@snappedly-tools/shipyard 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,21 +1,21 @@
-import { createRequire } from 'node:module';
-import { CODEX_MODELS, NodeContext_exports, NodeFileSystem_exports, formatErrorMessage } from './chunk-SRUH232X.js';
-export { CODEX_MODELS, CODEX_REASONING_EFFORTS } from './chunk-SRUH232X.js';
-import { Context_exports, CwdError, Effect_exports, resolveCwd, getCurrentBranch, generateTempBranchName, CONFIG_DIR, LOGS_DIR, assertNoSymlinkComponents, Layer_exports, FileDisplay, ClackDisplay, WorktreeDockerSandboxFactory, SandboxConfig, Display, CLI_NAME, PRODUCT_NAME, pruneStale, create, copyToWorktree, runHostHooks, startSandbox, resolveGitMounts, patchGitMountsForWindows, SANDBOX_REPO_DIR, remove, makeSandboxFromHandle, syncOut, withSandboxLifecycle, hasUncommittedChanges, registerShutdown, SandboxFactory, PromptError, FileSystem_exports, resolveCanonicalConfigDir, ConfigDirError, AgentError, SessionCaptureError, Clock_exports, Duration_exports, Option_exports, PromptExpansionTimeoutError, Deferred_exports, Ref_exports, SilentDisplay, AgentIdleTimeoutError, Fiber_exports } from './chunk-4VDXZY7T.js';
-import { shellQuote, toSessionTransferHandle } from './chunk-CP6YEQKU.js';
-export { createBindMountSandboxProvider, createIsolatedSandboxProvider } from './chunk-CP6YEQKU.js';
-import { noSandbox } from './chunk-YVJHSJUW.js';
-import './chunk-BU6XJFJ2.js';
+import { CODEX_MODELS, formatErrorMessage } from './chunk-VDHZO5PP.js';
+export { CODEX_MODELS, CODEX_REASONING_EFFORTS } from './chunk-VDHZO5PP.js';
+import { CwdError, resolveCwd, getCurrentBranch, generateTempBranchName, CONFIG_DIR, LOGS_DIR, assertNoSymlinkComponents, FileDisplay, ClackDisplay, WorktreeDockerSandboxFactory, SandboxConfig, Display, CLI_NAME, PRODUCT_NAME, pruneStale, create, copyToWorktree, runHostHooks, startSandbox, resolveGitMounts, patchGitMountsForWindows, SANDBOX_REPO_DIR, remove, makeSandboxFromHandle, syncOut, withSandboxLifecycle, hasUncommittedChanges, registerShutdown, SandboxFactory, PromptError, ConfigDirError, AgentError, SessionCaptureError, PromptExpansionTimeoutError, SilentDisplay, AgentIdleTimeoutError } from './chunk-2GT3OPO5.js';
+import { shellQuote, toSessionTransferHandle } from './chunk-KMGNFXKN.js';
+export { createBindMountSandboxProvider, createIsolatedSandboxProvider } from './chunk-KMGNFXKN.js';
+import { noSandbox } from './chunk-VW4MI5GJ.js';
+import './chunk-WA7QPAXO.js';
+import { NodeContext, NodeFileSystem } from '@effect/platform-node';
 import { mkdirSync, chmodSync, appendFileSync, constants } from 'fs';
 import path, { join, posix, dirname, relative } from 'path';
 import { styleText } from 'util';
+import { Context, Effect, Layer, Clock, Duration, Option, Deferred, Ref, Fiber } from 'effect';
+import { FileSystem } from '@effect/platform';
 import * as clack from '@clack/prompts';
 import { readdir, access, readFile, mkdir, mkdtemp, writeFile, rm, lstat, open, chmod } from 'fs/promises';
 import { homedir, tmpdir } from 'os';
 import { createHmac, timingSafeEqual, createHash, randomUUID } from 'crypto';
 
-createRequire(import.meta.url);
-
 // src/resumePrecheck.ts
 var assertResumeSessionExists = async (params) => {
   const { provider, sandboxTag, hostRepoDir, resumeSession } = params;
@@ -45,20 +45,16 @@ var assertResumeSessionExists = async (params) => {
     );
   }
 };
-
-// src/AgentStreamEmitter.ts
-var AgentStreamEmitter = class extends Context_exports.Tag("AgentStreamEmitter")() {
+var AgentStreamEmitter = class extends Context.Tag("AgentStreamEmitter")() {
 };
-var agentStreamEmitterLayer = (onEvent) => Layer_exports.succeed(AgentStreamEmitter, {
-  emit: onEvent ? (event) => Effect_exports.sync(() => {
+var agentStreamEmitterLayer = (onEvent) => Layer.succeed(AgentStreamEmitter, {
+  emit: onEvent ? (event) => Effect.sync(() => {
     try {
       onEvent(event);
     } catch {
     }
-  }) : () => Effect_exports.void
+  }) : () => Effect.void
 });
-
-// src/PromptPreprocessor.ts
 var PROMPT_EXPANSION_TIMEOUT_MS = 3e4;
 var MAX_PROMPT_EXPANSIONS = 64;
 var MAX_EXPANSION_OUTPUT_BYTES = 256 * 1024;
@@ -72,46 +68,46 @@ var MARKED_SHELL_BLOCK_PATTERN = new RegExp(
 var preprocessPrompt = (prompt, sandbox, cwd) => {
   const matches = [...prompt.matchAll(MARKED_SHELL_BLOCK_PATTERN)];
   if (matches.length === 0) {
-    return Effect_exports.succeed(prompt.replaceAll(SHELL_BLOCK_MARKER, ""));
+    return Effect.succeed(prompt.replaceAll(SHELL_BLOCK_MARKER, ""));
   }
   if (matches.length > MAX_PROMPT_EXPANSIONS) {
-    return Effect_exports.fail(
+    return Effect.fail(
       new PromptError({
         message: `Prompt contains ${matches.length} shell expressions; the maximum is ${MAX_PROMPT_EXPANSIONS}`
       })
     );
   }
-  return Effect_exports.gen(function* () {
+  return Effect.gen(function* () {
     const display = yield* Display;
     return yield* display.taskLog(
       "Expanding shell expressions",
-      (message) => Effect_exports.gen(function* () {
-        const results = yield* Effect_exports.all(
+      (message) => Effect.gen(function* () {
+        const results = yield* Effect.all(
           matches.map((match) => {
             const command = match[1];
-            return Effect_exports.gen(function* () {
-              const start = yield* Clock_exports.currentTimeMillis;
+            return Effect.gen(function* () {
+              const start = yield* Clock.currentTimeMillis;
               const controller = new AbortController();
               const maybeResult = yield* sandbox.exec(command, {
                 cwd,
                 signal: controller.signal,
                 maxOutputBytes: MAX_EXPANSION_OUTPUT_BYTES
               }).pipe(
-                Effect_exports.timeoutOption(
-                  Duration_exports.millis(PROMPT_EXPANSION_TIMEOUT_MS)
+                Effect.timeoutOption(
+                  Duration.millis(PROMPT_EXPANSION_TIMEOUT_MS)
                 ),
                 // A timeout must stop the underlying local process too;
                 // interrupting a Promise alone would leave a host-side
                 // prompt command running after the request has failed.
-                Effect_exports.ensuring(
-                  Effect_exports.sync(() => {
+                Effect.ensuring(
+                  Effect.sync(() => {
                     controller.abort();
                   })
                 )
               );
-              if (Option_exports.isNone(maybeResult)) {
-                const elapsedMs = (yield* Clock_exports.currentTimeMillis) - start;
-                return yield* Effect_exports.fail(
+              if (Option.isNone(maybeResult)) {
+                const elapsedMs = (yield* Clock.currentTimeMillis) - start;
+                return yield* Effect.fail(
                   new PromptExpansionTimeoutError({
                     message: `Shell expression \`${command}\` timed out after ${elapsedMs}ms`,
                     timeoutMs: PROMPT_EXPANSION_TIMEOUT_MS,
@@ -122,7 +118,7 @@ var preprocessPrompt = (prompt, sandbox, cwd) => {
               }
               const execResult = maybeResult.value;
               if (execResult.exitCode !== 0) {
-                return yield* Effect_exports.fail(
+                return yield* Effect.fail(
                   new PromptError({
                     message: `Command \`${command}\` exited with code ${execResult.exitCode}: ${execResult.stderr}`,
                     exitCode: execResult.exitCode
@@ -131,7 +127,7 @@ var preprocessPrompt = (prompt, sandbox, cwd) => {
               }
               const output = execResult.stdout.trimEnd();
               if (Buffer.byteLength(output, "utf8") > MAX_EXPANSION_OUTPUT_BYTES) {
-                return yield* Effect_exports.fail(
+                return yield* Effect.fail(
                   new PromptError({
                     message: `Shell expression output exceeds the ${MAX_EXPANSION_OUTPUT_BYTES}-byte limit`,
                     exitCode: execResult.exitCode
@@ -156,7 +152,7 @@ var preprocessPrompt = (prompt, sandbox, cwd) => {
         }
         const expanded = result3.replaceAll(SHELL_BLOCK_MARKER, "");
         if (Buffer.byteLength(expanded, "utf8") > MAX_EXPANDED_PROMPT_BYTES) {
-          return yield* Effect_exports.fail(
+          return yield* Effect.fail(
             new PromptError({
               message: `Expanded prompt exceeds the ${MAX_EXPANDED_PROMPT_BYTES}-byte limit`
             })
@@ -228,27 +224,27 @@ var appendBounded = (current, addition) => {
   if (current.length >= MAX_AGENT_RETAINED_OUTPUT_CHARS) return current;
   return current + addition.slice(0, MAX_AGENT_RETAINED_OUTPUT_CHARS - current.length);
 };
-var invokeAgent = (sandbox, sandboxRepoDir, prompt, provider, idleTimeoutMs, completionTimeoutMs, completionSignals, onText, onToolCall, onRawLine, onIdleWarning, onCompletionTimeout, idleWarningIntervalMs = IDLE_WARNING_INTERVAL_MS, resumeSession, forkSession, signal, toolAllowlist) => Effect_exports.gen(function* () {
+var invokeAgent = (sandbox, sandboxRepoDir, prompt, provider, idleTimeoutMs, completionTimeoutMs, completionSignals, onText, onToolCall, onRawLine, onIdleWarning, onCompletionTimeout, idleWarningIntervalMs = IDLE_WARNING_INTERVAL_MS, resumeSession, forkSession, signal, toolAllowlist) => Effect.gen(function* () {
   let resultText = "";
   let sessionId;
   let usage;
   let accumulatedOutput = "";
-  const timeoutSignal = yield* Deferred_exports.make();
-  const completionTimeoutDeferred = yield* Deferred_exports.make();
+  const timeoutSignal = yield* Deferred.make();
+  const completionTimeoutDeferred = yield* Deferred.make();
   let timeoutFiber = null;
   let completionDetected = false;
   let warningFiber = null;
   let idleMinuteCounter = 0;
   const interruptFiber = (fiber) => {
-    if (fiber !== null) Effect_exports.runFork(Fiber_exports.interrupt(fiber));
+    if (fiber !== null) Effect.runFork(Fiber.interrupt(fiber));
   };
   const startWarningInterval = () => {
     interruptFiber(warningFiber);
     idleMinuteCounter = 0;
-    warningFiber = Effect_exports.runFork(
-      Effect_exports.gen(function* () {
+    warningFiber = Effect.runFork(
+      Effect.gen(function* () {
         while (true) {
-          yield* Effect_exports.sleep(Duration_exports.millis(idleWarningIntervalMs));
