@smartergpt/lexrunner 2.1.0 → 2.2.0

package/dist/cli.js

@@ -32,6 +32,7 @@ import {
 import {
   AutopilotConfigError,
   FileAnalyzer,
+  FrozenGitInputs,
   GATE_EXECUTION_RECEIPT_SCHEMA_VERSION,
   GitHubAuthError,
   GitHubClientImpl,
@@ -75,6 +76,7 @@ import {
   readRunLog,
   readRunState,
   removeIndexEntry,
+  repositoryIdentity,
   resolveProfile,
   resolveSpawnExecutable,
   runEnvironmentQualityCheck,
@@ -83,7 +85,7 @@ import {
   validateWriteOperation,
   verifyToolchainPins,
   writeRunState
-} from "./chunk-SHSL643G.js";
+} from "./chunk-M6AAYMHH.js";
 import {
   ExecutionState,
   generateMarkdownSummary,
@@ -474,7 +476,7 @@ import "dotenv/config";
 // package.json
 var package_default = {
   name: "@smartergpt/lexrunner",
-  version: "2.1.0",
+  version: "2.2.0",
   type: "module",
   engines: {
     node: ">=24"
@@ -484,7 +486,7 @@ var package_default = {
   description: "Fan-out tasks as multiple PRs in parallel, then build a merge pyramid from the blocks. Compute dependency order, run gates locally, and merge cleanly.",
   repository: {
     type: "git",
-    url: "git+https://github.com/Guffawaffle/lexrunner.git"
+    url: "git+https://github.com/SmarterGPT/lexrunner.git"
   },
   publishConfig: {
     access: "public",
@@ -577,7 +579,7 @@ var package_default = {
     "docs:surface:check": "node scripts/render-doc-surfaces.mjs --check",
     "dogfood:ecosystem": "tsx scripts/dogfood-ecosystem.ts",
     test: "vitest run",
-    "test:git": "vitest run -c vitest.git.config.ts tests/release-prepare.spec.ts tests/promptsResolver.spec.ts tests/e2e-comprehensive.test.ts tests/autopilot-e2e-level3-4.spec.ts tests/deterministic-build.test.ts tests/e2e-merge-resume.spec.ts",
+    "test:git": "vitest run -c vitest.git.config.ts tests/release-prepare.spec.ts tests/promptsResolver.spec.ts tests/e2e-comprehensive.test.ts tests/autopilot-e2e-level3-4.spec.ts tests/deterministic-build.test.ts tests/e2e-merge-resume.spec.ts tests/e2e-frozen-git-inputs.spec.ts",
     "test:isolation": "node scripts/verify-parallel-isolation.mjs",
     "test:cli:slow": "vitest run -c vitest.slow-cli.config.ts",
     benchmark: "vitest bench -c vitest.benchmark.config.ts",
@@ -2644,13 +2646,41 @@ function installUnhandledRejectionHandler() {
   unhandledRejectionHandlerInstalled = true;
 }
 
+// src/core/standardGateCommands.ts
+function getStandardGateCommand(gateName) {
+  const commands = {
+    lint: "npm run lint",
+    test: "npm test",
+    unit: "npm test",
+    typecheck: "npm run typecheck",
+    build: "npm run build",
+    format: "npm run format"
+  };
+  if (!Object.prototype.hasOwnProperty.call(commands, gateName)) {
+    throw new Error(
+      `No executable command is defined for gate ${JSON.stringify(gateName)}. Author an explicit gate run command in a manual plan, or select a supported standard gate.`
+    );
+  }
+  return commands[gateName];
+}
+
 // src/core/githubPlan.ts
 var STANDARD_TEST_GATE_TIMEOUT_MS = 5 * 60 * 1e3;
 async function generatePlanFromGitHub(client, options = {}) {
   const repoInfo = await client.validateRepository();
   const target = options.target || repoInfo.defaultBranch;
+  const targetCommit = await client.getBranchHead(target);
+  const gitInputs = {
+    schemaVersion: "1.0.0",
+    repository: `${repoInfo.url.replace(/\/$/, "").replace(/\.git$/, "")}.git`,
+    checkoutRemote: "origin",
+    acquisition: options.gitAcquisition ?? "fetch",
+    target: { ref: `refs/heads/${target}`, commit: targetCommit },
+    sources: []
+  };
   const prs = await client.listOpenPRs({
     state: "open",
+    base: target,
     labels: options.labels,
     // If no specific query, find PRs with stack labels or open PRs
     ...options.query ? { query: options.query } : {}
@@ -2661,8 +2691,9 @@ async function generatePlanFromGitHub(client, options = {}) {
