@tangle-network/agent-app 0.60.215 → 0.60.217

package/dist/{chunk-KDPTXXOQ.js → chunk-WDY47GBR.js}

@@ -1,3 +1,7 @@
+import {
+  LAUNCH_BUDGETS
+} from "./chunk-LRYY3OX7.js";
+
 // src/signoff/worker-defaults.ts
 import { spawnSync } from "child_process";
 import { existsSync } from "fs";
@@ -6,10 +10,13 @@ import { basename, dirname, join } from "path";
 var WORKER_DEFAULTS_STEP = "worker defaults";
 var WORKER_COMPATIBILITY_DATE_FLOOR = "2026-09-01";
 var WRANGLER_CONFIG_NAME = /^wrangler[.-]?[\w.-]*\.(toml|json|jsonc)$/;
-function trackedWorkerConfigs(repoRoot) {
-  const listed = spawnSync("git", ["ls-files", "-z"], { cwd: repoRoot, encoding: "utf8" });
+function trackedFiles(repoRoot) {
+  const listed = spawnSync("git", ["ls-files", "-z"], { cwd: repoRoot, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
   if (listed.status !== 0) throw new Error(`signoff: git ls-files failed in ${repoRoot}: ${listed.stderr}`);
-  return listed.stdout.split("\0").filter((path) => path !== "" && WRANGLER_CONFIG_NAME.test(basename(path))).sort();
+  return listed.stdout.split("\0").filter((path) => path !== "");
+}
+function trackedWorkerConfigs(repoRoot) {
+  return trackedFiles(repoRoot).filter((path) => WRANGLER_CONFIG_NAME.test(basename(path))).sort();
 }
 function problemsFor(config) {
   const problems = [];
@@ -98,10 +105,351 @@ function formatWorkerDefaults(result) {
 }
 
 // src/signoff/config.ts
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join2, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join3, resolve } from "path";
 import { pathToFileURL } from "url";
 import { z } from "zod";
+
+// src/signoff/app-defaults.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync2, mkdtempSync, readFileSync, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { join as join2, posix } from "path";
+var APP_DEFAULTS_STEP = "agent-app defaults";
+var EXEMPTIBLE_DEFAULTS = ["turn-trace", "first-text", "prewarm", "placement", "limit-alarms"];
+var AGENT_APP_OUTCOME_FLOORS = [
+  { id: "turn-trace", label: "turn trace", since: "0.60.199" },
+  { id: "first-text", label: "first text", since: "0.60.203" }
+];
+var SOURCE_EXTENSIONS = /\.(?:[cm]?[jt]sx?)$/;
+var NOT_SOURCE = /(?:^|\/)(?:node_modules|dist|build|\.wrangler|tests?|__tests__|e2e|scripts|proof|journeys?|evals?|docs|examples|stories|\.storybook)\/|\.(?:test|spec|stories|e2e|bench)\.[cm]?[jt]sx?$|\.d\.ts$/;
+var MAX_SOURCE_BYTES = 400 * 1024;
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function findAppPackages(repoRoot, tracked) {
+  const packages = [];
+  for (const path of tracked) {
+    if (posix.basename(path) !== "package.json" || /(?:^|\/)node_modules\//.test(path)) continue;
+    const pkg = readJson(join2(repoRoot, path));
+    if (!pkg || pkg.name === "@tangle-network/agent-app") continue;
+    const spec = pkg.dependencies?.["@tangle-network/agent-app"] ?? pkg.devDependencies?.["@tangle-network/agent-app"] ?? pkg.peerDependencies?.["@tangle-network/agent-app"];
+    if (spec === void 0) continue;
+    packages.push({ name: pkg.name ?? posix.dirname(path), dir: posix.dirname(path), spec });
+  }
+  return packages;
+}
+function underDir(path, dir) {
+  return dir === "." || path === dir || path.startsWith(`${dir}/`);
+}
+function withoutComments(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(?<!:)\/\/.*$/gm, "");
+}
+function readSources(repoRoot, tracked, dir, others) {
+  const files = [];