+          yield* Effect.sleep(Duration.millis(idleWarningIntervalMs));
           idleMinuteCounter++;
           onIdleWarning(idleMinuteCounter);
         }
@@ -258,11 +254,11 @@ var invokeAgent = (sandbox, sandboxRepoDir, prompt, provider, idleTimeoutMs, com
   const resetTimer = () => {
     interruptFiber(timeoutFiber);
     if (completionDetected) {
-      timeoutFiber = Effect_exports.runFork(
-        Effect_exports.gen(function* () {
-          yield* Effect_exports.sleep(Duration_exports.millis(completionTimeoutMs));
+      timeoutFiber = Effect.runFork(
+        Effect.gen(function* () {
+          yield* Effect.sleep(Duration.millis(completionTimeoutMs));
           onCompletionTimeout(completionTimeoutMs);
-          yield* Deferred_exports.succeed(completionTimeoutDeferred, {
+          yield* Deferred.succeed(completionTimeoutDeferred, {
             result: resultText || accumulatedOutput,
             sessionId,
             usage
@@ -270,10 +266,10 @@ var invokeAgent = (sandbox, sandboxRepoDir, prompt, provider, idleTimeoutMs, com
         })
       );
     } else {
-      timeoutFiber = Effect_exports.runFork(
-        Effect_exports.gen(function* () {
-          yield* Effect_exports.sleep(Duration_exports.millis(idleTimeoutMs));
-          yield* Deferred_exports.fail(
+      timeoutFiber = Effect.runFork(
+        Effect.gen(function* () {
+          yield* Effect.sleep(Duration.millis(idleTimeoutMs));
+          yield* Deferred.fail(
             timeoutSignal,
             new AgentIdleTimeoutError({
               message: `Agent idle for ${idleTimeoutMs / 1e3} seconds \u2014 no output received. Consider increasing the idle timeout with --idle-timeout.`,
@@ -285,20 +281,20 @@ var invokeAgent = (sandbox, sandboxRepoDir, prompt, provider, idleTimeoutMs, com
       startWarningInterval();
     }
   };
-  const abortDeferred = yield* Deferred_exports.make();
+  const abortDeferred = yield* Deferred.make();
   let abortCleanup = null;
   if (signal) {
     if (signal.aborted) {
-      return yield* Effect_exports.die(signal.reason);
+      return yield* Effect.die(signal.reason);
     }
     const onAbort = () => {
-      Effect_exports.runFork(Deferred_exports.die(abortDeferred, signal.reason));
+      Effect.runFork(Deferred.die(abortDeferred, signal.reason));
     };
     signal.addEventListener("abort", onAbort, { once: true });
     abortCleanup = () => signal.removeEventListener("abort", onAbort);
   }
   resetTimer();
-  const execEffect = Effect_exports.gen(function* () {
+  const execEffect = Effect.gen(function* () {
     const printCmd = provider.buildPrintCommand({
       prompt,
       dangerouslySkipPermissions: true,
@@ -353,7 +349,7 @@ var invokeAgent = (sandbox, sandboxRepoDir, prompt, provider, idleTimeoutMs, com
         const lines = execResult.stdout.split("\n").filter((l) => l.trim());
         errorDetail = lines.slice(-20).join("\n");
       }
-      return yield* Effect_exports.fail(
+      return yield* Effect.fail(
         new AgentError({
           message: `${provider.name} exited with code ${execResult.exitCode}:
 ${errorDetail}`
@@ -362,8 +358,8 @@ ${errorDetail}`
     }
     return { result: resultText || execResult.stdout, sessionId, usage };
   }).pipe(
-    Effect_exports.ensuring(
-      Effect_exports.sync(() => {
+    Effect.ensuring(
+      Effect.sync(() => {
         interruptFiber(timeoutFiber);
         timeoutFiber = null;
         interruptFiber(warningFiber);
@@ -371,17 +367,17 @@ ${errorDetail}`
       })
     )
   );
-  let raced = Effect_exports.raceFirst(execEffect, Deferred_exports.await(timeoutSignal));
-  raced = Effect_exports.raceFirst(raced, Deferred_exports.await(completionTimeoutDeferred));
+  let raced = Effect.raceFirst(execEffect, Deferred.await(timeoutSignal));
+  raced = Effect.raceFirst(raced, Deferred.await(completionTimeoutDeferred));
   if (signal) {
-    raced = Effect_exports.raceFirst(
+    raced = Effect.raceFirst(
       raced,
-      Deferred_exports.await(abortDeferred)
+      Deferred.await(abortDeferred)
     );
   }
   return yield* raced.pipe(
-    Effect_exports.ensuring(
-      Effect_exports.sync(() => {
+    Effect.ensuring(
+      Effect.sync(() => {
         abortCleanup?.();
         interruptFiber(timeoutFiber);
         timeoutFiber = null;
@@ -397,13 +393,13 @@ var DEFAULT_COMPLETION_TIMEOUT_SECONDS = 60;
 var orchestrate = (options) => {
   const idleTimeoutMs = (options.idleTimeoutSeconds ?? DEFAULT_IDLE_TIMEOUT_SECONDS) * 1e3;
   const completionTimeoutMs = (options.completionTimeoutSeconds ?? DEFAULT_COMPLETION_TIMEOUT_SECONDS) * 1e3;
-  return Effect_exports.gen(function* () {
+  return Effect.gen(function* () {
     const factory = yield* SandboxFactory;
     const display = yield* Display;
     const streamEmitter = yield* AgentStreamEmitter;
     const { hostRepoDir, iterations, hooks, prompt, branch, provider } = options;
     if (options.toolAllowlist !== void 0 && provider.supportsToolAllowlist !== true) {
-      return yield* Effect_exports.fail(
+      return yield* Effect.fail(
         new AgentError({
           message: `Agent provider "${provider.name}" does not enforce the phase tool allowlist`
         })
@@ -423,7 +419,7 @@ var orchestrate = (options) => {
     let allStdout = "";
     let resolvedBranch = "";
     let iterationPreservedPath;
-    const checkAbort = () => options.signal?.aborted ? Effect_exports.die(options.signal.reason) : Effect_exports.void;
+    const checkAbort = () => options.signal?.aborted ? Effect.die(options.signal.reason) : Effect.void;
     for (let i = 1; i <= iterations; i++) {
       yield* checkAbort();
       yield* display.status(label(`Iteration ${i}/${iterations}`), "info");
@@ -441,12 +437,12 @@ var orchestrate = (options) => {
             keepSourceBranch: options.keepSourceBranch
           },
           sandbox,
-          (ctx) => Effect_exports.gen(function* () {
+          (ctx) => Effect.gen(function* () {
             const iterationResumeSession = i === 1 ? options.resumeSession : void 0;
             const iterationForkSession = i === 1 ? options.forkSession : void 0;
             if (iterationResumeSession && bindMountHandle && provider.sessionStorage) {
               yield* display.status(label("Resuming session"), "info");
-              yield* Effect_exports.tryPromise({
+              yield* Effect.tryPromise({
                 try: () => provider.sessionStorage.resumeIntoSandbox({
                   hostCwd: hostRepoDir,
                   sandboxCwd: ctx.sandboxRepoDir,
@@ -466,8 +462,8 @@ var orchestrate = (options) => {
             );
             yield* display.status(label("Agent started"), "success");
             const textBuffer = new TextDeltaBuffer((chunk) => {
-              Effect_exports.runPromise(display.textChunk(chunk));
-              Effect_exports.runPromise(
+              Effect.runPromise(display.textChunk(chunk));
+              Effect.runPromise(
                 streamEmitter.emit({
                   type: "text",
                   message: chunk,
@@ -481,8 +477,8 @@ var orchestrate = (options) => {
             };
             const onToolCall = (name, formattedArgs) => {
               textBuffer.flush();
-              Effect_exports.runPromise(display.toolCall(name, formattedArgs));
-              Effect_exports.runPromise(
+              Effect.runPromise(display.toolCall(name, formattedArgs));
+              Effect.runPromise(
                 streamEmitter.emit({
                   type: "toolCall",
                   name,
@@ -493,7 +489,7 @@ var orchestrate = (options) => {
               );
             };
             const onRawLine = (line) => {
-              Effect_exports.runPromise(
+              Effect.runPromise(
                 streamEmitter.emit({
                   type: "raw",
                   line,
@@ -504,10 +500,10 @@ var orchestrate = (options) => {
             };
             const onIdleWarning = (minutes) => {
               const msg = minutes === 1 ? "Agent idle for 1 minute" : `Agent idle for ${minutes} minutes`;
-              Effect_exports.runPromise(display.status(label(msg), "warn"));
+              Effect.runPromise(display.status(label(msg), "warn"));
             };
             const onCompletionTimeout = (timeoutMs) => {
-              Effect_exports.runPromise(
+              Effect.runPromise(
                 display.status(
                   label(
                     `Completion signal seen but agent process is hanging \u2014 force-completing after ${timeoutMs / 1e3}s grace window.`
@@ -545,7 +541,7 @@ var orchestrate = (options) => {
             let usage = streamUsage;
             if (provider.captureSessions && provider.sessionStorage && sessionId && bindMountHandle) {
               yield* display.status(label("Capturing session"), "info");
-              yield* Effect_exports.tryPromise({
+              yield* Effect.tryPromise({
                 try: () => provider.sessionStorage.captureToHost({
                   hostCwd: hostRepoDir,
                   sandboxCwd: ctx.sandboxRepoDir,
@@ -562,7 +558,7 @@ var orchestrate = (options) => {
                 sessionId
               );
               if (provider.parseSessionUsage) {
-                const content = yield* Effect_exports.promise(
+                const content = yield* Effect.promise(
                   () => provider.sessionStorage.readHostSession(hostRepoDir, sessionId).catch(() => void 0)
                 );
                 if (content) {
@@ -623,32 +619,30 @@ var orchestrate = (options) => {
     };
   });
 };
-
-// src/PromptResolver.ts
 var resolvePrompt = (options) => {
   const { prompt, promptFile } = options;
   if (prompt !== void 0 && promptFile !== void 0) {
-    return Effect_exports.fail(
+    return Effect.fail(
       new PromptError({
         message: "Cannot provide both --prompt and --prompt-file"
       })
     );
   }
   if (prompt !== void 0) {
-    return Effect_exports.succeed({ text: prompt, source: "inline" });
+    return Effect.succeed({ text: prompt, source: "inline" });
   }
   if (promptFile === void 0) {
-    return Effect_exports.fail(
+    return Effect.fail(
       new PromptError({
         message: "Must provide either prompt or promptFile. Pass prompt: '...' or promptFile: './.shipyard/prompt.md' to run()."
