],
     typecheck: ["typecheck-results.txt"],
     build: ["dist/"]
   };
   return artifacts[gateName] || [];
 }
+function isStandardTestGate(gateName) {
+  return gateName === "test" || gateName === "unit";
+}
 function createEmptyPlan(target, options) {
   const plan = {
     schemaVersion: "1.0.0",
@@ -3395,8 +3410,8 @@ function containedRegularFile(root, candidate) {
   }
 }
 function isContained(root, candidate) {
-  const relative3 = path8.relative(path8.resolve(root), path8.resolve(candidate));
-  return relative3 !== ".." && !relative3.startsWith(`..${path8.sep}`) && !path8.isAbsolute(relative3);
+  const relative5 = path8.relative(path8.resolve(root), path8.resolve(candidate));
+  return relative5 !== ".." && !relative5.startsWith(`..${path8.sep}`) && !path8.isAbsolute(relative5);
 }
 function evidenceError(code, message) {
   return new GateEvidenceServiceError(code, message);
@@ -4519,7 +4534,7 @@ function registerGateImportChecksCommand(program2) {
           version: "1.0.0",
           mappings: []
         };
-        const { DEFAULT_GATE_MAPPINGS } = await import("./gateMapping-R3RJYKMS.js");
+        const { DEFAULT_GATE_MAPPINGS } = await import("./gateMapping-V4DTL5WD.js");
         mappingConfig.mappings = DEFAULT_GATE_MAPPINGS;
       }
       let githubClient;
@@ -4832,11 +4847,11 @@ function isTestFile(file) {
 }
 function directOwnerCandidates(file) {
   if (!file.startsWith("src/") || !/\.[cm]?tsx?$/.test(file)) return [];
-  const relative3 = file.replace(/^src\//, "").replace(/\.[cm]?tsx?$/, "");
-  const basename4 = path12.posix.basename(relative3);
+  const relative5 = file.replace(/^src\//, "").replace(/\.[cm]?tsx?$/, "");
+  const basename4 = path12.posix.basename(relative5);
   return [
-    `tests/${relative3}.spec.ts`,
-    `tests/${relative3}.test.ts`,
+    `tests/${relative5}.spec.ts`,
+    `tests/${relative5}.test.ts`,
     `tests/${basename4}.spec.ts`,
     `tests/${basename4}.test.ts`
   ];
@@ -6062,10 +6077,10 @@ async function readInput(inputPath) {
     }
     return fs17.readFileSync(inputPath, "utf-8");
   } else {
-    return new Promise((resolve15, reject) => {
+    return new Promise((resolve16, reject) => {
       const chunks = [];
       process.stdin.on("data", (chunk) => chunks.push(chunk));
-      process.stdin.on("end", () => resolve15(Buffer.concat(chunks).toString("utf-8")));
+      process.stdin.on("end", () => resolve16(Buffer.concat(chunks).toString("utf-8")));
       process.stdin.on("error", reject);
     });
   }
@@ -6702,20 +6717,20 @@ async function registerSecurityCommands(program2) {
   program2.command("security").description("Security operations: token rotation, secrets scanning, validation").addCommand(
     new Command3("check-rotation").description("Check if secrets need rotation based on age").argument("[secrets...]", "Secret IDs to check (without LEX_PR_ prefix)", ["GITHUB_TOKEN"]).option("--max-age <days>", "Maximum age in days before rotation needed", "90").option("--format <format>", "Output format: text or json", "text").option("--no-color", "Disable ANSI colors in text output").action(
       async (secretIds, opts) => {
-        const { checkRotation } = await import("./security-OE4VLUFK.js");
+        const { checkRotation } = await import("./security-W7TOUXSB.js");
         const result = await checkRotation(secretIds, parseInt(opts.maxAge));
         outputSecurityResult("check-rotation", result, opts.format, opts.color !== false);
       }
     )
   ).addCommand(
     new Command3("scan-plan").description("Scan plan file for accidentally exposed secrets").argument("[plan-file]", "Path to plan file", "plan.json").option("--format <format>", "Output format: text or json", "text").option("--no-color", "Disable ANSI colors in text output").action(async (planFile, opts) => {
-      const { scanPlan } = await import("./security-OE4VLUFK.js");
+      const { scanPlan } = await import("./security-W7TOUXSB.js");
       const result = await scanPlan(planFile);
       outputSecurityResult("scan-plan", result, opts.format, opts.color !== false);
     })
   ).addCommand(
     new Command3("validate-secrets").description("Validate that required secrets are present").argument("<secrets...>", "Required secret IDs (without LEX_PR_ prefix)").option("--format <format>", "Output format: text or json", "text").option("--no-color", "Disable ANSI colors in text output").action(async (secretIds, opts) => {
-      const { validateSecrets } = await import("./security-OE4VLUFK.js");
+      const { validateSecrets } = await import("./security-W7TOUXSB.js");
       const result = await validateSecrets(secretIds);
       outputSecurityResult("validate-secrets", result, opts.format, opts.color !== false);
     })
@@ -6756,7 +6771,7 @@ function outputAuditResult(command, result, format, color) {
 async function registerAuditCommands(program2) {
   program2.command("audit").description("Audit operations: signature verification, manifest validation").addCommand(
     new Command4("verify").description("Verify audit manifest signature").argument("[manifest-file]", "Path to audit manifest file", "audit-manifest.json").option("--format <format>", "Output format: text or json", "text").option("--no-color", "Disable ANSI colors in text output").action(async (manifestFile, opts) => {
-      const { verifyCommand } = await import("./verify-3UVMA62I.js");
+      const { verifyCommand } = await import("./verify-Y34CJAKB.js");
       const result = await verifyCommand(manifestFile);
       outputAuditResult("verify", result, opts.format, opts.color !== false);
     })
@@ -8378,8 +8393,8 @@ Details:`);
       if (opts.json || deps.jsonModeActive()) {
         const output = JSON.stringify(plan, null, 2);
         if (opts.output) {
-          const fs50 = await import("fs/promises");
-          await fs50.writeFile(opts.output, output, "utf-8");
+          const fs51 = await import("fs/promises");
+          await fs51.writeFile(opts.output, output, "utf-8");
           console.log(`Plan written to: ${opts.output}`);
         } else {
           console.log(output);
@@ -8402,8 +8417,8 @@ Details:`);
           console.log(`     ${phase}: ${count}`);
         }
         if (opts.output) {
-          const fs50 = await import("fs/promises");
-          await fs50.writeFile(opts.output, JSON.stringify(plan, null, 2), "utf-8");
+          const fs51 = await import("fs/promises");
+          await fs51.writeFile(opts.output, JSON.stringify(plan, null, 2), "utf-8");
           console.log(`
 Plan written to: ${opts.output}`);
         }
@@ -8655,8 +8670,8 @@ function registerHarvestCommand(fanoutCommand) {
       });
       const output = JSON.stringify(harvestBundle, null, 2);
       if (opts.output) {
-        const fs50 = await import("fs/promises");
-        await fs50.writeFile(opts.output, output, "utf-8");
+        const fs51 = await import("fs/promises");
+        await fs51.writeFile(opts.output, output, "utf-8");
         console.error(`\u2713 Harvest bundle written to ${opts.output}`);
         console.error(`  ${harvestBundle.bundle.pullRequests.length} PRs`);
         console.error(`  ${harvestBundle.bundle.issues.length} issues`);
@@ -9045,10 +9060,10 @@ function analyzeBundle(harvest) {
 function registerAnalyzeCommand(fanoutCommand) {
   fanoutCommand.command("analyze").description("D1: Analyze harvest bundle into facts pool (deterministic)").option("--input <file>", "Path to harvest bundle JSON file (default: stdin)").option("--json", "Output JSON format (default)").option("--output <file>", "Write output to file").action(async (opts) => {
     try {
-      const fs50 = await import("fs/promises");
+      const fs51 = await import("fs/promises");
       let content;
       if (opts.input) {
-        content = await fs50.readFile(opts.input, "utf-8");
+        content = await fs51.readFile(opts.input, "utf-8");
       } else {
         const chunks = [];
         for await (const chunk of process.stdin) {
@@ -9090,7 +9105,7 @@ function registerAnalyzeCommand(fanoutCommand) {
       const analysisPool = analyzeBundle(harvest);
       const output = JSON.stringify(analysisPool, null, 2);
       if (opts.output) {
-        await fs50.writeFile(opts.output, output, "utf-8");
+        await fs51.writeFile(opts.output, output, "utf-8");
         console.error(`\u2713 Analysis pool written to ${opts.output}`);
         console.error(`  ${analysisPool.pool.entities.length} entities`);
         console.error(`  ${analysisPool.pool.relations.length} relations`);
@@ -9187,9 +9202,9 @@ var DEFAULT_FANOUT_TEMPLATES_PATHS = [
   "fanout-templates.yml"
 ];
 var FanoutTemplatesLoadError = class extends Error {
-  constructor(message, path59, cause) {
+  constructor(message, path60, cause) {
     super(message);
-    this.path = path59;
+    this.path = path60;
     this.cause = cause;
     this.name = "FanoutTemplatesLoadError";
   }
@@ -9520,7 +9535,7 @@ function registerFanoutCommands(weaveCommand) {
     }