   const finalPRs = excludePRs.length > 0 ? filteredPRs.filter((pr) => !excludePRs.includes(pr.number)) : filteredPRs;
   if (finalPRs.length === 0) {
     const emptyPlan = {
-      schemaVersion: "1.0.0",
+      schemaVersion: "1.0.1",
       target,
+      gitInputs,
       items: []
     };
     if (options.policy) {
@@ -2676,15 +2707,28 @@ async function generatePlanFromGitHub(client, options = {}) {
         mergeRule: { type: "strict-required" }
       };
     }
-    return emptyPlan;
+    return Plan.parse(emptyPlan);
   }
   const prDetails = await Promise.all(finalPRs.map((pr) => client.getPRDetails(pr.number)));
-  const planItems = prDetails.map((pr) => transformPRToPlanItem(pr, options));
+  if (prDetails.some((pr) => pr.base.ref !== target)) {
+    throw new Error(
+      "Selected PR targets a different branch; refresh discovery for the intended target"
+    );
+  }
+  const planItems = prDetails.map(
+    (pr) => transformPRToPlanItem(pr, options, `${repoInfo.owner}/${repoInfo.repo}`)
+  );
+  gitInputs.sources = prDetails.map((pr) => ({
+    item: `PR-${pr.number}`,
+    ref: `refs/pull/${pr.number}/head`,
+    commit: pr.head.sha
+  })).sort((a, b) => a.item.localeCompare(b.item));
   planItems.sort((a, b) => a.name.localeCompare(b.name));
   validateGitHubDependencies(planItems, prDetails);
   const plan = {
-    schemaVersion: "1.0.0",
+    schemaVersion: "1.0.1",
     target,
+    gitInputs,
     items: planItems
   };
   if (options.policy) {
@@ -2698,12 +2742,18 @@ async function generatePlanFromGitHub(client, options = {}) {
       mergeRule: { type: "strict-required" }
     };
   }
-  return plan;
+  return Plan.parse(plan);
 }
-function transformPRToPlanItem(pr, options) {
+function transformPRToPlanItem(pr, options, repository) {
   const name = `PR-${pr.number}`;
   const deps = pr.dependencies.filter((dep) => {
-    return dep.includes("#");
+    const match = /^(?:([^#]+))?#([1-9][0-9]*)$/.exec(dep);
+    if (!match || match[1] && match[1].toLowerCase() !== repository.toLowerCase()) {
+      throw new Error(
+        `Dependency ${JSON.stringify(dep)} is outside this single-repository plan; declare a valid repository-bound dependency`
+      );
+    }
+    return true;
   }).map((dep) => {
     const prNumber = dep.includes("#") ? dep.split("#")[1] : dep;
     return `PR-${prNumber}`;
@@ -2738,47 +2788,7 @@ function createStandardGate(gateName, pr) {
     runtime: "local",
     artifacts: []
   };
-  switch (gateName) {
-    case "lint":
-      return {
-        ...baseGate,
-        run: "npm run lint",
-        artifacts: ["lint-results.txt"]
-      };
-    case "test":
-    case "unit":
-      return {
-        ...baseGate,
-        run: "npm test",
-        artifacts: ["test-results.xml", "coverage/"],
-        timeoutMs: STANDARD_TEST_GATE_TIMEOUT_MS
-      };
-    case "typecheck":
-      return {
-        ...baseGate,
-        run: "npm run typecheck",
-        artifacts: ["typecheck-results.txt"]
-      };
-    case "build":
-      return {
-        ...baseGate,
-        run: "npm run build",
-        artifacts: ["dist/", "build-log.txt"]
-      };
-    default:
-      return baseGate;
-  }
-}
-function getStandardGateCommand(gateName) {
-  const standardCommands = {
-    lint: "npm run lint",
-    test: "npm test",
-    unit: "npm test",
-    typecheck: "npm run typecheck",
-    build: "npm run build",
-    format: "npm run format"
-  };
-  return standardCommands[gateName] || `echo "Running ${gateName} gate"`;
+  return gateName === "test" || gateName === "unit" ? { ...baseGate, timeoutMs: STANDARD_TEST_GATE_TIMEOUT_MS } : baseGate;
 }
 function validateGitHubDependencies(planItems, prDetails) {
   const itemNames = new Set(planItems.map((item) => item.name));
@@ -2928,7 +2938,7 @@ function generateGatesForMultiRepoPR(pr, options) {
   for (const gateName of requiredGates) {
     gates.push({