       })
     );
   }
-  return Effect_exports.gen(function* () {
-    const fs = yield* FileSystem_exports.FileSystem;
+  return Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
     const text2 = yield* fs.readFileString(promptFile).pipe(
-      Effect_exports.catchAll(
-        (e) => Effect_exports.fail(
+      Effect.catchAll(
+        (e) => Effect.fail(
           new PromptError({
             message: `Failed to read prompt from ${promptFile}: ${e}`
           })
@@ -658,14 +652,14 @@ var resolvePrompt = (options) => {
     return { text: text2, source: "template" };
   });
 };
-var parseEnvFile = (filePath) => Effect_exports.gen(function* () {
-  const fs = yield* FileSystem_exports.FileSystem;
+var parseEnvFile = (filePath) => Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
   const symlink = yield* fs.readLink(filePath).pipe(
-    Effect_exports.map(() => true),
-    Effect_exports.catchAll(() => Effect_exports.succeed(false))
+    Effect.map(() => true),
+    Effect.catchAll(() => Effect.succeed(false))
   );
   if (symlink) return {};
-  const content = yield* fs.readFileString(filePath).pipe(Effect_exports.catchAll(() => Effect_exports.succeed(null)));
+  const content = yield* fs.readFileString(filePath).pipe(Effect.catchAll(() => Effect.succeed(null)));
   if (content === null) return {};
   const vars = {};
   for (const line of content.split("\n")) {
@@ -695,10 +689,10 @@ var parseEnvFile = (filePath) => Effect_exports.gen(function* () {
   }
   return vars;
 });
-var resolveEnv = (repoDir) => Effect_exports.gen(function* () {
-  const configDir = yield* resolveCanonicalConfigDir(repoDir);
+var resolveEnv = (repoDir) => Effect.gen(function* () {
+  const configDir = join(repoDir, CONFIG_DIR);
   const envPath = join(configDir, ".env");
-  yield* Effect_exports.tryPromise({
+  yield* Effect.tryPromise({
     try: () => assertNoSymlinkComponents(repoDir, envPath, "environment file"),
     catch: (e) => new ConfigDirError({
       message: `Refusing symlinked environment path: ${e instanceof Error ? e.message : String(e)}`
@@ -732,8 +726,6 @@ var mergeProviderEnv = (options) => {
     ...agentProviderEnv
   };
 };
-
-// src/PromptArgumentSubstitution.ts
 var SHELL_BLOCK_PATTERN = /!`([^`]+)`/g;
 var BUILT_IN_PROMPT_ARG_KEYS = [
   "SOURCE_BRANCH",
@@ -741,8 +733,8 @@ var BUILT_IN_PROMPT_ARG_KEYS = [
 ];
 var PLACEHOLDER_PATTERN = /\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
 var validateNoArgsWithInlinePrompt = (args) => {
-  if (Object.keys(args).length === 0) return Effect_exports.void;
-  return Effect_exports.fail(
+  if (Object.keys(args).length === 0) return Effect.void;
+  return Effect.fail(
     new PromptError({
       message: 'promptArgs is only supported with promptFile. Inline prompts (prompt: "...") are passed to the agent as-is \u2014 interpolate values directly in JavaScript, or switch to promptFile to use {{KEY}} substitution.'
     })
@@ -751,14 +743,14 @@ var validateNoArgsWithInlinePrompt = (args) => {
 var validateNoBuiltInArgOverride = (args) => {
   for (const key of BUILT_IN_PROMPT_ARG_KEYS) {
     if (key in args) {
-      return Effect_exports.fail(
+      return Effect.fail(
         new PromptError({
           message: `"${key}" is a built-in prompt argument and cannot be overridden via promptArgs`
         })
       );
     }
   }
-  return Effect_exports.void;
+  return Effect.void;
 };
 var findMissingPromptArgKeys = (prompt, providedArgs) => {
   const matches = [...prompt.matchAll(PLACEHOLDER_PATTERN)];
@@ -785,14 +777,14 @@ var substitutePromptArgs = (prompt, args, silentKeys) => {
   );
   const matches = [...markedPrompt.matchAll(PLACEHOLDER_PATTERN)];
   if (matches.length === 0 && Object.keys(sanitizedArgs).length === 0) {
-    return Effect_exports.succeed(markedPrompt);
+    return Effect.succeed(markedPrompt);
   }
-  return Effect_exports.gen(function* () {
+  return Effect.gen(function* () {
     const display = yield* Display;
     const referencedKeys = new Set(matches.map((m) => m[1]));
     for (const key of referencedKeys) {
       if (!(key in sanitizedArgs)) {
-        return yield* Effect_exports.fail(
+        return yield* Effect.fail(
           new PromptError({
             message: `Prompt argument "{{${key}}}" has no matching value in promptArgs`
           })
@@ -800,7 +792,7 @@ var substitutePromptArgs = (prompt, args, silentKeys) => {
       }
       const value = sanitizedArgs[key];
       if (value == null) {
-        return yield* Effect_exports.fail(
+        return yield* Effect.fail(
           new PromptError({
             message: `Prompt argument "{{${key}}}" has value ${value === null ? "null" : "undefined"} in promptArgs`
           })
@@ -957,6 +949,15 @@ var unwrapFences = (text2) => {
   return text2;
 };
 
+// src/validateMaxIterations.ts
+var validateMaxIterations = (value) => {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(
+      `maxIterations must be a positive safe integer. Received: ${value}`
+    );
+  }
+};
+
 // src/run.ts
 var buildStructuredOutputRetryFeedback = (error, retriesRemaining) => {
   const raw = error.rawMatched === void 0 ? "(no matching tag was emitted)" : error.rawMatched;
@@ -1066,6 +1067,7 @@ async function run(options) {
     hooks,
     agent: provider
   } = options;
+  validateMaxIterations(maxIterations);
   const branchStrategy = options.branchStrategy ?? (options.sandbox.tag === "isolated" ? { type: "merge-to-head" } : { type: "head" });
   const effectiveBranchType = branchStrategy.type;
   if (effectiveBranchType === "head" && options.sandbox.tag === "isolated") {
@@ -1105,8 +1107,8 @@ async function run(options) {
     );
   }
   const branch = branchStrategy.type === "branch" ? branchStrategy.branch : void 0;
-  const hostRepoDir = await Effect_exports.runPromise(
-    resolveCwd(options.cwd).pipe(Effect_exports.provide(NodeContext_exports.layer))
+  const hostRepoDir = await Effect.runPromise(
+    resolveCwd(options.cwd).pipe(Effect.provide(NodeContext.layer))
   );
   if (options.resumeSession) {
     await assertResumeSessionExists({
@@ -1116,9 +1118,9 @@ async function run(options) {
       resumeSession: options.resumeSession
     });
   }
-  const resolved = await Effect_exports.runPromise(
+  const resolved = await Effect.runPromise(
     resolvePrompt({ prompt, promptFile }).pipe(
-      Effect_exports.provide(NodeContext_exports.layer)
+      Effect.provide(NodeContext.layer)
     )
   );
   const rawPrompt = resolved.text;
@@ -1132,15 +1134,15 @@ async function run(options) {
     }
   }
   const agentName = provider.name;
-  const resolvedEnv = await Effect_exports.runPromise(
-    resolveEnv(hostRepoDir).pipe(Effect_exports.provide(NodeContext_exports.layer))
+  const resolvedEnv = await Effect.runPromise(
+    resolveEnv(hostRepoDir).pipe(Effect.provide(NodeContext.layer))
   );
   const env = mergeProviderEnv({
     resolvedEnv,
     agentProviderEnv: provider.env,
     sandboxProviderEnv: options.sandbox.env
   });
-  const currentHostBranch = await Effect_exports.runPromise(
+  const currentHostBranch = await Effect.runPromise(
     getCurrentBranch(hostRepoDir)
   );
   const resolvedBranch = effectiveBranchType === "head" ? currentHostBranch : branch ?? generateTempBranchName(options.name);
@@ -1168,15 +1170,15 @@ async function run(options) {
       branch: resolvedBranch,
       hostRepoDir
     });
-    return Layer_exports.provide(
+    return Layer.provide(
       FileDisplay.layer(resolvedLogging.path),
-      NodeFileSystem_exports.layer
+      NodeFileSystem.layer
     );
   })() : ClackDisplay.layer;
-  const factoryLayer = Layer_exports.provide(
+  const factoryLayer = Layer.provide(
     WorktreeDockerSandboxFactory.layer,
-    Layer_exports.mergeAll(
-      Layer_exports.succeed(SandboxConfig, {
+    Layer.mergeAll(
+      Layer.succeed(SandboxConfig, {
         env,
         hostRepoDir,
         copyToWorktree: options.copyToWorktree,
@@ -1187,19 +1189,19 @@ async function run(options) {
         signal: options.signal,
         timeouts: options.timeouts
       }),
-      NodeFileSystem_exports.layer,
+      NodeFileSystem.layer,
       displayLayer
     )
   );
   const streamEmitterLayer = agentStreamEmitterLayer(
     buildAgentStreamHandler(resolvedLogging)
   );
-  const runLayer = Layer_exports.mergeAll(
+  const runLayer = Layer.mergeAll(
     factoryLayer,
     displayLayer,
     streamEmitterLayer
   );
-  const baseEffect = Effect_exports.gen(function* () {
+  const baseEffect = Effect.gen(function* () {
     const d = yield* Display;
     yield* d.intro(options.name ?? CLI_NAME);
     const rows = buildRunSummaryRows({
@@ -1259,8 +1261,8 @@ async function run(options) {
     return orchestrateResult;
   });
   const withErrorLog = resolvedLogging.type === "file" ? baseEffect.pipe(
-    Effect_exports.tapError(
-      (error) => Effect_exports.gen(function* () {
+    Effect.tapError(
+      (error) => Effect.gen(function* () {
         const d = yield* Display;
         yield* d.status(
           formatErrorMessage(error),
@@ -1271,8 +1273,8 @@ async function run(options) {
   ) : baseEffect;
   let result3;
   try {
-    result3 = await Effect_exports.runPromise(
-      withErrorLog.pipe(Effect_exports.provide(runLayer))
+    result3 = await Effect.runPromise(
+      withErrorLog.pipe(Effect.provide(runLayer))
     );
   } catch (error) {
     options.signal?.throwIfAborted();
@@ -1351,28 +1353,26 @@ async function run(options) {
   }
   return baseResult;
 }
-
-// src/raceAbortSignal.ts
 var raceAbortSignal = (effect, signal) => {
   if (!signal) return effect;
-  return Effect_exports.gen(function* () {
+  return Effect.gen(function* () {
     if (signal.aborted) {
-      return yield* Effect_exports.die(signal.reason);
+      return yield* Effect.die(signal.reason);
     }
-    const abortDeferred = yield* Deferred_exports.make();
+    const abortDeferred = yield* Deferred.make();
     const onAbort = () => {
-      Effect_exports.runPromise(Deferred_exports.die(abortDeferred, signal.reason)).catch(
+      Effect.runPromise(Deferred.die(abortDeferred, signal.reason)).catch(
         () => {
         }
       );
     };
     signal.addEventListener("abort", onAbort, { once: true });
-    return yield* Effect_exports.raceFirst(
+    return yield* Effect.raceFirst(
       effect,
-      Deferred_exports.await(abortDeferred)
+      Deferred.await(abortDeferred)
     ).pipe(
-      Effect_exports.ensuring(
-        Effect_exports.sync(() => signal.removeEventListener("abort", onAbort))
+      Effect.ensuring(
+        Effect.sync(() => signal.removeEventListener("abort", onAbort))
       )
     );
   });
@@ -1402,7 +1402,7 @@ var interactive = async (options) => {
   const branch = branchStrategy.type === "branch" ? branchStrategy.branch : void 0;
   const isHeadMode = branchStrategy.type === "head";
   const sandboxProvider = resolvedSandbox;
-  const inner = Effect_exports.gen(function* () {
+  const inner = Effect.gen(function* () {
     const hostRepoDir = yield* resolveCwd(options.cwd);
     const d = yield* Display;
     const hasPromptSource = prompt !== void 0 || promptFile !== void 0;
@@ -1425,7 +1425,7 @@ var interactive = async (options) => {
       const missingKeys = findMissingPromptArgKeys(rawPrompt, userArgs);
       const collectedArgs = {};
       for (const key of missingKeys) {
-        const value = yield* Effect_exports.promise(
+        const value = yield* Effect.promise(
           () => clack.text({
             message: `Enter value for {{${key}}}`,
             validate: (v) => {
@@ -1435,7 +1435,7 @@ var interactive = async (options) => {
         );
         if (clack.isCancel(value)) {
           clack.cancel("Prompt arg collection cancelled.");
-          return yield* Effect_exports.fail(
+          return yield* Effect.fail(
             new Error("User cancelled prompt arg collection")
           );
         }
@@ -1469,14 +1469,14 @@ var interactive = async (options) => {
       worktreeInfo = yield* d.taskLog(
         "Creating worktree",
         () => pruneStale(hostRepoDir).pipe(
-          Effect_exports.catchAll(() => Effect_exports.void),
-          Effect_exports.andThen(
+          Effect.catchAll(() => Effect.void),
+          Effect.andThen(
             branch ? create(hostRepoDir, { branch }) : create(hostRepoDir, { name: options.name })
           )
         )
       );
     }
-    const handle = yield* Effect_exports.gen(function* () {
+    const handle = yield* Effect.gen(function* () {
       if (!isHeadMode) {
         if ((sandboxProvider.tag === "bind-mount" || sandboxProvider.tag === "none") && options.copyToWorktree && options.copyToWorktree.length > 0) {
           yield* d.taskLog(
@@ -1497,7 +1497,7 @@ var interactive = async (options) => {
       }
       if (sandboxProvider.tag === "none") {
         const worktreePath = isHeadMode ? hostRepoDir : worktreeInfo.path;
-        return yield* Effect_exports.promise(