   });
   fanout.command("validate").description("Validate fanout templates file").option("-f, --file <path>", "Path to templates file").action(async (options) => {
-    const fs50 = await import("fs/promises");
+    const fs51 = await import("fs/promises");
     try {
       let filePath;
       if (options.file) {
@@ -9533,7 +9548,7 @@ function registerFanoutCommands(weaveCommand) {
         }
         filePath = result2.path;
       }
-      const content = await fs50.readFile(filePath, "utf-8");
+      const content = await fs51.readFile(filePath, "utf-8");
       const result = validateFanoutTemplatesContent(content);
       if (result.valid) {
         console.log(`\u2713 Valid: ${filePath}`);
@@ -10514,8 +10529,8 @@ function lastCompletedMergeSha(operations) {
     (operation) => operation.phase === "merge" && operation.status === "completed" && operation.result?.externalId
   )?.result?.externalId;
 }
-function isRunnerStatePath(path59) {
-  return path59 === ".lexrunner" || path59.startsWith(".lexrunner/") || path59 === "weave-lock.json" || path59.endsWith("/weave-lock.json");
+function isRunnerStatePath(path60) {
+  return path60 === ".lexrunner" || path60.startsWith(".lexrunner/") || path60 === "weave-lock.json" || path60.endsWith("/weave-lock.json");
 }
 
 // src/commands/weave.ts
@@ -10927,7 +10942,7 @@ async function runWeaveApply(opts, deps) {
       if (json2) {
         const output = { ...preview.summary };
         if (showConstraints) {
-          const { previewConstraints: previewConstraints2 } = await import("./constraints-2ZK5FJFA.js");
+          const { previewConstraints: previewConstraints2 } = await import("./constraints-LE2MW5NS.js");
           output.constraints = await previewConstraints2(plan);
         }
         console.log(canonicalJSONStringify(output));
@@ -10937,7 +10952,7 @@ async function runWeaveApply(opts, deps) {
 \u{1F50D} Merge-Weave Dry Run
 `);
       if (showConstraints) {
-        const { previewConstraints: previewConstraints2, formatConstraintPreview: formatConstraintPreview2 } = await import("./constraints-2ZK5FJFA.js");
+        const { previewConstraints: previewConstraints2, formatConstraintPreview: formatConstraintPreview2 } = await import("./constraints-LE2MW5NS.js");
         console.log(formatConstraintPreview2(await previewConstraints2(plan)));
       }
       console.log(`Plan: ${opts.plan}`);
@@ -11133,7 +11148,7 @@ function registerPlanDiffCommand(program2, deps) {
       const plan2Content = fs24.readFileSync(plan2Path, "utf-8");
       const plan1 = loadPlan(plan1Content);
       const plan2 = loadPlan(plan2Content);
-      const { comparePlans, formatPlanDiff } = await import("./planDiff-IHLFNZUT.js");
+      const { comparePlans, formatPlanDiff } = await import("./planDiff-4D3AERAW.js");
       const diff = comparePlans(plan1, plan2);
       if (opts.json || deps.jsonModeActive()) {
         writeJsonOutput(diff);
@@ -11617,12 +11632,12 @@ ${prefix} Plan validation failed: ${error.message}`);
   }
   fs25.mkdirSync(outDir, { recursive: true });
   const planPath = path16.join(outDir, "plan.json");
-  const snapshotPath = path16.join(outDir, "snapshot.md");
+  const snapshotPath2 = path16.join(outDir, "snapshot.md");
   fs25.writeFileSync(planPath, planJSON);
-  fs25.writeFileSync(snapshotPath, snapshot);
+  fs25.writeFileSync(snapshotPath2, snapshot);
   console.log(`\u2713 Generated plan artifacts:`);
   console.log(`  \u{1F4C1} ${planPath}`);
-  console.log(`  \u{1F4C1} ${snapshotPath}`);
+  console.log(`  \u{1F4C1} ${snapshotPath2}`);
   console.log("");
   console.log(generatePlanSummary(validatedPlan));
   return;
@@ -11763,7 +11778,7 @@ function registerAutopilotCommand(program2, deps) {
           argv: process.argv.slice(2)
         });
       }
-      const { AutopilotLevel0, AutopilotLevel1, AutopilotLevel2: AutopilotLevel22 } = await import("./autopilot-3OHEUTHD.js");
+      const { AutopilotLevel0, AutopilotLevel1, AutopilotLevel2: AutopilotLevel22 } = await import("./autopilot-JWIOXBCZ.js");
       const context = {
         plan,
         profilePath: profile.path,
@@ -12788,7 +12803,7 @@ import * as fs28 from "fs";
 import * as path18 from "path";
 async function finalizeAuditGuard(emitter, status) {
   try {
-    const { finalizeAudit: finalizeAudit2 } = await import("./audit-SKMMC2U4.js");
+    const { finalizeAudit: finalizeAudit2 } = await import("./audit-HVB2HJPU.js");
     await finalizeAudit2(emitter, status);
   } catch (e) {
     if (e instanceof Error && typeof e.message === "string" && e.message.startsWith("HIPAA:")) {
@@ -13354,8 +13369,8 @@ function registerPlanReviewCommand(program2, deps) {
       }
       const planContent = fs29.readFileSync(planFile, "utf-8");
       const plan = loadPlan(planContent);
-      const { reviewPlan } = await import("./planReview-UUMCGZJ6.js");
-      const { savePlanVersion, getPlanHistoryPath } = await import("./planHistory-GLRI356L.js");
+      const { reviewPlan } = await import("./planReview-FV6INFLQ.js");
+      const { savePlanVersion, getPlanHistoryPath } = await import("./planHistory-VPV4WDPW.js");
       const result = await reviewPlan({
         plan,
         interactive: !opts.nonInteractive,
@@ -14055,7 +14070,7 @@ async function predictConflicts(options) {
       const pr2Head = prHeads.get(edge.to);
       if (pr1Head && pr2Head) {
         const key = `${edge.from}-${edge.to}`;
-        const result = await import("./mergeTreeSimulator-QCFSOU25.js").then(
+        const result = await import("./mergeTreeSimulator-GWZ77NF2.js").then(
           (m) => m.simulateMerge(baseBranch, pr1Head, pr2Head, workingDir)
         );
         mergeTreeSimulation[key] = result;
@@ -14131,7 +14146,7 @@ function generateRecommendations(misBatches, mergeTreeSimulation) {
 
 // src/orchestration/agentAssigner.ts
 function sleep(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 async function assignAgentWithRetry(issueNumber, repo, assignFn, maxRetries = 4) {
   let retries = 0;
@@ -14750,8 +14765,8 @@ function registerGenerateDeliverablesCommand(program2) {
       console.log(`\u2705 Created: ${path23.join(outputDir, "GATE5_cleanup.md")}`);
       console.log(`\u2705 Created: ${path23.join(outputDir, "SUMMARY.md")}`);
       console.log("");
-      const fs50 = await import("fs");
-      const planHashContent = fs50.readFileSync(path23.join(outputDir, "plan-hash.txt"), "utf-8");
+      const fs51 = await import("fs");
+      const planHashContent = fs51.readFileSync(path23.join(outputDir, "plan-hash.txt"), "utf-8");
       const planHashMatch = planHashContent.match(/SHA256: ([a-f0-9]+)/);
       if (planHashMatch) {
         console.log(`Plan hash: ${planHashMatch[1]}`);
@@ -15542,7 +15557,7 @@ function formatMonitor(monitor) {
 async function runCheck(opts) {
   let githubAPI = await createGitHubAPI();
   if (opts.owner && opts.repo) {
-    const { GitHubAPI: GitHubAPI2 } = await import("./api-QBPBKYOC.js");
+    const { GitHubAPI: GitHubAPI2 } = await import("./api-UIWVFU7M.js");
     githubAPI = new GitHubAPI2({
       owner: opts.owner,
       repo: opts.repo,
@@ -16753,9 +16768,9 @@ async function promptInteractive(defaults) {
     output: process.stdout
   });
   const question = (prompt) => {
-    return new Promise((resolve15) => {
+    return new Promise((resolve16) => {
       rl.question(prompt, (answer) => {
-        resolve15(answer.trim());
+        resolve16(answer.trim());
       });
     });
   };
@@ -18612,8 +18627,8 @@ Total: ${entries.length} counter-examples (${entries.filter((e) => e.shouldLearn
   counterExamples.command("export").description("Export counter-examples for analysis").option("--format <format>", "Export format (json|csv)", "json").option("--base-dir <dir>", "Base directory for lexrunner", process.cwd()).option("--output <file>", "Output file (prints to stdout if not specified)").action(async (options) => {
     const output = exportCounterExamples(options.format, options.baseDir);
     if (options.output) {
-      const fs50 = await import("fs");
-      fs50.writeFileSync(options.output, output, "utf-8");
+      const fs51 = await import("fs");
+      fs51.writeFileSync(options.output, output, "utf-8");
       console.log(chalk9.green(`\u2713 Exported counter-examples to ${options.output}`));
     } else {
       console.log(output);
@@ -19193,7 +19208,7 @@ function nativePathsOverlap(runtimePlatform, left, right, comparison) {
   if (api.parse(normalizedLeft).root !== api.parse(normalizedRight).root) return false;
   const relativeLeft = api.relative(normalizedLeft, normalizedRight);
   const relativeRight = api.relative(normalizedRight, normalizedLeft);
-  const isDescendant = (relative3) => relative3.length > 0 && relative3 !== ".." && !relative3.startsWith(`..${api.sep}`);
+  const isDescendant = (relative5) => relative5.length > 0 && relative5 !== ".." && !relative5.startsWith(`..${api.sep}`);
   return isDescendant(relativeLeft) || isDescendant(relativeRight);
 }