       name: gateName,
-      run: getGateCommand(gateName),
+      run: getStandardGateCommand(gateName),
       env: {
         PR_NUMBER: pr.number.toString(),
         PR_BRANCH: pr.head.ref,
@@ -2937,33 +2947,13 @@ function generateGatesForMultiRepoPR(pr, options) {
         REPO_NAME: pr.repoName
       },
       runtime: "local",
-      artifacts: getGateArtifacts(gateName),
+      artifacts: [],
       ...isStandardTestGate(gateName) ? { timeoutMs: STANDARD_TEST_GATE_TIMEOUT_MS2 } : {}
     });
   }
   gates.sort((a, b) => a.name.localeCompare(b.name));
   return gates;
 }
-function getGateCommand(gateName) {
-  const commands = {
-    lint: "npm run lint",
-    test: "npm test",
-    unit: "npm test",
-    typecheck: "npm run typecheck",
-    build: "npm run build"
-  };
-  return commands[gateName] || `echo "Running ${gateName}"`;
-}
-function getGateArtifacts(gateName) {
-  const artifacts = {
-    lint: ["lint-results.txt"],
-    test: ["test-results.xml", "coverage/"],
-    unit: ["test-results.xml", "coverage/"],
-    typecheck: ["typecheck-results.txt"],
-    build: ["dist/"]
-  };
-  return artifacts[gateName] || [];
-}
 function isStandardTestGate(gateName) {
   return gateName === "test" || gateName === "unit";
 }
@@ -3491,6 +3481,7 @@ var IntegrationStatusQueryService = class {
         schemaVersion: validated.schemaVersion,
         target: bounded(validated.target),
         itemCount: validated.items.length,
+        gitInputBinding: validated.gitInputs ? "frozen" : "legacy-unbound",
         ...validated.policy ? { policy: validated.policy } : {}
       },
       mergeSummary: evaluator.getMergeSummary(),
@@ -10019,6 +10010,70 @@ import { join as join15 } from "path";
 import { simpleGit as simpleGit2 } from "simple-git";
 import { ulid } from "ulid";
 
+// src/git/frozen-inputs.ts
+var FrozenGitInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FrozenGitInputError";
+  }
+};
+async function verifyFrozenGitInputs(git2, value) {
+  const inputs = FrozenGitInputs.parse(value);
+  let remote;
+  try {
+    remote = (await git2.raw(["remote", "get-url", inputs.checkoutRemote])).trim();
+    if (repositoryIdentity(remote) !== repositoryIdentity(inputs.repository)) throw new Error();
+  } catch {
+    throw new FrozenGitInputError(
+      "Checkout repository does not match gitInputs; use the declared checkout"
+    );
+  }
+  const resolve16 = async (input) => {
+    let ref = input.ref;
+    if (inputs.acquisition === "fetch") {
+      ref = `refs/lexrunner/inputs/${sha256(Buffer.from(`${inputs.repository}
+${input.ref}
+${input.commit}`))}`;
+      try {
+        await git2.raw([
+          "fetch",
+          "--no-tags",
+          "--no-recurse-submodules",
+          "--no-write-fetch-head",
+          "--",
+          inputs.repository,
+          `+${input.ref}:${ref}`
+        ]);
+      } catch {
+        throw new FrozenGitInputError(
+          `Declared acquisition failed for ${input.ref}; restore access and retry without changing frozen expectations`
+        );
+      }
+    }
+    let observed;
+    try {
+      observed = (await git2.raw(["rev-parse", "--verify", ref])).trim();
+    } catch {
+      throw new FrozenGitInputError(
+        `Declared ref ${input.ref} is unavailable; explicitly acquire it or create a new plan permitting fetch`
+      );
+    }
+    if (observed !== input.commit) {
+      throw new FrozenGitInputError(
+        `Stale Git input ${input.ref}; reassess and generate a new plan instead of replacing its expected commit`
+      );
+    }
+    if ((await git2.raw(["cat-file", "-t", input.commit])).trim() !== "commit") {
+      throw new FrozenGitInputError(`Declared input ${input.ref} is not a commit object`);
+    }
+    return observed;
+  };
+  const targetHeadSha = await resolve16(inputs.target);
+  const sourceHeads = /* @__PURE__ */ Object.create(null);