+        return yield* Effect.promise(
           () => sandboxProvider.create({
             worktreePath,
             env: effectiveEnv
@@ -1538,13 +1538,13 @@ var interactive = async (options) => {
         return startResult.handle;
       }
     }).pipe(
-      Effect_exports.tapError(
+      Effect.tapError(
         () => worktreeInfo ? remove(worktreeInfo.path).pipe(
-          Effect_exports.catchAll(() => Effect_exports.void)
-        ) : Effect_exports.void
+          Effect.catchAll(() => Effect.void)
+        ) : Effect.void
       )
     );
-    return yield* Effect_exports.gen(function* () {
+    return yield* Effect.gen(function* () {
       if (!handle.interactiveExec) {
         throw new Error(
           `Sandbox provider does not support interactiveExec. The provider must implement the optional interactiveExec method to use interactive().`
@@ -1553,7 +1553,7 @@ var interactive = async (options) => {
       const interactiveExecFn = handle.interactiveExec.bind(handle);
       const sandbox = makeSandboxFromHandle(handle);
       const worktreePath = handle.worktreePath;
-      const applyToHost = sandboxProvider.tag === "isolated" && worktreeInfo ? () => syncOut(worktreeInfo.path, handle) : () => Effect_exports.void;
+      const applyToHost = sandboxProvider.tag === "isolated" && worktreeInfo ? () => syncOut(worktreeInfo.path, handle) : () => Effect.void;
       const lifecycleEffect = withSandboxLifecycle(
         {
           hostRepoDir,
@@ -1565,7 +1565,7 @@ var interactive = async (options) => {
           timeouts: options.timeouts
         },
         sandbox,
-        (ctx) => Effect_exports.gen(function* () {
+        (ctx) => Effect.gen(function* () {
           const fullPrompt = !hasPromptSource || isInlinePrompt ? substitutedPrompt : yield* preprocessPrompt(
             substitutedPrompt,
             ctx.sandbox,
@@ -1576,12 +1576,13 @@ var interactive = async (options) => {
             dangerouslySkipPermissions: sandboxProvider.tag !== "none"
           });
           const result4 = yield* raceAbortSignal(
-            Effect_exports.promise(
+            Effect.promise(
               () => interactiveExecFn(interactiveArgs, {
                 stdin: process.stdin,
                 stdout: process.stdout,
                 stderr: process.stderr,
-                cwd: worktreePath
+                cwd: worktreePath,
+                signal: options.signal
               })
             ),
             options.signal
@@ -1595,14 +1596,14 @@ var interactive = async (options) => {
       if (worktreeInfo) {
         const hasUncommitted = yield* hasUncommittedChanges(
           worktreeInfo.path
-        ).pipe(Effect_exports.catchAll(() => Effect_exports.succeed(false)));
+        ).pipe(Effect.catchAll(() => Effect.succeed(false)));
         if (hasUncommitted) {
           preservedWorktreePath = worktreeInfo.path;
         }
       }
       if (worktreeInfo && !preservedWorktreePath) {
         yield* remove(worktreeInfo.path).pipe(
-          Effect_exports.catchAll(() => Effect_exports.void)
+          Effect.catchAll(() => Effect.void)
         );
       }
       yield* d.summary("Session Complete", {
@@ -1618,24 +1619,24 @@ var interactive = async (options) => {
         exitCode
       };
     }).pipe(
-      // On error, always clean up worktree (on success, handled above with preserve check)
-      Effect_exports.tapError(
-        () => worktreeInfo ? remove(worktreeInfo.path).pipe(
-          Effect_exports.catchAll(() => Effect_exports.void)
-        ) : Effect_exports.void
+      // Cancellation preserves the worktree for inspection and recovery.
+      Effect.tapError(
+        () => worktreeInfo && !options.signal?.aborted ? remove(worktreeInfo.path).pipe(
+          Effect.catchAll(() => Effect.void)
+        ) : Effect.void
       ),
       // Always close sandbox handle
-      Effect_exports.ensuring(Effect_exports.promise(() => handle.close().catch(() => {
+      Effect.ensuring(Effect.promise(() => handle.close().catch(() => {
       })))
     );
   });
   let result3;
   try {
-    result3 = await Effect_exports.runPromise(
+    result3 = await Effect.runPromise(
       inner.pipe(
-        Effect_exports.provide(ClackDisplay.layer),
-        Effect_exports.provide(NodeContext_exports.layer),
-        Effect_exports.provide(NodeFileSystem_exports.layer)
+        Effect.provide(ClackDisplay.layer),
+        Effect.provide(NodeContext.layer),
+        Effect.provide(NodeFileSystem.layer)
       )
     );
   } catch (error) {
@@ -1669,6 +1670,7 @@ var buildSandboxHandle = (ctx, close) => {
         promptFile,
         maxIterations = 1
       } = runOptions;
+      validateMaxIterations(maxIterations);
       if (runOptions.resumeSession && maxIterations > 1) {
         throw new Error(
           "resumeSession cannot be combined with maxIterations > 1. Resume applies to iteration 1 only; multi-iteration resume semantics are not supported."
@@ -1687,21 +1689,21 @@ var buildSandboxHandle = (ctx, close) => {
           resumeSession: runOptions.resumeSession
         });
       }
-      const resolved = await Effect_exports.runPromise(
+      const resolved = await Effect.runPromise(
         resolvePrompt({ prompt, promptFile }).pipe(
-          Effect_exports.provide(NodeContext_exports.layer)
+          Effect.provide(NodeContext.layer)
         )
       );
       const rawPrompt = resolved.text;
       const isInlinePrompt = resolved.source === "inline";
       const userArgs = runOptions.promptArgs ?? {};
-      const currentHostBranch = await Effect_exports.runPromise(
+      const currentHostBranch = await Effect.runPromise(
         getCurrentBranch(hostRepoDir)
       );
-      const displayRef = Ref_exports.unsafeMake([]);
+      const displayRef = Ref.unsafeMake([]);
       const silentDisplayLayer = SilentDisplay.layer(displayRef);
-      const resolvedPrompt = await Effect_exports.runPromise(
-        Effect_exports.gen(function* () {
+      const resolvedPrompt = await Effect.runPromise(
+        Effect.gen(function* () {
           if (isInlinePrompt) {
             yield* validateNoArgsWithInlinePrompt(userArgs);
             return rawPrompt;
@@ -1718,7 +1720,7 @@ var buildSandboxHandle = (ctx, close) => {
             effectiveArgs,
             builtInArgKeysSet
           );
-        }).pipe(Effect_exports.provide(silentDisplayLayer))
+        }).pipe(Effect.provide(silentDisplayLayer))
       );
       const resolvedLogging = runOptions.logging ?? {
         type: "file",
@@ -1742,12 +1744,12 @@ var buildSandboxHandle = (ctx, close) => {
           agentName: runOptions.name,
           branch
         });
-        return Layer_exports.provide(
+        return Layer.provide(
           FileDisplay.layer(resolvedLogging.path),
-          NodeFileSystem_exports.layer
+          NodeFileSystem.layer
         );
       })() : silentDisplayLayer;
-      const reuseFactoryLayer = Layer_exports.succeed(SandboxFactory, {
+      const reuseFactoryLayer = Layer.succeed(SandboxFactory, {
         withSandbox: (makeEffect) => makeEffect(
           {
             hostWorktreePath: worktreePath,
@@ -1757,7 +1759,7 @@ var buildSandboxHandle = (ctx, close) => {
           },
           sandbox
         ).pipe(
-          Effect_exports.map((value) => ({
+          Effect.map((value) => ({
             value,
             preservedWorktreePath: void 0
           }))
@@ -1766,15 +1768,15 @@ var buildSandboxHandle = (ctx, close) => {
       const streamEmitterLayer = agentStreamEmitterLayer(
         buildAgentStreamHandler(resolvedLogging)
       );
-      const runLayer = Layer_exports.mergeAll(
+      const runLayer = Layer.mergeAll(
         reuseFactoryLayer,
         runDisplayLayer,
         streamEmitterLayer
       );
       let result3;
       try {
-        result3 = await Effect_exports.runPromise(
-          Effect_exports.gen(function* () {
+        result3 = await Effect.runPromise(
+          Effect.gen(function* () {
             const display = yield* Display;
             yield* display.intro(runOptions.name ?? CLI_NAME);
             const orchestrateResult = yield* orchestrate({
@@ -1806,7 +1808,7 @@ var buildSandboxHandle = (ctx, close) => {
               yield* display.text(line);
             }
             return orchestrateResult;
-          }).pipe(Effect_exports.provide(runLayer))
+          }).pipe(Effect.provide(runLayer))
         );
       } catch (error) {
         runOptions.signal?.throwIfAborted();
@@ -1861,8 +1863,8 @@ var buildSandboxHandle = (ctx, close) => {
       const interactiveExecFn = providerHandle.interactiveExec.bind(providerHandle);
       let lifecycleResult;
       try {
-        lifecycleResult = await Effect_exports.runPromise(
-          Effect_exports.gen(function* () {
+        lifecycleResult = await Effect.runPromise(
+          Effect.gen(function* () {
             const resolved = yield* resolvePrompt({ prompt, promptFile });
             const rawPrompt = resolved.text;
             const isInlinePrompt = resolved.source === "inline";
@@ -1899,7 +1901,7 @@ var buildSandboxHandle = (ctx, close) => {
                 keepSourceBranch: mergeToHead
               },
               sandbox,
-              (ctx2) => Effect_exports.gen(function* () {
+              (ctx2) => Effect.gen(function* () {
                 const fullPrompt = isInlinePrompt ? resolvedPrompt : yield* preprocessPrompt(
                   resolvedPrompt,
                   ctx2.sandbox,
@@ -1913,10 +1915,11 @@ var buildSandboxHandle = (ctx, close) => {
                   stdin: process.stdin,
                   stdout: process.stdout,
                   stderr: process.stderr,
-                  cwd: sandboxRepoDir
+                  cwd: sandboxRepoDir,
+                  signal: interactiveOptions.signal
                 });
                 const signal = interactiveOptions.signal;
-                const result3 = yield* Effect_exports.promise(() => {
+                const result3 = yield* Effect.promise(() => {
                   if (!signal) return execPromise;
                   if (signal.aborted) return Promise.reject(signal.reason);
                   return new Promise(
@@ -1942,8 +1945,8 @@ var buildSandboxHandle = (ctx, close) => {
               })
             );
           }).pipe(
-            Effect_exports.provide(ClackDisplay.layer),
-            Effect_exports.provide(NodeContext_exports.layer)
+            Effect.provide(ClackDisplay.layer),
+            Effect.provide(NodeContext.layer)
           )
         );
       } catch (error) {
@@ -1960,7 +1963,7 @@ var buildSandboxHandle = (ctx, close) => {
       if (providerHandle) {
         return providerHandle.exec(command, mergedOptions);
       }
-      return Effect_exports.runPromise(sandbox.exec(command, mergedOptions));
+      return Effect.runPromise(sandbox.exec(command, mergedOptions));
     },
     close: async () => close(),
     [Symbol.asyncDispose]: async () => {
@@ -1973,7 +1976,7 @@ var createSandboxFromWorktree = async (options) => {
   const { branch, worktreePath, hostRepoDir } = options;
   const isTestMode = !!options._test?.buildSandbox;
   if (options.copyToWorktree && options.copyToWorktree.length > 0 && options.sandbox.tag !== "isolated") {
-    await Effect_exports.runPromise(
+    await Effect.runPromise(
       copyToWorktree(
         options.copyToWorktree,
         hostRepoDir,
@@ -1991,8 +1994,8 @@ var createSandboxFromWorktree = async (options) => {
     sandboxRepoDir = worktreePath;
     providerHandle = options._test.bindMountHandle;
   } else {
-    const resolvedEnv = await Effect_exports.runPromise(
-      resolveEnv(hostRepoDir).pipe(Effect_exports.provide(NodeContext_exports.layer))
+    const resolvedEnv = await Effect.runPromise(
+      resolveEnv(hostRepoDir).pipe(Effect.provide(NodeContext.layer))
     );
     const env = mergeProviderEnv({
       resolvedEnv,
@@ -2018,13 +2021,13 @@ var createSandboxFromWorktree = async (options) => {
       });
     } else {
       startEffect = resolveGitMounts(join(hostRepoDir, ".git")).pipe(
-        Effect_exports.provide(NodeFileSystem_exports.layer),
-        Effect_exports.catchAll(() => Effect_exports.succeed([])),
+        Effect.provide(NodeFileSystem.layer),
+        Effect.catchAll(() => Effect.succeed([])),
         // Patch git mounts for Windows worktree compatibility (ADR-0006)
-        Effect_exports.flatMap(
+        Effect.flatMap(
           (gitMounts) => patchGitMountsForWindows(gitMounts, worktreePath, SANDBOX_REPO_DIR)
         ),
-        Effect_exports.flatMap(
+        Effect.flatMap(
           (gitMounts) => startSandbox({
             provider,
             hostRepoDir,
@@ -2036,7 +2039,7 @@ var createSandboxFromWorktree = async (options) => {
         )
       );
     }
-    const startResult = await Effect_exports.runPromise(startEffect);
+    const startResult = await Effect.runPromise(startEffect);