+  for (const path of tracked) {
+    if (!underDir(path, dir) || !SOURCE_EXTENSIONS.test(path) || NOT_SOURCE.test(path)) continue;
+    if (others.some((other) => other !== dir && other !== "." && underDir(path, other) && underDir(other, dir))) continue;
+    const abs = join2(repoRoot, path);
+    try {
+      if (statSync(abs).size > MAX_SOURCE_BYTES) continue;
+      files.push({ path, text: withoutComments(readFileSync(abs, "utf8")) });
+    } catch {
+    }
+  }
+  return files;
+}
+function versionTuple(spec) {
+  const match = /(\d+)\.(\d+)\.(\d+)/.exec(spec);
+  if (!match || /^(?:workspace|file|link|portal|git|github|http|catalog):/.test(spec)) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function atLeast(have, floor) {
+  const want = versionTuple(floor);
+  for (let index = 0; index < 3; index += 1) {
+    if (have[index] !== want[index]) return have[index] > want[index];
+  }
+  return true;
+}
+function filesMatching(sources, pattern) {
+  return sources.filter((file) => pattern.test(file.text));
+}
+function callArguments(text, openIndex) {
+  let depth = 0;
+  for (let index = openIndex; index < Math.min(text.length, openIndex + 1200); index += 1) {
+    const char = text[index];
+    if (char === "(") depth += 1;
+    else if (char === ")" && --depth === 0) return text.slice(openIndex, index + 1);
+  }
+  return text.slice(openIndex, openIndex + 1200);
+}
+function sinkCalls(sources) {
+  const calls = [];
+  for (const file of sources) {
+    for (const match of file.text.matchAll(/createIntelligenceTurnTraceSink\s*\(/g)) {
+      const args = callArguments(file.text, match.index + match[0].length - 1);
+      const direct = /\bproject\s*:\s*['"`]([^'"`]+)['"`]/.exec(args);
+      const named = /\bproject\s*:\s*([A-Za-z_$][\w$]*)\s*[,}\n]/.exec(args) ?? /\bproject\b\s*[,}]/.exec(args);
+      const identifier = named?.[1] ?? (named ? "project" : void 0);
+      const constant = identifier ? new RegExp(`(?:const|let)\\s+${identifier}\\s*(?::\\s*string\\s*)?=\\s*['"\`]([^'"\`]+)['"\`]`).exec(file.text) : null;
+      calls.push({ file: file.path, args, project: direct?.[1] ?? constant?.[1] ?? null });
+    }
+  }
+  return calls;
+}
+function pinRow(pin, spec) {
+  const tuple = pin === null ? null : versionTuple(pin);
+  if (pin === null || tuple === null) {
+    return { id: "pin", label: "agent-app pin", status: "unknown", detail: `"${spec}" is not a plain version; the floors cannot be compared` };
+  }
+  const below = AGENT_APP_OUTCOME_FLOORS.filter((floor) => !atLeast(tuple, floor.since));
+  const floors = AGENT_APP_OUTCOME_FLOORS.map((floor) => `${floor.label} ${floor.since}`).join(", ");
+  return below.length === 0 ? { id: "pin", label: "agent-app pin", status: "ok", detail: `${pin} (floors: ${floors})` } : { id: "pin", label: "agent-app pin", status: "gap", detail: `${pin} is below the ${below.map((floor) => `${floor.label} floor ${floor.since}`).join(" and the ")}` };
+}
+function withExemption(row, id, exemptions, optedOut) {
+  const reason = exemptions[id];
+  if (optedOut !== null) {
+    return reason ? { row: { ...row, status: "exempt", detail: `${optedOut}; exempt: ${reason}` }, finding: null } : { row: { ...row, status: "opted-out", detail: optedOut }, finding: `${row.label}: ${optedOut}, with no reason in signoff.config.mjs agentApp.exemptions.${id}` };
+  }
+  if (row.status !== "ok" && row.status !== "na" && reason) {