 function digestBinding(runtime) {
@@ -20538,8 +20553,8 @@ function parseGitStatusPorcelainV1Z(input) {
     }
     const indexStatus = field[0];
     const worktreeStatus = field[1];
-    const path59 = field.slice(3);
-    if (path59.length === 0) {
+    const path60 = field.slice(3);
+    if (path60.length === 0) {
       throw new Error("Malformed git status porcelain: path is empty");
     }
     const renameOrCopy = [indexStatus, worktreeStatus].find(
@@ -20557,7 +20572,7 @@ function parseGitStatusPorcelainV1Z(input) {
     records.push({
       indexStatus,
       worktreeStatus,
-      path: path59,
+      path: path60,
       ...originalPath === void 0 ? {} : { originalPath },
       kind
     });
@@ -21009,8 +21024,8 @@ function copyIssues(result, context) {
     context.addIssue({ code: "custom", path: issue.path, message: issue.message });
   }
 }
-function addIssue(context, path59, message) {
-  context.addIssue({ code: "custom", path: path59, message });
+function addIssue(context, path60, message) {
+  context.addIssue({ code: "custom", path: path60, message });
 }
 
 // src/workspaces/linux-workspace-boundary.ts
@@ -22051,8 +22066,8 @@ var NodeGitWorktreeBroker = class {
           "The worktree root was replaced after broker initialization"
         );
       }
-      const relative3 = path34.relative(this.worktreeRoot, path34.resolve(target.worktreePath));
-      const components = relative3.split(path34.sep);
+      const relative5 = path34.relative(this.worktreeRoot, path34.resolve(target.worktreePath));
+      const components = relative5.split(path34.sep);
       const targetName = components.pop();
       if (!targetName) {
         throw new DirectoryBoundaryError("invalid_path", "The worktree target has no basename");
@@ -22256,8 +22271,8 @@ var NodeGitWorktreeBroker = class {
       );
     }
     const normalized = path34.resolve(gitDirectoryPath);
-    const relative3 = path34.relative(this.repositoryGitIdentity.path, normalized);
-    if (!relative3 || relative3 === ".." || relative3.startsWith(`..${path34.sep}`)) {
+    const relative5 = path34.relative(this.repositoryGitIdentity.path, normalized);
+    if (!relative5 || relative5 === ".." || relative5.startsWith(`..${path34.sep}`)) {
       return this.failure(
         operation,
         "containment_violation",
@@ -22266,7 +22281,7 @@ var NodeGitWorktreeBroker = class {
     }
     let current = null;
     try {
-      for (const component of relative3.split(path34.sep)) {
+      for (const component of relative5.split(path34.sep)) {
         const child = await boundary.lease.openChild(
           current ?? boundary.repositoryGit,
           component,
@@ -22320,8 +22335,8 @@ var NodeGitWorktreeBroker = class {
     const normalizedRoot = path34.resolve(root);
     const comparedCandidate = this.pathComparison === "case-insensitive" ? normalizedCandidate.toLocaleLowerCase("en-US") : normalizedCandidate;
     const comparedRoot = this.pathComparison === "case-insensitive" ? normalizedRoot.toLocaleLowerCase("en-US") : normalizedRoot;
-    const relative3 = path34.relative(comparedRoot, comparedCandidate);
-    return relative3.length > 0 && relative3 !== ".." && !relative3.startsWith(`..${path34.sep}`);
+    const relative5 = path34.relative(comparedRoot, comparedCandidate);
+    return relative5.length > 0 && relative5 !== ".." && !relative5.startsWith(`..${path34.sep}`);
   }
   async git(boundary, operation, args, cwd, options, allowedNonzeroExitCodes = [], evidence) {
     const result = await boundary.lease.runProcess({
@@ -22426,7 +22441,7 @@ function nativePathsOverlap2(left, right, comparison) {
   if (normalizedLeft === normalizedRight) return true;
   const relativeLeft = path34.relative(normalizedLeft, normalizedRight);
   const relativeRight = path34.relative(normalizedRight, normalizedLeft);
-  const isDescendant = (relative3) => relative3.length > 0 && relative3 !== ".." && !relative3.startsWith(`..${path34.sep}`);
+  const isDescendant = (relative5) => relative5.length > 0 && relative5 !== ".." && !relative5.startsWith(`..${path34.sep}`);
   return isDescendant(relativeLeft) || isDescendant(relativeRight);
 }
 function branchName(ref) {
@@ -24966,24 +24981,24 @@ var AcceptanceCriterion = z19.object({
 function isMachineLocalAbsolutePath(value) {
   return /(?:^|\s)\/(?!\/)[^\s]*/.test(value) || /(?:^|\s)~\/[^\s]*/.test(value) || /(?:^|\s)\\\\[^\s]*/.test(value) || /(?:^|\s)[a-z]:[\\/][^\s]*/i.test(value) || /(?:^|\s)file:/i.test(value);
 }
-function rejectMachineLocalPaths(value, ctx, path59 = []) {
+function rejectMachineLocalPaths(value, ctx, path60 = []) {
   if (typeof value === "string") {
     if (isMachineLocalAbsolutePath(value)) {
       ctx.addIssue({
         code: "custom",
-        path: path59,
+        path: path60,
         message: "AgentTaskPacket_v1 must not contain machine-local absolute paths"
       });
     }
     return;
   }
   if (Array.isArray(value)) {
-    value.forEach((item, index) => rejectMachineLocalPaths(item, ctx, [...path59, index]));
+    value.forEach((item, index) => rejectMachineLocalPaths(item, ctx, [...path60, index]));
     return;
   }
   if (value !== null && typeof value === "object") {
     for (const [key, item] of Object.entries(value)) {
-      rejectMachineLocalPaths(item, ctx, [...path59, key]);
+      rejectMachineLocalPaths(item, ctx, [...path60, key]);
     }
   }
 }
@@ -27157,10 +27172,10 @@ function captureBoundIdentities(input) {
     worktree: captureDirectoryIdentity(input.worktreePath, "execution mapping worktree")
   };
 }
-function verifiedRoot(runtimeId, path59, identity) {
+function verifiedRoot(runtimeId, path60, identity) {
   return {
     runtime_id: runtimeId,
-    path: path59,
+    path: path60,
     verification: "directory_identity",
     directory_identity: identityClaim2(identity)
   };
@@ -27279,8 +27294,8 @@ async function requireDirectoryWithin(directory, root, field) {
     realpath(directory),
     realpath(root)
   ]);
-  const relative3 = path36.relative(resolvedRoot, resolvedDirectory);
-  if (relative3 === ".." || relative3.startsWith(`..${path36.sep}`) || path36.isAbsolute(relative3)) {
+  const relative5 = path36.relative(resolvedRoot, resolvedDirectory);
+  if (relative5 === ".." || relative5.startsWith(`..${path36.sep}`) || path36.isAbsolute(relative5)) {
     throw new Error(`${field} must resolve within its authorized root`);
   }
 }
@@ -32472,8 +32487,8 @@ async function requireDirectoryWithin2(directory, root, field) {
     realpath2(directory),
     realpath2(root)
   ]);
-  const relative3 = path37.relative(resolvedRoot, resolvedDirectory);
-  if (relative3 === ".." || relative3.startsWith(`..${path37.sep}`) || path37.isAbsolute(relative3)) {
+  const relative5 = path37.relative(resolvedRoot, resolvedDirectory);
+  if (relative5 === ".." || relative5.startsWith(`..${path37.sep}`) || path37.isAbsolute(relative5)) {
     throw new Error(`${field} must resolve within the authorized worktree`);
   }
 }
@@ -35250,10 +35265,10 @@ var WorkerSessionDelegationBinding_v1 = z29.object({
 function decisionReceiptMatchesOffer(receipt, offer, offerHash) {
   return receipt.delegation_id === offer.delegation_id && receipt.attempt_id === offer.attempt_id && receipt.offer_hash === offerHash && receipt.worker_thread_id === offer.worker.thread_id && receipt.transcript_start_hash === offer.transcript_start_hash && Date.parse(receipt.decided_at) >= Date.parse(offer.offered_at);
 }
-function requireTimeOrder(earlier, later, path59, context, equalAllowed = true) {
+function requireTimeOrder(earlier, later, path60, context, equalAllowed = true) {
   const ordered = equalAllowed ? Date.parse(earlier) <= Date.parse(later) : Date.parse(earlier) < Date.parse(later);
   if (!ordered) {
-    context.addIssue({ code: "custom", path: [path59], message: `${path59} is out of order` });
+    context.addIssue({ code: "custom", path: [path60], message: `${path60} is out of order` });
   }
 }
 
@@ -36363,12 +36378,12 @@ function grantWithinRequirements(grant, requirements) {
   );
   return grant.authorized_model_provider === requirements.authorized_model_provider && grant.source_disclosure_allowed === requirements.source_disclosure_allowed && grant.max_duration_ms <= requirements.max_duration_ms && grant.max_output_bytes <= requirements.max_output_bytes && grant.controls.every((control) => required2.get(control.control) === control.minimum_strength) && grant.tools.length <= 1;
 }
-function requireExactControls(controls, context, path59) {
+function requireExactControls(controls, context, path60) {
   const actual = new Set(controls.map((control) => control.control));
   if (actual.size !== GovernedControlId.options.length || GovernedControlId.options.some((control) => !actual.has(control))) {
     context.addIssue({
       code: "custom",
-      path: path59,
+      path: path60,
       message: "every governed denial control must appear exactly once"
     });
   }
