@smartergpt/lexrunner 2.0.2 → 2.1.0

package/dist/cli.cjs

@@ -7,6 +7,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __esm = (fn, res, err) => function __init() {
   if (err) throw err[0];
@@ -45,6 +48,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
 // src/tiers/schema.ts
 function parseTierOverride(overrideStr) {
@@ -717,10 +725,10 @@ function formatPlanValidationFailureText(failure5) {
   return lines.join("\n");
 }
 function normalizeValidationIssue(issue) {
-  const path81 = normalizeValidationPath(issue.path);
+  const path82 = normalizeValidationPath(issue.path);
   const stableCustomIssue = safeCustomValidationIssue(issue);
   return {
-    path: boundDiagnostic(path81, MAX_SCHEMA_VALIDATION_PATH_BYTES),
+    path: boundDiagnostic(path82, MAX_SCHEMA_VALIDATION_PATH_BYTES),
     message: boundDiagnostic(
       stableCustomIssue?.message ?? safeValidationMessage(issue.code),
       MAX_SCHEMA_VALIDATION_MESSAGE_BYTES
@@ -1252,7 +1260,7 @@ var init_performance = __esm({
           if (global.gc) {
             global.gc();
           }
-          await new Promise((resolve28) => setTimeout(resolve28, 100));
+          await new Promise((resolve29) => setTimeout(resolve29, 100));
         }
       }
       /**
@@ -1421,26 +1429,26 @@ function detectCycles(graph) {
   const visited = /* @__PURE__ */ new Set();
   const recursionStack = /* @__PURE__ */ new Set();
   const cycles = [];
-  const path81 = [];
+  const path82 = [];
   function dfs(node) {
     visited.add(node);
     recursionStack.add(node);
-    path81.push(node);
+    path82.push(node);
     const neighbors = graph.get(node) || [];
     for (const neighbor of neighbors) {
       if (!visited.has(neighbor)) {
         dfs(neighbor);
       } else if (recursionStack.has(neighbor)) {
-        const cycleStart = path81.indexOf(neighbor);
+        const cycleStart = path82.indexOf(neighbor);
         if (cycleStart !== -1) {
-          const cycle = path81.slice(cycleStart);
+          const cycle = path82.slice(cycleStart);
           cycle.push(neighbor);
           cycles.push(cycle);
         }
       }
     }
     recursionStack.delete(node);
-    path81.pop();
+    path82.pop();
   }
   for (const node of graph.keys()) {
     if (!visited.has(node)) {
@@ -1870,7 +1878,7 @@ async function withTimeout(promise, timeoutMs) {
   ]);
 }
 function delay(ms) {
-  return new Promise((resolve28) => setTimeout(resolve28, ms));
+  return new Promise((resolve29) => setTimeout(resolve29, ms));
 }
 function formatErrorForUser(classified) {
   const lines = [];
@@ -4027,8 +4035,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path81 = req.path;
-        _req.url = typeof path81 === "string" ? path81 : req.url ? req.url.path || req.url : void 0;
+        const path82 = req.path;
+        _req.url = typeof path82 === "string" ? path82 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -4193,14 +4201,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path81) {
+    function parsePath(path82) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path81.length; i++) {
-        const char = path81[i];
+      for (let i = 0; i < path82.length; i++) {
+        const char = path82[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -4331,10 +4339,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path81 of paths) {
-        const parts = parsePath(path81);
+      for (const path82 of paths) {
+        const parts = parsePath(path82);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path81, remove);
+          redactWildcardPath(obj, parts, censor, path82, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -4419,8 +4427,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path81) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path81];
+            const wrappedCensor = typeof censor === "function" ? (value, path82) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path82];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -4455,8 +4463,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path81 of pathsToClone) {
-        const parts = parsePath(path81);
+      for (const path82 of pathsToClone) {
+        const parts = parsePath(path82);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -4508,24 +4516,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path81) {
-      if (typeof path81 !== "string") {
+    function validatePath(path82) {
+      if (typeof path82 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path81 === "") {
+      if (path82 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path81.includes("..")) {
-        throw new Error(`Invalid redaction path (${path81})`);
+      if (path82.includes("..")) {
+        throw new Error(`Invalid redaction path (${path82})`);
       }
-      if (path81.includes(",")) {
-        throw new Error(`Invalid redaction path (${path81})`);
+      if (path82.includes(",")) {
+        throw new Error(`Invalid redaction path (${path82})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path81.length; i++) {
-        const char = path81[i];
+      for (let i = 0; i < path82.length; i++) {
+        const char = path82[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -4539,20 +4547,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path81})`);
+            throw new Error(`Invalid redaction path (${path82})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path81})`);
+        throw new Error(`Invalid redaction path (${path82})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path81 of paths) {
-        validatePath(path81);
+      for (const path82 of paths) {
+        validatePath(path82);
       }
     }
     function slowRedact(options = {}) {
@@ -4720,8 +4728,8 @@ var require_redaction = __commonJS({
         if (shape[k] === null) {
           o[k] = (value) => topCensor(value, [k]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path81) => {
-            return censor(value, [k, ...path81]);
+          const wrappedCensor = typeof censor === "function" ? (value, path82) => {
+            return censor(value, [k, ...path82]);
           } : censor;
           o[k] = Redact({
             paths: shape[k],
@@ -4939,10 +4947,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs73 = require("fs");
+    var fs74 = require("fs");
     var EventEmitter = require("events");
     var inherits = require("util").inherits;
-    var path81 = require("path");
+    var path82 = require("path");
     var sleep2 = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -4996,20 +5004,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs73.mkdirSync(path81.dirname(file), { recursive: true });
-          const fd = fs73.openSync(file, flags, mode);
+          if (sonic.mkdir) fs74.mkdirSync(path82.dirname(file), { recursive: true });
+          const fd = fs74.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs73.mkdir(path81.dirname(file), { recursive: true }, (err) => {
+        fs74.mkdir(path82.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs73.open(file, flags, mode, fileOpened);
+          fs74.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs73.open(file, flags, mode, fileOpened);
+        fs74.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -5050,8 +5058,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs73.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs73.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs74.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs74.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -5060,15 +5068,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs73.writeSync(this.fd, this._writingBuf);
+            return fs74.writeSync(this.fd, this._writingBuf);
           }
-          return fs73.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs74.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs73.write(this.fd, this._writingBuf, this.release);
+            return fs74.write(this.fd, this._writingBuf, this.release);
           }
-          return fs73.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs74.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -5125,7 +5133,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs73.fsyncSync(this.fd);
+          fs74.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -5239,7 +5247,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs73.fsync(this.fd, (err) => {
+            fs74.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -5341,7 +5349,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs73.close(fd, (err) => {
+          fs74.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -5390,7 +5398,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs73.writeSync(this.fd, buf) : fs73.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs74.writeSync(this.fd, buf) : fs74.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -5406,7 +5414,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs73.fsyncSync(this.fd);
+        fs74.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -5427,7 +5435,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs73.writeSync(this.fd, buf);
+          const n = fs74.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -5455,13 +5463,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs73.writeSync(this.fd, this._writingBuf) : fs73.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs74.writeSync(this.fd, this._writingBuf) : fs74.writeSync(this.fd, this._writingBuf, "utf8");
           release3(null, written);
         } catch (err) {
           release3(err);
         }
       } else {
-        fs73.write(this.fd, this._writingBuf, release3);
+        fs74.write(this.fd, this._writingBuf, release3);
       }
     }
     function actualWriteBuffer() {
@@ -5470,7 +5478,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs73.writeSync(this.fd, this._writingBuf);
+          const written = fs74.writeSync(this.fd, this._writingBuf);
           release3(null, written);
         } catch (err) {
           release3(err);
@@ -5479,7 +5487,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs73.write(this.fd, this._writingBuf, release3);
+        fs74.write(this.fd, this._writingBuf, release3);
       }
     }
     function actualClose(sonic) {
@@ -5495,12 +5503,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs73.fsync(sonic.fd, closeWrapped);
+        fs74.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs73.close(sonic.fd, done);
+          fs74.close(sonic.fd, done);
         } else {
           done();
         }
@@ -5753,7 +5761,7 @@ var require_thread_stream = __commonJS({
     var { version } = require_package();
     var { EventEmitter } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join61 } = require("path");
+    var { join: join62 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -5804,7 +5812,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join61(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join62(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -5968,7 +5976,7 @@ var require_thread_stream = __commonJS({
         }
         if (this[kImpl].flushing && this[kImpl].bufLen + dataBuf.length >= MAX_STRING) {
           try {
-            writeSync(this);
+            writeSync2(this);
             this[kImpl].flushing = true;
           } catch (err) {
             destroy(this, err);
@@ -5979,7 +5987,7 @@ var require_thread_stream = __commonJS({
         this[kImpl].bufLen += dataBuf.length;
         if (this[kImpl].sync) {
           try {
-            writeSync(this);
+            writeSync2(this);
             return true;
           } catch (err) {
             destroy(this, err);
@@ -6014,7 +6022,7 @@ var require_thread_stream = __commonJS({
         if (this[kImpl].destroyed) {
           return;
         }
-        writeSync(this);
+        writeSync2(this);
         flushSync(this);
       }
       unref() {
@@ -6218,7 +6226,7 @@ var require_thread_stream = __commonJS({
         destroy(stream, err);
       }
     }
-    function writeSync(stream) {
+    function writeSync2(stream) {
       const cb = () => {
         if (stream[kImpl].ending) {
           end(stream);
@@ -6272,7 +6280,7 @@ var require_transport = __commonJS({
     var { createRequire: createRequire2 } = require("module");
     var { existsSync: existsSync55 } = require("fs");
     var getCallers = require_caller();
-    var { join: join61, isAbsolute: isAbsolute12, sep: sep5 } = require("path");
+    var { join: join62, isAbsolute: isAbsolute12, sep: sep7 } = require("path");
     var { fileURLToPath: fileURLToPath9 } = require("url");
     var sleep2 = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -6336,15 +6344,15 @@ var require_transport = __commonJS({
       if (!unquoted) {
         return false;
       }
-      let path81 = unquoted;
-      if (path81.startsWith("file://")) {
+      let path82 = unquoted;
+      if (path82.startsWith("file://")) {
         try {
-          path81 = fileURLToPath9(path81);
+          path82 = fileURLToPath9(path82);
         } catch {
           return false;
         }
       }
-      return isAbsolute12(path81) && !existsSync55(path81);