+  for (const source of inputs.sources) sourceHeads[source.item] = await resolve16(source);
+  return { targetHeadSha, sourceHeads };
+}
+
 // src/weave/resume-service.ts
 import { z as z7 } from "zod";
 async function resumePersistedWeave(input) {
@@ -10167,6 +10222,15 @@ function validateResumeJournal(checkpoint) {
     };
   }
   const ids = /* @__PURE__ */ new Set();
+  const inputs = parsedPlan.data.gitInputs;
+  if (inputs && journal.repository.integrationBranch !== `weave/resume-${checkpoint.runId.toLowerCase()}`) {
+    return { valid: false, reason: "checkpoint integration branch does not match its bound run" };
+  }
+  if (inputs && (inputs.target.commit !== journal.repository.targetHeadSha || inputs.sources.some(
+    (source) => source.commit !== journal.repository.sourceHeads[source.item]
+  ))) {
+    return { valid: false, reason: "checkpoint commits do not match the plan's frozen Git inputs" };
+  }
   let seenIncomplete = false;
   for (const operation of journal.operations) {
     if (!operation.id || ids.has(operation.id)) {
@@ -10332,11 +10396,22 @@ async function createLocalResumeCheckpoint(input) {
   const runId = input.runId ?? ulid();
   const at = input.now ?? (/* @__PURE__ */ new Date()).toISOString();
   const levels = computeMergeOrder(input.plan);
-  const sourceHeads = {};
-  for (const item of input.plan.items) {
-    sourceHeads[item.name] = await exactRefHead(git2, item.name);
+  Plan.parse(input.plan);
+  const sourceHeads = /* @__PURE__ */ Object.create(null);
+  let targetHeadSha;
+  if (input.plan.gitInputs) {
+    const status = await git2.status();
+    if (status.files.some(isUnexpectedBoundChange)) {
+      throw new Error("Working tree must be clean before acquiring frozen Git inputs");
+    }
+    const verified = await verifyFrozenGitInputs(git2, input.plan.gitInputs);
+    Object.assign(sourceHeads, verified.sourceHeads);
+    targetHeadSha = verified.targetHeadSha;
+  } else {
+    for (const item of input.plan.items)
+      sourceHeads[item.name] = await exactRefHead(git2, item.name);
+    targetHeadSha = await exactRefHead(git2, input.plan.target);
   }
-  const targetHeadSha = await exactRefHead(git2, input.plan.target);
   const integrationBranch = `weave/resume-${runId.toLowerCase()}`;
   const operations = planResumeOperations(input.plan);
   const planHash = sha256(Buffer.from(canonicalJSONStringify(input.plan)));
@@ -10358,7 +10433,7 @@ async function createLocalResumeCheckpoint(input) {
     lastUpdatedAt: at,
     metadata: {
       target: input.plan.target,
-      warnings: [],
+      warnings: input.plan.gitInputs ? [] : ["Legacy unbound plan: Git heads are selected at preparation, not frozen at synthesis"],
       resume: createResumeJournal({
         operations,
         target: input.plan.target,
@@ -10380,23 +10455,34 @@ var LocalWeaveResumeDriver = class {
     if (!journal) return { valid: false, reason: "resume journal is missing" };
     try {
       const status = await this.git.status();
-      const unexpectedChanges = status.files.filter((file) => !isRunnerStatePath(file.path));
+      const unexpectedChanges = status.files.filter(
+        checkpoint.plan.gitInputs ? isUnexpectedBoundChange : (file) => !isRunnerStatePath(file.path)
+      );
       if (unexpectedChanges.length > 0) {
         return {
           valid: false,
           reason: "working tree is not clean; resolve or abort the interrupted operation first"
         };
       }
-      const targetHead = await exactRefHead(this.git, journal.repository.target);
-      if (targetHead !== journal.repository.targetHeadSha) {
-        return { valid: false, reason: "target branch changed after the checkpoint was created" };
-      }
-      for (const [name, expected] of Object.entries(journal.repository.sourceHeads)) {
-        if (await exactRefHead(this.git, name) !== expected) {