     providerHandle = startResult.handle;
     sandbox = startResult.sandbox;
     sandboxRepoDir = startResult.worktreePath;
@@ -2044,8 +2047,8 @@ var createSandboxFromWorktree = async (options) => {
   const sandboxOnReady = options.hooks?.sandbox?.onSandboxReady;
   const hostOnReady = options.hooks?.host?.onSandboxReady;
   if (sandboxOnReady?.length || hostOnReady?.length) {
-    await Effect_exports.runPromise(
-      Effect_exports.gen(function* () {
+    await Effect.runPromise(
+      Effect.gen(function* () {
         yield* sandbox.exec(
           `git config --global --add safe.directory ${shellQuote(sandboxRepoDir)}`
         );
@@ -2059,13 +2062,13 @@ var createSandboxFromWorktree = async (options) => {
         if (hostOnReady?.length) {
           allEffects.push(runHostHooks(hostOnReady, worktreePath));
         }
-        yield* Effect_exports.all(allEffects, {
+        yield* Effect.all(allEffects, {
           concurrency: "unbounded"
         });
       })
     );
   }
-  const applyToHost = isIsolated && providerHandle ? () => syncOut(worktreePath, providerHandle) : () => Effect_exports.void;
+  const applyToHost = isIsolated && providerHandle ? () => syncOut(worktreePath, providerHandle) : () => Effect.void;
   let closed = false;
   const bindMountHandle = toSessionTransferHandle(providerHandle);
   return buildSandboxHandle(
@@ -2094,17 +2097,17 @@ var createSandbox = async (options) => {
   const { branch } = options;
   const isTestMode = !!options._test?.buildSandbox;
   const isIsolated = options.sandbox.tag === "isolated";
-  const { hostRepoDir, worktreePath, providerHandle, sandbox, sandboxRepoDir } = await Effect_exports.runPromise(
-    Effect_exports.gen(function* () {
+  const { hostRepoDir, worktreePath, providerHandle, sandbox, sandboxRepoDir } = await Effect.runPromise(
+    Effect.gen(function* () {
       const hostRepoDir2 = yield* resolveCwd(options.cwd);
       yield* pruneStale(hostRepoDir2).pipe(
-        Effect_exports.catchAll(() => Effect_exports.void)
+        Effect.catchAll(() => Effect.void)
       );
       const { path: worktreePath2 } = yield* create(
         hostRepoDir2,
         { branch, baseBranch: options.baseBranch }
       );
-      const prepared = yield* Effect_exports.gen(function* () {
+      const prepared = yield* Effect.gen(function* () {
         if (options.copyToWorktree && options.copyToWorktree.length > 0 && options.sandbox.tag !== "isolated") {
           yield* copyToWorktree(
             options.copyToWorktree,
@@ -2146,17 +2149,17 @@ var createSandbox = async (options) => {
             env,
             worktreeOrRepoPath: worktreePath2
           }) : resolveGitMounts(join(hostRepoDir2, ".git")).pipe(
-            Effect_exports.provide(NodeFileSystem_exports.layer),
-            Effect_exports.catchAll(() => Effect_exports.succeed([])),
+            Effect.provide(NodeFileSystem.layer),
+            Effect.catchAll(() => Effect.succeed([])),
             // Patch git mounts for Windows worktree compatibility (ADR-0006)
-            Effect_exports.flatMap(
+            Effect.flatMap(
               (gitMounts) => patchGitMountsForWindows(
                 gitMounts,
                 worktreePath2,
                 SANDBOX_REPO_DIR
               )
             ),
-            Effect_exports.flatMap(
+            Effect.flatMap(
               (gitMounts) => startSandbox({
                 provider,
                 hostRepoDir: hostRepoDir2,
@@ -2174,7 +2177,7 @@ var createSandbox = async (options) => {
         const sandboxOnReady = options.hooks?.sandbox?.onSandboxReady;
         const hostOnReady = options.hooks?.host?.onSandboxReady;
         if (sandboxOnReady?.length || hostOnReady?.length) {
-          yield* Effect_exports.gen(function* () {
+          yield* Effect.gen(function* () {
             yield* sandbox2.exec(
               `git config --global --add safe.directory ${shellQuote(sandboxRepoDir2)}`
             );
@@ -2188,28 +2191,28 @@ var createSandbox = async (options) => {
             if (hostOnReady?.length) {
               allEffects.push(runHostHooks(hostOnReady, worktreePath2));
             }
-            yield* Effect_exports.all(allEffects, { concurrency: "unbounded" });
+            yield* Effect.all(allEffects, { concurrency: "unbounded" });
           }).pipe(
-            Effect_exports.onError(
-              () => providerHandle2 ? Effect_exports.promise(
+            Effect.onError(
+              () => providerHandle2 ? Effect.promise(
                 () => providerHandle2.close().catch(() => {
                 })
-              ) : Effect_exports.void
+              ) : Effect.void
             )
           );
         }
         return { providerHandle: providerHandle2, sandbox: sandbox2, sandboxRepoDir: sandboxRepoDir2 };
       }).pipe(
-        Effect_exports.onError(
+        Effect.onError(
           () => remove(worktreePath2).pipe(
-            Effect_exports.catchAll(() => Effect_exports.void)
+            Effect.catchAll(() => Effect.void)
           )
         )
       );
       return { hostRepoDir: hostRepoDir2, worktreePath: worktreePath2, ...prepared };
-    }).pipe(Effect_exports.provide(NodeContext_exports.layer))
+    }).pipe(Effect.provide(NodeContext.layer))
   );
-  const applyToHost = isIsolated && providerHandle ? () => syncOut(worktreePath, providerHandle) : () => Effect_exports.void;
+  const applyToHost = isIsolated && providerHandle ? () => syncOut(worktreePath, providerHandle) : () => Effect.void;
   let closed = false;
   const forceCleanup = () => {
     console.error(`
@@ -2221,19 +2224,19 @@ Worktree preserved at ${worktreePath}`);
   const doClose = async () => {
     if (closed) return { preservedWorktreePath: void 0 };
     closed = true;
-    return Effect_exports.runPromise(
-      Effect_exports.gen(function* () {
+    return Effect.runPromise(
+      Effect.gen(function* () {
         if (providerHandle) {
-          yield* Effect_exports.promise(() => providerHandle.close());
+          yield* Effect.promise(() => providerHandle.close());
         }
         const isDirty = yield* hasUncommittedChanges(
           worktreePath
-        ).pipe(Effect_exports.catchAll(() => Effect_exports.succeed(false)));
+        ).pipe(Effect.catchAll(() => Effect.succeed(false)));
         if (isDirty) {
           return { preservedWorktreePath: worktreePath };
         }
         yield* remove(worktreePath).pipe(
-          Effect_exports.catchAll(() => Effect_exports.void)
+          Effect.catchAll(() => Effect.void)
         );
         return { preservedWorktreePath: void 0 };
       })
@@ -2263,10 +2266,10 @@ var createWorktree = async (options) => {
   const branch = options.branchStrategy.type === "branch" ? options.branchStrategy.branch : void 0;
   const baseBranch = options.branchStrategy.type === "branch" ? options.branchStrategy.baseBranch : void 0;
   const isMergeToHead = options.branchStrategy.type === "merge-to-head";
-  const { hostRepoDir, worktreeInfo } = await Effect_exports.gen(function* () {
+  const { hostRepoDir, worktreeInfo } = await Effect.gen(function* () {
     const hostRepoDir2 = yield* resolveCwd(options.cwd);
     yield* pruneStale(hostRepoDir2).pipe(
-      Effect_exports.catchAll(() => Effect_exports.void)
+      Effect.catchAll(() => Effect.void)
     );
     const info = yield* create(hostRepoDir2, {
       branch,
@@ -2284,23 +2287,23 @@ var createWorktree = async (options) => {
       yield* runHostHooks(options.hooks.host.onWorktreeReady, info.path);
     }
     return { hostRepoDir: hostRepoDir2, worktreeInfo: info };
-  }).pipe(Effect_exports.provide(NodeContext_exports.layer), Effect_exports.runPromise);
+  }).pipe(Effect.provide(NodeContext.layer), Effect.runPromise);
   let closed = false;
   const close = async () => {
     if (closed) return { preservedWorktreePath: void 0 };
     closed = true;
-    return Effect_exports.gen(function* () {
+    return Effect.gen(function* () {
       const isDirty = yield* hasUncommittedChanges(
         worktreeInfo.path
-      ).pipe(Effect_exports.catchAll(() => Effect_exports.succeed(false)));
+      ).pipe(Effect.catchAll(() => Effect.succeed(false)));
       if (isDirty) {
         return { preservedWorktreePath: worktreeInfo.path };
       }
       yield* remove(worktreeInfo.path).pipe(
-        Effect_exports.catchAll(() => Effect_exports.void)
+        Effect.catchAll(() => Effect.void)
       );
       return { preservedWorktreePath: void 0 };
-    }).pipe(Effect_exports.runPromise);
+    }).pipe(Effect.runPromise);
   };
   const worktreeInteractive = async (opts) => {
     opts.signal?.throwIfAborted();
@@ -2311,7 +2314,7 @@ var createWorktree = async (options) => {
         `Agent provider "${provider.name}" does not support buildInteractiveArgs, required for interactive sessions.`
       );
     }
-    const inner = Effect_exports.gen(function* () {
+    const inner = Effect.gen(function* () {
       const d = yield* Display;
       const hasPromptSource = prompt !== void 0 || promptFile !== void 0;
       const resolved = hasPromptSource ? yield* resolvePrompt({ prompt, promptFile }) : void 0;
@@ -2350,7 +2353,7 @@ var createWorktree = async (options) => {
       });
       let handle;
       if (resolvedSandbox.tag === "none") {
-        handle = yield* Effect_exports.promise(
+        handle = yield* Effect.promise(
           () => resolvedSandbox.create({
             worktreePath: worktreeInfo.path,
             env: effectiveEnv
@@ -2388,7 +2391,7 @@ var createWorktree = async (options) => {
         );
         handle = startResult.handle;
       }
-      return yield* Effect_exports.gen(function* () {
+      return yield* Effect.gen(function* () {
         if (!handle.interactiveExec) {
           throw new Error(
             `Sandbox provider does not support interactiveExec. The provider must implement the optional interactiveExec method to use interactive().`
@@ -2397,7 +2400,7 @@ var createWorktree = async (options) => {
         const interactiveExecFn = handle.interactiveExec.bind(handle);
         const sandbox = makeSandboxFromHandle(handle);
         const worktreePath = handle.worktreePath;
-        const applyToHost = resolvedSandbox.tag === "isolated" ? () => syncOut(worktreeInfo.path, handle) : () => Effect_exports.void;
+        const applyToHost = resolvedSandbox.tag === "isolated" ? () => syncOut(worktreeInfo.path, handle) : () => Effect.void;
         const lifecycleEffect = withSandboxLifecycle(
           {
             hostRepoDir,
@@ -2413,7 +2416,7 @@ var createWorktree = async (options) => {
             keepSourceBranch: isMergeToHead
           },
           sandbox,
-          (ctx) => Effect_exports.gen(function* () {
+          (ctx) => Effect.gen(function* () {
             const fullPrompt = !hasPromptSource || isInlinePrompt ? substitutedPrompt : yield* preprocessPrompt(
               substitutedPrompt,
               ctx.sandbox,
@@ -2424,12 +2427,13 @@ var createWorktree = async (options) => {
               dangerouslySkipPermissions: resolvedSandbox.tag !== "none"
             });
             const result3 = yield* raceAbortSignal(
-              Effect_exports.promise(
+              Effect.promise(
                 () => interactiveExecFn(interactiveArgs, {
                   stdin: process.stdin,
                   stdout: process.stdout,
                   stderr: process.stderr,
-                  cwd: worktreePath
+                  cwd: worktreePath,
+                  signal: opts.signal
                 })
               ),
               opts.signal
@@ -2452,16 +2456,16 @@ var createWorktree = async (options) => {
         };
       }).pipe(
         // Always close sandbox handle
-        Effect_exports.ensuring(Effect_exports.promise(() => handle.close().catch(() => {
+        Effect.ensuring(Effect.promise(() => handle.close().catch(() => {
         })))
       );
     });
     try {
-      return await Effect_exports.runPromise(
+      return await Effect.runPromise(
         inner.pipe(
-          Effect_exports.provide(ClackDisplay.layer),
-          Effect_exports.provide(NodeContext_exports.layer),
-          Effect_exports.provide(NodeFileSystem_exports.layer)
+          Effect.provide(ClackDisplay.layer),
+          Effect.provide(NodeContext.layer),
+          Effect.provide(NodeFileSystem.layer)
         )
       );
     } catch (error) {
@@ -2474,6 +2478,7 @@ var createWorktree = async (options) => {
     const { prompt, promptFile, hooks, agent: provider } = opts;
     const sandboxProvider = opts.sandbox;
     const maxIterations = opts.maxIterations ?? 1;
+    validateMaxIterations(maxIterations);
     if (opts.resumeSession && maxIterations > 1) {
       throw new Error(
         "resumeSession cannot be combined with maxIterations > 1. Resume applies to iteration 1 only; multi-iteration resume semantics are not supported."