+      return isAbsolute12(path82) && !existsSync55(path82);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -6425,7 +6433,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join61(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join62(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -6443,7 +6451,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline) {
-        target = bundlerOverrides["pino-worker"] || join61(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join62(__dirname, "worker.js");
         options.pipelines = [pipeline.map((dest) => {
           return {
             ...dest,
@@ -6466,12 +6474,12 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join61(__dirname, "..", "file.js");
+          return join62(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
           try {
-            const context = filePath === "node:repl" ? process.cwd() + sep5 : filePath;
+            const context = filePath === "node:repl" ? process.cwd() + sep7 : filePath;
             fixTarget2 = createRequire2(context).resolve(origin);
             break;
           } catch (err) {
@@ -7447,7 +7455,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join61 = ",";
+            let join62 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -7461,7 +7469,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join61 = `,
+                join62 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -7469,13 +7477,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join61;
+                res += join62;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join61}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join62}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -7496,7 +7504,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join61 = `,
+              join62 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -7510,13 +7518,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join61;
+                separator = join62;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join61;
+              separator = join62;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -7557,7 +7565,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join61 = ",";
+            let join62 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -7570,7 +7578,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join61 = `,
+                join62 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -7578,13 +7586,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join61;
+                res += join62;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join61}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join62}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -7597,7 +7605,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join61 = `,
+              join62 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -7606,7 +7614,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join61;
+                separator = join62;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -7664,20 +7672,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join62 = `,
+              const join63 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join62;
+                res2 += join63;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join62}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join63}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -7693,16 +7701,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join61 = `,
+            const join62 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join61, maximumBreadth);
+              res += stringifyTypedArray(value, join62, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join61;
+              separator = join62;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -7713,13 +7721,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join61;
+                separator = join62;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join61;
+              separator = join62;
             }
             if (separator !== "") {
               res = `
@@ -9247,7 +9255,7 @@ var require_postgres_interval = __commonJS({
       if (!(this instanceof PostgresInterval)) {
         return new PostgresInterval(raw);
       }
-      extend(this, parse6(raw));
+      extend(this, parse8(raw));
     }
     var properties = ["seconds", "minutes", "hours", "days", "months", "years"];
     PostgresInterval.prototype.toPostgres = function() {
@@ -9308,7 +9316,7 @@ var require_postgres_interval = __commonJS({
       var microseconds = fraction + "000000".slice(fraction.length);
       return parseInt(microseconds, 10) / 1e3;
     }
-    function parse6(interval) {
+    function parse8(interval) {
       if (!interval) return {};
       var matches = INTERVAL.exec(interval);
       var isNegative = matches[8] === "-";
@@ -9797,13 +9805,13 @@ var require_binaryParsers = __commonJS({
           console.log("ERROR: ElementType not implemented: " + elementType2);
         }
       };
-      var parse6 = function(dimension, elementType2) {
+      var parse8 = function(dimension, elementType2) {
         var array = [];
         var i2;
         if (dimension.length > 1) {
           var count = dimension.shift();
           for (i2 = 0; i2 < count; i2++) {
-            array[i2] = parse6(dimension, elementType2);
+            array[i2] = parse8(dimension, elementType2);
           }
           dimension.unshift(count);
         } else {
@@ -9813,7 +9821,7 @@ var require_binaryParsers = __commonJS({
         }
         return array;
       };
-      return parse6(dims, elementType);
+      return parse8(dims, elementType);
     };
     var parseText = function(value) {
       return value.toString("utf8");
@@ -10564,7 +10572,7 @@ var require_type_overrides = __commonJS({
 var require_pg_connection_string = __commonJS({
   "node_modules/pg-connection-string/index.js"(exports2, module2) {
     "use strict";
-    function parse6(str, options = {}) {
+    function parse8(str, options = {}) {
       if (str.charAt(0) === "/") {
         const config2 = str.split(" ");
         return { host: config2[0], database: config2[1] };
@@ -10620,15 +10628,15 @@ var require_pg_connection_string = __commonJS({
       if (config.sslnegotiation === "direct" && config.ssl === void 0) {
         config.ssl = true;
       }
-      const fs73 = config.sslcert || config.sslkey || config.sslrootcert ? require("fs") : null;
+      const fs74 = config.sslcert || config.sslkey || config.sslrootcert ? require("fs") : null;
       if (config.sslcert) {
-        config.ssl.cert = fs73.readFileSync(config.sslcert).toString();
+        config.ssl.cert = fs74.readFileSync(config.sslcert).toString();
       }
       if (config.sslkey) {
-        config.ssl.key = fs73.readFileSync(config.sslkey).toString();
+        config.ssl.key = fs74.readFileSync(config.sslkey).toString();
       }
       if (config.sslrootcert) {
-        config.ssl.ca = fs73.readFileSync(config.sslrootcert).toString();
+        config.ssl.ca = fs74.readFileSync(config.sslrootcert).toString();
       }
       if (options.useLibpqCompat && config.uselibpqcompat) {
         throw new Error("Both useLibpqCompat and uselibpqcompat are set. Please use only one of them.");
@@ -10726,7 +10734,7 @@ var require_pg_connection_string = __commonJS({
       return poolConfig;
     }
     function parseIntoClientConfig(str) {
-      return toClientConfig(parse6(str));
+      return toClientConfig(parse8(str));
     }
     function deprecatedSslModeWarning(sslmode) {
       if (!deprecatedSslModeWarning.warned && typeof process !== "undefined" && process.emitWarning) {
@@ -10741,10 +10749,10 @@ To prepare for this change:
 See https://www.postgresql.org/docs/current/libpq-ssl.html for libpq SSL mode definitions.`);
       }
     }
-    module2.exports = parse6;
-    parse6.parse = parse6;
-    parse6.toClientConfig = toClientConfig;
-    parse6.parseIntoClientConfig = parseIntoClientConfig;
+    module2.exports = parse8;
+    parse8.parse = parse8;
+    parse8.toClientConfig = toClientConfig;
+    parse8.parseIntoClientConfig = parseIntoClientConfig;
   }
 });
 
@@ -10754,7 +10762,7 @@ var require_connection_parameters = __commonJS({
     "use strict";
     var dns = require("dns");
     var defaults2 = require_defaults();
-    var parse6 = require_pg_connection_string().parse;
+    var parse8 = require_pg_connection_string().parse;
     var val = function(key, config, envVar) {
       if (config[key]) {
         return config[key];
@@ -10792,9 +10800,9 @@ var require_connection_parameters = __commonJS({
     };
     var ConnectionParameters = class {
       constructor(config) {
-        config = typeof config === "string" ? parse6(config) : config || {};
+        config = typeof config === "string" ? parse8(config) : config || {};
         if (config.connectionString) {
-          config = Object.assign({}, config, parse6(config.connectionString));
+          config = Object.assign({}, config, parse8(config.connectionString));
         }
         this.user = val("user", config);
         this.database = val("database", config);
@@ -11508,7 +11516,7 @@ var require_serializer = __commonJS({
       );
     };
     var emptyArray = [];
-    var parse6 = (query2) => {
+    var parse8 = (query2) => {
       const name = query2.name || "";
       if (name.length > 63) {
         console.error("Warning! Postgres only supports 63 characters for query names.");
@@ -11663,7 +11671,7 @@ var require_serializer = __commonJS({
       sendSASLInitialResponseMessage,
       sendSCRAMClientFinalMessage,
       query,
-      parse: parse6,
+      parse: parse8,
       bind,
       execute,
       describe,
@@ -12052,7 +12060,7 @@ var require_dist = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.DatabaseError = exports2.serialize = void 0;
-    exports2.parse = parse6;
+    exports2.parse = parse8;
     var messages_1 = require_messages();
     Object.defineProperty(exports2, "DatabaseError", { enumerable: true, get: function() {
       return messages_1.DatabaseError;
@@ -12062,10 +12070,10 @@ var require_dist = __commonJS({
       return serializer_1.serialize;
     } });
     var parser_1 = require_parser();
-    function parse6(stream, callback) {
+    function parse8(stream, callback) {
       const parser2 = new parser_1.Parser();
       stream.on("data", (buffer) => parser2.parse(buffer, callback));
-      return new Promise((resolve28) => stream.on("end", () => resolve28()));
+      return new Promise((resolve29) => stream.on("end", () => resolve29()));
     }
   }
 });
@@ -12151,7 +12159,7 @@ var require_connection = __commonJS({
   "node_modules/pg/lib/connection.js"(exports2, module2) {
     "use strict";
     var EventEmitter = require("events").EventEmitter;
-    var { parse: parse6, serialize } = require_dist();
+    var { parse: parse8, serialize } = require_dist();
     var stream = require_stream();
     var { getStream } = stream;
     var flushBuffer = serialize.flush();
@@ -12251,7 +12259,7 @@ var require_connection = __commonJS({
         self.emit("sslconnect");
       }
       attachListeners(stream2) {
-        parse6(stream2, (msg) => {
+        parse8(stream2, (msg) => {
           const eventName = msg.name === "error" ? "errorMessage" : msg.name;
           if (this._emitMessage) {
             this.emit("message", msg);
@@ -12448,7 +12456,7 @@ var require_split2 = __commonJS({
 var require_helper = __commonJS({
   "node_modules/pgpass/lib/helper.js"(exports2, module2) {
     "use strict";
-    var path81 = require("path");
+    var path82 = require("path");
     var Stream = require("stream").Stream;
     var split = require_split2();
     var util = require("util");
@@ -12487,7 +12495,7 @@ var require_helper = __commonJS({
     };
     module2.exports.getFileName = function(rawEnv) {
       var env = rawEnv || process.env;
-      var file = env.PGPASSFILE || (isWin ? path81.join(env.APPDATA || "./", "postgresql", "pgpass.conf") : path81.join(env.HOME || "./", ".pgpass"));
+      var file = env.PGPASSFILE || (isWin ? path82.join(env.APPDATA || "./", "postgresql", "pgpass.conf") : path82.join(env.HOME || "./", ".pgpass"));
       return file;
     };
     module2.exports.usePgPass = function(stats, fname) {
@@ -12619,16 +12627,16 @@ var require_helper = __commonJS({
 var require_lib = __commonJS({
   "node_modules/pgpass/lib/index.js"(exports2, module2) {
     "use strict";
-    var path81 = require("path");
-    var fs73 = require("fs");
+    var path82 = require("path");
+    var fs74 = require("fs");
     var helper = require_helper();
     module2.exports = function(connInfo, cb) {
       var file = helper.getFileName();
-      fs73.stat(file, function(err, stat12) {
+      fs74.stat(file, function(err, stat12) {
         if (err || !helper.usePgPass(stat12, file)) {
           return cb(void 0);
         }
-        var st = fs73.createReadStream(file);
+        var st = fs74.createReadStream(file);
         helper.getPassword(connInfo, st, cb);
       });
     };
@@ -12827,12 +12835,12 @@ var require_client = __commonJS({
           this._connect(callback);
           return;
         }
-        return new this._Promise((resolve28, reject) => {
+        return new this._Promise((resolve29, reject) => {
           this._connect((error) => {
             if (error) {