@@ -37318,10 +37333,10 @@ function requireAbsent(value, fields, context) {
 function addStateIssue(message, context) {
   context.addIssue({ code: "custom", path: ["status"], message });
 }
-function requireOrdered(earlier, later, path59, context, equalAllowed = true) {
+function requireOrdered(earlier, later, path60, context, equalAllowed = true) {
   const ordered = equalAllowed ? Date.parse(earlier) <= Date.parse(later) : Date.parse(earlier) < Date.parse(later);
   if (!ordered) {
-    context.addIssue({ code: "custom", path: [path59], message: `${path59} is out of order` });
+    context.addIssue({ code: "custom", path: [path60], message: `${path60} is out of order` });
   }
 }
 
@@ -39041,8 +39056,8 @@ function normalizeInstant4(value) {
   return new Date(timestamp).toISOString();
 }
 function assertDescendant(parent, candidate) {
-  const relative3 = path46.relative(path46.resolve(parent), path46.resolve(candidate));
-  if (relative3.startsWith("..") || path46.isAbsolute(relative3)) {
+  const relative5 = path46.relative(path46.resolve(parent), path46.resolve(candidate));
+  if (relative5.startsWith("..") || path46.isAbsolute(relative5)) {
     throw new LocalProtectedEvidenceVerificationError("container_invalid");
   }
 }
@@ -39197,14 +39212,14 @@ var WindowsProtectedEvidenceAuthority = class {
     this.child = null;
     child?.stdin.end();
     if (child && child.exitCode === null) {
-      await new Promise((resolve15) => {
+      await new Promise((resolve16) => {
         const timeout = setTimeout(() => {
           child.kill();
-          resolve15();
+          resolve16();
         }, 5e3);
         child.once("close", () => {
           clearTimeout(timeout);
-          resolve15();
+          resolve16();
         });
       });
     }
@@ -39215,8 +39230,8 @@ var WindowsProtectedEvidenceAuthority = class {
     const child = this.ensureChild();
     const id = this.nextId;
     this.nextId += 1;
-    return new Promise((resolve15, reject) => {
-      this.pending.set(id, { resolve: resolve15, reject });
+    return new Promise((resolve16, reject) => {
+      this.pending.set(id, { resolve: resolve16, reject });
       child.stdin.write(`${JSON.stringify({ id, op: operation, path: target })}
 `, (error) => {
         if (!error) return;
@@ -39868,7 +39883,7 @@ var repositoryCorpusHeaderBody = z41.object({
 var GovernedRepositoryCorpusHeader_v1 = repositoryCorpusHeaderBody.superRefine(
   (value, context) => {
     const paths = value.entries.map((entry) => entry.path);
-    if (new Set(paths).size !== paths.length || paths.some((path59, index) => index > 0 && path59 <= paths[index - 1])) {
+    if (new Set(paths).size !== paths.length || paths.some((path60, index) => index > 0 && path60 <= paths[index - 1])) {
       context.addIssue({
         code: "custom",
         path: ["entries"],
@@ -40295,7 +40310,7 @@ function sanitizedWslEnvironment() {
   return environment;
 }
 function waitForExit(child, timeoutMs) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const timeout = setTimeout(() => {
       child.kill();
       reject(new Error("WSL2 provider control request timed out"));
@@ -40306,7 +40321,7 @@ function waitForExit(child, timeoutMs) {
     });
     child.once("close", (code) => {
       clearTimeout(timeout);
-      resolve15(code);
+      resolve16(code);
     });
   });
 }
@@ -41421,8 +41436,8 @@ var LocalProtectedEvidenceStore = class {
   exclusive(operation) {
     const previous = this.queue;
     let release;
-    this.queue = new Promise((resolve15) => {
-      release = resolve15;
+    this.queue = new Promise((resolve16) => {
+      release = resolve16;
     });
     return previous.then(operation).finally(release);
   }
@@ -41585,8 +41600,8 @@ function sameToken(expected, candidate) {
   return left.length === right.length && timingSafeEqual(left, right);
 }
 function assertDescendant2(root, candidate) {
-  const relative3 = path50.relative(root, candidate);
-  if (!relative3 || relative3.startsWith("..") || path50.isAbsolute(relative3)) {
+  const relative5 = path50.relative(root, candidate);
+  if (!relative5 || relative5.startsWith("..") || path50.isAbsolute(relative5)) {
     throw new Error("protected evidence deletion target escaped its root");
   }
 }
@@ -42434,11 +42449,11 @@ async function launchDetachedSupervisor(input) {
         env: sanitizedSupervisorEnvironment()
       }
     );
-    return await new Promise((resolve15) => {
-      child.once("error", () => resolve15(false));
+    return await new Promise((resolve16) => {
+      child.once("error", () => resolve16(false));
       child.once("spawn", () => {
         child.unref();
-        resolve15(true);
+        resolve16(true);
       });
     });
   } catch {
@@ -43184,10 +43199,10 @@ function commandPath(command) {
   }
   return components.join(" ");
 }
-function aliasWarning(path59) {
-  const policy = POLICY_BY_PATH.get(path59);
+function aliasWarning(path60) {
+  const policy = POLICY_BY_PATH.get(path60);
   if (!policy) return null;
-  return policy.disposition === "deprecated" ? `[lexrunner] deprecated alias "${path59}"; use "${policy.replacement}"; removal: ${policy.removeIn}.` : `[lexrunner] compatibility alias "${path59}"; use "${policy.replacement}"; supported through 2.x and reviewed at 3.0.0.`;
+  return policy.disposition === "deprecated" ? `[lexrunner] deprecated alias "${path60}"; use "${policy.replacement}"; removal: ${policy.removeIn}.` : `[lexrunner] compatibility alias "${path60}"; use "${policy.replacement}"; supported through 2.x and reviewed at 3.0.0.`;
 }
 function emitAliasWarning(command, write = (message) => process.stderr.write(message)) {
   const warning = aliasWarning(commandPath(command));
@@ -43293,8 +43308,8 @@ async function searchAttributions(query, runId) {
 }
 
 // src/cli.ts
-import * as fs49 from "fs";
-import * as path58 from "path";
+import * as fs50 from "fs";
+import * as path59 from "path";
 
 // src/runs/enforcement.ts
 import { z as z45 } from "zod";
@@ -44716,8 +44731,8 @@ async function executeAgentWorkPreparation(input) {
 function passed(results, id) {
   return results.some((result) => result.id === id && result.outcome === "passed");
 }
-async function containedExistingDirectory(root, relative3) {
-  const candidate = relative3 ? path55.resolve(root, relative3) : root;
+async function containedExistingDirectory(root, relative5) {
+  const candidate = relative5 ? path55.resolve(root, relative5) : root;
   const resolved = await realpath6(candidate);
   const relation = path55.relative(root, resolved);
   if (relation === ".." || relation.startsWith(`..${path55.sep}`) || path55.isAbsolute(relation)) {
@@ -44800,7 +44815,7 @@ var workspaceFilesystemEntry = z49.discriminatedUnion("kind", [
   }).strict()
 ]);
 function requireStrictlyOrderedPaths(values, context, field) {
-  if (values.some(({ path: path59 }, index) => index > 0 && path59 <= values[index - 1].path)) {
+  if (values.some(({ path: path60 }, index) => index > 0 && path60 <= values[index - 1].path)) {
     context.addIssue({
       code: "custom",
       path: [field],
@@ -44820,7 +44835,7 @@ var completeGitIdentity = z49.object({
   kind: z49.enum(["absent", "present"]),
   paths: z49.array(boundedRelativePath).max(4096)
 }).strict().superRefine((identity, context) => {
-  if (identity.paths.some((path59, index) => index > 0 && path59 <= identity.paths[index - 1]) || identity.kind === "absent" && identity.paths.length !== 0 || identity.kind === "present" && identity.paths.length === 0) {
+  if (identity.paths.some((path60, index) => index > 0 && path60 <= identity.paths[index - 1]) || identity.kind === "absent" && identity.paths.length !== 0 || identity.kind === "present" && identity.paths.length === 0) {
     context.addIssue({
       code: "custom",
       path: ["paths"],
@@ -45130,7 +45145,7 @@ var GovernedWorkspaceMutationRecoveryReceipt_v1 = z49.object({
     });
   }
   if (receipt.changed_paths.some(
-    (path59, index) => index > 0 && path59 <= receipt.changed_paths[index - 1]
+    (path60, index) => index > 0 && path60 <= receipt.changed_paths[index - 1]
   )) {
     context.addIssue({
       code: "custom",
@@ -45965,15 +45980,15 @@ var AttemptAwaitableSupervisor = class {
       0,
       Date.parse(record.observer_lease.expires_at) - Date.parse(this.now()) + 1
     );
-    let resolve15;
+    let resolve16;
     const completion = new Promise((resolvePromise) => {
-      resolve15 = resolvePromise;
+      resolve16 = resolvePromise;
     });
     const timer = setTimeout(() => {
       this.leaseExpiryWakeups.delete(record.awaitable_id);
-      void this.attach(record.awaitable_id).finally(resolve15);
+      void this.attach(record.awaitable_id).finally(resolve16);
     }, delayMs);
-    this.leaseExpiryWakeups.set(record.awaitable_id, { timer, completion, resolve: resolve15 });
+    this.leaseExpiryWakeups.set(record.awaitable_id, { timer, completion, resolve: resolve16 });
   }
   clearLeaseExpiryWakeup(awaitableId) {