+    return { row: { ...row, status: "exempt", detail: `${row.detail}; exempt: ${reason}` }, finding: null };
+  }
+  return { row, finding: null };
+}
+function turnTraceRow(sources, calls, exports) {
+  const optOut = filesMatching(sources, /\bturnTrace\s*:\s*false\b/)[0];
+  if (optOut) return { row: { id: "turn-trace", label: "turn trace", status: "gap", detail: "" }, optedOut: `turnTrace: false in ${optOut.path}`, wired: false };
+  const customSink = filesMatching(sources, /\bturnTrace\s*:\s*\{/);
+  if (calls.length === 0 && customSink.length === 0) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "gap", detail: "no turn trace sink; createChatTurnRoutes gets no turnTrace" }, optedOut: null, wired: false };
+  }
+  const project = calls.find((call) => call.project)?.project ?? null;
+  const last = project === null ? void 0 : exports?.get(project);
+  const where = calls[0]?.file ?? customSink[0]?.path ?? "";
+  const wired = `sink wired in ${where}${project ? ` (${project})` : ""}`;
+  if (last) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "ok", detail: `${wired}; last export accepted ${new Date(last.at).toISOString().slice(0, 16)}Z` }, optedOut: null, wired: true };
+  }
+  if (last === null) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "gap", detail: `${wired}; Intelligence holds no turn from the last 30 days for this key` }, optedOut: null, wired: true };
+  }
+  const routerKey = calls.find((call) => /\bapiKey\s*:[^,}]*\bTANGLE_API_KEY\b/.test(call.args));
+  if (routerKey) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "unknown", detail: `${wired} with TANGLE_API_KEY; the ingest refused it for Legal (#468): run with --probe, or drop apiKey so the sink reads the Sandbox product key` }, optedOut: null, wired: true };
+  }
+  return { row: { id: "turn-trace", label: "turn trace", status: "ok", detail: `${wired}; last export not checked` }, optedOut: null, wired: true };
+}
+function firstTextRow(pin, sources, traceWired, calls, exports) {
+  const floor = AGENT_APP_OUTCOME_FLOORS.find((entry) => entry.id === "first-text")?.since ?? "";
+  const tuple = pin === null ? null : versionTuple(pin);
+  const marks = filesMatching(sources, /\.markFirstText\s*\(/).length > 0;
+  const routes = filesMatching(sources, /\bcreateChatTurnRoutes\s*[(<]/).length > 0;
+  if (!traceWired) return { id: "first-text", label: "first text", status: "gap", detail: "needs the turn trace" };
+  if (tuple !== null && !atLeast(tuple, floor)) return { id: "first-text", label: "first text", status: "gap", detail: `agent-app ${pin} does not mark first text; ${floor} does` };
+  if (!routes && !marks) return { id: "first-text", label: "first text", status: "gap", detail: "the turn owner does not call trace.markFirstText() and the app does not use createChatTurnRoutes" };
+  const project = calls.find((call) => call.project)?.project ?? null;
+  const last = project === null ? void 0 : exports?.get(project);
+  const observed = last?.firstTextMs === void 0 ? "" : `; last turn first_text_ms ${Math.round(last.firstTextMs)}`;
+  if (last && last.firstTextMs === void 0) return { id: "first-text", label: "first text", status: "gap", detail: "the last exported turn has no tangle.turn.first_text_ms" };
+  return { id: "first-text", label: "first text", status: "ok", detail: `${routes ? "createChatTurnRoutes marks it" : "the turn owner marks it"}${observed}` };
+}
+function prewarmRow(sources) {