               reject(error);
             } else {
-              resolve28(this);
+              resolve29(this);
             }
           });
         });
@@ -13179,8 +13187,8 @@ var require_client = __commonJS({
         } else {
           query = new Query2(config, values, callback);
           if (!query.callback) {
-            result = new this._Promise((resolve28, reject) => {
-              query.callback = (err, res) => err ? reject(err) : resolve28(res);
+            result = new this._Promise((resolve29, reject) => {
+              query.callback = (err, res) => err ? reject(err) : resolve29(res);
             }).catch((err) => {
               Error.captureStackTrace(err);
               throw err;
@@ -13264,8 +13272,8 @@ var require_client = __commonJS({
         if (cb) {
           this.connection.once("end", cb);
         } else {
-          return new this._Promise((resolve28) => {
-            this.connection.once("end", resolve28);
+          return new this._Promise((resolve29) => {
+            this.connection.once("end", resolve29);
           });
         }
       }
@@ -13314,8 +13322,8 @@ var require_pg_pool = __commonJS({
       const cb = function(err, client) {
         err ? rej(err) : res(client);
       };
-      const result = new Promise2(function(resolve28, reject) {
-        res = resolve28;
+      const result = new Promise2(function(resolve29, reject) {
+        res = resolve29;
         rej = reject;
       }).catch((err) => {
         Error.captureStackTrace(err);
@@ -13376,7 +13384,7 @@ var require_pg_pool = __commonJS({
         if (typeof Promise2.try === "function") {
           return Promise2.try(f);
         }
-        return new Promise2((resolve28) => resolve28(f()));
+        return new Promise2((resolve29) => resolve29(f()));
       }
       _isFull() {
         return this._clients.length >= this.options.max;
@@ -13769,8 +13777,8 @@ var require_query2 = __commonJS({
     NativeQuery.prototype._getPromise = function() {
       if (this._promise) return this._promise;
       this._promise = new Promise(
-        function(resolve28, reject) {
-          this._once("end", resolve28);
+        function(resolve29, reject) {
+          this._once("end", resolve29);
           this._once("error", reject);
         }.bind(this)
       );
@@ -13948,12 +13956,12 @@ var require_client2 = __commonJS({
         this._connect(callback);
         return;
       }
-      return new this._Promise((resolve28, reject) => {
+      return new this._Promise((resolve29, reject) => {
         this._connect((error) => {
           if (error) {
             reject(error);
           } else {
-            resolve28(this);
+            resolve29(this);
           }
         });
       });
@@ -13977,8 +13985,8 @@ var require_client2 = __commonJS({
         query = new NativeQuery(config, values, callback);
         if (!query.callback) {
           let resolveOut, rejectOut;
-          result = new this._Promise((resolve28, reject) => {
-            resolveOut = resolve28;
+          result = new this._Promise((resolve29, reject) => {
+            resolveOut = resolve29;
             rejectOut = reject;
           }).catch((err) => {
             Error.captureStackTrace(err);
@@ -14041,8 +14049,8 @@ var require_client2 = __commonJS({
       }
       let result;
       if (!cb) {
-        result = new this._Promise(function(resolve28, reject) {
-          cb = (err) => err ? reject(err) : resolve28();
+        result = new this._Promise(function(resolve29, reject) {
+          cb = (err) => err ? reject(err) : resolve29();
         });
       }
       this.native.end(function() {
@@ -14522,7 +14530,7 @@ function loadPolicySnapshot(policyContent, policyPath) {
   }
   return policy;
 }
-function resolvePolicyPath(path81, options = {}) {
+function resolvePolicyPath(path82, options = {}) {
   const envPath = options.includeEnvironmentOverride === false ? void 0 : process.env[POLICY_PATH_ENV];
   if (envPath) {
     return {
@@ -14532,11 +14540,11 @@ function resolvePolicyPath(path81, options = {}) {
       workspaceRoot: null
     };
   }
-  if (path81) {
+  if (path82) {
     return {
-      path: (0, import_path4.resolve)(path81),
+      path: (0, import_path4.resolve)(path82),
       source: "argument",
-      searchedPaths: [(0, import_path4.resolve)(path81)],
+      searchedPaths: [(0, import_path4.resolve)(path82)],
       workspaceRoot: null
     };
   }
@@ -14579,11 +14587,11 @@ function resolvePolicyPath(path81, options = {}) {
     workspaceRoot
   };
 }
-function loadPolicy(path81, options = {}) {
-  if (cachedPolicy && !path81 && options.includeEnvironmentOverride !== false) {
+function loadPolicy(path82, options = {}) {
+  if (cachedPolicy && !path82 && options.includeEnvironmentOverride !== false) {
     return cachedPolicy;
   }
-  const resolution = resolvePolicyPath(path81, options);
+  const resolution = resolvePolicyPath(path82, options);
   try {
     if (!resolution.path) {
       throw new AXErrorException(POLICY_ERROR_CODES.POLICY_NOT_FOUND, `Policy file not found`, [
@@ -14623,7 +14631,7 @@ function loadPolicy(path81, options = {}) {
       throw error;
     }
     const err = error;
-    const policyPath = resolution.path || path81 || DEFAULT_POLICY_PATH;
+    const policyPath = resolution.path || path82 || DEFAULT_POLICY_PATH;
     if (err.code === "ENOENT") {
       logger6.error("Policy file not found", {
         operation: "loadPolicy",
@@ -14819,7 +14827,7 @@ async function resolveModulePath(input, options = {}) {
   }
 }
 async function resolveModulePaths(paths, options = {}) {
-  const resolutions = await Promise.all(paths.map((path81) => resolveModulePath(path81, options)));
+  const resolutions = await Promise.all(paths.map((path82) => resolveModulePath(path82, options)));
   return resolutions;
 }
 function extractCanonicalIds(resolutions) {
@@ -15767,10 +15775,10 @@ function prompt(question) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve28(answer.trim());
+      resolve29(answer.trim());
     });
   });
 }
@@ -15984,7 +15992,7 @@ async function terminateProcessTree(child, options = {}) {
     return { method: "taskkill", forceKilled: true, descendantsReaped: reaped };
   }
   const killGroup = options.killGroup ?? process.kill.bind(process);
-  const wait = options.wait ?? ((durationMs) => new Promise((resolve28) => setTimeout(resolve28, durationMs)));
+  const wait = options.wait ?? ((durationMs) => new Promise((resolve29) => setTimeout(resolve29, durationMs)));
   const graceMs = options.graceMs ?? 500;
   let method = "process-group";
   try {
@@ -16017,13 +16025,13 @@ function groupExists(pid, killGroup) {
   }
 }
 function runTaskkill(pid) {
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     const killer = (0, import_node_child_process3.spawn)("taskkill", ["/PID", String(pid), "/T", "/F"], {
       stdio: "ignore",
       windowsHide: true
     });
-    killer.once("error", () => resolve28(false));
-    killer.once("close", (code) => resolve28(code === 0 || code === 128));
+    killer.once("error", () => resolve29(false));
+    killer.once("close", (code) => resolve29(code === 0 || code === 128));
   });
 }
 var import_node_child_process3;
@@ -16724,7 +16732,7 @@ async function executeGate(gate, policy, artifactDir, timeoutMs = 3e4, itemName,
           `\u23F3 Retrying gate '${gate.name}' (attempt ${attempt}/${retryConfig.maxAttempts}) after ${retryConfig.backoffSeconds}s delay...`
         );
       }
-      await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+      await new Promise((resolve29) => setTimeout(resolve29, delayMs));
     }
     const result = await executeGateAttempt(
       gate,
@@ -16968,7 +16976,7 @@ async function executeLocalGate(gate, artifactDir, attempt, startedAt, startTime
       candidateDigest
     });
   }
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     let timedOut = false;
     let settled = false;
     const childProcess = (0, import_child_process.spawn)(shellExecutable, shell.arguments, {
@@ -17002,7 +17010,7 @@ async function executeLocalGate(gate, artifactDir, attempt, startedAt, startTime
       const stdoutText = stdout.toString("utf8");
       const stderrText = stderr.toString("utf8");
       const projectedStderr = timedOut ? `GATE_TIMEOUT: exceeded ${timeoutMs}ms; descendantsReaped=${cleanup?.descendantsReaped ?? false}` : stderrText.trim();
-      resolve28(
+      resolve29(
         finalizeLocalGateAttempt({
           gate,
           artifactBaselines,
@@ -17045,7 +17053,7 @@ async function executeLocalGate(gate, artifactDir, attempt, startedAt, startTime
       const classified = classifyError(error, `Gate '${gate.name}' process error`);
       console.error(formatErrorForUser(classified));
       const projectedStderr = `${classified.context}: ${error.message}`;
-      resolve28(
+      resolve29(
         finalizeLocalGateAttempt({
           gate,
           artifactBaselines,
@@ -17502,13 +17510,13 @@ async function executeGatesWithPolicy(plan, executionState, artifactDir, timeout
     if (promises.length > 0) {
       await Promise.race(promises);
     } else if (executing.size > 0) {
-      await new Promise((resolve28) => setTimeout(resolve28, 50));
+      await new Promise((resolve29) => setTimeout(resolve29, 50));
     } else {
       break;
     }
   }
   while (executing.size > 0) {
-    await new Promise((resolve28) => setTimeout(resolve28, 50));
+    await new Promise((resolve29) => setTimeout(resolve29, 50));
   }
 }
 function buildExecutionOrder(plan) {
@@ -17610,24 +17618,24 @@ var init_gates = __esm({
 // src/schema/gateReport.ts
 function formatValidationErrors(error) {
   return error.issues.map((issue) => {
-    const path81 = issue.path.join(".");
+    const path82 = issue.path.join(".");
     let suggestion;
     if (issue.code === "invalid_type") {
-      if (path81 === "started_at") {
+      if (path82 === "started_at") {
         suggestion = 'Use ISO 8601 format: "2024-01-15T10:30:00Z"';
-      } else if (path81 === "status") {
+      } else if (path82 === "status") {
         suggestion = 'Valid values: "pass" or "fail"';
-      } else if (path81 === "duration_ms") {
+      } else if (path82 === "duration_ms") {
         suggestion = "Must be a non-negative number (milliseconds)";
-      } else if (path81 === "item" || path81 === "gate") {
+      } else if (path82 === "item" || path82 === "gate") {
         suggestion = "Must be a non-empty string identifier";
       }
     } else if (issue.code === "invalid_value") {
-      if (path81 === "status") {
+      if (path82 === "status") {
         suggestion = 'Valid values: "pass" or "fail"';
       }
     } else if (issue.code === "too_small") {
-      if (path81 === "duration_ms") {
+      if (path82 === "duration_ms") {
         suggestion = "Duration must be >= 0 milliseconds";
       }
     } else if (issue.code === "unrecognized_keys") {
@@ -17635,7 +17643,7 @@ function formatValidationErrors(error) {
       suggestion = `Remove unexpected fields: ${keys}`;
     }
     return {
-      path: path81 || "root",
+      path: path82 || "root",
       message: issue.message,
       code: issue.code,
       suggestion
@@ -24986,10 +24994,10 @@ var init_emitter2 = __esm({
         await this.ingestSidecar();
         if (this.ndjsonStream) {
           const stream = this.ndjsonStream;
-          await new Promise((resolve28, reject) => {
+          await new Promise((resolve29, reject) => {
             stream.end((err) => {
               if (err) reject(err);
-              else resolve28();
+              else resolve29();
             });
           });
           this.ndjsonStream = null;
@@ -25770,10 +25778,10 @@ function prompt2(question) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve28(answer.trim());
+      resolve29(answer.trim());
     });
   });
 }
@@ -26481,10 +26489,10 @@ var init_planViewer = __esm({
         console.log(import_chalk13.default.gray("Navigation: \u2191/\u2193 | Filter: /search | Toggle: d(eps) g(ates) | Quit: q"));
       }
       async start() {
-        return new Promise((resolve28) => {
+        return new Promise((resolve29) => {
           if (this.filteredItems.length === 0) {
             console.log(import_chalk13.default.yellow("No items to display"));
-            resolve28();
+            resolve29();
             return;
           }
           this.render();
@@ -26495,7 +26503,7 @@ var init_planViewer = __esm({
           const onKeyPress = (str, key) => {
             if (key.name === "q" || key.ctrl && key.name === "c") {
               cleanup();
-              resolve28();
+              resolve29();
               return;
             }
             if (key.name === "up") {
@@ -26534,11 +26542,11 @@ var init_planViewer = __esm({
           input: process.stdin,
           output: process.stdout
         });
-        return new Promise((resolve28) => {
+        return new Promise((resolve29) => {
           rl.question(import_chalk13.default.yellow("Filter text (Enter to clear): "), (answer) => {
             this.filterText = answer.trim();
             rl.close();
-            resolve28();
+            resolve29();
           });
         });
       }