     const wakeup = this.leaseExpiryWakeups.get(awaitableId);
@@ -46078,14 +46093,14 @@ function normalizeRetryDelay(value, name) {
 }
 function waitForRetry(delayMs, signal) {
   if (signal.aborted) return Promise.resolve(false);
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve15(true);
+      resolve16(true);
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
-      resolve15(false);
+      resolve16(false);
     };
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -49602,8 +49617,135 @@ function normalizeInstant8(value) {
 // src/application/plan-artifact-service.ts
 import * as fs48 from "fs";
 import * as path57 from "path";
-var MAX_PLAN_REFERENCE_BYTES = 4096;
-var MAX_PLAN_BYTES = 4 * 1024 * 1024;
+import { isDeepStrictEqual } from "util";
+
+// src/application/execution-plan-artifact.ts
+import { createHash as createHash13 } from "crypto";
+import { z as z54 } from "zod";
+var EXECUTION_PLAN_ARTIFACT_CONTRACT = "lexrunner.execution-plan-artifact.v1";
+var PLAN_ARTIFACT_REFERENCE_CONTRACT = "lexrunner.plan-artifact-reference.v1";
+var EXECUTION_PLAN_CANONICALIZATION_PROFILE = "lexrunner.execution-plan.canonical-json.v1";
+var EXECUTION_PLAN_HASH_PROFILE = "lexrunner.execution-plan-artifact.sha256.v1";
+var EXECUTION_PLAN_HASH_DOMAIN = "lexrunner:execution-plan-artifact:v1\0";
+var MAX_PLAN_ARTIFACT_BYTES = 4 * 1024 * 1024;
+var MAX_PLAN_RETRIEVAL_REFERENCE_BYTES = 4096;
+var MAX_SCOPE_LABEL_BYTES = 512;
+var Sha256Digest = z54.string().regex(/^sha256:[a-f0-9]{64}$/);
+var BoundedScopeLabel = z54.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_SCOPE_LABEL_BYTES, {
+  message: "Scope label exceeds the transport limit"
+});
+var BoundedIdentityLabel = z54.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_SCOPE_LABEL_BYTES, {
+  message: "Identity label exceeds the transport limit"
+});
+var PlanArtifactScope_v1Schema = z54.object({
+  tenant: BoundedScopeLabel,
+  workspace: BoundedScopeLabel,
+  repository: BoundedScopeLabel,
+  refNamespace: BoundedScopeLabel,
+  policy: BoundedScopeLabel
+}).strict();
+var ExecutionPlanArtifactIdentity_v1Schema = z54.object({
+  contract: z54.literal(EXECUTION_PLAN_ARTIFACT_CONTRACT),
+  kind: z54.literal("execution-plan"),
+  planSchema: z54.literal("lexrunner.execution-plan"),
+  planSchemaVersion: BoundedIdentityLabel,
+  canonicalizationProfile: z54.literal(EXECUTION_PLAN_CANONICALIZATION_PROFILE),
+  hashProfile: z54.literal(EXECUTION_PLAN_HASH_PROFILE),
+  digestAlgorithm: z54.literal("sha256"),
+  digest: Sha256Digest,
+  canonicalByteLength: z54.number().int().nonnegative().max(MAX_PLAN_ARTIFACT_BYTES),
+  target: BoundedIdentityLabel,
+  summary: z54.object({
+    itemCount: z54.number().int().nonnegative().max(256),
+    gateCount: z54.number().int().nonnegative().max(256 * 64)
+  }).strict()
+}).strict();
+var ExecutionPlanArtifact_v1Schema = z54.object({
+  identity: ExecutionPlanArtifactIdentity_v1Schema,
+  canonicalBytes: z54.string()
+}).strict().superRefine((artifact, context) => {
+  const byteLength = Buffer.byteLength(artifact.canonicalBytes, "utf8");
+  if (byteLength > MAX_PLAN_ARTIFACT_BYTES) {
+    context.addIssue({
+      code: "custom",
+      path: ["canonicalBytes"],
+      message: "Canonical plan bytes exceed the artifact limit"
+    });
+  }
+  if (byteLength !== artifact.identity.canonicalByteLength) {
+    context.addIssue({
+      code: "custom",
+      path: ["identity", "canonicalByteLength"],
+      message: "Canonical plan byte length does not match the artifact identity"
+    });
+  }
+  if (computeExecutionPlanArtifactDigest(artifact.canonicalBytes) !== artifact.identity.digest) {
+    context.addIssue({
+      code: "custom",
+      path: ["identity", "digest"],
+      message: "Canonical plan digest does not match the artifact identity"
+    });
+  }
+  try {
+    const plan = loadPlan(artifact.canonicalBytes);
+    if (canonicalJSONStringify(plan) !== artifact.canonicalBytes) {
+      context.addIssue({
+        code: "custom",
+        path: ["canonicalBytes"],
+        message: "Plan bytes are not in the declared canonical form"
+      });
+    }
+    const gateCount = plan.items.reduce((count, item) => count + item.gates.length, 0);
+    if (artifact.identity.planSchemaVersion !== plan.schemaVersion || artifact.identity.target !== plan.target || artifact.identity.summary.itemCount !== plan.items.length || artifact.identity.summary.gateCount !== gateCount) {
+      context.addIssue({
+        code: "custom",
+        path: ["identity"],
+        message: "Plan semantics do not match the artifact identity"
+      });
+    }
+  } catch {
+    context.addIssue({
+      code: "custom",
+      path: ["canonicalBytes"],
+      message: "Canonical bytes do not contain a valid execution plan"
+    });
+  }
+});
+var PlanArtifactReference_v1Schema = z54.object({
+  contract: z54.literal(PLAN_ARTIFACT_REFERENCE_CONTRACT),
+  artifact: ExecutionPlanArtifactIdentity_v1Schema,
+  expectedDigest: Sha256Digest,
+  expectedCanonicalByteLength: z54.number().int().nonnegative().max(MAX_PLAN_ARTIFACT_BYTES),
+  retrieval: z54.object({
+    kind: z54.enum(["file", "registered"]),
+    reference: z54.string().min(1).refine(
+      (value) => !value.includes("\0") && Buffer.byteLength(value, "utf8") <= MAX_PLAN_RETRIEVAL_REFERENCE_BYTES,
+      { message: "Retrieval reference is invalid or exceeds the transport limit" }
+    )
+  }).strict(),
+  scope: PlanArtifactScope_v1Schema.optional()
+}).strict().superRefine((reference, context) => {
+  if (reference.expectedDigest !== reference.artifact.digest) {
+    context.addIssue({
+      code: "custom",
+      path: ["expectedDigest"],
+      message: "Expected digest does not match the embedded artifact identity"
+    });
+  }
+  if (reference.expectedCanonicalByteLength !== reference.artifact.canonicalByteLength) {
+    context.addIssue({
+      code: "custom",
+      path: ["expectedCanonicalByteLength"],
+      message: "Expected byte length does not match the embedded artifact identity"
+    });
+  }
+});
+function computeExecutionPlanArtifactDigest(canonicalBytes2) {
+  const digest = createHash13("sha256").update(EXECUTION_PLAN_HASH_DOMAIN, "utf8").update(canonicalBytes2, "utf8").digest("hex");
+  return `sha256:${digest}`;
+}
+
+// src/application/plan-artifact-service.ts
 var MAX_PLAN_ITEMS = 256;
 var MAX_GATES_PER_ITEM2 = 64;
 var MAX_IDENTITY_LABEL_BYTES = 512;
@@ -49615,16 +49757,41 @@ var PlanArtifactServiceError = class extends Error {
     this.name = "PlanArtifactServiceError";
   }
 };
+var _hooks;
 var PlanArtifactService = class {
+  constructor(options = {}) {
+    __privateAdd(this, _hooks);
+    __privateSet(this, _hooks, options.importHooks ?? {});
+  }
   resolve(input = {}) {
     const workingDir = path57.resolve(input.workingDir ?? process.cwd());
+    const scope = parseScope(input.scope);
+    if (input.planReference !== void 0 && input.planFile !== void 0) {
+      throw new PlanArtifactServiceError(
+        "PLAN_REFERENCE_INVALID",
+        "Provide either an immutable plan reference or an explicit plan path, not both",
+        "explicit"
+      );
+    }
+    if (input.planReference !== void 0 && input.scope !== void 0) {
+      throw new PlanArtifactServiceError(
+        "PLAN_REFERENCE_INVALID",
+        "A separately supplied scope cannot override an immutable plan reference",
+        "explicit"
+      );
+    }
+    if (input.planReference !== void 0) {
+      const reference = parseReference(input.planReference);
+      const explicitPath = resolveExplicitReference(reference.retrieval.reference, workingDir);
+      return readArtifact(explicitPath, "explicit", __privateGet(this, _hooks), reference);
+    }
     if (input.planFile !== void 0) {
       const explicitPath = resolveExplicitReference(input.planFile, workingDir);
-      return readArtifact(explicitPath, "explicit");
+      return readArtifact(explicitPath, "explicit", __privateGet(this, _hooks), void 0, scope);
     }
     const repositoryPlan = path57.join(workingDir, "plan.json");
-    if (isRegularFile(repositoryPlan)) {
-      return readArtifact(repositoryPlan, "repository-root");
+    if (pathEntryExists(repositoryPlan)) {
+      return readArtifact(repositoryPlan, "repository-root", __privateGet(this, _hooks), void 0, scope);
     }
     let profilePlan;
     try {
@@ -49632,8 +49799,8 @@ var PlanArtifactService = class {
       profilePlan = path57.join(profile.path, "runner", "plan.json");
     } catch {
     }
-    if (profilePlan && isRegularFile(profilePlan)) {
-      return readArtifact(profilePlan, "profile-runner");
+    if (profilePlan && pathEntryExists(profilePlan)) {
+      return readArtifact(profilePlan, "profile-runner", __privateGet(this, _hooks), void 0, scope);
     }
     throw new PlanArtifactServiceError(
       "PLAN_NOT_FOUND",
@@ -49641,46 +49808,85 @@ var PlanArtifactService = class {
     );
   }
 };
-function resolveExplicitReference(reference, workingDir) {