+  const usesBox = filesMatching(sources, /@tangle-network\/agent-app\/sandbox|\bensureWorkspaceSandbox\b/).length > 0;
+  if (!usesBox) return { id: "prewarm", label: "prewarm route", status: "na", detail: "the app opens no workspace box" };
+  const shared = filesMatching(sources, /\bcreateWorkspacePrewarmRoute\b/)[0];
+  if (shared) return { id: "prewarm", label: "prewarm route", status: "ok", detail: `shared route in ${shared.path}` };
+  const local = sources.find((file) => /prewarm/i.test(file.path) || /['"`/]prewarm['"`/]/.test(file.text));
+  return local ? { id: "prewarm", label: "prewarm route", status: "gap", detail: `local copy in ${local.path}; mount createWorkspacePrewarmRoute` } : { id: "prewarm", label: "prewarm route", status: "gap", detail: "no prewarm route; the first send waits for the box" };
+}
+function placementRow(configs) {
+  const pinned = configs.find((file) => /^\s*\[placement\]\s*$[\s\S]{0,300}?^\s*(?:region|host|hostname)\s*=/m.test(file.text) || /"placement"\s*:\s*\{[^}]*"(?:region|host|hostname)"/.test(file.text));
+  if (pinned) return { id: "placement", label: "placement", status: "ok", detail: `pinned in ${pinned.path}` };
+  if (configs.length === 0) return { id: "placement", label: "placement", status: "na", detail: "no Wrangler config" };
+  const smart = configs.some((file) => /^\s*\[placement\]/m.test(file.text) || /"placement"/.test(file.text));
+  return {
+    id: "placement",
+    label: "placement",
+    status: "gap",
+    detail: smart ? "a [placement] without a region or host is smart placement, which does not pin; unmeasured against the D1 primary" : "no [placement]; unmeasured against the D1 primary. Pin it beside D1 or declare an exemption with the reason"
+  };
+}
+function limitAlarmsRow(sources) {
+  const wired = filesMatching(sources, /\bwithD1LimitAlarms\s*\(/);
+  const copies = filesMatching(sources, /\bcreateLimitAlarms\s*\(/);
+  const product = filesMatching(sources, /\bcreateProductLimitAlarms\s*\(/);
+  if (wired.length === 0) {
+    return {
+      id: "limit-alarms",
+      label: "limit alarms",
+      status: "gap",
+      detail: copies.length + product.length > 0 ? `alarms are built in ${(copies[0] ?? product[0])?.path} but nothing wraps the D1 binding with withD1LimitAlarms in the server` : "no limit alarms"
+    };
+  }
+  if (copies.length > 0) {
+    return { id: "limit-alarms", label: "limit alarms", status: "gap", detail: `wired in ${wired[0]?.path}; ${copies[0]?.path} keeps a local copy of the budgets: use createProductLimitAlarms with overrides` };
+  }
+  return { id: "limit-alarms", label: "limit alarms", status: "ok", detail: `wired in ${wired[0]?.path}` };
+}
+function parseWranglerUpload(output) {
+  const clean = output.replace(/\u001b\[[0-9;]*m/g, "");
+  const match = /Total Upload:\s*([\d.]+)\s*KiB\s*\/\s*gzip:\s*([\d.]+)\s*KiB/.exec(clean);
+  return match ? { rawKiB: Number(match[1]), gzipKiB: Number(match[2]) } : null;
+}
+function wranglerBinary(repoRoot, dir) {
+  for (const base of [join2(repoRoot, dir), repoRoot]) {
+    const bin = join2(base, "node_modules", ".bin", "wrangler");
+    if (existsSync2(bin)) return bin;
+  }
+  return null;
+}
+function bundleRow(repoRoot, dir, configs, measure) {
+  const label = "Worker upload";
+  if (configs.length === 0) return { id: "worker-bundle", label, status: "na", detail: "no Wrangler config" };
+  if (!measure) return { id: "worker-bundle", label, status: "unknown", detail: "not measured" };