-          return {
-            valid: false,
-            reason: `source branch ${name} changed after checkpoint creation`
-          };
+      if (checkpoint.plan.gitInputs) {
+        const verified = await verifyFrozenGitInputs(this.git, checkpoint.plan.gitInputs);
+        if (verified.targetHeadSha !== journal.repository.targetHeadSha || Object.entries(verified.sourceHeads).some(
+          ([name, commit]) => journal.repository.sourceHeads[name] !== commit
+        )) {
+          return { valid: false, reason: "Journal commit evidence differs from frozen Git inputs" };
+        }
+      } else {
+        const targetHead = await exactRefHead(this.git, journal.repository.target);
+        if (targetHead !== journal.repository.targetHeadSha) {
+          return { valid: false, reason: "target branch changed after the checkpoint was created" };
+        }
+        for (const [name, expected] of Object.entries(journal.repository.sourceHeads)) {
+          if (await exactRefHead(this.git, name) !== expected) {
+            return {
+              valid: false,
+              reason: `source branch ${name} changed after checkpoint creation`
+            };
+          }
         }
       }
       const integrationHead = await localBranchHead(this.git, journal.repository.integrationBranch);
@@ -10447,29 +10533,66 @@ var LocalWeaveResumeDriver = class {
   }
   async execute(operation, checkpoint) {
     const journal = checkpoint.metadata.resume;
+    const bound4 = !!checkpoint.plan.gitInputs;
+    const expectedIntegration = lastCompletedMergeSha(journal.operations) ?? journal.repository.targetHeadSha;
+    if (bound4) {
+      const stateError = await this.boundStateError();
+      if (stateError) return { completed: false, reason: stateError };
+      const integrationHead = await localBranchHead(this.git, journal.repository.integrationBranch);
+      if (integrationHead && integrationHead !== expectedIntegration || !integrationHead && lastCompletedMergeSha(journal.operations)) {
+        return {
+          completed: false,
+          reason: "Frozen integration branch changed before operation; preserve and inspect it"
+        };
+      }
+    }
     await this.ensureIntegrationBranch(
       journal.repository.integrationBranch,
       journal.repository.targetHeadSha
     );
     if (operation.phase === "merge") {
       await this.git.checkout(journal.repository.integrationBranch);
+      if (bound4) {
+        const stateError = await this.boundStateError(expectedIntegration);
+        if (stateError) return { completed: false, reason: stateError };
+      }
       const item = checkpoint.plan.items.find((candidate) => candidate.name === operation.item);
       if (!item) return { completed: false, reason: "plan item is missing" };
       const result2 = await this.operations.executeMergeOperation({
         item,
         targetBranch: journal.repository.integrationBranch,
-        strategy: "merge-weave"
+        strategy: "merge-weave",
+        ...checkpoint.plan.gitInputs ? { sourceCommit: journal.repository.sourceHeads[operation.item] } : {}
       });
+      if (bound4 && result2.success && result2.sha) {
+        const stateError = await this.boundStateError(result2.sha);
+        if (stateError) return { completed: false, reason: stateError };
+      }
       return result2.success && result2.sha ? { completed: true, externalId: result2.sha } : { completed: false, reason: result2.message ?? "merge failed" };
     }
     const gate = gateForOperation(checkpoint.plan, operation);
     if (!gate) return { completed: false, reason: "gate definition is missing" };
     if (operation.phase === "gate") {
-      await this.git.checkout(`origin/${operation.item}`).catch(() => this.git.checkout(operation.item));
+      if (checkpoint.plan.gitInputs) {