-  if (reference.length === 0 || reference.includes("\0") || Buffer.byteLength(reference, "utf8") > MAX_PLAN_REFERENCE_BYTES) {
+_hooks = new WeakMap();
+function parseReference(reference) {
+  const parsed = PlanArtifactReference_v1Schema.safeParse(reference);
+  if (!parsed.success) {
     throw new PlanArtifactServiceError(
       "PLAN_REFERENCE_INVALID",
-      "The explicit plan reference is empty, overlong, or contains an invalid character",
+      "The immutable plan reference does not satisfy the bounded transport contract",
       "explicit"
     );
   }
-  return path57.isAbsolute(reference) ? path57.normalize(reference) : path57.resolve(workingDir, reference);
+  return parsed.data;
 }
-function readArtifact(filePath, source) {
-  let stat11;
-  try {
-    stat11 = fs48.statSync(filePath);
-  } catch {
+function parseScope(scope) {
+  if (scope === void 0) return void 0;
+  const parsed = PlanArtifactScope_v1Schema.safeParse(scope);
+  if (!parsed.success) {
     throw new PlanArtifactServiceError(
-      "PLAN_NOT_FOUND",
-      "The referenced integration plan does not exist",
-      source
+      "PLAN_REFERENCE_INVALID",
+      "The plan scope does not satisfy the bounded transport contract",
+      "explicit"
     );
   }
-  if (!stat11.isFile() || stat11.size > MAX_PLAN_BYTES) {
+  return parsed.data;
+}
+function resolveExplicitReference(reference, workingDir) {
+  if (reference.length === 0 || reference.includes("\0") || Buffer.byteLength(reference, "utf8") > MAX_PLAN_RETRIEVAL_REFERENCE_BYTES) {
     throw new PlanArtifactServiceError(
-      "PLAN_UNREADABLE",
-      "The referenced integration plan is not a readable bounded file",
+      "PLAN_REFERENCE_INVALID",
+      "The explicit plan reference is empty, overlong, or contains an invalid character",
+      "explicit"
+    );
+  }
+  return path57.isAbsolute(reference) ? path57.normalize(reference) : path57.resolve(workingDir, reference);
+}
+function readArtifact(filePath, source, hooks, expected, scope) {
+  const content = readPortableRaceDetectedFile(filePath, source, hooks);
+  const plan = loadPlan(content);
+  assertBoundedArtifact(plan, source);
+  const canonicalBytes2 = canonicalJSONStringify(plan);
+  const canonicalByteLength = Buffer.byteLength(canonicalBytes2, "utf8");
+  if (canonicalByteLength > MAX_PLAN_ARTIFACT_BYTES) {
+    throw new PlanArtifactServiceError(
+      "PLAN_ARTIFACT_LIMIT_EXCEEDED",
+      "The canonical integration plan exceeds the artifact byte limit",
       source
     );
   }
-  let content;
-  try {
-    content = fs48.readFileSync(filePath, "utf8");
-  } catch {
+  const artifactIdentity = {
+    contract: EXECUTION_PLAN_ARTIFACT_CONTRACT,
+    kind: "execution-plan",
+    planSchema: "lexrunner.execution-plan",
+    planSchemaVersion: plan.schemaVersion,
+    canonicalizationProfile: EXECUTION_PLAN_CANONICALIZATION_PROFILE,
+    hashProfile: EXECUTION_PLAN_HASH_PROFILE,
+    digestAlgorithm: "sha256",
+    digest: computeExecutionPlanArtifactDigest(canonicalBytes2),
+    canonicalByteLength,
+    target: plan.target,
+    summary: {
+      itemCount: plan.items.length,
+      gateCount: plan.items.reduce((count, item) => count + item.gates.length, 0)
+    }
+  };
+  const artifact = { identity: artifactIdentity, canonicalBytes: canonicalBytes2 };
+  if (expected && !isDeepStrictEqual(expected.artifact, artifactIdentity)) {
     throw new PlanArtifactServiceError(
-      "PLAN_UNREADABLE",
-      "The referenced integration plan could not be read",
+      "PLAN_REFERENCE_MISMATCH",
+      "The retrieved integration plan does not match the immutable reference",
       source
     );
   }
-  const plan = loadPlan(content);
-  assertBoundedArtifact(plan, source);
+  const reference = expected ?? parseReference({
+    contract: PLAN_ARTIFACT_REFERENCE_CONTRACT,
+    artifact: artifactIdentity,
+    expectedDigest: artifactIdentity.digest,
+    expectedCanonicalByteLength: artifactIdentity.canonicalByteLength,
+    retrieval: { kind: "file", reference: filePath },
+    ...scope ? { scope } : {}
+  });
   return {
     plan,
     identity: {
@@ -49692,10 +49898,167 @@ function readArtifact(filePath, source) {
       target: plan.target,
       itemCount: plan.items.length
     },
+    artifact,
+    reference,
+    acquisition: {
+      contract: "lexrunner.plan-artifact-acquisition.v1",
+      assurance: "portable-race-detection",
+      authority: "unverified"
+    },
     source,
     filePath
   };
 }
+function readPortableRaceDetectedFile(filePath, source, hooks) {
+  const initialPath = snapshotPath(filePath, source);
+  hooks.afterInitialPathSnapshot?.();
+  const noFollow = typeof fs48.constants.O_NOFOLLOW === "number" ? fs48.constants.O_NOFOLLOW : 0;
+  let descriptor;
+  try {
+    descriptor = fs48.openSync(filePath, fs48.constants.O_RDONLY | noFollow);
+  } catch (error) {
+    throw importError(error, source);
+  }
+  let bytes;
+  try {
+    const before = fs48.fstatSync(descriptor, { bigint: true });
+    assertOpenedIdentity(initialPath[initialPath.length - 1].stats, before, source);
+    hooks.afterOpen?.();
+    if (before.size > BigInt(MAX_PLAN_ARTIFACT_BYTES)) {
+      throw new PlanArtifactServiceError(
+        "PLAN_ARTIFACT_LIMIT_EXCEEDED",
+        "The referenced integration plan exceeds the artifact byte limit",
+        source
+      );
+    }
+    bytes = readAtMost(descriptor, MAX_PLAN_ARTIFACT_BYTES + 1);
+    hooks.afterRead?.();
+    const after = fs48.fstatSync(descriptor, { bigint: true });
+    assertStableOpenedFile(before, after, bytes.length, source);
+  } finally {
+    fs48.closeSync(descriptor);
+  }
+  hooks.beforeFinalPathSnapshot?.();
+  const finalPath = snapshotPath(filePath, source);
+  assertStablePath(initialPath, finalPath, source);
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new PlanArtifactServiceError(
+      "PLAN_UNREADABLE",
+      "The referenced integration plan is not valid UTF-8",
+      source
+    );
+  }
+}
+function snapshotPath(filePath, source) {
+  const absolute = path57.resolve(filePath);
+  const root = path57.parse(absolute).root;
+  const relative5 = path57.relative(root, absolute);
+  const segments = relative5.length === 0 ? [] : relative5.split(path57.sep);
+  const candidates = [root];
+  let current = root;
+  for (const segment of segments) {
+    current = path57.join(current, segment);
+    candidates.push(current);
+  }
+  return candidates.map((candidate, index) => {
+    let stats;
+    try {
+      stats = fs48.lstatSync(candidate, { bigint: true });
+    } catch (error) {
+      throw importError(error, source);
+    }
+    const leaf = index === candidates.length - 1;
+    if (stats.isSymbolicLink()) {
+      throw new PlanArtifactServiceError(
+        "PLAN_FILESYSTEM_UNSAFE",
+        "The integration plan path contains an unsafe filesystem object",
+        source
+      );
+    }
+    if (leaf ? !stats.isFile() : !stats.isDirectory()) {
+      throw new PlanArtifactServiceError(
+        "PLAN_UNREADABLE",
+        "The referenced integration plan is not a readable bounded file",
+        source
+      );
+    }
+    if (leaf && stats.nlink !== 1n) {
+      throw new PlanArtifactServiceError(
+        "PLAN_FILESYSTEM_UNSAFE",
+        "The integration plan file has an ambiguous filesystem identity",
+        source
+      );
+    }
+    return { stats, leaf };
+  });
+}
+function assertOpenedIdentity(pathStats, openedStats, source) {
+  if (!openedStats.isFile() || openedStats.nlink !== 1n || !sameObject(pathStats, openedStats) || pathStats.size !== openedStats.size || pathStats.mtimeNs !== openedStats.mtimeNs || pathStats.ctimeNs !== openedStats.ctimeNs) {
+    throw new PlanArtifactServiceError(
+      "PLAN_FILESYSTEM_UNSAFE",
+      "The integration plan filesystem identity changed during acquisition",
+      source
+    );
+  }
+}
+function assertStableOpenedFile(before, after, bytesRead, source) {
+  if (bytesRead > MAX_PLAN_ARTIFACT_BYTES) {
+    throw new PlanArtifactServiceError(
+      "PLAN_ARTIFACT_LIMIT_EXCEEDED",
+      "The referenced integration plan exceeds the artifact byte limit",
+      source
+    );
+  }
+  if (!after.isFile() || after.nlink !== 1n || !sameObject(before, after) || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || BigInt(bytesRead) !== before.size) {
+    throw new PlanArtifactServiceError(
+      "PLAN_FILESYSTEM_UNSAFE",
+      "The integration plan changed while its bytes were being acquired",
+      source
+    );
+  }
+}
+function assertStablePath(before, after, source) {
+  if (before.length !== after.length || before.some((entry, index) => {
+    const current = after[index];
+    return !current || entry.leaf !== current.leaf || !sameObject(entry.stats, current.stats) || entry.leaf && (entry.stats.size !== current.stats.size || entry.stats.mtimeNs !== current.stats.mtimeNs || entry.stats.ctimeNs !== current.stats.ctimeNs || current.stats.nlink !== 1n);
+  })) {
+    throw new PlanArtifactServiceError(