+  const bin = wranglerBinary(repoRoot, dir);
+  if (!bin) return { id: "worker-bundle", label, status: "unknown", detail: "wrangler is not installed; install, build, then measure" };
+  const outDir = mkdtempSync(join2(tmpdir(), "agent-app-upload-"));
+  try {
+    const run = spawnSync2(bin, ["deploy", "--dry-run", "--env=", "--outdir", outDir], {
+      cwd: join2(repoRoot, dir),
+      encoding: "utf8",
+      timeout: 5 * 6e4,
+      maxBuffer: 20 * 1024 * 1024,
+      env: { ...process.env, CI: "1", WRANGLER_SEND_METRICS: "false", NO_COLOR: "1" }
+    });
+    const upload = parseWranglerUpload(`${run.stdout}
+${run.stderr}`);
+    if (!upload) {
+      const reason = `${run.stderr}${run.stdout}`.split("\n").map((line) => line.trim()).find((line) => /error|not found|no such/i.test(line)) ?? `wrangler exited ${run.status}`;
+      return { id: "worker-bundle", label, status: "unknown", detail: `unmeasured (build first): ${reason.slice(0, 160)}` };
+    }
+    const limit = LAUNCH_BUDGETS.workerUploadGzipKiB;
+    const share = upload.gzipKiB / limit;
+    return {
+      id: "worker-bundle",
+      label,
+      status: share >= LAUNCH_BUDGETS.alarmRatio ? "gap" : "ok",
+      detail: `${Math.round(upload.gzipKiB)} KiB gzip of ${limit} KiB (${Math.round(share * 100)}%); ${Math.round(upload.rawKiB)} KiB raw of ${LAUNCH_BUDGETS.workerUploadRawKiB} KiB`
+    };
+  } finally {
+    rmSync(outDir, { recursive: true, force: true });
+  }
+}
+function toolCountRow() {
+  return { id: "tool-count", label: "tool_count p50", status: "unknown", detail: "unmeasured; no ceiling until a measured link to first text exists" };
+}
+function checkAppDefaults(repoRoot, options = {}) {
+  const tracked = trackedFiles(repoRoot);
+  const packages = findAppPackages(repoRoot, tracked);
+  const owned = /* @__PURE__ */ new Map();
+  for (const path of trackedWorkerConfigs(repoRoot)) {
+    const owner = packages.filter((pkg) => underDir(path, pkg.dir)).sort((x, y) => y.dir.length - x.dir.length)[0];
+    if (owner) owned.set(owner.dir, [...owned.get(owner.dir) ?? [], path]);
+  }
+  const deployed = packages.filter((pkg) => owned.has(pkg.dir));
+  const apps = [];
+  const findings = [];
+  for (const pkg of deployed.length > 0 ? deployed : packages) {
+    const sources = readSources(repoRoot, tracked, pkg.dir, packages.map((other) => other.dir));
+    const configs = (owned.get(pkg.dir) ?? []).map((path) => ({ path, text: readFileSync(join2(repoRoot, path), "utf8") }));
+    const exemptions = options.exemptions ?? {};
+    const pin = versionTuple(pkg.spec) ? /(\d+\.\d+\.\d+)/.exec(pkg.spec)?.[1] ?? null : null;
+    const calls = sinkCalls(sources);
+    const trace = turnTraceRow(sources, calls, options.exports);
+    const traceWired = trace.wired;
+    const reports = [
+      { row: pinRow(pin, pkg.spec), id: null, optedOut: null },
+      { row: trace.row, id: "turn-trace", optedOut: trace.optedOut },
+      { row: firstTextRow(pin, sources, traceWired, calls, options.exports), id: "first-text", optedOut: null },
+      { row: prewarmRow(sources), id: "prewarm", optedOut: null },
+      { row: placementRow(configs), id: "placement", optedOut: null },
+      { row: toolCountRow(), id: null, optedOut: null },
+      { row: limitAlarmsRow(sources), id: "limit-alarms", optedOut: null },
+      { row: bundleRow(repoRoot, pkg.dir, configs, options.measureBundle ?? true), id: null, optedOut: null }