@@ -26602,11 +26610,17 @@ __export(cli_exports, {
   ConfigurationQueryService: () => ConfigurationQueryService,
   ControllerLease_v1: () => ControllerLease_v1,
   DiscoveryQueryService: () => DiscoveryQueryService,
+  EXECUTION_PLAN_ARTIFACT_CONTRACT: () => EXECUTION_PLAN_ARTIFACT_CONTRACT,
+  EXECUTION_PLAN_CANONICALIZATION_PROFILE: () => EXECUTION_PLAN_CANONICALIZATION_PROFILE,
+  EXECUTION_PLAN_HASH_DOMAIN: () => EXECUTION_PLAN_HASH_DOMAIN,
+  EXECUTION_PLAN_HASH_PROFILE: () => EXECUTION_PLAN_HASH_PROFILE,
   EngineVerificationCheckSource_v2: () => EngineVerificationCheckSource_v2,
   EngineVerificationDeterminism_v2: () => EngineVerificationDeterminism_v2,
   EngineVerificationTrustGapReason_v2: () => EngineVerificationTrustGapReason_v2,
   ExecutionEnvelope_v1: () => ExecutionEnvelope_v1,
   ExecutionEnvironmentOS: () => ExecutionEnvironmentOS,
+  ExecutionPlanArtifactIdentity_v1Schema: () => ExecutionPlanArtifactIdentity_v1Schema,
+  ExecutionPlanArtifact_v1Schema: () => ExecutionPlanArtifact_v1Schema,
   ExecutionState: () => ExecutionState,
   ExternalAwaitOutcome_v1: () => ExternalAwaitOutcome_v1,
   ExternalAwaitableDescriptor_v1: () => ExternalAwaitableDescriptor_v1,
@@ -26662,6 +26676,11 @@ __export(cli_exports, {
   NativeWslProjectionSelection_v1: () => NativeWslProjectionSelection_v1,
   NativeWslProjectionStatusRequestJsonSchema: () => NativeWslProjectionStatusRequestJsonSchema,
   NativeWslSourceObservation_v1: () => NativeWslSourceObservation_v1,
+  PLAN_ARTIFACT_REFERENCE_CONTRACT: () => PLAN_ARTIFACT_REFERENCE_CONTRACT,
+  PlanArtifactReference_v1Schema: () => PlanArtifactReference_v1Schema,
+  PlanArtifactRegistrationError: () => PlanArtifactRegistrationError,
+  PlanArtifactRegistrationService: () => PlanArtifactRegistrationService,
+  PlanArtifactScope_v1Schema: () => PlanArtifactScope_v1Schema,
   PlanArtifactService: () => PlanArtifactService,
   PlanArtifactServiceError: () => PlanArtifactServiceError,
   PlanCreationService: () => PlanCreationService,
@@ -26691,6 +26710,7 @@ __export(cli_exports, {
   completionForAttemptAwaitable: () => completionForAttemptAwaitable,
   computeAgentEngineVerificationV2Hash: () => computeAgentEngineVerificationV2Hash,
   computeAgentTaskPacketHash: () => computeAgentTaskPacketHash,
+  computeExecutionPlanArtifactDigest: () => computeExecutionPlanArtifactDigest,
   computeFanInEvidenceSetHash: () => computeFanInEvidenceSetHash,
   computeMergeOrder: () => computeMergeOrder,
   containsAttemptAwaitableCredentialValue: () => containsAttemptAwaitableCredentialValue,
@@ -26773,7 +26793,7 @@ var import_config3 = require("dotenv/config");
 // package.json
 var package_default = {
   name: "@smartergpt/lexrunner",
-  version: "2.0.2",
+  version: "2.1.0",
   type: "module",
   engines: {
     node: ">=24"
@@ -26786,10 +26806,10 @@ var package_default = {
     url: "git+https://github.com/Guffawaffle/lexrunner.git"
   },
   publishConfig: {
-    access: "restricted",
+    access: "public",
     registry: "https://registry.npmjs.org/"
   },
-  license: "SEE LICENSE IN LICENSE.md",
+  license: "Apache-2.0",
   files: [
     "dist/",
     "schemas/",
@@ -26798,7 +26818,9 @@ var package_default = {
     "README.mcp.md",
     "CHANGELOG.md",
     "NOTICE.md",
-    "LICENSE.md"
+    "LICENSE.md",
+    "GOVERNANCE.md",
+    "BRAND.md"
   ],
   bin: {
     lexrunner: "dist/cli.js",
@@ -27421,8 +27443,8 @@ function generateSnapshot(plan, inputs) {
 }
 function getPackageVersion() {
   try {
-    const fs73 = require("fs");
-    const packageJson = JSON.parse(fs73.readFileSync("package.json", "utf8"));
+    const fs74 = require("fs");
+    const packageJson = JSON.parse(fs74.readFileSync("package.json", "utf8"));
     return packageJson.version || "unknown";
   } catch {
     return "unknown";
@@ -28766,10 +28788,10 @@ async function promptGitHubToken() {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     rl.question("GitHub token (optional, press Enter to skip): ", (answer) => {
       rl.close();
-      resolve28(answer.trim());
+      resolve29(answer.trim());
     });
   });
 }
@@ -29764,8 +29786,8 @@ function containedRegularFile(root, candidate) {
   }
 }
 function isContained(root, candidate) {
-  const relative6 = path23.relative(path23.resolve(root), path23.resolve(candidate));
-  return relative6 !== ".." && !relative6.startsWith(`..${path23.sep}`) && !path23.isAbsolute(relative6);
+  const relative8 = path23.relative(path23.resolve(root), path23.resolve(candidate));
+  return relative8 !== ".." && !relative8.startsWith(`..${path23.sep}`) && !path23.isAbsolute(relative8);
 }
 function evidenceError(code, message) {
   return new GateEvidenceServiceError(code, message);
@@ -31221,11 +31243,11 @@ function isTestFile(file) {
 }
 function directOwnerCandidates(file) {
   if (!file.startsWith("src/") || !/\.[cm]?tsx?$/.test(file)) return [];
-  const relative6 = file.replace(/^src\//, "").replace(/\.[cm]?tsx?$/, "");
-  const basename8 = path28.posix.basename(relative6);
+  const relative8 = file.replace(/^src\//, "").replace(/\.[cm]?tsx?$/, "");
+  const basename8 = path28.posix.basename(relative8);
   return [
-    `tests/${relative6}.spec.ts`,
-    `tests/${relative6}.test.ts`,
+    `tests/${relative8}.spec.ts`,
+    `tests/${relative8}.test.ts`,
     `tests/${basename8}.spec.ts`,
     `tests/${basename8}.test.ts`
   ];
@@ -32452,10 +32474,10 @@ async function readInput(inputPath) {
     }
     return fs34.readFileSync(inputPath, "utf-8");
   } else {
-    return new Promise((resolve28, reject) => {
+    return new Promise((resolve29, reject) => {
       const chunks = [];
       process.stdin.on("data", (chunk) => chunks.push(chunk));
-      process.stdin.on("end", () => resolve28(Buffer.concat(chunks).toString("utf-8")));
+      process.stdin.on("end", () => resolve29(Buffer.concat(chunks).toString("utf-8")));
       process.stdin.on("error", reject);
     });
   }
@@ -34779,8 +34801,8 @@ Details:`);
       if (opts.json || deps.jsonModeActive()) {
         const output = JSON.stringify(plan, null, 2);
         if (opts.output) {
-          const fs73 = await import("fs/promises");
-          await fs73.writeFile(opts.output, output, "utf-8");
+          const fs74 = await import("fs/promises");
+          await fs74.writeFile(opts.output, output, "utf-8");
           console.log(`Plan written to: ${opts.output}`);
         } else {
           console.log(output);
@@ -34803,8 +34825,8 @@ Details:`);
           console.log(`     ${phase}: ${count}`);
         }
         if (opts.output) {
-          const fs73 = await import("fs/promises");
-          await fs73.writeFile(opts.output, JSON.stringify(plan, null, 2), "utf-8");
+          const fs74 = await import("fs/promises");
+          await fs74.writeFile(opts.output, JSON.stringify(plan, null, 2), "utf-8");
           console.log(`
 Plan written to: ${opts.output}`);
         }
@@ -35057,8 +35079,8 @@ function registerHarvestCommand(fanoutCommand) {
       });
       const output = JSON.stringify(harvestBundle, null, 2);
       if (opts.output) {
-        const fs73 = await import("fs/promises");
-        await fs73.writeFile(opts.output, output, "utf-8");
+        const fs74 = await import("fs/promises");
+        await fs74.writeFile(opts.output, output, "utf-8");
         console.error(`\u2713 Harvest bundle written to ${opts.output}`);
         console.error(`  ${harvestBundle.bundle.pullRequests.length} PRs`);
         console.error(`  ${harvestBundle.bundle.issues.length} issues`);
@@ -35447,10 +35469,10 @@ function analyzeBundle(harvest) {
 function registerAnalyzeCommand(fanoutCommand) {
   fanoutCommand.command("analyze").description("D1: Analyze harvest bundle into facts pool (deterministic)").option("--input <file>", "Path to harvest bundle JSON file (default: stdin)").option("--json", "Output JSON format (default)").option("--output <file>", "Write output to file").action(async (opts) => {
     try {
-      const fs73 = await import("fs/promises");
+      const fs74 = await import("fs/promises");
       let content;
       if (opts.input) {
-        content = await fs73.readFile(opts.input, "utf-8");
+        content = await fs74.readFile(opts.input, "utf-8");
       } else {
         const chunks = [];
         for await (const chunk of process.stdin) {
@@ -35492,7 +35514,7 @@ function registerAnalyzeCommand(fanoutCommand) {
       const analysisPool = analyzeBundle(harvest);
       const output = JSON.stringify(analysisPool, null, 2);
       if (opts.output) {
-        await fs73.writeFile(opts.output, output, "utf-8");
+        await fs74.writeFile(opts.output, output, "utf-8");
         console.error(`\u2713 Analysis pool written to ${opts.output}`);
         console.error(`  ${analysisPool.pool.entities.length} entities`);
         console.error(`  ${analysisPool.pool.relations.length} relations`);
@@ -35589,9 +35611,9 @@ var DEFAULT_FANOUT_TEMPLATES_PATHS = [
   "fanout-templates.yml"
 ];
 var FanoutTemplatesLoadError = class extends Error {
-  constructor(message, path81, cause) {
+  constructor(message, path82, cause) {
     super(message);
-    this.path = path81;
+    this.path = path82;
     this.cause = cause;
     this.name = "FanoutTemplatesLoadError";
   }
@@ -35922,7 +35944,7 @@ function registerFanoutCommands(weaveCommand) {
     }
   });
   fanout.command("validate").description("Validate fanout templates file").option("-f, --file <path>", "Path to templates file").action(async (options) => {
-    const fs73 = await import("fs/promises");
+    const fs74 = await import("fs/promises");
     try {
       let filePath;
       if (options.file) {
@@ -35935,7 +35957,7 @@ function registerFanoutCommands(weaveCommand) {
         }
         filePath = result2.path;
       }
-      const content = await fs73.readFile(filePath, "utf-8");
+      const content = await fs74.readFile(filePath, "utf-8");
       const result = validateFanoutTemplatesContent(content);
       if (result.valid) {
         console.log(`\u2713 Valid: ${filePath}`);
@@ -36935,8 +36957,8 @@ function lastCompletedMergeSha(operations) {
     (operation) => operation.phase === "merge" && operation.status === "completed" && operation.result?.externalId
   )?.result?.externalId;
 }
-function isRunnerStatePath(path81) {
-  return path81 === ".lexrunner" || path81.startsWith(".lexrunner/") || path81 === "weave-lock.json" || path81.endsWith("/weave-lock.json");
+function isRunnerStatePath(path82) {
+  return path82 === ".lexrunner" || path82.startsWith(".lexrunner/") || path82 === "weave-lock.json" || path82.endsWith("/weave-lock.json");
 }
 
 // src/commands/weave.ts
@@ -38056,12 +38078,12 @@ ${prefix} Plan validation failed: ${error.message}`);
   }
   fs43.mkdirSync(outDir, { recursive: true });
   const planPath = path33.join(outDir, "plan.json");
-  const snapshotPath = path33.join(outDir, "snapshot.md");
+  const snapshotPath2 = path33.join(outDir, "snapshot.md");
   fs43.writeFileSync(planPath, planJSON);
-  fs43.writeFileSync(snapshotPath, snapshot);
+  fs43.writeFileSync(snapshotPath2, snapshot);
   console.log(`\u2713 Generated plan artifacts:`);
   console.log(`  \u{1F4C1} ${planPath}`);
-  console.log(`  \u{1F4C1} ${snapshotPath}`);
+  console.log(`  \u{1F4C1} ${snapshotPath2}`);
   console.log("");
   console.log(generatePlanSummary(validatedPlan));
   return;
@@ -40608,7 +40630,7 @@ function generateRecommendations(misBatches, mergeTreeSimulation) {
 // src/orchestration/agentAssigner.ts
 init_errorRecovery();
 function sleep(ms) {
-  return new Promise((resolve28) => setTimeout(resolve28, ms));
+  return new Promise((resolve29) => setTimeout(resolve29, ms));
 }
 async function assignAgentWithRetry(issueNumber, repo, assignFn, maxRetries = 4) {
   let retries = 0;
@@ -41229,8 +41251,8 @@ function registerGenerateDeliverablesCommand(program2) {
       console.log(`\u2705 Created: ${path45.join(outputDir, "GATE5_cleanup.md")}`);
       console.log(`\u2705 Created: ${path45.join(outputDir, "SUMMARY.md")}`);
       console.log("");
-      const fs73 = await import("fs");
-      const planHashContent = fs73.readFileSync(path45.join(outputDir, "plan-hash.txt"), "utf-8");
+      const fs74 = await import("fs");
+      const planHashContent = fs74.readFileSync(path45.join(outputDir, "plan-hash.txt"), "utf-8");
       const planHashMatch = planHashContent.match(/SHA256: ([a-f0-9]+)/);
       if (planHashMatch) {
         console.log(`Plan hash: ${planHashMatch[1]}`);
@@ -43252,9 +43274,9 @@ async function promptInteractive(defaults2) {
     output: process.stdout
   });
   const question = (prompt3) => {
-    return new Promise((resolve28) => {
+    return new Promise((resolve29) => {
       rl.question(prompt3, (answer) => {
-        resolve28(answer.trim());
+        resolve29(answer.trim());
       });
     });
   };
@@ -45116,8 +45138,8 @@ Total: ${entries.length} counter-examples (${entries.filter((e) => e.shouldLearn
   counterExamples.command("export").description("Export counter-examples for analysis").option("--format <format>", "Export format (json|csv)", "json").option("--base-dir <dir>", "Base directory for lexrunner", process.cwd()).option("--output <file>", "Output file (prints to stdout if not specified)").action(async (options) => {