+      "PLAN_FILESYSTEM_UNSAFE",
+      "The integration plan path changed while its bytes were being acquired",
+      source
+    );
+  }
+}
+function sameObject(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;
+}
+function readAtMost(descriptor, maximumBytes) {
+  const buffer = Buffer.allocUnsafe(maximumBytes);
+  let offset = 0;
+  while (offset < maximumBytes) {
+    const count = fs48.readSync(descriptor, buffer, offset, maximumBytes - offset, null);
+    if (count === 0) break;
+    offset += count;
+  }
+  return buffer.subarray(0, offset);
+}
+function importError(error, source) {
+  const code = error?.code;
+  if (code === "ENOENT" || code === "ENOTDIR") {
+    return new PlanArtifactServiceError(
+      "PLAN_NOT_FOUND",
+      "The referenced integration plan does not exist",
+      source
+    );
+  }
+  return new PlanArtifactServiceError(
+    "PLAN_UNREADABLE",
+    "The referenced integration plan could not be safely read",
+    source
+  );
+}
 function assertBoundedArtifact(plan, source) {
   const labels = [
     plan.schemaVersion,
@@ -49710,11 +50073,277 @@ function assertBoundedArtifact(plan, source) {
     );
   }
 }
-function isRegularFile(filePath) {
+function pathEntryExists(filePath) {
   try {
-    return fs48.statSync(filePath).isFile();
-  } catch {
-    return false;
+    fs48.lstatSync(filePath);
+    return true;
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return false;
+    return true;
+  }
+}
+
+// src/application/plan-artifact-registration-service.ts
+import * as fs49 from "fs";
+import * as path58 from "path";
+import { randomUUID as randomUUID9 } from "crypto";
+var PlanArtifactRegistrationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "PlanArtifactRegistrationError";
+  }
+};
+var _PlanArtifactRegistrationService_instances, verifyExisting_fn;
+var PlanArtifactRegistrationService = class {
+  constructor() {
+    __privateAdd(this, _PlanArtifactRegistrationService_instances);
+  }
+  register(input) {
+    const parsed = ExecutionPlanArtifact_v1Schema.safeParse(input.artifact);
+    if (!parsed.success) {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_INVALID",
+        "The plan artifact does not satisfy the immutable artifact contract"
+      );
+    }
+    const artifact = parsed.data;
+    const scope = parseScope2(input.scope);
+    const storeDirectory = validateStoreReference(input.storeDirectory);
+    prepareControlledStore(storeDirectory);
+    const digestName = `${artifact.identity.digest.slice("sha256:".length)}.json`;
+    const artifactPath = path58.join(storeDirectory, digestName);
+    const reference = createRegisteredReference(artifact, artifactPath, scope);
+    if (pathEntryExists2(artifactPath)) {
+      return __privateMethod(this, _PlanArtifactRegistrationService_instances, verifyExisting_fn).call(this, artifact, reference, false);
+    }
+    const temporaryPath = path58.join(storeDirectory, `.plan-${randomUUID9()}.tmp`);
+    let temporaryCreated = false;
+    try {
+      const descriptor = fs49.openSync(
+        temporaryPath,
+        fs49.constants.O_WRONLY | fs49.constants.O_CREAT | fs49.constants.O_EXCL,
+        384
+      );
+      temporaryCreated = true;
+      try {
+        writeAll(descriptor, Buffer.from(artifact.canonicalBytes, "utf8"));
+        fs49.fsyncSync(descriptor);
+      } finally {
+        fs49.closeSync(descriptor);
+      }
+      try {
+        fs49.linkSync(temporaryPath, artifactPath);
+      } catch (error) {
+        if (!pathEntryExists2(artifactPath)) throw error;
+        return __privateMethod(this, _PlanArtifactRegistrationService_instances, verifyExisting_fn).call(this, artifact, reference, false);
+      }
+      try {
+        fs49.unlinkSync(temporaryPath);
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      temporaryCreated = false;
+      flushDirectoryWhenSupported(storeDirectory);
+      assertStoreDirectory(storeDirectory);
+      return __privateMethod(this, _PlanArtifactRegistrationService_instances, verifyExisting_fn).call(this, artifact, reference, true);
+    } catch (error) {
+      if (error instanceof PlanArtifactRegistrationError) throw error;
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_UNSAFE",
+        "The plan artifact could not be published without replacing existing bytes"
+      );
+    } finally {
+      if (temporaryCreated) {
+        try {
+          fs49.unlinkSync(temporaryPath);
+        } catch {
+        }
+      }
+    }
+  }
+};
+_PlanArtifactRegistrationService_instances = new WeakSet();
+verifyExisting_fn = function(artifact, reference, created) {
+  try {
+    waitForConcurrentPublisher(reference.retrieval.reference);
+    const resolved = new PlanArtifactService().resolve({ planReference: reference });
+    if (resolved.artifact.canonicalBytes !== artifact.canonicalBytes) {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_CONFLICT",
+        "The content-addressed plan object conflicts with the requested artifact"
+      );
+    }
+    return {
+      artifact: resolved.artifact,
+      reference,
+      created,
+      storage: { assurance: "service-no-replace-verified", authority: "unverified" }
+    };
+  } catch (error) {
+    if (error instanceof PlanArtifactRegistrationError) throw error;
+    if (error instanceof PlanArtifactServiceError && error.code === "PLAN_REFERENCE_MISMATCH") {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_CONFLICT",
+        "The content-addressed plan object conflicts with the requested artifact"
+      );
+    }
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_VERIFY_FAILED",
+      "The persisted plan artifact could not be reread and verified"
+    );
+  }
+};
+function createRegisteredReference(artifact, artifactPath, scope) {
+  if (Buffer.byteLength(artifactPath, "utf8") > 4096) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The artifact store cannot produce a bounded retrieval reference"
+    );
+  }
+  const reference = {
+    contract: PLAN_ARTIFACT_REFERENCE_CONTRACT,
+    artifact: artifact.identity,
+    expectedDigest: artifact.identity.digest,
+    expectedCanonicalByteLength: artifact.identity.canonicalByteLength,
+    retrieval: { kind: "registered", reference: artifactPath },
+    ...scope ? { scope } : {}
+  };
+  const parsed = PlanArtifactReference_v1Schema.safeParse(reference);
+  if (!parsed.success) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The registered artifact reference does not satisfy the bounded transport contract"
+    );
+  }
+  return parsed.data;
+}
+function parseScope2(scope) {
+  if (scope === void 0) return void 0;
+  const parsed = PlanArtifactScope_v1Schema.safeParse(scope);
+  if (!parsed.success) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The plan scope does not satisfy the bounded transport contract"
+    );
+  }
+  return parsed.data;
+}
+function validateStoreReference(reference) {
+  if (reference.length === 0 || reference.includes("\0") || Buffer.byteLength(reference, "utf8") > 4096) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The artifact store reference is invalid or exceeds its bound"
+    );
+  }
+  return path58.resolve(reference);
+}
+function prepareControlledStore(storeDirectory) {
+  const root = path58.parse(storeDirectory).root;
+  const segments = path58.relative(root, storeDirectory).split(path58.sep).filter(Boolean);
+  let current = root;
+  for (const segment of segments) {
+    current = path58.join(current, segment);
+    try {
+      const stats = fs49.lstatSync(current);
+      if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        throw new PlanArtifactRegistrationError(
+          "PLAN_REGISTRATION_UNSAFE",
+          "The artifact store contains an unsafe filesystem object"
+        );
+      }
+    } catch (error) {
+      if (error instanceof PlanArtifactRegistrationError) throw error;
+      if (error.code !== "ENOENT") {
+        throw new PlanArtifactRegistrationError(
+          "PLAN_REGISTRATION_UNSAFE",
+          "The artifact store identity is unavailable"
+        );
+      }
+      try {
+        fs49.mkdirSync(current, { mode: 448 });
+      } catch (mkdirError) {
+        if (mkdirError.code !== "EEXIST") {
+          throw new PlanArtifactRegistrationError(
+            "PLAN_REGISTRATION_UNSAFE",
+            "The artifact store could not be prepared"
+          );
+        }
+      }
+      const created = fs49.lstatSync(current);
+      if (created.isSymbolicLink() || !created.isDirectory()) {
+        throw new PlanArtifactRegistrationError(
+          "PLAN_REGISTRATION_UNSAFE",
+          "The artifact store contains an unsafe filesystem object"
+        );
+      }
+    }
+  }
+  assertStoreDirectory(storeDirectory);
+}
+function assertStoreDirectory(storeDirectory) {
+  const root = path58.parse(storeDirectory).root;
+  const segments = path58.relative(root, storeDirectory).split(path58.sep).filter(Boolean);
+  let current = root;
+  for (const segment of segments) {