+    ];
+    const rows = [];
+    const appFindings = [];
+    for (const entry of reports) {
+      if (entry.id === null) {
+        rows.push(entry.row);
+        continue;
+      }
+      const resolved = withExemption(entry.row, entry.id, exemptions, entry.optedOut);
+      rows.push(resolved.row);
+      if (resolved.finding) appFindings.push(resolved.finding);
+    }
+    const traceResolved = rows.find((row) => row.id === "turn-trace");
+    if (trace.optedOut && traceResolved) {
+      const at = rows.findIndex((row) => row.id === "first-text");
+      rows[at] = { id: "first-text", label: "first text", status: traceResolved.status, detail: "the turn trace is turned off" };
+    }
+    apps.push({ app: pkg.name, dir: pkg.dir, pin, rows, findings: appFindings });
+    findings.push(...appFindings.map((finding) => `${pkg.name}: ${finding}`));
+  }
+  return { apps, findings };
+}
+var STATUS_MARK = {
+  ok: "ok     ",
+  gap: "GAP    ",
+  unknown: "?      ",
+  exempt: "exempt ",
+  "opted-out": "FAIL   ",
+  na: "n/a    "
+};
+function formatAppDefaults(result) {
+  if (result.apps.length === 0) return "no agent app in this checkout; nothing to report\n";
+  const lines = [];
+  for (const app of result.apps) {
+    lines.push(`${app.app}${app.dir === "." ? "" : ` (${app.dir})`}`);
+    for (const row of app.rows) lines.push(`  ${STATUS_MARK[row.status]}${row.label.padEnd(15)} ${row.detail}`);
+  }
+  for (const finding of result.findings) lines.push(`FAIL ${finding}`);
+  if (result.findings.length > 0) lines.push("Defaults and how to opt out with a reason: https://github.com/tangle-network/agent-app/blob/main/docs/app-defaults.md");
+  return `${lines.join("\n")}
+`;
+}
+async function readLastTurnExport(project, options) {
+  const base = (options.baseUrl ?? "https://intelligence.tangle.tools").replace(/\/+$/, "");
+  const get = async (path) => {
+    const response = await (options.fetchImpl ?? fetch)(`${base}${path}`, {
+      headers: { authorization: `Bearer ${options.apiKey}` },
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!response.ok) throw new Error(`Intelligence answered HTTP ${response.status} for ${path.split("?")[0]}`);
+    return response.json();
+  };
+  const listing = await get(`/v1/traces?limit=1&q=agent_app.turn&attr=${encodeURIComponent(`tangle.project:${project}`)}`);
+  const newest = listing.items?.[0];
+  if (!newest) return null;
+  const spans = await get(`/v1/traces/${newest.traceId}/spans`);
+  const firstTextMs = Number(spans.items?.find((span) => span.name === "agent_app.turn")?.attributes?.["tangle.turn.first_text_ms"]);
+  return {
+    at: Number(BigInt(newest.startUnixNano) / 1000000n),
+    traceId: newest.traceId,
+    ...Number.isFinite(firstTextMs) ? { firstTextMs } : {}
+  };
+}
+async function collectLastExports(repoRoot, apiKey) {
+  const tracked = trackedFiles(repoRoot);
+  const projects = /* @__PURE__ */ new Set();
+  for (const pkg of findAppPackages(repoRoot, tracked)) {
+    for (const call of sinkCalls(readSources(repoRoot, tracked, pkg.dir, []))) if (call.project) projects.add(call.project);
+  }
+  const exports = /* @__PURE__ */ new Map();
+  for (const project of projects) {
+    try {
+      exports.set(project, await readLastTurnExport(project, { apiKey }));
+    } catch {
+    }
+  }
+  return exports;
+}
+
+// src/signoff/config.ts
 var SIGNOFF_CONFIG_FILES = ["signoff.config.mjs", "signoff.config.js"];