@@ -2487,7 +2492,7 @@ var createWorktree = async (options) => {
         resumeSession: opts.resumeSession
       });
     }
-    const inner = Effect_exports.gen(function* () {
+    const inner = Effect.gen(function* () {
       const resolved = yield* resolvePrompt({ prompt, promptFile });
       const rawPrompt = resolved.text;
       const isInlinePrompt = resolved.source === "inline";
@@ -2557,7 +2562,7 @@ var createWorktree = async (options) => {
         sandboxRepoDir = startResult.worktreePath;
       }
       const sandbox = makeSandboxFromHandle(handle);
-      const applyToHost = sandboxProvider.tag === "isolated" ? () => syncOut(worktreeInfo.path, handle) : () => Effect_exports.void;
+      const applyToHost = sandboxProvider.tag === "isolated" ? () => syncOut(worktreeInfo.path, handle) : () => Effect.void;
       const resolvedLogging = opts.logging ?? {
         type: "file",
         path: join(
@@ -2568,7 +2573,7 @@ var createWorktree = async (options) => {
         )
       };
       if (opts.logging === void 0 && resolvedLogging.type === "file") {
-        yield* Effect_exports.tryPromise({
+        yield* Effect.tryPromise({
           try: () => assertNoSymlinkComponents(
             hostRepoDir,
             resolvedLogging.path,
@@ -2585,13 +2590,13 @@ var createWorktree = async (options) => {
           agentName: opts.name,
           branch: worktreeInfo.branch
         });
-        return Layer_exports.provide(
+        return Layer.provide(
           FileDisplay.layer(resolvedLogging.path),
-          NodeFileSystem_exports.layer
+          NodeFileSystem.layer
         );
       })() : ClackDisplay.layer;
       const bindMountHandle = toSessionTransferHandle(handle);
-      const reuseFactoryLayer = Layer_exports.succeed(SandboxFactory, {
+      const reuseFactoryLayer = Layer.succeed(SandboxFactory, {
         withSandbox: (makeEffect) => makeEffect(
           {
             hostWorktreePath: worktreeInfo.path,
@@ -2601,7 +2606,7 @@ var createWorktree = async (options) => {
           },
           sandbox
         ).pipe(
-          Effect_exports.map((value) => ({
+          Effect.map((value) => ({
             value,
             preservedWorktreePath: void 0
           }))
@@ -2610,12 +2615,12 @@ var createWorktree = async (options) => {
       const streamEmitterLayer = agentStreamEmitterLayer(
         buildAgentStreamHandler(resolvedLogging)
       );
-      const runLayer = Layer_exports.mergeAll(
+      const runLayer = Layer.mergeAll(
         reuseFactoryLayer,
         runDisplayLayer,
         streamEmitterLayer
       );
-      const result3 = yield* Effect_exports.gen(function* () {
+      const result3 = yield* Effect.gen(function* () {
         const display = yield* Display;
         yield* display.intro(opts.name ?? CLI_NAME);
         const orchestrateResult = yield* orchestrate({
@@ -2650,9 +2655,9 @@ var createWorktree = async (options) => {
         }
         return orchestrateResult;
       }).pipe(
-        Effect_exports.provide(runLayer),
+        Effect.provide(runLayer),
         // Always close sandbox handle
-        Effect_exports.ensuring(Effect_exports.promise(() => handle.close().catch(() => {
+        Effect.ensuring(Effect.promise(() => handle.close().catch(() => {
         })))
       );
       return {
@@ -2665,11 +2670,11 @@ var createWorktree = async (options) => {
       };
     });
     try {
-      return await Effect_exports.runPromise(
+      return await Effect.runPromise(
         inner.pipe(
-          Effect_exports.provide(ClackDisplay.layer),
-          Effect_exports.provide(NodeContext_exports.layer),
-          Effect_exports.provide(NodeFileSystem_exports.layer)
+          Effect.provide(ClackDisplay.layer),
+          Effect.provide(NodeContext.layer),
+          Effect.provide(NodeFileSystem.layer)
         )
       );
     } catch (error) {
@@ -3648,7 +3653,21 @@ var allowedTransitions = {
   blocked: [],
   cancelled: []
 };
-var allRequiredChecksPassed = (checks) => checks !== void 0 && checks.length > 0 && checks.every((check) => check.status === "passed");
+var allRequiredChecksPassed = (context) => {
+  const checks = context.checks;
+  if (checks === void 0) return false;
+  if (context.requiredCheckNames === void 0) {
+    return checks.length > 0 && checks.every((check) => check.status === "passed");
+  }
+  if (context.requiredCheckNames.length > 0 && context.checkCandidate === void 0) {
+    return false;
+  }
+  return context.requiredCheckNames.every(
+    (name) => checks.some(
+      (check) => check.name === name && check.status === "passed" && (context.checkCandidate === void 0 || check.baseSha === context.checkCandidate.baseSha && check.headSha === context.checkCandidate.headSha && check.briefHash === context.checkCandidate.briefHash)
+    )
+  );
+};
 var requireTransition = (from, to, context) => {
   if (!allowedTransitions[from].includes(to)) {
     throw new ContractValidationError(
@@ -3667,20 +3686,20 @@ var requireTransition = (from, to, context) => {
       );
     }
   }
-  if (to === "reviewing" && !allRequiredChecksPassed(context.checks)) {
+  if (to === "reviewing" && !allRequiredChecksPassed(context)) {
     const unknown = context.checks?.find((check) => check.status === "unknown");
     throw new ContractValidationError(
       unknown ? `Cannot review while check ${unknown.name} is unknown` : "Cannot review until all required checks pass"
     );
   }
   if (to === "human-review") {
-    if (!allRequiredChecksPassed(context.checks)) {
+    if (!allRequiredChecksPassed(context)) {
       throw new ContractValidationError(
         "Human review requires a complete set of passing checks"
       );
     }
     if (context.review?.outcome !== "passed" || context.review.axes.length === 0 || context.review.findings.some(
-      (finding) => finding.disposition === "open" || finding.severity !== "info" && finding.disposition === "deferred"
+      (finding) => finding.severity !== "info" && (finding.disposition === "open" || finding.disposition === "deferred")
     )) {
       throw new ContractValidationError(
         "Human review requires every review axis to pass and blocking findings to be disposed"
@@ -3715,6 +3734,11 @@ var createAssignment = (input) => {
       "Assignment policy repository does not match work identity"
     );
   }
+  if (["checking", "review", "handoff", "merge"].includes(input.phase) && input.head === void 0) {
+    throw new ContractValidationError(
+      `${input.phase} assignments require an immutable candidate head`
+    );
+  }
   const assignment = {
     contractVersion: WORKFLOW_CONTRACT_VERSION,
     id: nonEmptyString(input.id, "assignment.id"),
@@ -3776,6 +3800,7 @@ var parsePhaseResult = (value) => {
     ),
     outcome,
     identity: parseIdentity(value.identity, "phase result.identity"),
+    briefHash: nonEmptyString(value.briefHash, "phase result.briefHash"),
     base: value.base === void 0 ? void 0 : parseRevision(value.base, "phase result.base"),
     head: value.head === void 0 ? void 0 : parseRevision(value.head, "phase result.head"),
     summary: nonEmptyString(value.summary, "phase result.summary"),
@@ -3870,6 +3895,8 @@ var MemoryTransaction = class {
   async saveEvent(event) {
     this.state.events.set(event.deliveryId, clone(event));
   }
+  async lockWorkIdentity(_identity) {
+  }
   async getJob(jobId) {
     const job = this.state.jobs.get(jobId);
     return job === void 0 ? void 0 : clone(job);
@@ -3899,9 +3926,13 @@ var MemoryTransaction = class {
     this.state.jobs.set(job.id, clone(job));
   }
   async saveJob(job) {
-    if (!this.state.jobs.has(job.id)) {
+    const current = this.state.jobs.get(job.id);
+    if (current === void 0) {
       throw new Error(`Workflow job ${job.id} does not exist`);
     }
+    if (current.version !== job.version - 1) {
+      throw new Error(`Workflow job ${job.id} was updated concurrently`);
+    }
     this.state.jobs.set(job.id, clone(job));
   }
   async findDispatchByDedupeKey(dedupeKey) {
@@ -3961,6 +3992,8 @@ var MemoryTransaction = class {
     const lease = this.state.leases.get(resourceKey(repository, branch));
     return lease === void 0 ? void 0 : clone(lease);
   }
+  async lockLeaseResource(_repository, _branch) {
+  }
   async saveLease(lease) {
     this.state.leases.set(lease.resourceKey, clone(lease));
   }
@@ -4382,9 +4415,15 @@ var PostgresTransaction = class {
       ]
     );
   }
+  async lockWorkIdentity(identity) {
+    await this.client.query(
+      "SELECT pg_advisory_xact_lock(hashtextextended($1, 0))",
+      [`${identity.repository}\0${identity.itemId}\0${identity.kind}`]
+    );
+  }
   async getJob(jobId) {
     const result3 = await this.client.query(
-      "SELECT * FROM shipyard_jobs WHERE id = $1",
+      "SELECT * FROM shipyard_jobs WHERE id = $1 FOR UPDATE",
       [jobId]
     );
     const value = optionalRow(result3);
@@ -4396,7 +4435,7 @@ var PostgresTransaction = class {
        WHERE repository = $1 AND item_id = $2 AND brief_revision = $3
          AND phase = $4 AND relevant_revision = $5
          AND brief->>'hash' = $6
-       ORDER BY updated_at DESC LIMIT 1`,
+       ORDER BY updated_at DESC LIMIT 1 FOR UPDATE`,
       [
         key.repository,
         key.itemId,
@@ -4414,7 +4453,7 @@ var PostgresTransaction = class {
       `SELECT * FROM shipyard_jobs
        WHERE repository = $1 AND item_id = $2 AND item_kind = $3
          AND control <> 'superseded'
-       ORDER BY latest_observed_at DESC, updated_at DESC LIMIT 1`,
+       ORDER BY latest_observed_at DESC, updated_at DESC LIMIT 1 FOR UPDATE`,
       [identity.repository, identity.itemId, identity.kind]
     );
     const value = optionalRow(result3);
@@ -4435,7 +4474,7 @@ var PostgresTransaction = class {
     );
   }
   async saveJob(job) {
-    await this.client.query(
+    const result3 = await this.client.query(
       `UPDATE shipyard_jobs SET
          repository = $2, item_id = $3, item_kind = $4, brief_revision = $5,
          phase = $6, relevant_revision = $7, brief = $8::jsonb,
@@ -4445,9 +4484,13 @@ var PostgresTransaction = class {
          assignments = $17::jsonb, phase_results = $18::jsonb,
          active_assignment_id = $19, latest_observed_at = $20,
          created_at = $21, updated_at = $22, version = $23
-       WHERE id = $1`,
-      jobValues(job)
+       WHERE id = $1 AND version = $24
+       RETURNING id`,
+      [...jobValues(job), job.version - 1]
     );
+    if (result3.rows.length !== 1) {
+      throw new Error(`Workflow job ${job.id} was updated concurrently`);
+    }
   }
   async findDispatchByDedupeKey(dedupeKey) {
     const result3 = await this.client.query(
@@ -4568,6 +4611,12 @@ var PostgresTransaction = class {
     const value = optionalRow(result3);
     return value === void 0 ? void 0 : leaseFromRow(value);
   }
+  async lockLeaseResource(repository, branch) {
+    await this.client.query(
+      "SELECT pg_advisory_xact_lock(hashtextextended($1, 0))",
+      [`${repository}\0${branch}`]
+    );
+  }
   async saveLease(lease) {
     await this.client.query(
       `INSERT INTO shipyard_branch_leases (
@@ -4773,7 +4822,9 @@ var resultState = (result3) => {
         case "checking":
           return "reviewing";
         case "review":
-          return "human-review";
+          return result3.findings.some(
+            (finding) => finding.severity !== "info" && (finding.disposition === "open" || finding.disposition === "deferred")