+        await this.git.checkout(["--detach", journal.repository.sourceHeads[operation.item]]);
+      } else {
+        await this.git.checkout(`origin/${operation.item}`).catch(() => this.git.checkout(operation.item));
+      }
     } else {
       await this.git.checkout(journal.repository.integrationBranch);
     }
-    const artifactDir = join15(this.workingDir, ".lexrunner", "runs", checkpoint.runId, "gates");
+    const expectedGateHead = operation.phase === "gate" ? journal.repository.sourceHeads[operation.item] : expectedIntegration;
+    if (bound4) {
+      const stateError = await this.boundStateError(expectedGateHead);
+      if (stateError) return { completed: false, reason: stateError };
+    }
+    const artifactDir = join15(
+      this.workingDir,
+      ".lexrunner",
+      "runs",
+      checkpoint.runId,
+      operation.phase
+    );
     await mkdir2(artifactDir, { recursive: true });
     const policy = Policy.parse(checkpoint.plan.policy ?? {});
     const result = await executeGate(
@@ -10481,12 +10604,38 @@ var LocalWeaveResumeDriver = class {
       false,
       this.workingDir
     );
-    return result.status === "pass" ? { completed: true, externalId: `${gate.name}:${result.lastAttempt ?? "pass"}` } : { completed: false, reason: result.stderr || `gate ${gate.name} failed` };
+    if (bound4) {
+      const stateError = await this.boundStateError(expectedGateHead);
+      if (stateError) return { completed: false, reason: stateError };
+      if (await localBranchHead(this.git, journal.repository.integrationBranch) !== expectedIntegration) {
+        return {
+          completed: false,
+          reason: "Gate changed the frozen integration branch; preserve and inspect it"
+        };
+      }
+    }
+    const receipt = result.artifacts?.find(
+      (path60) => /gate-execution-receipt\.attempt-\d+\.json$/.test(path60)
+    );
+    return result.status === "pass" ? {
+      completed: true,
+      externalId: receipt ?? `${gate.name}:${result.lastAttempt ?? "pass"}`
+    } : { completed: false, reason: result.stderr || `gate ${gate.name} failed` };
   }
   async ensureIntegrationBranch(branch, targetHeadSha) {
     if (await localBranchHead(this.git, branch)) return;
     await this.git.checkoutBranch(branch, targetHeadSha);
   }
+  async boundStateError(expectedHead) {
+    if (expectedHead && (await this.git.revparse(["HEAD"])).trim() !== expectedHead) {
+      return "Frozen checkout HEAD changed during the operation; preserve and inspect the new commit";
+    }
+    const status = await this.git.status();
+    if (status.files.some(isUnexpectedBoundChange)) {
+      return "Frozen checkout index or working tree changed; preserve and inspect the modifications before continuing";
+    }
+    return null;
+  }
 };
 function gateForOperation(plan, operation) {
   const parts = operation.id.split(":");
@@ -10532,12 +10681,16 @@ function lastCompletedMergeSha(operations) {
 function isRunnerStatePath(path60) {
   return path60 === ".lexrunner" || path60.startsWith(".lexrunner/") || path60 === "weave-lock.json" || path60.endsWith("/weave-lock.json");
 }
+function isUnexpectedBoundChange(file) {
+  return !(file.index === "?" && file.working_dir === "?" && isRunnerStatePath(file.path));
+}
 
 // src/commands/weave.ts
 import fs22 from "fs";
 import path15 from "path";
 
 // src/application/merge-application-service.ts
+import { join as join16 } from "path";
 var MAX_OPERATIONS = 256;
 var MAX_LABEL_BYTES2 = 512;
 var MAX_RESULT_BYTES2 = 256 * 1024;
@@ -10564,6 +10717,7 @@ var MergeApplicationService = class {
           ok: true,
           status: "preview",
           totalItems: input.plan.items.length,
+          gitInputBinding: input.plan.gitInputs ? "frozen" : "legacy-unbound",
           levels,
           maxParallelism: levels.length === 0 ? 0 : Math.max(...levels.map((level) => level.length)),
           artifactRefs: []