 var shuffleSchema = z.object({
   runs: z.number().int().positive().optional(),
@@ -133,7 +481,12 @@ var configSchema = z.object({
   carryFiles: z.array(z.string()).optional(),
   cacheDir: z.string().optional(),
   storeGenerations: z.number().int().positive().optional(),
-  workerConfigs: z.array(z.string().min(1)).optional()
+  workerConfigs: z.array(z.string().min(1)).optional(),
+  agentApp: z.object({
+    exemptions: z.object(
+      Object.fromEntries(EXEMPTIBLE_DEFAULTS.map((id) => [id, z.string().trim().min(8, "say why in a sentence").optional()]))
+    ).strict().optional()
+  }).optional()
 });
 function describeIssues(error, where) {
   const lines = error.issues.map((issue) => `  ${issue.path.join(".") || "(root)"}: ${issue.message}`);
@@ -143,8 +496,10 @@ ${lines.join("\n")}`;
 function parseSignoffConfig(value, where) {
   const result = configSchema.safeParse(value);
   if (!result.success) throw new Error(describeIssues(result.error, where));
-  if (result.data.steps.some((step) => step.name === WORKER_DEFAULTS_STEP)) {
-    throw new Error(`signoff: ${where} declares a step named "${WORKER_DEFAULTS_STEP}", which the gate runs itself`);
+  for (const reserved of [WORKER_DEFAULTS_STEP, APP_DEFAULTS_STEP]) {
+    if (result.data.steps.some((step) => step.name === reserved)) {
+      throw new Error(`signoff: ${where} declares a step named "${reserved}", which the gate runs itself`);
+    }
   }
   return result.data;
 }
@@ -180,18 +535,18 @@ async function loadSignoffConfig(options) {
   const { repoRoot, configPath } = options;
   if (configPath !== void 0) {
     const abs = resolve(repoRoot, configPath);
-    if (!existsSync2(abs)) throw new Error(`signoff: no config at ${abs}`);
+    if (!existsSync3(abs)) throw new Error(`signoff: no config at ${abs}`);
     return { config: await importConfig(abs), origin: { kind: "file", path: abs } };
   }
   for (const candidate of SIGNOFF_CONFIG_FILES) {
-    const abs = join2(repoRoot, candidate);
-    if (existsSync2(abs)) return { config: await importConfig(abs), origin: { kind: "file", path: abs } };
+    const abs = join3(repoRoot, candidate);
+    if (existsSync3(abs)) return { config: await importConfig(abs), origin: { kind: "file", path: abs } };
   }
-  const pkgPath = join2(repoRoot, "package.json");
-  if (!existsSync2(pkgPath)) {
+  const pkgPath = join3(repoRoot, "package.json");
+  if (!existsSync3(pkgPath)) {
     throw new Error(`signoff: ${repoRoot} has no package.json, no signoff.config.mjs, and nothing to derive from.`);
   }
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
   if (pkg.signoff !== void 0) {
     return { config: parseSignoffConfig(pkg.signoff, `${pkgPath} "signoff"`), origin: { kind: "package-json", path: pkgPath } };
   }
@@ -206,19 +561,303 @@ async function importConfig(abs) {
 }
 
 // src/signoff/run.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync7 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync9 } from "fs";
 import { availableParallelism, homedir } from "os";
-import { basename as basename2, join as join7, resolve as resolve3 } from "path";
+import { basename as basename4, join as join9, resolve as resolve4 } from "path";
+
+// src/signoff/cache.ts
+import { randomUUID } from "crypto";
+import { spawnSync as spawnSync3 } from "child_process";
+import {
+  existsSync as existsSync4,
+  lstatSync,
+  mkdirSync,
+  readFileSync as readFileSync3,