     const output = exportCounterExamples(options.format, options.baseDir);
     if (options.output) {
-      const fs73 = await import("fs");
-      fs73.writeFileSync(options.output, output, "utf-8");
+      const fs74 = await import("fs");
+      fs74.writeFileSync(options.output, output, "utf-8");
       console.log(import_chalk11.default.green(`\u2713 Exported counter-examples to ${options.output}`));
     } else {
       console.log(output);
@@ -45688,7 +45710,7 @@ function nativePathsOverlap(runtimePlatform, left, right, comparison) {
   if (api.parse(normalizedLeft).root !== api.parse(normalizedRight).root) return false;
   const relativeLeft = api.relative(normalizedLeft, normalizedRight);
   const relativeRight = api.relative(normalizedRight, normalizedLeft);
-  const isDescendant = (relative6) => relative6.length > 0 && relative6 !== ".." && !relative6.startsWith(`..${api.sep}`);
+  const isDescendant = (relative8) => relative8.length > 0 && relative8 !== ".." && !relative8.startsWith(`..${api.sep}`);
   return isDescendant(relativeLeft) || isDescendant(relativeRight);
 }
 function digestBinding(runtime) {
@@ -47028,8 +47050,8 @@ function parseGitStatusPorcelainV1Z(input) {
     }
     const indexStatus = field[0];
     const worktreeStatus = field[1];
-    const path81 = field.slice(3);
-    if (path81.length === 0) {
+    const path82 = field.slice(3);
+    if (path82.length === 0) {
       throw new Error("Malformed git status porcelain: path is empty");
     }
     const renameOrCopy = [indexStatus, worktreeStatus].find(
@@ -47047,7 +47069,7 @@ function parseGitStatusPorcelainV1Z(input) {
     records.push({
       indexStatus,
       worktreeStatus,
-      path: path81,
+      path: path82,
       ...originalPath === void 0 ? {} : { originalPath },
       kind
     });
@@ -47500,8 +47522,8 @@ function copyIssues(result, context) {
     context.addIssue({ code: "custom", path: issue.path, message: issue.message });
   }
 }
-function addIssue(context, path81, message) {
-  context.addIssue({ code: "custom", path: path81, message });
+function addIssue(context, path82, message) {
+  context.addIssue({ code: "custom", path: path82, message });
 }
 
 // src/workspaces/linux-workspace-boundary.ts
@@ -48542,8 +48564,8 @@ var NodeGitWorktreeBroker = class {
           "The worktree root was replaced after broker initialization"
         );
       }
-      const relative6 = import_node_path19.default.relative(this.worktreeRoot, import_node_path19.default.resolve(target.worktreePath));
-      const components = relative6.split(import_node_path19.default.sep);
+      const relative8 = import_node_path19.default.relative(this.worktreeRoot, import_node_path19.default.resolve(target.worktreePath));
+      const components = relative8.split(import_node_path19.default.sep);
       const targetName = components.pop();
       if (!targetName) {
         throw new DirectoryBoundaryError("invalid_path", "The worktree target has no basename");
@@ -48747,8 +48769,8 @@ var NodeGitWorktreeBroker = class {
       );
     }
     const normalized = import_node_path19.default.resolve(gitDirectoryPath);
-    const relative6 = import_node_path19.default.relative(this.repositoryGitIdentity.path, normalized);
-    if (!relative6 || relative6 === ".." || relative6.startsWith(`..${import_node_path19.default.sep}`)) {
+    const relative8 = import_node_path19.default.relative(this.repositoryGitIdentity.path, normalized);
+    if (!relative8 || relative8 === ".." || relative8.startsWith(`..${import_node_path19.default.sep}`)) {
       return this.failure(
         operation,
         "containment_violation",
@@ -48757,7 +48779,7 @@ var NodeGitWorktreeBroker = class {
     }
     let current = null;
     try {
-      for (const component of relative6.split(import_node_path19.default.sep)) {
+      for (const component of relative8.split(import_node_path19.default.sep)) {
         const child = await boundary.lease.openChild(
           current ?? boundary.repositoryGit,
           component,
@@ -48811,8 +48833,8 @@ var NodeGitWorktreeBroker = class {
     const normalizedRoot = import_node_path19.default.resolve(root);
     const comparedCandidate = this.pathComparison === "case-insensitive" ? normalizedCandidate.toLocaleLowerCase("en-US") : normalizedCandidate;
     const comparedRoot = this.pathComparison === "case-insensitive" ? normalizedRoot.toLocaleLowerCase("en-US") : normalizedRoot;
-    const relative6 = import_node_path19.default.relative(comparedRoot, comparedCandidate);
-    return relative6.length > 0 && relative6 !== ".." && !relative6.startsWith(`..${import_node_path19.default.sep}`);
+    const relative8 = import_node_path19.default.relative(comparedRoot, comparedCandidate);
+    return relative8.length > 0 && relative8 !== ".." && !relative8.startsWith(`..${import_node_path19.default.sep}`);
   }
   async git(boundary, operation, args, cwd, options, allowedNonzeroExitCodes = [], evidence) {
     const result = await boundary.lease.runProcess({
@@ -48917,7 +48939,7 @@ function nativePathsOverlap2(left, right, comparison) {
   if (normalizedLeft === normalizedRight) return true;
   const relativeLeft = import_node_path19.default.relative(normalizedLeft, normalizedRight);
   const relativeRight = import_node_path19.default.relative(normalizedRight, normalizedLeft);
-  const isDescendant = (relative6) => relative6.length > 0 && relative6 !== ".." && !relative6.startsWith(`..${import_node_path19.default.sep}`);
+  const isDescendant = (relative8) => relative8.length > 0 && relative8 !== ".." && !relative8.startsWith(`..${import_node_path19.default.sep}`);
   return isDescendant(relativeLeft) || isDescendant(relativeRight);
 }
 function branchName(ref) {
@@ -51458,24 +51480,24 @@ var AcceptanceCriterion = import_zod39.z.object({
 function isMachineLocalAbsolutePath(value) {
   return /(?:^|\s)\/(?!\/)[^\s]*/.test(value) || /(?:^|\s)~\/[^\s]*/.test(value) || /(?:^|\s)\\\\[^\s]*/.test(value) || /(?:^|\s)[a-z]:[\\/][^\s]*/i.test(value) || /(?:^|\s)file:/i.test(value);
 }
-function rejectMachineLocalPaths(value, ctx, path81 = []) {
+function rejectMachineLocalPaths(value, ctx, path82 = []) {
   if (typeof value === "string") {
     if (isMachineLocalAbsolutePath(value)) {
       ctx.addIssue({
         code: "custom",
-        path: path81,
+        path: path82,
         message: "AgentTaskPacket_v1 must not contain machine-local absolute paths"
       });
     }
     return;
   }
   if (Array.isArray(value)) {
-    value.forEach((item, index) => rejectMachineLocalPaths(item, ctx, [...path81, index]));
+    value.forEach((item, index) => rejectMachineLocalPaths(item, ctx, [...path82, index]));
     return;
   }
   if (value !== null && typeof value === "object") {
     for (const [key, item] of Object.entries(value)) {
-      rejectMachineLocalPaths(item, ctx, [...path81, key]);
+      rejectMachineLocalPaths(item, ctx, [...path82, key]);
     }
   }
 }
@@ -53655,10 +53677,10 @@ function captureBoundIdentities(input) {
     worktree: captureDirectoryIdentity(input.worktreePath, "execution mapping worktree")
   };
 }
-function verifiedRoot(runtimeId, path81, identity) {
+function verifiedRoot(runtimeId, path82, identity) {
   return {
     runtime_id: runtimeId,
-    path: path81,
+    path: path82,
     verification: "directory_identity",
     directory_identity: identityClaim2(identity)
   };
@@ -53777,8 +53799,8 @@ async function requireDirectoryWithin(directory, root, field) {
     (0, import_promises8.realpath)(directory),
     (0, import_promises8.realpath)(root)
   ]);
-  const relative6 = import_node_path21.default.relative(resolvedRoot, resolvedDirectory);
-  if (relative6 === ".." || relative6.startsWith(`..${import_node_path21.default.sep}`) || import_node_path21.default.isAbsolute(relative6)) {
+  const relative8 = import_node_path21.default.relative(resolvedRoot, resolvedDirectory);
+  if (relative8 === ".." || relative8.startsWith(`..${import_node_path21.default.sep}`) || import_node_path21.default.isAbsolute(relative8)) {
     throw new Error(`${field} must resolve within its authorized root`);
   }
 }
@@ -58977,8 +58999,8 @@ async function requireDirectoryWithin2(directory, root, field) {
     (0, import_promises9.realpath)(directory),
     (0, import_promises9.realpath)(root)
   ]);
-  const relative6 = import_node_path22.default.relative(resolvedRoot, resolvedDirectory);
-  if (relative6 === ".." || relative6.startsWith(`..${import_node_path22.default.sep}`) || import_node_path22.default.isAbsolute(relative6)) {
+  const relative8 = import_node_path22.default.relative(resolvedRoot, resolvedDirectory);
+  if (relative8 === ".." || relative8.startsWith(`..${import_node_path22.default.sep}`) || import_node_path22.default.isAbsolute(relative8)) {
     throw new Error(`${field} must resolve within the authorized worktree`);
   }
 }
@@ -61762,10 +61784,10 @@ var WorkerSessionDelegationBinding_v1 = import_zod49.z.object({
 function decisionReceiptMatchesOffer(receipt, offer, offerHash) {
   return receipt.delegation_id === offer.delegation_id && receipt.attempt_id === offer.attempt_id && receipt.offer_hash === offerHash && receipt.worker_thread_id === offer.worker.thread_id && receipt.transcript_start_hash === offer.transcript_start_hash && Date.parse(receipt.decided_at) >= Date.parse(offer.offered_at);
 }
-function requireTimeOrder(earlier, later, path81, context, equalAllowed = true) {
+function requireTimeOrder(earlier, later, path82, context, equalAllowed = true) {
   const ordered = equalAllowed ? Date.parse(earlier) <= Date.parse(later) : Date.parse(earlier) < Date.parse(later);
   if (!ordered) {
-    context.addIssue({ code: "custom", path: [path81], message: `${path81} is out of order` });
+    context.addIssue({ code: "custom", path: [path82], message: `${path82} is out of order` });
   }
 }
 
@@ -62882,12 +62904,12 @@ function grantWithinRequirements(grant, requirements) {
   );
   return grant.authorized_model_provider === requirements.authorized_model_provider && grant.source_disclosure_allowed === requirements.source_disclosure_allowed && grant.max_duration_ms <= requirements.max_duration_ms && grant.max_output_bytes <= requirements.max_output_bytes && grant.controls.every((control) => required2.get(control.control) === control.minimum_strength) && grant.tools.length <= 1;
 }
-function requireExactControls(controls, context, path81) {
+function requireExactControls(controls, context, path82) {
   const actual = new Set(controls.map((control) => control.control));
   if (actual.size !== GovernedControlId.options.length || GovernedControlId.options.some((control) => !actual.has(control))) {
     context.addIssue({
       code: "custom",
-      path: path81,
+      path: path82,
       message: "every governed denial control must appear exactly once"
     });
   }
@@ -63846,10 +63868,10 @@ function requireAbsent(value, fields, context) {
 function addStateIssue(message, context) {
   context.addIssue({ code: "custom", path: ["status"], message });
 }
-function requireOrdered(earlier, later, path81, context, equalAllowed = true) {
+function requireOrdered(earlier, later, path82, context, equalAllowed = true) {
   const ordered = equalAllowed ? Date.parse(earlier) <= Date.parse(later) : Date.parse(earlier) < Date.parse(later);
   if (!ordered) {
-    context.addIssue({ code: "custom", path: [path81], message: `${path81} is out of order` });
+    context.addIssue({ code: "custom", path: [path82], message: `${path82} is out of order` });
   }
 }
 
@@ -65573,8 +65595,8 @@ function normalizeInstant4(value) {
   return new Date(timestamp).toISOString();
 }
 function assertDescendant(parent, candidate) {
-  const relative6 = import_node_path31.default.relative(import_node_path31.default.resolve(parent), import_node_path31.default.resolve(candidate));
-  if (relative6.startsWith("..") || import_node_path31.default.isAbsolute(relative6)) {
+  const relative8 = import_node_path31.default.relative(import_node_path31.default.resolve(parent), import_node_path31.default.resolve(candidate));
+  if (relative8.startsWith("..") || import_node_path31.default.isAbsolute(relative8)) {
     throw new LocalProtectedEvidenceVerificationError("container_invalid");
   }
 }
@@ -65729,14 +65751,14 @@ var WindowsProtectedEvidenceAuthority = class {
     this.child = null;
     child?.stdin.end();
     if (child && child.exitCode === null) {
-      await new Promise((resolve28) => {
+      await new Promise((resolve29) => {
         const timeout = setTimeout(() => {
           child.kill();
-          resolve28();
+          resolve29();
         }, 5e3);
         child.once("close", () => {
           clearTimeout(timeout);
-          resolve28();
+          resolve29();
         });
       });
     }
@@ -65747,8 +65769,8 @@ var WindowsProtectedEvidenceAuthority = class {
     const child = this.ensureChild();
     const id = this.nextId;
     this.nextId += 1;
-    return new Promise((resolve28, reject) => {
-      this.pending.set(id, { resolve: resolve28, reject });
+    return new Promise((resolve29, reject) => {
+      this.pending.set(id, { resolve: resolve29, reject });