@@ -10585,10 +10739,10 @@ var MergeApplicationService = class {
     let runId;
     try {
       runId = await this.runtime.prepare(input.plan, input.workingDir);
-    } catch {
+    } catch (error) {
       throw new MergeApplicationServiceError(
         "MERGE_STALE_INPUT",
-        "Merge input could not be bound to current source and target heads"
+        error instanceof FrozenGitInputError ? error.message : "Merge input could not be bound to current source and target heads"
       );
     }
     return this.executePrepared({ plan: input.plan, workingDir: input.workingDir, runId });
@@ -10618,6 +10772,7 @@ var MergeApplicationService = class {
       ok: completed,
       status: execution.result.ok ? execution.result.outcome : "failed",
       totalItems: input.plan.items.length,
+      gitInputBinding: input.plan.gitInputs ? "frozen" : "legacy-unbound",
       runId: bound2(input.runId),
       operations: execution.operations.map((operation) => ({
         id: bound2(operation.id),
@@ -10638,15 +10793,22 @@ var LocalMergeApplicationRuntime = class {
   }
   async prepare(plan, workingDir) {
     const checkpoint = await createLocalResumeCheckpoint({ plan, workingDir });
-    await saveCheckpoint(checkpoint, { skipCleanup: true });
+    await saveCheckpoint(checkpoint, {
+      checkpointDir: join16(workingDir, ".lexrunner", "checkpoints"),
+      skipCleanup: true
+    });
     return checkpoint.runId;
   }
   async resume(runId, workingDir) {
     const result = await resumePersistedWeave({
       runId,
+      checkpointDir: join16(workingDir, ".lexrunner", "checkpoints"),
       driver: new LocalWeaveResumeDriver(workingDir)
     });
-    const checkpoint = await loadCheckpoint(runId, { validatePlanHash: false });
+    const checkpoint = await loadCheckpoint(runId, {
+      checkpointDir: join16(workingDir, ".lexrunner", "checkpoints"),
+      validatePlanHash: false
+    });
     return { result, operations: checkpoint.metadata?.resume?.operations ?? [] };
   }
 };
@@ -10959,6 +11121,10 @@ async function runWeaveApply(opts, deps) {
       console.log(`Items: ${plan.items.length}`);
       console.log(`Target: ${plan.target}
 `);
+      console.log(
+        `Git inputs: ${preview.summary.gitInputBinding}${plan.gitInputs ? `; acquisition: ${plan.gitInputs.acquisition}` : ""}
+`
+      );
       console.log("\u{1F4E6} Execution Plan\n");
       console.log("Execution Order (topological):\n");
       levels.forEach((level, index) => {
@@ -10982,7 +11148,7 @@ async function runWeaveApply(opts, deps) {
       console.log(`Items: ${plan.items.length}
 `);
     }
-    if (!opts.skipGates) {
+    if (!opts.skipGates && !(opts.execute && plan.gitInputs)) {
       if (!json2) console.log("Running gates...\n");
       const executionState = new ExecutionState(plan);
       const gatesDir = path15.join(process.cwd(), ".smartergpt", "runner", "gates");
@@ -11778,7 +11944,7 @@ function registerAutopilotCommand(program2, deps) {
           argv: process.argv.slice(2)
         });
       }
-      const { AutopilotLevel0, AutopilotLevel1, AutopilotLevel2: AutopilotLevel22 } = await import("./autopilot-JWIOXBCZ.js");
+      const { AutopilotLevel0, AutopilotLevel1, AutopilotLevel2: AutopilotLevel22 } = await import("./autopilot-7PX6YG55.js");
       const context = {
         plan,
         profilePath: profile.path,
@@ -11826,7 +11992,7 @@ function registerAutopilotCommand(program2, deps) {
 // src/application/gate-execution-service.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { mkdirSync as mkdirSync12 } from "fs";
-import { join as join18, resolve as resolve9 } from "path";
+import { join as join19, resolve as resolve9 } from "path";
 var MAX_ITEMS = 256;
 var MAX_GATES_PER_ITEM = 64;
 var MAX_LABEL_BYTES3 = 512;
@@ -11929,7 +12095,7 @@ var GateExecutionService = class {
 function prepareOwnedArtifactDirectory(requestedRoot) {