+    current = path58.join(current, segment);
+    let stats;
+    try {
+      stats = fs49.lstatSync(current);
+    } catch {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_UNSAFE",
+        "The artifact store identity is unavailable"
+      );
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_UNSAFE",
+        "The artifact store contains an unsafe filesystem object"
+      );
+    }
+  }
+}
+function writeAll(descriptor, bytes) {
+  let offset = 0;
+  while (offset < bytes.length) {
+    offset += fs49.writeSync(descriptor, bytes, offset, bytes.length - offset, null);
+  }
+}
+function flushDirectoryWhenSupported(directory) {
+  let descriptor;
+  try {
+    descriptor = fs49.openSync(directory, fs49.constants.O_RDONLY);
+    fs49.fsyncSync(descriptor);
+  } catch (error) {
+    const code = error?.code;
+    if (process.platform !== "win32" || code !== "EISDIR" && code !== "EPERM") throw error;
+  } finally {
+    if (descriptor !== void 0) fs49.closeSync(descriptor);
+  }
+}
+function pathEntryExists2(filePath) {
+  try {
+    fs49.lstatSync(filePath);
+    return true;
+  } catch (error) {
+    const code = error?.code;
+    return code !== "ENOENT" && code !== "ENOTDIR";
+  }
+}
+function waitForConcurrentPublisher(artifactPath) {
+  const deadline = Date.now() + 500;
+  const signal = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() < deadline) {
+    let stats;
+    try {
+      stats = fs49.lstatSync(artifactPath);
+    } catch {
+      return;
+    }
+    if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink <= 1) return;
+    Atomics.wait(signal, 0, 0, 10);
   }
 }
 
@@ -50273,7 +50902,7 @@ workspaceCmd.command("init").description("Initialize lexrunner workspace with in
         force: opts.force
       });
       if (isJsonMode) {
-        const { writeSuccessEnvelope } = await import("./jsonEnvelope-K2U5CWKU.js");
+        const { writeSuccessEnvelope } = await import("./jsonEnvelope-MXJM5ZQH.js");
         writeSuccessEnvelope("lex-pr workspace init", initialized);
       } else {
         console.log(
@@ -50293,7 +50922,7 @@ workspaceCmd.command("init").description("Initialize lexrunner workspace with in
       policyTemplate: opts.policyTemplate
     });
     if (isJsonMode) {
-      const { writeSuccessEnvelope, writeErrorEnvelope } = await import("./jsonEnvelope-K2U5CWKU.js");
+      const { writeSuccessEnvelope, writeErrorEnvelope } = await import("./jsonEnvelope-MXJM5ZQH.js");
       if (result.success) {
         writeSuccessEnvelope("lex-pr workspace init", {
           profileDir: result.profileDir,
@@ -50321,7 +50950,7 @@ workspaceCmd.command("init").description("Initialize lexrunner workspace with in
       throw error;
     }
     if (isJsonMode) {
-      const { writeErrorEnvelope, errorToJsonError } = await import("./jsonEnvelope-K2U5CWKU.js");
+      const { writeErrorEnvelope, errorToJsonError } = await import("./jsonEnvelope-MXJM5ZQH.js");
       if (error instanceof WorkspaceConfigServiceError) {
         writeErrorEnvelope("lex-pr workspace init", {
           code: error.code,
@@ -50418,7 +51047,7 @@ program.command("init").description("Initialize lexrunner workspace with interac
       jsonMode: isJsonMode
     });
     if (isJsonMode) {
-      const { writeSuccessEnvelope, writeErrorEnvelope, errorToJsonError } = await import("./jsonEnvelope-K2U5CWKU.js");
+      const { writeSuccessEnvelope, writeErrorEnvelope, errorToJsonError } = await import("./jsonEnvelope-MXJM5ZQH.js");
       if (result.success) {
         writeSuccessEnvelope("lex-pr init", {
           profileDir: result.profileDir,
@@ -50446,7 +51075,7 @@ program.command("init").description("Initialize lexrunner workspace with interac
       throw error;
     }
     if (isJsonMode) {
-      const { writeErrorEnvelope, errorToJsonError } = await import("./jsonEnvelope-K2U5CWKU.js");
+      const { writeErrorEnvelope, errorToJsonError } = await import("./jsonEnvelope-MXJM5ZQH.js");
       if (error instanceof WriteProtectionError) {
         writeErrorEnvelope("lex-pr init", {
           code: "EWRITE_PROTECTED",
@@ -50642,8 +51271,8 @@ program.command("view").description("Interactive plan viewer with navigation and
     throwExit(1);
   }
   try {
-    const { InteractivePlanViewer } = await import("./planViewer-TRSQVMH4.js");
-    const planContent = fs49.readFileSync(planFile, "utf-8");
+    const { InteractivePlanViewer } = await import("./planViewer-WOV6A2HZ.js");
+    const planContent = fs50.readFileSync(planFile, "utf-8");
     const plan = loadPlan(planContent);
     const viewer = new InteractivePlanViewer(plan, {
       filter: opts.filter,
@@ -50659,7 +51288,7 @@ program.command("view").description("Interactive plan viewer with navigation and
 program.command("deliverables:list").description("List all autopilot deliverables with metadata").option("--profile-dir <dir>", "Profile directory (default: .smartergpt)").option("--json", "Output JSON format").action(async (opts) => {
   try {
     const profile = resolveProfile(opts.profileDir);
-    const { DeliverablesManager } = await import("./autopilot-3OHEUTHD.js");
+    const { DeliverablesManager } = await import("./autopilot-JWIOXBCZ.js");
     const manager = new DeliverablesManager(profile.path);
     const deliverables = await manager.listDeliverables();
     if (opts.json) {
@@ -50685,7 +51314,7 @@ program.command("deliverables:list").description("List all autopilot deliverable
       });
       const latest = manager.getLatestPath();
       if (latest) {
-        console.log(`\u{1F4CD} Latest: ${path58.basename(latest)}`);
+        console.log(`\u{1F4CD} Latest: ${path59.basename(latest)}`);
       }
     }
   } catch (error) {
@@ -50698,7 +51327,7 @@ program.command("deliverables:list").description("List all autopilot deliverable
 program.command("deliverables:cleanup").description("Clean up old deliverables based on retention policy").option("--profile-dir <dir>", "Profile directory (default: .smartergpt)").option("--max-age <days>", "Maximum age in days (deletes older deliverables)").option("--max-count <count>", "Maximum number of deliverables to keep").option("--keep-latest", "Always keep the latest deliverables (default: true)", true).option("--dry-run", "Preview cleanup without deleting").option("--json", "Output JSON format").action(async (opts) => {
   try {
     const profile = resolveProfile(opts.profileDir);
-    const { DeliverablesManager } = await import("./autopilot-3OHEUTHD.js");
+    const { DeliverablesManager } = await import("./autopilot-JWIOXBCZ.js");
     const manager = new DeliverablesManager(profile.path);
     const policy = {
       maxAge: opts.maxAge ? parseInt(opts.maxAge) : void 0,
@@ -50759,8 +51388,8 @@ program.command("deliverables:cleanup").description("Clean up old deliverables b
         console.log(`Freed space: ${(result.freedSpace / 1024).toFixed(2)} KB`);
         if (result.removed.length > 0) {
           console.log("\nRemoved:");
-          result.removed.forEach((path59) => {
-            console.log(`  - ${path59}`);
+          result.removed.forEach((path60) => {
+            console.log(`  - ${path60}`);
           });
         }
       }
@@ -50831,8 +51460,8 @@ var isDirectExec = (() => {
   try {
     if (typeof import.meta === "undefined") return false;
     if (!process.argv[1] || !import.meta.url) return false;
-    const invokedPath = fs49.realpathSync(resolve14(process.argv[1]));
-    const modulePath = fs49.realpathSync(fileURLToPath6(import.meta.url));
+    const invokedPath = fs50.realpathSync(resolve15(process.argv[1]));
+    const modulePath = fs50.realpathSync(fileURLToPath6(import.meta.url));
     return invokedPath === modulePath;
   } catch {
     return false;
@@ -50902,11 +51531,17 @@ export {
   ConfigurationQueryService,
   ControllerLease_v1,
   DiscoveryQueryService,
+  EXECUTION_PLAN_ARTIFACT_CONTRACT,
+  EXECUTION_PLAN_CANONICALIZATION_PROFILE,
+  EXECUTION_PLAN_HASH_DOMAIN,
+  EXECUTION_PLAN_HASH_PROFILE,
   EngineVerificationCheckSource_v2,
   EngineVerificationDeterminism_v2,
   EngineVerificationTrustGapReason_v2,
   ExecutionEnvelope_v1,
   ExecutionEnvironmentOS,
+  ExecutionPlanArtifactIdentity_v1Schema,
+  ExecutionPlanArtifact_v1Schema,
   ExecutionState,
   ExternalAwaitOutcome_v1,
   ExternalAwaitableDescriptor_v1,
@@ -50962,6 +51597,11 @@ export {
   NativeWslProjectionSelection_v1,
   NativeWslProjectionStatusRequestJsonSchema,
   NativeWslSourceObservation_v1,
+  PLAN_ARTIFACT_REFERENCE_CONTRACT,
+  PlanArtifactReference_v1Schema,
+  PlanArtifactRegistrationError,
+  PlanArtifactRegistrationService,
+  PlanArtifactScope_v1Schema,
   PlanArtifactService,
   PlanArtifactServiceError,
   PlanCreationService,
@@ -50991,6 +51631,7 @@ export {
   completionForAttemptAwaitable,
   computeAgentEngineVerificationV2Hash,
   computeAgentTaskPacketHash,
+  computeExecutionPlanArtifactDigest,
   computeFanInEvidenceSetHash,
   computeMergeOrder,
   containsAttemptAwaitableCredentialValue,