       child.stdin.write(`${JSON.stringify({ id, op: operation, path: target })}
 `, (error) => {
         if (!error) return;
@@ -66404,7 +66426,7 @@ var repositoryCorpusHeaderBody = import_zod61.z.object({
 var GovernedRepositoryCorpusHeader_v1 = repositoryCorpusHeaderBody.superRefine(
   (value, context) => {
     const paths = value.entries.map((entry) => entry.path);
-    if (new Set(paths).size !== paths.length || paths.some((path81, index) => index > 0 && path81 <= paths[index - 1])) {
+    if (new Set(paths).size !== paths.length || paths.some((path82, index) => index > 0 && path82 <= paths[index - 1])) {
       context.addIssue({
         code: "custom",
         path: ["entries"],
@@ -66831,7 +66853,7 @@ function sanitizedWslEnvironment() {
   return environment;
 }
 function waitForExit(child, timeoutMs) {
-  return new Promise((resolve28, reject) => {
+  return new Promise((resolve29, reject) => {
     const timeout = setTimeout(() => {
       child.kill();
       reject(new Error("WSL2 provider control request timed out"));
@@ -66842,7 +66864,7 @@ function waitForExit(child, timeoutMs) {
     });
     child.once("close", (code) => {
       clearTimeout(timeout);
-      resolve28(code);
+      resolve29(code);
     });
   });
 }
@@ -67951,8 +67973,8 @@ var LocalProtectedEvidenceStore = class {
   exclusive(operation) {
     const previous = this.queue;
     let release3;
-    this.queue = new Promise((resolve28) => {
-      release3 = resolve28;
+    this.queue = new Promise((resolve29) => {
+      release3 = resolve29;
     });
     return previous.then(operation).finally(release3);
   }
@@ -68115,8 +68137,8 @@ function sameToken(expected, candidate) {
   return left.length === right.length && (0, import_node_crypto36.timingSafeEqual)(left, right);
 }
 function assertDescendant2(root, candidate) {
-  const relative6 = import_node_path35.default.relative(root, candidate);
-  if (!relative6 || relative6.startsWith("..") || import_node_path35.default.isAbsolute(relative6)) {
+  const relative8 = import_node_path35.default.relative(root, candidate);
+  if (!relative8 || relative8.startsWith("..") || import_node_path35.default.isAbsolute(relative8)) {
     throw new Error("protected evidence deletion target escaped its root");
   }
 }
@@ -68965,11 +68987,11 @@ async function launchDetachedSupervisor(input) {
         env: sanitizedSupervisorEnvironment()
       }
     );
-    return await new Promise((resolve28) => {
-      child.once("error", () => resolve28(false));
+    return await new Promise((resolve29) => {
+      child.once("error", () => resolve29(false));
       child.once("spawn", () => {
         child.unref();
-        resolve28(true);
+        resolve29(true);
       });
     });
   } catch {
@@ -69719,10 +69741,10 @@ function commandPath(command) {
   }
   return components.join(" ");
 }
-function aliasWarning(path81) {
-  const policy = POLICY_BY_PATH.get(path81);
+function aliasWarning(path82) {
+  const policy = POLICY_BY_PATH.get(path82);
   if (!policy) return null;
-  return policy.disposition === "deprecated" ? `[lexrunner] deprecated alias "${path81}"; use "${policy.replacement}"; removal: ${policy.removeIn}.` : `[lexrunner] compatibility alias "${path81}"; use "${policy.replacement}"; supported through 2.x and reviewed at 3.0.0.`;
+  return policy.disposition === "deprecated" ? `[lexrunner] deprecated alias "${path82}"; use "${policy.replacement}"; removal: ${policy.removeIn}.` : `[lexrunner] compatibility alias "${path82}"; use "${policy.replacement}"; supported through 2.x and reviewed at 3.0.0.`;
 }
 function emitAliasWarning(command, write = (message) => process.stderr.write(message)) {
   const warning = aliasWarning(commandPath(command));
@@ -69831,8 +69853,8 @@ async function searchAttributions(query, runId) {
 // src/cli.ts
 init_controller();
 init_audit();
-var fs72 = __toESM(require("fs"), 1);
-var path80 = __toESM(require("path"), 1);
+var fs73 = __toESM(require("fs"), 1);
+var path81 = __toESM(require("path"), 1);
 
 // src/runs/enforcement.ts
 var import_zod65 = require("zod");
@@ -71267,8 +71289,8 @@ async function executeAgentWorkPreparation(input) {
 function passed(results, id) {
   return results.some((result) => result.id === id && result.outcome === "passed");
 }
-async function containedExistingDirectory(root, relative6) {
-  const candidate = relative6 ? import_node_path38.default.resolve(root, relative6) : root;
+async function containedExistingDirectory(root, relative8) {
+  const candidate = relative8 ? import_node_path38.default.resolve(root, relative8) : root;
   const resolved = await (0, import_promises21.realpath)(candidate);
   const relation = import_node_path38.default.relative(root, resolved);
   if (relation === ".." || relation.startsWith(`..${import_node_path38.default.sep}`) || import_node_path38.default.isAbsolute(relation)) {
@@ -71352,7 +71374,7 @@ var workspaceFilesystemEntry = import_zod69.z.discriminatedUnion("kind", [
   }).strict()
 ]);
 function requireStrictlyOrderedPaths(values, context, field) {
-  if (values.some(({ path: path81 }, index) => index > 0 && path81 <= values[index - 1].path)) {
+  if (values.some(({ path: path82 }, index) => index > 0 && path82 <= values[index - 1].path)) {
     context.addIssue({
       code: "custom",
       path: [field],
@@ -71372,7 +71394,7 @@ var completeGitIdentity = import_zod69.z.object({
   kind: import_zod69.z.enum(["absent", "present"]),
   paths: import_zod69.z.array(boundedRelativePath).max(4096)
 }).strict().superRefine((identity, context) => {
-  if (identity.paths.some((path81, index) => index > 0 && path81 <= identity.paths[index - 1]) || identity.kind === "absent" && identity.paths.length !== 0 || identity.kind === "present" && identity.paths.length === 0) {
+  if (identity.paths.some((path82, index) => index > 0 && path82 <= identity.paths[index - 1]) || identity.kind === "absent" && identity.paths.length !== 0 || identity.kind === "present" && identity.paths.length === 0) {
     context.addIssue({
       code: "custom",
       path: ["paths"],
@@ -71682,7 +71704,7 @@ var GovernedWorkspaceMutationRecoveryReceipt_v1 = import_zod69.z.object({
     });
   }
   if (receipt.changed_paths.some(
-    (path81, index) => index > 0 && path81 <= receipt.changed_paths[index - 1]
+    (path82, index) => index > 0 && path82 <= receipt.changed_paths[index - 1]
   )) {
     context.addIssue({
       code: "custom",
@@ -72519,15 +72541,15 @@ var AttemptAwaitableSupervisor = class {
       0,
       Date.parse(record.observer_lease.expires_at) - Date.parse(this.now()) + 1
     );
-    let resolve28;
+    let resolve29;
     const completion = new Promise((resolvePromise) => {
-      resolve28 = resolvePromise;
+      resolve29 = resolvePromise;
     });
     const timer = setTimeout(() => {
       this.leaseExpiryWakeups.delete(record.awaitable_id);
-      void this.attach(record.awaitable_id).finally(resolve28);
+      void this.attach(record.awaitable_id).finally(resolve29);
     }, delayMs);
-    this.leaseExpiryWakeups.set(record.awaitable_id, { timer, completion, resolve: resolve28 });
+    this.leaseExpiryWakeups.set(record.awaitable_id, { timer, completion, resolve: resolve29 });
   }
   clearLeaseExpiryWakeup(awaitableId) {
     const wakeup = this.leaseExpiryWakeups.get(awaitableId);
@@ -72632,14 +72654,14 @@ function normalizeRetryDelay(value, name) {
 }
 function waitForRetry(delayMs, signal) {
   if (signal.aborted) return Promise.resolve(false);
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve28(true);
+      resolve29(true);
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
-      resolve28(false);
+      resolve29(false);
     };
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -76179,11 +76201,141 @@ init_fileAnalysis();
 // src/application/plan-artifact-service.ts
 var fs71 = __toESM(require("fs"), 1);
 var path79 = __toESM(require("path"), 1);
+var import_node_util2 = require("util");
 init_profileResolver();
 init_schema2();
 init_task_contract();
-var MAX_PLAN_REFERENCE_BYTES = 4096;
-var MAX_PLAN_BYTES = 4 * 1024 * 1024;
+init_canonicalJson();
+
+// src/application/execution-plan-artifact.ts
+var import_node_crypto40 = require("crypto");
+var import_zod74 = require("zod");
+init_schema2();
+init_canonicalJson();
+var EXECUTION_PLAN_ARTIFACT_CONTRACT = "lexrunner.execution-plan-artifact.v1";
+var PLAN_ARTIFACT_REFERENCE_CONTRACT = "lexrunner.plan-artifact-reference.v1";
+var EXECUTION_PLAN_CANONICALIZATION_PROFILE = "lexrunner.execution-plan.canonical-json.v1";
+var EXECUTION_PLAN_HASH_PROFILE = "lexrunner.execution-plan-artifact.sha256.v1";
+var EXECUTION_PLAN_HASH_DOMAIN = "lexrunner:execution-plan-artifact:v1\0";
+var MAX_PLAN_ARTIFACT_BYTES = 4 * 1024 * 1024;
+var MAX_PLAN_RETRIEVAL_REFERENCE_BYTES = 4096;
+var MAX_SCOPE_LABEL_BYTES = 512;
+var Sha256Digest = import_zod74.z.string().regex(/^sha256:[a-f0-9]{64}$/);
+var BoundedScopeLabel = import_zod74.z.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_SCOPE_LABEL_BYTES, {
+  message: "Scope label exceeds the transport limit"
+});
+var BoundedIdentityLabel = import_zod74.z.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_SCOPE_LABEL_BYTES, {
+  message: "Identity label exceeds the transport limit"
+});
+var PlanArtifactScope_v1Schema = import_zod74.z.object({
+  tenant: BoundedScopeLabel,
+  workspace: BoundedScopeLabel,
+  repository: BoundedScopeLabel,
+  refNamespace: BoundedScopeLabel,
+  policy: BoundedScopeLabel
+}).strict();
+var ExecutionPlanArtifactIdentity_v1Schema = import_zod74.z.object({
+  contract: import_zod74.z.literal(EXECUTION_PLAN_ARTIFACT_CONTRACT),
+  kind: import_zod74.z.literal("execution-plan"),
+  planSchema: import_zod74.z.literal("lexrunner.execution-plan"),
+  planSchemaVersion: BoundedIdentityLabel,
+  canonicalizationProfile: import_zod74.z.literal(EXECUTION_PLAN_CANONICALIZATION_PROFILE),
+  hashProfile: import_zod74.z.literal(EXECUTION_PLAN_HASH_PROFILE),
+  digestAlgorithm: import_zod74.z.literal("sha256"),
+  digest: Sha256Digest,
+  canonicalByteLength: import_zod74.z.number().int().nonnegative().max(MAX_PLAN_ARTIFACT_BYTES),
+  target: BoundedIdentityLabel,
+  summary: import_zod74.z.object({
+    itemCount: import_zod74.z.number().int().nonnegative().max(256),
+    gateCount: import_zod74.z.number().int().nonnegative().max(256 * 64)
+  }).strict()
+}).strict();
+var ExecutionPlanArtifact_v1Schema = import_zod74.z.object({
+  identity: ExecutionPlanArtifactIdentity_v1Schema,
+  canonicalBytes: import_zod74.z.string()
+}).strict().superRefine((artifact, context) => {
+  const byteLength = Buffer.byteLength(artifact.canonicalBytes, "utf8");
+  if (byteLength > MAX_PLAN_ARTIFACT_BYTES) {
+    context.addIssue({
+      code: "custom",
+      path: ["canonicalBytes"],
+      message: "Canonical plan bytes exceed the artifact limit"
+    });
+  }
+  if (byteLength !== artifact.identity.canonicalByteLength) {
+    context.addIssue({
+      code: "custom",
+      path: ["identity", "canonicalByteLength"],
+      message: "Canonical plan byte length does not match the artifact identity"
+    });
+  }
+  if (computeExecutionPlanArtifactDigest(artifact.canonicalBytes) !== artifact.identity.digest) {
+    context.addIssue({
+      code: "custom",
+      path: ["identity", "digest"],
+      message: "Canonical plan digest does not match the artifact identity"
+    });
+  }
+  try {
+    const plan = loadPlan(artifact.canonicalBytes);
+    if (canonicalJSONStringify(plan) !== artifact.canonicalBytes) {
+      context.addIssue({
+        code: "custom",
+        path: ["canonicalBytes"],
+        message: "Plan bytes are not in the declared canonical form"
+      });
+    }
+    const gateCount = plan.items.reduce((count, item) => count + item.gates.length, 0);
+    if (artifact.identity.planSchemaVersion !== plan.schemaVersion || artifact.identity.target !== plan.target || artifact.identity.summary.itemCount !== plan.items.length || artifact.identity.summary.gateCount !== gateCount) {
+      context.addIssue({
+        code: "custom",
+        path: ["identity"],
+        message: "Plan semantics do not match the artifact identity"
+      });
+    }
+  } catch {
+    context.addIssue({
+      code: "custom",
+      path: ["canonicalBytes"],
+      message: "Canonical bytes do not contain a valid execution plan"
+    });
+  }
+});
+var PlanArtifactReference_v1Schema = import_zod74.z.object({
+  contract: import_zod74.z.literal(PLAN_ARTIFACT_REFERENCE_CONTRACT),
+  artifact: ExecutionPlanArtifactIdentity_v1Schema,
+  expectedDigest: Sha256Digest,
+  expectedCanonicalByteLength: import_zod74.z.number().int().nonnegative().max(MAX_PLAN_ARTIFACT_BYTES),
+  retrieval: import_zod74.z.object({
+    kind: import_zod74.z.enum(["file", "registered"]),
+    reference: import_zod74.z.string().min(1).refine(
+      (value) => !value.includes("\0") && Buffer.byteLength(value, "utf8") <= MAX_PLAN_RETRIEVAL_REFERENCE_BYTES,
+      { message: "Retrieval reference is invalid or exceeds the transport limit" }
+    )
+  }).strict(),
+  scope: PlanArtifactScope_v1Schema.optional()
+}).strict().superRefine((reference, context) => {
+  if (reference.expectedDigest !== reference.artifact.digest) {
+    context.addIssue({
+      code: "custom",