   const root = resolve9(bounded2(requestedRoot, MAX_ARTIFACT_REF_BYTES));
   mkdirSync12(root, { recursive: true });
-  const runDirectory = join18(root, `gate-run-${Date.now()}-${randomUUID4()}`);
+  const runDirectory = join19(root, `gate-run-${Date.now()}-${randomUUID4()}`);
   mkdirSync12(runDirectory);
   return runDirectory;
 }
@@ -23484,7 +23650,7 @@ var NativeWslProjectionEngine = class {
         "native publication target became occupied"
       );
     }
-    const repositoryIdentity = identityOf(staging.repository);
+    const repositoryIdentity2 = identityOf(staging.repository);
     const allocationIdentity = identityOf(staging.allocation);
     staging.repository.close();
     staging.repository = void 0;
@@ -23497,7 +23663,7 @@ var NativeWslProjectionEngine = class {
     staging.repositoryPublished = true;
     assertPublishedIdentity(
       path35.join(boundary.projectionRoot.path, projectionId),
-      repositoryIdentity,
+      repositoryIdentity2,
       "native projection"
     );
     await rename(
@@ -24383,11 +24549,11 @@ function loadNativeWslProjectionSelection(repositoryRoot, expectedSelectionDiges
   if (!/^sha256:[a-f0-9]{64}$/u.test(expectedSelectionDigest)) {
     throw new Error("Projection selection authority is invalid");
   }
-  const repositoryIdentity = captureDirectoryIdentity(
+  const repositoryIdentity2 = captureDirectoryIdentity(
     repositoryRoot,
     "native projection repository"
   );
-  const repository = reopenDirectoryIdentity(repositoryIdentity, "native projection repository");
+  const repository = reopenDirectoryIdentity(repositoryIdentity2, "native projection repository");
   let gitDirectory;
   try {
     gitDirectory = openChildDirectory(repository, ".git", "native projection Git directory");
@@ -44417,7 +44583,7 @@ function createRunManager(baseDirOrOptions) {
 
 // src/runs/coordinated-manager.ts
 import { existsSync as existsSync24, readFileSync as readFileSync32, renameSync as renameSync3, writeFileSync as writeFileSync19 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 
 // src/runs/agent-work-supervisor.ts
 import { z as z48 } from "zod";
@@ -51288,7 +51454,7 @@ program.command("view").description("Interactive plan viewer with navigation and
 program.command("deliverables:list").description("List all autopilot deliverables with metadata").option("--profile-dir <dir>", "Profile directory (default: .smartergpt)").option("--json", "Output JSON format").action(async (opts) => {
   try {
     const profile = resolveProfile(opts.profileDir);
-    const { DeliverablesManager } = await import("./autopilot-JWIOXBCZ.js");
+    const { DeliverablesManager } = await import("./autopilot-7PX6YG55.js");
     const manager = new DeliverablesManager(profile.path);
     const deliverables = await manager.listDeliverables();
     if (opts.json) {
@@ -51327,7 +51493,7 @@ program.command("deliverables:list").description("List all autopilot deliverable
 program.command("deliverables:cleanup").description("Clean up old deliverables based on retention policy").option("--profile-dir <dir>", "Profile directory (default: .smartergpt)").option("--max-age <days>", "Maximum age in days (deletes older deliverables)").option("--max-count <count>", "Maximum number of deliverables to keep").option("--keep-latest", "Always keep the latest deliverables (default: true)", true).option("--dry-run", "Preview cleanup without deleting").option("--json", "Output JSON format").action(async (opts) => {
   try {
     const profile = resolveProfile(opts.profileDir);
-    const { DeliverablesManager } = await import("./autopilot-JWIOXBCZ.js");
+    const { DeliverablesManager } = await import("./autopilot-7PX6YG55.js");
     const manager = new DeliverablesManager(profile.path);
     const policy = {
       maxAge: opts.maxAge ? parseInt(opts.maxAge) : void 0,