+          ) ? "repairing" : "human-review";
         case "repair":
           return "checking";
         case "handoff":
@@ -4787,6 +4838,29 @@ var resultState = (result3) => {
       }
   }
 };
+var normalizeWorkerReviewFindings = (findings) => {
+  const byId = /* @__PURE__ */ new Map();
+  const byContent = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    if (finding.disposition !== "open") {
+      throw new Error("Review workers may only submit open findings");
+    }
+    const contentKey = JSON.stringify([
+      finding.axis,
+      finding.title,
+      finding.location ?? "",
+      finding.requirement ?? "",
+      finding.evidence
+    ]);
+    const previous = byId.get(finding.id);
+    if (previous !== void 0 && previous !== contentKey) {
+      throw new Error(`Finding id ${finding.id} identifies different findings`);
+    }
+    byId.set(finding.id, contentKey);
+    if (!byContent.has(contentKey)) byContent.set(contentKey, finding);
+  }
+  return [...byContent.values()];
+};
 var phaseAttempts = () => ({
   triage: 0,
   implementation: 0,
@@ -4876,6 +4950,7 @@ var WorkflowCoordinator = class {
           job: job2
         };
       }
+      await transaction.lockWorkIdentity(brief.identity);
       const current = await transaction.findCurrentJob(brief.identity);
       if (input.sourceState === "closed") {
         const cancelled = current ? await this.cancelStoredJob(
@@ -5072,7 +5147,7 @@ var WorkflowCoordinator = class {
           brief: job.brief,
           policy: job.policy,
           attempt,
-          head: phase2 === "review" ? this.latestHeadForRevision(job, job.key.relevantRevision) : void 0,
+          head: ["checking", "review", "handoff", "merge"].includes(phase2) ? this.latestHeadForRevision(job, job.key.relevantRevision) : void 0,
           createdAt: this.clock.now()
         });
         const attempts = { ...job.phaseAttempts, [phase2]: attempt };
@@ -5158,6 +5233,7 @@ var WorkflowCoordinator = class {
       }
       const now = this.clock.nowMilliseconds();
       const resourceKey2 = `${input.repository}\0${input.branch}`;
+      await transaction.lockLeaseResource(input.repository, input.branch);
       const existing = await transaction.getLease(
         input.repository,
         input.branch
@@ -5399,7 +5475,11 @@ var WorkflowCoordinator = class {
     });
   }
   async recordPhaseResult(input) {
-    const result3 = parsePhaseResult(input.result);
+    const parsedResult = parsePhaseResult(input.result);
+    const result3 = parsedResult.phase === "review" ? {
+      ...parsedResult,
+      findings: normalizeWorkerReviewFindings(parsedResult.findings)
+    } : parsedResult;
     return this.storage.transaction(async (transaction) => {
       let job = await transaction.getJob(input.jobId);
       if (job === void 0)
@@ -5417,14 +5497,14 @@ var WorkflowCoordinator = class {
           `Phase result ${result3.assignmentId} is not assigned to job ${job.id}`
         );
       }
-      if (assignment.phase !== result3.phase || !sameIdentity3(assignment.identity, result3.identity)) {
+      if (assignment.phase !== result3.phase || !sameIdentity3(assignment.identity, result3.identity) || assignment.briefHash !== result3.briefHash) {
         throw new Error("Phase result does not match its assignment");
       }
       if (result3.base !== void 0 && !sameRevision(result3.base, assignment.base)) {
         throw new Error("Phase result base revision does not match assignment");
       }
-      if (assignment.phase === "review" && assignment.head !== void 0 && (result3.head === void 0 || !sameRevision(result3.head, assignment.head))) {
-        throw new Error("Review result is not bound to the assigned candidate");
+      if (["checking", "review", "handoff", "merge"].includes(assignment.phase) && (result3.base === void 0 || !sameRevision(result3.base, assignment.base) || assignment.head === void 0 || result3.head === void 0 || !sameRevision(result3.head, assignment.head))) {
+        throw new Error("Phase result is not bound to the assigned candidate");
       }
       const dispatch = await transaction.findDispatchByAssignmentId(
         result3.assignmentId
@@ -5461,12 +5541,18 @@ var WorkflowCoordinator = class {
             kind: job.brief.identity.kind,
             authorization: job.brief.authorization.status,
             checks: result3.checks,
+            requiredCheckNames: job.policy.checks.filter((check) => check.required).map((check) => check.name),
+            checkCandidate: assignment.head === void 0 ? void 0 : {
+              baseSha: assignment.base.sha,
+              headSha: assignment.head.sha,
+              briefHash: assignment.briefHash
+            },
             review: {
               outcome: result3.outcome === "completed" && result3.phase === "review" ? "passed" : "incomplete",
               axes: result3.reviewAxes ?? result3.findings.map((finding) => finding.axis),
               findings: result3.findings,
-              headSha: result3.head?.sha ?? "",
-              briefHash: job.brief.hash
+              headSha: assignment.head?.sha ?? "",
+              briefHash: assignment.briefHash
             }
           });
           state2 = nextState;
@@ -5626,6 +5712,17 @@ var WorkflowCoordinator = class {
       if (input.head !== void 0 && input.head.sha !== input.relevantRevision) {
         throw new Error("Scheduled phase head does not match its revision");
       }
+      if (["checking", "review", "handoff", "merge"].includes(input.phase)) {
+        const currentCandidate = this.latestHeadForRevision(
+          job,
+          input.relevantRevision
+        );
+        if (input.head === void 0 || currentCandidate === void 0 || !sameRevision(input.head, currentCandidate)) {
+          throw new Error(
+            "Scheduled phase head does not match the current candidate"
+          );
+        }
+      }
       if (input.phase !== "triage" && !isAuthorized(job.brief, job.policy)) {
         return {
           status: "blocked",
@@ -5657,7 +5754,13 @@ var WorkflowCoordinator = class {
           requireTransition(state2, targetState, {
             kind: job.brief.identity.kind,
             authorization: job.brief.authorization.status,
-            checks: latestChecks2
+            checks: latestChecks2,
+            requiredCheckNames: job.policy.checks.filter((check) => check.required).map((check) => check.name),
+            checkCandidate: input.head === void 0 ? void 0 : {
+              baseSha: job.brief.base.sha,
+              headSha: input.head.sha,
+              briefHash: job.brief.hash
+            }
           });
           state2 = targetState;
         } catch (error) {
@@ -5869,6 +5972,7 @@ var toPhaseResult = (input) => {
     phase: assignment.phase,
     outcome: input.outcome,
     identity: assignment.identity,
+    briefHash: assignment.briefHash,
     base: assignment.base,
     head,
     summary: input.summary ?? report.summary,
@@ -5877,7 +5981,10 @@ var toPhaseResult = (input) => {
     commits: isReview ? [] : input.commits,
     artifacts: input.artifacts,
     questions: input.questions ?? report.questions,
-    findings: report.findings,
+    findings: isReview ? report.findings.map((finding) => ({
+      ...finding,
+      disposition: "open"
+    })) : report.findings,
     reviewAxes: report.reviewAxes,
     completedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
@@ -6009,6 +6116,7 @@ var executePhase = async (options) => {
   let response;
   try {
     response = await options.adapter.execute(request);
+    controller.signal.throwIfAborted();
   } catch (error) {
     clearTimeout(timeout);
     options.signal?.removeEventListener("abort", abortFromCaller);
@@ -6334,6 +6442,9 @@ var isFreshTimestamp = (value, now, freshnessWindowSeconds) => {
 };
 var requiredChecks = (policy) => policy.checks.filter((check) => check.required).map((check) => check.name);
 var blockingFinding = (finding) => finding.severity !== "info" && (finding.disposition === "open" || finding.disposition === "deferred");
+var implementationEvidence = (job, candidate) => [...job.phaseResults].reverse().find(
+  (result3) => result3.outcome === "completed" && (result3.phase === "implementation" || result3.phase === "repair") && result3.base !== void 0 && result3.head !== void 0 && sameRevision2(result3.base, candidate.base) && sameRevision2(result3.head, candidate.head) && result3.briefHash === candidate.briefHash
+)?.evidence ?? [];
 var allRequiredChecksPassed2 = (policy, checks, expected) => {
   const reasons = [];
   for (const name of requiredChecks(policy)) {
@@ -6385,13 +6496,18 @@ var candidateReasons = (job, candidate, review, requiredAxes) => {
   if (review.briefHash !== candidate.briefHash || review.briefHash !== brief.hash) {
     reasons.push("Review evidence is bound to a different brief revision");
   }
-  const implementationHead = [...job.phaseResults].reverse().find((result3) => result3.phase === "implementation")?.head;
+  const implementationHead = [...job.phaseResults].reverse().find(
+    (result3) => result3.phase === "implementation" || result3.phase === "repair"
+  )?.head;
   if (implementationHead !== void 0 && !sameRevision2(implementationHead, candidate.head)) {
     reasons.push("Candidate head does not match the implementation result");
   }
   if (review.outcome !== "passed") {
     reasons.push(`Independent review outcome is ${review.outcome}`);
   }
+  if (implementationEvidence(job, candidate).length < brief.acceptanceCriteria.length) {
+    reasons.push("Implementation acceptance evidence is missing");
+  }
   for (const axis of requiredAxes) {
     if (!review.axes.includes(axis))
       reasons.push(`Review axis is missing: ${axis}`);
@@ -6411,7 +6527,7 @@ var packetFor = (input, brief) => ({
   change: brief.problem,
   risk: brief.risk,
   acceptanceCriteria: brief.acceptanceCriteria,
-  acceptanceEvidence: brief.evidence,
+  acceptanceEvidence: implementationEvidence(input.job, input.candidate),
   checks: input.checks,
   reviewAxes: input.review.axes,
   findings: input.review.findings,
@@ -6803,7 +6919,6 @@ var checkConclusion = (check) => {
       return "neutral";
   }
 };
-var checkStatus = (check) => "completed";
 var checkSummary = (check) => `${check.summary}${check.exitCode === void 0 ? "" : ` (exit ${check.exitCode})`}`;
 var publicPrBody = (brief, result3, readinessIssue, policy) => [
   "## Shipyard implementation",
@@ -7098,7 +7213,7 @@ var runAuthorizedImplementation = async (options) => {
       branch,
       name: check.name,
       headSha: phaseResult.head.sha,
-      status: checkStatus(),
+      status: "completed",
       conclusion: checkConclusion(check),
       summary: checkSummary(check)
     });
@@ -7687,13 +7802,6 @@ var validSeverities = [
   "high",
   "critical"
 ];
-var validDispositions = [
-  "open",
-  "fixed",
-  "rejected",
-  "accepted",
-  "deferred"
-];
 var nonEmpty = (value, path2) => {
   if (typeof value !== "string" || value.trim().length === 0) {
     throw new Error(`${path2} must be a non-empty string`);
@@ -7732,11 +7840,9 @@ var normalizeFinding = (value, index) => ({
     `findings[${index}].severity`
   ),
   axis: enumValue2(value.axis, validAxes, `findings[${index}].axis`),
-  disposition: enumValue2(
-    value.disposition,
-    validDispositions,
-    `findings[${index}].disposition`
-  ),
+  // A reviewer reports evidence. Only the repair/authorization workflow may
+  // dispose of a finding after independent verification.