+      path: ["expectedDigest"],
+      message: "Expected digest does not match the embedded artifact identity"
+    });
+  }
+  if (reference.expectedCanonicalByteLength !== reference.artifact.canonicalByteLength) {
+    context.addIssue({
+      code: "custom",
+      path: ["expectedCanonicalByteLength"],
+      message: "Expected byte length does not match the embedded artifact identity"
+    });
+  }
+});
+function computeExecutionPlanArtifactDigest(canonicalBytes2) {
+  const digest = (0, import_node_crypto40.createHash)("sha256").update(EXECUTION_PLAN_HASH_DOMAIN, "utf8").update(canonicalBytes2, "utf8").digest("hex");
+  return `sha256:${digest}`;
+}
+
+// src/application/plan-artifact-service.ts
 var MAX_PLAN_ITEMS = 256;
 var MAX_GATES_PER_ITEM2 = 64;
 var MAX_IDENTITY_LABEL_BYTES = 512;
@@ -76195,16 +76347,41 @@ var PlanArtifactServiceError = class extends Error {
     this.name = "PlanArtifactServiceError";
   }
 };
+var _hooks;
 var PlanArtifactService = class {
+  constructor(options = {}) {
+    __privateAdd(this, _hooks);
+    __privateSet(this, _hooks, options.importHooks ?? {});
+  }
   resolve(input = {}) {
     const workingDir = path79.resolve(input.workingDir ?? process.cwd());
+    const scope = parseScope(input.scope);
+    if (input.planReference !== void 0 && input.planFile !== void 0) {
+      throw new PlanArtifactServiceError(
+        "PLAN_REFERENCE_INVALID",
+        "Provide either an immutable plan reference or an explicit plan path, not both",
+        "explicit"
+      );
+    }
+    if (input.planReference !== void 0 && input.scope !== void 0) {
+      throw new PlanArtifactServiceError(
+        "PLAN_REFERENCE_INVALID",
+        "A separately supplied scope cannot override an immutable plan reference",
+        "explicit"
+      );
+    }
+    if (input.planReference !== void 0) {
+      const reference = parseReference(input.planReference);
+      const explicitPath = resolveExplicitReference(reference.retrieval.reference, workingDir);
+      return readArtifact(explicitPath, "explicit", __privateGet(this, _hooks), reference);
+    }
     if (input.planFile !== void 0) {
       const explicitPath = resolveExplicitReference(input.planFile, workingDir);
-      return readArtifact(explicitPath, "explicit");
+      return readArtifact(explicitPath, "explicit", __privateGet(this, _hooks), void 0, scope);
     }
     const repositoryPlan = path79.join(workingDir, "plan.json");
-    if (isRegularFile(repositoryPlan)) {
-      return readArtifact(repositoryPlan, "repository-root");
+    if (pathEntryExists(repositoryPlan)) {
+      return readArtifact(repositoryPlan, "repository-root", __privateGet(this, _hooks), void 0, scope);
     }
     let profilePlan;
     try {
@@ -76212,8 +76389,8 @@ var PlanArtifactService = class {
       profilePlan = path79.join(profile.path, "runner", "plan.json");
     } catch {
     }
-    if (profilePlan && isRegularFile(profilePlan)) {
-      return readArtifact(profilePlan, "profile-runner");
+    if (profilePlan && pathEntryExists(profilePlan)) {
+      return readArtifact(profilePlan, "profile-runner", __privateGet(this, _hooks), void 0, scope);
     }
     throw new PlanArtifactServiceError(
       "PLAN_NOT_FOUND",
@@ -76221,46 +76398,85 @@ var PlanArtifactService = class {
     );
   }
 };
-function resolveExplicitReference(reference, workingDir) {
-  if (reference.length === 0 || reference.includes("\0") || Buffer.byteLength(reference, "utf8") > MAX_PLAN_REFERENCE_BYTES) {
+_hooks = new WeakMap();
+function parseReference(reference) {
+  const parsed = PlanArtifactReference_v1Schema.safeParse(reference);
+  if (!parsed.success) {
     throw new PlanArtifactServiceError(
       "PLAN_REFERENCE_INVALID",
-      "The explicit plan reference is empty, overlong, or contains an invalid character",
+      "The immutable plan reference does not satisfy the bounded transport contract",
       "explicit"
     );
   }
-  return path79.isAbsolute(reference) ? path79.normalize(reference) : path79.resolve(workingDir, reference);
+  return parsed.data;
 }
-function readArtifact(filePath, source) {
-  let stat12;
-  try {
-    stat12 = fs71.statSync(filePath);
-  } catch {
+function parseScope(scope) {
+  if (scope === void 0) return void 0;
+  const parsed = PlanArtifactScope_v1Schema.safeParse(scope);
+  if (!parsed.success) {
     throw new PlanArtifactServiceError(
-      "PLAN_NOT_FOUND",
-      "The referenced integration plan does not exist",
-      source
+      "PLAN_REFERENCE_INVALID",
+      "The plan scope does not satisfy the bounded transport contract",
+      "explicit"
     );
   }
-  if (!stat12.isFile() || stat12.size > MAX_PLAN_BYTES) {
+  return parsed.data;
+}
+function resolveExplicitReference(reference, workingDir) {
+  if (reference.length === 0 || reference.includes("\0") || Buffer.byteLength(reference, "utf8") > MAX_PLAN_RETRIEVAL_REFERENCE_BYTES) {
     throw new PlanArtifactServiceError(
-      "PLAN_UNREADABLE",
-      "The referenced integration plan is not a readable bounded file",
+      "PLAN_REFERENCE_INVALID",
+      "The explicit plan reference is empty, overlong, or contains an invalid character",
+      "explicit"
+    );
+  }
+  return path79.isAbsolute(reference) ? path79.normalize(reference) : path79.resolve(workingDir, reference);
+}
+function readArtifact(filePath, source, hooks, expected, scope) {
+  const content = readPortableRaceDetectedFile(filePath, source, hooks);
+  const plan = loadPlan(content);
+  assertBoundedArtifact(plan, source);
+  const canonicalBytes2 = canonicalJSONStringify(plan);
+  const canonicalByteLength = Buffer.byteLength(canonicalBytes2, "utf8");
+  if (canonicalByteLength > MAX_PLAN_ARTIFACT_BYTES) {
+    throw new PlanArtifactServiceError(
+      "PLAN_ARTIFACT_LIMIT_EXCEEDED",
+      "The canonical integration plan exceeds the artifact byte limit",
       source
     );
   }
-  let content;
-  try {
-    content = fs71.readFileSync(filePath, "utf8");
-  } catch {
+  const artifactIdentity = {
+    contract: EXECUTION_PLAN_ARTIFACT_CONTRACT,
+    kind: "execution-plan",
+    planSchema: "lexrunner.execution-plan",
+    planSchemaVersion: plan.schemaVersion,
+    canonicalizationProfile: EXECUTION_PLAN_CANONICALIZATION_PROFILE,
+    hashProfile: EXECUTION_PLAN_HASH_PROFILE,
+    digestAlgorithm: "sha256",
+    digest: computeExecutionPlanArtifactDigest(canonicalBytes2),
+    canonicalByteLength,
+    target: plan.target,
+    summary: {
+      itemCount: plan.items.length,
+      gateCount: plan.items.reduce((count, item) => count + item.gates.length, 0)
+    }
+  };
+  const artifact = { identity: artifactIdentity, canonicalBytes: canonicalBytes2 };
+  if (expected && !(0, import_node_util2.isDeepStrictEqual)(expected.artifact, artifactIdentity)) {
     throw new PlanArtifactServiceError(
-      "PLAN_UNREADABLE",
-      "The referenced integration plan could not be read",
+      "PLAN_REFERENCE_MISMATCH",
+      "The retrieved integration plan does not match the immutable reference",
       source
     );
   }
-  const plan = loadPlan(content);
-  assertBoundedArtifact(plan, source);
+  const reference = expected ?? parseReference({
+    contract: PLAN_ARTIFACT_REFERENCE_CONTRACT,
+    artifact: artifactIdentity,
+    expectedDigest: artifactIdentity.digest,
+    expectedCanonicalByteLength: artifactIdentity.canonicalByteLength,
+    retrieval: { kind: "file", reference: filePath },
+    ...scope ? { scope } : {}
+  });
   return {
     plan,
     identity: {
@@ -76272,10 +76488,167 @@ function readArtifact(filePath, source) {
       target: plan.target,
       itemCount: plan.items.length
     },
+    artifact,
+    reference,
+    acquisition: {
+      contract: "lexrunner.plan-artifact-acquisition.v1",
+      assurance: "portable-race-detection",
+      authority: "unverified"
+    },
     source,
     filePath
   };
 }
+function readPortableRaceDetectedFile(filePath, source, hooks) {
+  const initialPath = snapshotPath(filePath, source);
+  hooks.afterInitialPathSnapshot?.();
+  const noFollow = typeof fs71.constants.O_NOFOLLOW === "number" ? fs71.constants.O_NOFOLLOW : 0;
+  let descriptor;
+  try {
+    descriptor = fs71.openSync(filePath, fs71.constants.O_RDONLY | noFollow);
+  } catch (error) {
+    throw importError(error, source);
+  }
+  let bytes;
+  try {
+    const before = fs71.fstatSync(descriptor, { bigint: true });
+    assertOpenedIdentity(initialPath[initialPath.length - 1].stats, before, source);
+    hooks.afterOpen?.();
+    if (before.size > BigInt(MAX_PLAN_ARTIFACT_BYTES)) {
+      throw new PlanArtifactServiceError(
+        "PLAN_ARTIFACT_LIMIT_EXCEEDED",
+        "The referenced integration plan exceeds the artifact byte limit",
+        source
+      );
+    }
+    bytes = readAtMost(descriptor, MAX_PLAN_ARTIFACT_BYTES + 1);
+    hooks.afterRead?.();
+    const after = fs71.fstatSync(descriptor, { bigint: true });
+    assertStableOpenedFile(before, after, bytes.length, source);
+  } finally {
+    fs71.closeSync(descriptor);
+  }
+  hooks.beforeFinalPathSnapshot?.();
+  const finalPath = snapshotPath(filePath, source);
+  assertStablePath(initialPath, finalPath, source);
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new PlanArtifactServiceError(
+      "PLAN_UNREADABLE",
+      "The referenced integration plan is not valid UTF-8",
+      source
+    );
+  }
+}
+function snapshotPath(filePath, source) {
+  const absolute = path79.resolve(filePath);
+  const root = path79.parse(absolute).root;
+  const relative8 = path79.relative(root, absolute);
+  const segments = relative8.length === 0 ? [] : relative8.split(path79.sep);
+  const candidates = [root];
+  let current = root;
+  for (const segment of segments) {
+    current = path79.join(current, segment);
+    candidates.push(current);
+  }
+  return candidates.map((candidate, index) => {
+    let stats;
+    try {
+      stats = fs71.lstatSync(candidate, { bigint: true });
+    } catch (error) {
+      throw importError(error, source);
+    }
+    const leaf = index === candidates.length - 1;
+    if (stats.isSymbolicLink()) {
+      throw new PlanArtifactServiceError(
+        "PLAN_FILESYSTEM_UNSAFE",
+        "The integration plan path contains an unsafe filesystem object",
+        source
+      );
+    }
+    if (leaf ? !stats.isFile() : !stats.isDirectory()) {
+      throw new PlanArtifactServiceError(
+        "PLAN_UNREADABLE",
+        "The referenced integration plan is not a readable bounded file",
+        source
+      );
+    }
+    if (leaf && stats.nlink !== 1n) {
+      throw new PlanArtifactServiceError(
+        "PLAN_FILESYSTEM_UNSAFE",
+        "The integration plan file has an ambiguous filesystem identity",
+        source
+      );
+    }
+    return { stats, leaf };
+  });
+}
+function assertOpenedIdentity(pathStats, openedStats, source) {
+  if (!openedStats.isFile() || openedStats.nlink !== 1n || !sameObject(pathStats, openedStats) || pathStats.size !== openedStats.size || pathStats.mtimeNs !== openedStats.mtimeNs || pathStats.ctimeNs !== openedStats.ctimeNs) {
+    throw new PlanArtifactServiceError(
+      "PLAN_FILESYSTEM_UNSAFE",
+      "The integration plan filesystem identity changed during acquisition",
+      source
+    );
+  }
+}
+function assertStableOpenedFile(before, after, bytesRead, source) {
+  if (bytesRead > MAX_PLAN_ARTIFACT_BYTES) {
+    throw new PlanArtifactServiceError(
+      "PLAN_ARTIFACT_LIMIT_EXCEEDED",
+      "The referenced integration plan exceeds the artifact byte limit",
+      source
+    );
+  }
+  if (!after.isFile() || after.nlink !== 1n || !sameObject(before, after) || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || BigInt(bytesRead) !== before.size) {
+    throw new PlanArtifactServiceError(
+      "PLAN_FILESYSTEM_UNSAFE",
+      "The integration plan changed while its bytes were being acquired",
+      source
+    );
+  }
+}
+function assertStablePath(before, after, source) {
+  if (before.length !== after.length || before.some((entry, index) => {
+    const current = after[index];
+    return !current || entry.leaf !== current.leaf || !sameObject(entry.stats, current.stats) || entry.leaf && (entry.stats.size !== current.stats.size || entry.stats.mtimeNs !== current.stats.mtimeNs || entry.stats.ctimeNs !== current.stats.ctimeNs || current.stats.nlink !== 1n);
+  })) {
+    throw new PlanArtifactServiceError(
+      "PLAN_FILESYSTEM_UNSAFE",
+      "The integration plan path changed while its bytes were being acquired",
+      source
+    );
+  }
+}
+function sameObject(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;
+}
+function readAtMost(descriptor, maximumBytes) {
+  const buffer = Buffer.allocUnsafe(maximumBytes);
+  let offset = 0;
+  while (offset < maximumBytes) {
+    const count = fs71.readSync(descriptor, buffer, offset, maximumBytes - offset, null);
+    if (count === 0) break;
+    offset += count;
+  }
+  return buffer.subarray(0, offset);
+}
+function importError(error, source) {
+  const code = error?.code;
+  if (code === "ENOENT" || code === "ENOTDIR") {
+    return new PlanArtifactServiceError(
+      "PLAN_NOT_FOUND",
+      "The referenced integration plan does not exist",
+      source
+    );
+  }
+  return new PlanArtifactServiceError(
+    "PLAN_UNREADABLE",
+    "The referenced integration plan could not be safely read",
+    source
+  );
+}
 function assertBoundedArtifact(plan, source) {
   const labels = [
     plan.schemaVersion,
@@ -76290,11 +76663,277 @@ function assertBoundedArtifact(plan, source) {
     );
   }
 }
-function isRegularFile(filePath) {
+function pathEntryExists(filePath) {
   try {
-    return fs71.statSync(filePath).isFile();
-  } catch {
-    return false;
+    fs71.lstatSync(filePath);
+    return true;
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return false;
+    return true;
+  }
+}
+
+// src/application/plan-artifact-registration-service.ts
+var fs72 = __toESM(require("fs"), 1);
+var path80 = __toESM(require("path"), 1);
+var import_node_crypto41 = require("crypto");
+var PlanArtifactRegistrationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "PlanArtifactRegistrationError";
+  }
+};
+var _PlanArtifactRegistrationService_instances, verifyExisting_fn;
+var PlanArtifactRegistrationService = class {
+  constructor() {
+    __privateAdd(this, _PlanArtifactRegistrationService_instances);
+  }
+  register(input) {
+    const parsed = ExecutionPlanArtifact_v1Schema.safeParse(input.artifact);
+    if (!parsed.success) {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_INVALID",
+        "The plan artifact does not satisfy the immutable artifact contract"
+      );
+    }
+    const artifact = parsed.data;
+    const scope = parseScope2(input.scope);
+    const storeDirectory = validateStoreReference(input.storeDirectory);
+    prepareControlledStore(storeDirectory);
+    const digestName = `${artifact.identity.digest.slice("sha256:".length)}.json`;
+    const artifactPath = path80.join(storeDirectory, digestName);
+    const reference = createRegisteredReference(artifact, artifactPath, scope);
+    if (pathEntryExists2(artifactPath)) {
+      return __privateMethod(this, _PlanArtifactRegistrationService_instances, verifyExisting_fn).call(this, artifact, reference, false);
+    }
+    const temporaryPath = path80.join(storeDirectory, `.plan-${(0, import_node_crypto41.randomUUID)()}.tmp`);
+    let temporaryCreated = false;
+    try {
+      const descriptor = fs72.openSync(
+        temporaryPath,
+        fs72.constants.O_WRONLY | fs72.constants.O_CREAT | fs72.constants.O_EXCL,
+        384
+      );
+      temporaryCreated = true;
+      try {
+        writeAll(descriptor, Buffer.from(artifact.canonicalBytes, "utf8"));
+        fs72.fsyncSync(descriptor);
+      } finally {
+        fs72.closeSync(descriptor);
+      }
+      try {
+        fs72.linkSync(temporaryPath, artifactPath);
+      } catch (error) {
+        if (!pathEntryExists2(artifactPath)) throw error;
+        return __privateMethod(this, _PlanArtifactRegistrationService_instances, verifyExisting_fn).call(this, artifact, reference, false);
+      }
+      try {
+        fs72.unlinkSync(temporaryPath);
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      temporaryCreated = false;
+      flushDirectoryWhenSupported(storeDirectory);
+      assertStoreDirectory(storeDirectory);
+      return __privateMethod(this, _PlanArtifactRegistrationService_instances, verifyExisting_fn).call(this, artifact, reference, true);
+    } catch (error) {
+      if (error instanceof PlanArtifactRegistrationError) throw error;
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_UNSAFE",
+        "The plan artifact could not be published without replacing existing bytes"
+      );
+    } finally {
+      if (temporaryCreated) {
+        try {
+          fs72.unlinkSync(temporaryPath);
+        } catch {
+        }
+      }
+    }
+  }
+};
+_PlanArtifactRegistrationService_instances = new WeakSet();
+verifyExisting_fn = function(artifact, reference, created) {
+  try {
+    waitForConcurrentPublisher(reference.retrieval.reference);
+    const resolved = new PlanArtifactService().resolve({ planReference: reference });
+    if (resolved.artifact.canonicalBytes !== artifact.canonicalBytes) {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_CONFLICT",
+        "The content-addressed plan object conflicts with the requested artifact"
+      );
+    }
+    return {
+      artifact: resolved.artifact,
+      reference,
+      created,
+      storage: { assurance: "service-no-replace-verified", authority: "unverified" }
+    };
+  } catch (error) {
+    if (error instanceof PlanArtifactRegistrationError) throw error;
+    if (error instanceof PlanArtifactServiceError && error.code === "PLAN_REFERENCE_MISMATCH") {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_CONFLICT",
+        "The content-addressed plan object conflicts with the requested artifact"
+      );
+    }
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_VERIFY_FAILED",
+      "The persisted plan artifact could not be reread and verified"
+    );
+  }
+};
+function createRegisteredReference(artifact, artifactPath, scope) {
+  if (Buffer.byteLength(artifactPath, "utf8") > 4096) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The artifact store cannot produce a bounded retrieval reference"
+    );
+  }
+  const reference = {
+    contract: PLAN_ARTIFACT_REFERENCE_CONTRACT,
+    artifact: artifact.identity,
+    expectedDigest: artifact.identity.digest,
+    expectedCanonicalByteLength: artifact.identity.canonicalByteLength,
+    retrieval: { kind: "registered", reference: artifactPath },
+    ...scope ? { scope } : {}
+  };
+  const parsed = PlanArtifactReference_v1Schema.safeParse(reference);
+  if (!parsed.success) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The registered artifact reference does not satisfy the bounded transport contract"
+    );
+  }
+  return parsed.data;
+}
+function parseScope2(scope) {
+  if (scope === void 0) return void 0;
+  const parsed = PlanArtifactScope_v1Schema.safeParse(scope);
+  if (!parsed.success) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The plan scope does not satisfy the bounded transport contract"
+    );
+  }
+  return parsed.data;
+}
+function validateStoreReference(reference) {
+  if (reference.length === 0 || reference.includes("\0") || Buffer.byteLength(reference, "utf8") > 4096) {
+    throw new PlanArtifactRegistrationError(
+      "PLAN_REGISTRATION_INVALID",
+      "The artifact store reference is invalid or exceeds its bound"
+    );
+  }
+  return path80.resolve(reference);
+}
+function prepareControlledStore(storeDirectory) {
+  const root = path80.parse(storeDirectory).root;
+  const segments = path80.relative(root, storeDirectory).split(path80.sep).filter(Boolean);
+  let current = root;
+  for (const segment of segments) {
+    current = path80.join(current, segment);
+    try {
+      const stats = fs72.lstatSync(current);
+      if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        throw new PlanArtifactRegistrationError(
+          "PLAN_REGISTRATION_UNSAFE",
+          "The artifact store contains an unsafe filesystem object"
+        );
+      }
+    } catch (error) {
+      if (error instanceof PlanArtifactRegistrationError) throw error;
+      if (error.code !== "ENOENT") {
+        throw new PlanArtifactRegistrationError(
+          "PLAN_REGISTRATION_UNSAFE",
+          "The artifact store identity is unavailable"
+        );
+      }
+      try {
+        fs72.mkdirSync(current, { mode: 448 });
+      } catch (mkdirError) {
+        if (mkdirError.code !== "EEXIST") {
+          throw new PlanArtifactRegistrationError(
+            "PLAN_REGISTRATION_UNSAFE",
+            "The artifact store could not be prepared"
+          );
+        }
+      }
+      const created = fs72.lstatSync(current);
+      if (created.isSymbolicLink() || !created.isDirectory()) {
+        throw new PlanArtifactRegistrationError(
+          "PLAN_REGISTRATION_UNSAFE",
+          "The artifact store contains an unsafe filesystem object"
+        );
+      }
+    }
+  }
+  assertStoreDirectory(storeDirectory);
+}
+function assertStoreDirectory(storeDirectory) {
+  const root = path80.parse(storeDirectory).root;
+  const segments = path80.relative(root, storeDirectory).split(path80.sep).filter(Boolean);
+  let current = root;
+  for (const segment of segments) {
+    current = path80.join(current, segment);
+    let stats;
+    try {
+      stats = fs72.lstatSync(current);
+    } catch {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_UNSAFE",
+        "The artifact store identity is unavailable"
+      );
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+      throw new PlanArtifactRegistrationError(
+        "PLAN_REGISTRATION_UNSAFE",
+        "The artifact store contains an unsafe filesystem object"
+      );
+    }
+  }
+}
+function writeAll(descriptor, bytes) {
+  let offset = 0;
+  while (offset < bytes.length) {
+    offset += fs72.writeSync(descriptor, bytes, offset, bytes.length - offset, null);
+  }
+}
+function flushDirectoryWhenSupported(directory) {
+  let descriptor;
+  try {
+    descriptor = fs72.openSync(directory, fs72.constants.O_RDONLY);
+    fs72.fsyncSync(descriptor);
+  } catch (error) {
+    const code = error?.code;
+    if (process.platform !== "win32" || code !== "EISDIR" && code !== "EPERM") throw error;
+  } finally {
+    if (descriptor !== void 0) fs72.closeSync(descriptor);
+  }
+}
+function pathEntryExists2(filePath) {
+  try {
+    fs72.lstatSync(filePath);
+    return true;
+  } catch (error) {
+    const code = error?.code;
+    return code !== "ENOENT" && code !== "ENOTDIR";
+  }
+}
+function waitForConcurrentPublisher(artifactPath) {
+  const deadline = Date.now() + 500;
+  const signal = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() < deadline) {
+    let stats;
+    try {
+      stats = fs72.lstatSync(artifactPath);
+    } catch {
+      return;
+    }
+    if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink <= 1) return;
+    Atomics.wait(signal, 0, 0, 10);
   }
 }
 
@@ -77227,7 +77866,7 @@ program.command("view").description("Interactive plan viewer with navigation and
   }
   try {
     const { InteractivePlanViewer: InteractivePlanViewer2 } = await Promise.resolve().then(() => (init_planViewer(), planViewer_exports));
-    const planContent = fs72.readFileSync(planFile, "utf-8");
+    const planContent = fs73.readFileSync(planFile, "utf-8");
     const plan = loadPlan(planContent);
     const viewer = new InteractivePlanViewer2(plan, {
       filter: opts.filter,
@@ -77269,7 +77908,7 @@ program.command("deliverables:list").description("List all autopilot deliverable
       });
       const latest = manager.getLatestPath();
       if (latest) {
-        console.log(`\u{1F4CD} Latest: ${path80.basename(latest)}`);
+        console.log(`\u{1F4CD} Latest: ${path81.basename(latest)}`);
       }
     }
   } catch (error) {
@@ -77343,8 +77982,8 @@ program.command("deliverables:cleanup").description("Clean up old deliverables b
         console.log(`Freed space: ${(result.freedSpace / 1024).toFixed(2)} KB`);
         if (result.removed.length > 0) {
           console.log("\nRemoved:");
-          result.removed.forEach((path81) => {
-            console.log(`  - ${path81}`);
+          result.removed.forEach((path82) => {
+            console.log(`  - ${path82}`);
           });
         }
       }
@@ -77415,8 +78054,8 @@ var isDirectExec = (() => {
   try {
     if (typeof import_meta === "undefined") return false;
     if (!process.argv[1] || !__lexrunnerImportMetaUrl) return false;
-    const invokedPath = fs72.realpathSync((0, import_node_path40.resolve)(process.argv[1]));
-    const modulePath = fs72.realpathSync((0, import_node_url7.fileURLToPath)(__lexrunnerImportMetaUrl));
+    const invokedPath = fs73.realpathSync((0, import_node_path40.resolve)(process.argv[1]));
+    const modulePath = fs73.realpathSync((0, import_node_url7.fileURLToPath)(__lexrunnerImportMetaUrl));
     return invokedPath === modulePath;
   } catch {
     return false;
@@ -77487,11 +78126,17 @@ if (isDirectExec) {
   ConfigurationQueryService,
   ControllerLease_v1,
   DiscoveryQueryService,
+  EXECUTION_PLAN_ARTIFACT_CONTRACT,
+  EXECUTION_PLAN_CANONICALIZATION_PROFILE,
+  EXECUTION_PLAN_HASH_DOMAIN,
+  EXECUTION_PLAN_HASH_PROFILE,
   EngineVerificationCheckSource_v2,
   EngineVerificationDeterminism_v2,
   EngineVerificationTrustGapReason_v2,
   ExecutionEnvelope_v1,
   ExecutionEnvironmentOS,
+  ExecutionPlanArtifactIdentity_v1Schema,
+  ExecutionPlanArtifact_v1Schema,
   ExecutionState,
   ExternalAwaitOutcome_v1,
   ExternalAwaitableDescriptor_v1,
@@ -77547,6 +78192,11 @@ if (isDirectExec) {
   NativeWslProjectionSelection_v1,
   NativeWslProjectionStatusRequestJsonSchema,
   NativeWslSourceObservation_v1,
+  PLAN_ARTIFACT_REFERENCE_CONTRACT,
+  PlanArtifactReference_v1Schema,
+  PlanArtifactRegistrationError,
+  PlanArtifactRegistrationService,
+  PlanArtifactScope_v1Schema,
   PlanArtifactService,
   PlanArtifactServiceError,
   PlanCreationService,
@@ -77576,6 +78226,7 @@ if (isDirectExec) {
   completionForAttemptAwaitable,
   computeAgentEngineVerificationV2Hash,
   computeAgentTaskPacketHash,
+  computeExecutionPlanArtifactDigest,
   computeFanInEvidenceSetHash,
   computeMergeOrder,
   containsAttemptAwaitableCredentialValue,