+  disposition: "open",
   title: nonEmpty(value.title, `findings[${index}].title`),
   evidence: nonEmpty(value.evidence, `findings[${index}].evidence`),
   location: value.location === void 0 ? void 0 : nonEmpty(value.location, `findings[${index}].location`),
@@ -8873,8 +8979,15 @@ var GitHubIntegration = class {
     if (!trustedReconciliation && isBot(effectiveSource, this.options.authorization)) {
       return this.ignoreStored(effectiveDelivery, "bot-originated");
     }
-    if (!trustedReconciliation && !allowedSender(this.options.authorization, effectiveSource)) {
-      return this.rejectStored(effectiveDelivery, "disallowed-sender");
+    if (!trustedReconciliation) {
+      const isReview = effectiveEnvelope.eventName === "pull_request_review";
+      const authorized = isReview ? allowedReviewer(this.options.authorization, effectiveSource) : allowedSender(this.options.authorization, effectiveSource);
+      if (!authorized) {
+        return this.rejectStored(
+          effectiveDelivery,
+          isReview ? "disallowed-reviewer" : "disallowed-sender"
+        );
+      }
     }
     const normalized = await this.normalize(effectiveEnvelope);
     if (normalized.disposition === "ignored") {
@@ -9172,6 +9285,9 @@ var allowedRepository = (policy, repository) => policy.allowedRepositories.some(
 var allowedSender = (policy, source) => policy.allowedSenders.some(
   (candidate) => candidate.toLowerCase() === source.login.toLowerCase()
 );
+var allowedReviewer = (policy, source) => policy.allowedReviewers.some(
+  (candidate) => candidate.toLowerCase() === source.login.toLowerCase()
+);
 var isBot = (source, policy) => source.type === "Bot" || policy.botLogins?.some(
   (candidate) => candidate.toLowerCase() === source.login.toLowerCase()
 ) === true;
@@ -9429,7 +9545,7 @@ var isFreshTimestamp2 = (value, now, maxAgeSeconds) => {
   return Number.isFinite(timestamp2) && Number.isFinite(current) && timestamp2 <= current && current - timestamp2 <= maxAgeSeconds * 1e3;
 };
 var approvalRoles = (policy) => policy.approvalRoles ?? ["owner", "maintainer"];
-var validCandidate = (candidate) => {
+var validCandidate = (candidate, validateArtifactRef) => {
   const fields = [
     ["sourceSha", candidate.sourceSha],
     ["reviewedHeadSha", candidate.reviewedHeadSha],
@@ -9440,8 +9556,40 @@ var validCandidate = (candidate) => {
   const missing = fields.find(
     ([, value]) => typeof value !== "string" || value.trim().length === 0
   );
-  return missing === void 0 ? void 0 : `${missing[0]} is required`;
+  if (missing !== void 0) return `${missing[0]} is required`;
+  const gitObject = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i;
+  if (!gitObject.test(candidate.sourceSha)) {
+    return "sourceSha must be a full Git object id";
+  }
+  if (!gitObject.test(candidate.reviewedHeadSha)) {
+    return "reviewedHeadSha must be a full Git object id";
+  }
+  if (!/^[0-9a-f]{64}$/i.test(candidate.briefHash)) {
+    return "briefHash must be a SHA-256 hash";
+  }
+  if (!/^sha256:[0-9a-f]{64}$/i.test(candidate.artifactDigest)) {
+    return "artifactDigest must be a SHA-256 digest";
+  }
+  if (/[\s?#]/.test(candidate.artifactRef)) {
+    return "artifactRef must not contain whitespace, a query, or a fragment";
+  }
+  const digestReference = candidate.artifactRef.match(
+    /@sha256:([0-9a-f]{64})$/i
+  );
+  if (digestReference !== null) {
+    return digestReference[1].toLowerCase() === candidate.artifactDigest.slice("sha256:".length).toLowerCase() ? void 0 : "digest-qualified artifactRef must match artifactDigest";
+  }
+  const immutableNpmReference = /^npm:(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*@v?\d+\.\d+\.\d+(?:-[0-9a-z.-]+)?(?:\+[0-9a-z.-]+)?$/i;
+  const immutableGitReference = /^(?:git|github):[^\s/@]+\/[^\s@]+@[0-9a-f]{40}(?:[0-9a-f]{24})?$/i;
+  if (immutableNpmReference.test(candidate.artifactRef) || immutableGitReference.test(candidate.artifactRef)) {
+    return void 0;
+  }
+  if (validateArtifactRef !== void 0) {
+    return validateArtifactRef(candidate);
+  }
+  return "artifactRef format is not proven immutable";
 };
+var isIntentDeploymentId = (deploymentId) => deploymentId.startsWith("intent:");
 var requiredChecksPassed = (policy, checks) => {
   const reasons = [];
   for (const required of policy.requiredStagingChecks) {
@@ -9470,6 +9618,7 @@ var ReleaseIntegration = class {
   store;
   transport;
   actor;
+  validateArtifactRef;
   now;
   constructor(options) {
     if (options.policy.repository.trim().length === 0) {
@@ -9493,6 +9642,7 @@ var ReleaseIntegration = class {
     this.store = options.store;
     this.transport = options.transport;
     this.actor = options.actor;
+    this.validateArtifactRef = options.validateArtifactRef;
     this.now = options.now ?? defaultNow5;
   }
   // Bind evidence and remote idempotency to the deployment target and gate.
@@ -9513,7 +9663,7 @@ var ReleaseIntegration = class {
     ).digest("hex");
   }
   async requestStaging(candidate) {
-    const invalid = validCandidate(candidate);
+    const invalid = validCandidate(candidate, this.validateArtifactRef);
     if (invalid !== void 0)
       return blocked3(`Invalid release candidate: ${invalid}`);
     const key = this.stateKey(candidate);
@@ -9565,7 +9715,10 @@ var ReleaseIntegration = class {
     return { outcome: "requested", state: updated };
   }
   recordStagingVerification(verification) {
-    const invalid = validCandidate(verification.candidate);
+    const invalid = validCandidate(
+      verification.candidate,
+      this.validateArtifactRef
+    );
     if (invalid !== void 0)
       return blocked3(`Invalid release candidate: ${invalid}`);
     if (verification.environment !== "staging")
@@ -9574,6 +9727,12 @@ var ReleaseIntegration = class {
     const state2 = this.store.get(key);
     if (state2 === void 0)
       return blocked3("Staging deployment was not requested");
+    if (state2.staging === void 0 || isIntentDeploymentId(state2.staging.deploymentId)) {
+      return blocked3(
+        "Staging deployment request has not been confirmed",
+        state2
+      );
+    }
     if (state2.staging?.deploymentId !== verification.deploymentId) {
       return blocked3(
         "Staging verification references a different deployment",
@@ -9603,7 +9762,7 @@ var ReleaseIntegration = class {
     return reasons.length === 0 ? { outcome: "verified", state: updated } : { outcome: "failed", reason: reasons.join("; "), state: updated };
   }
   approveProduction(input) {
-    const invalid = validCandidate(input.candidate);
+    const invalid = validCandidate(input.candidate, this.validateArtifactRef);
     if (invalid !== void 0)
       return blocked3(`Invalid release candidate: ${invalid}`);
     const key = this.stateKey(input.candidate);
@@ -9668,7 +9827,7 @@ var ReleaseIntegration = class {
     return { outcome: "approved", state: updated };
   }
   async promoteProduction(candidate) {
-    const invalid = validCandidate(candidate);
+    const invalid = validCandidate(candidate, this.validateArtifactRef);
     if (invalid !== void 0)
       return blocked3(`Invalid release candidate: ${invalid}`);
     const key = this.stateKey(candidate);
@@ -9781,7 +9940,10 @@ var ReleaseIntegration = class {
     }
   }
   recordProductionVerification(verification) {
-    const invalid = validCandidate(verification.candidate);
+    const invalid = validCandidate(
+      verification.candidate,
+      this.validateArtifactRef
+    );
     if (invalid !== void 0)
       return blocked3(`Invalid release candidate: ${invalid}`);
     if (verification.environment !== "production")
@@ -9791,6 +9953,12 @@ var ReleaseIntegration = class {
     if (state2 === void 0 || state2.production === void 0) {
       return blocked3("Production deployment was not requested");
     }
+    if (isIntentDeploymentId(state2.production.deploymentId)) {
+      return blocked3(
+        "Production deployment request has not been confirmed",
+        state2
+      );
+    }
     if (state2.status === "production-failed") {
       return blocked3(
         "Production verification already failed; record recovery before any new candidate",
@@ -9825,6 +9993,12 @@ var ReleaseIntegration = class {
         "Recovery can only be recorded for a failed production candidate"
       );
     }
+    if (input.reason.trim().length === 0) {
+      throw new Error("Recovery reason is required");
+    }
+    if (input.authorizedBy.id.trim().length === 0 || input.authorizedBy.role === "release-coordinator" || !approvalRoles(this.policy).includes(input.authorizedBy.role)) {
+      throw new Error("Recovery requires an authorized owner or maintainer");
+    }
     const recovery = {
       candidate: structuredClone(input.candidate),
       action: this.policy.recoveryMode,