+  readdirSync,
+  renameSync,
+  rmSync as rmSync2,
+  readlinkSync,
+  realpathSync,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { hostname } from "os";
+import { basename as basename2, join as join4, relative, resolve as resolve2, sep } from "path";
+import lockfile from "proper-lockfile";
+var SIGNOFF_CACHE_MAX_AGE_MS = 3 * 24 * 60 * 60 * 1e3;
+var SIGNOFF_CACHE_MAX_BYTES = 4 * 1024 ** 3;
+function processStart(pid) {
+  try {
+    const stat = readFileSync3(`/proc/${pid}/stat`, "utf8");
+    return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19] ?? null;
+  } catch {
+    return null;
+  }
+}
+function hasRunProcesses(run) {
+  if (process.platform !== "linux") return true;
+  try {
+    for (const entry of readdirSync("/proc")) {
+      if (!/^\d+$/.test(entry)) continue;
+      const proc = join4("/proc", entry);
+      try {
+        const start = processStart(Number(entry));
+        if (run.processStart && start && BigInt(start) < BigInt(run.processStart)) continue;
+        const cwd = readlinkSync(join4(proc, "cwd"));
+        if (cwd === run.tree || cwd.startsWith(run.tree + sep)) return true;
+        const env = readFileSync3(join4(proc, "environ"), "utf8").split("\0");
+        if (env.includes(`SIGNOFF_TREE=${run.tree}`)) return true;
+      } catch (error) {
+        if (["ENOENT", "ESRCH"].includes(error.code ?? "")) continue;
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return true;
+  }
+}
+function alive(run) {
+  if (run.host !== hostname()) return true;
+  try {
+    process.kill(run.pid, 0);
+  } catch (error) {
+    if (error.code === "ESRCH") return hasRunProcesses(run);
+    return true;
+  }
+  const currentStart = processStart(run.pid);
+  return !run.processStart || !currentStart || currentStart === run.processStart || hasRunProcesses(run);
+}
+function cacheRoot(cacheDir) {
+  mkdirSync(cacheDir, { recursive: true });
+  return realpathSync(cacheDir);
+}
+async function withCacheLock(cacheDir, action) {
+  const release = await lockfile.lock(cacheRoot(cacheDir), {
+    realpath: false,
+    stale: 3e5,
+    update: 3e4,
+    retries: { retries: 100, factor: 1, minTimeout: 100, maxTimeout: 100 }
+  });
+  try {
+    return await action();
+  } finally {
+    await release();
+  }
+}
+function markerDir(cacheDir) {
+  return join4(cacheDir, "active");
+}
+function writeMarker(path, run) {
+  const temp = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temp, `${JSON.stringify(run)}
+`, { flag: "wx" });
+  renameSync(temp, path);
+}
+function protectedPaths(cacheDir) {
+  const paths = /* @__PURE__ */ new Set();
+  const root = markerDir(cacheDir);
+  if (!existsSync4(root)) return { paths, unknown: false };
+  let unknown = false;
+  for (const entry of readdirSync(root)) {
+    if (!entry.endsWith(".json")) continue;
+    const file = join4(root, entry);
+    let run;
+    try {
+      run = JSON.parse(readFileSync3(file, "utf8"));
+      if (!Number.isSafeInteger(run.pid) || run.pid <= 0 || typeof run.host !== "string" || typeof run.tree !== "string" || !run.tree.startsWith(resolve2(cacheDir) + sep) || run.processStart !== null && (typeof run.processStart !== "string" || !/^\d+$/.test(run.processStart)) || run.storeKey !== null && (typeof run.storeKey !== "string" || !/^[a-f0-9]{64}$/.test(run.storeKey))) {
+        unknown = true;
+        continue;
+      }
+    } catch {
+      unknown = true;
+      continue;
+    }
+    if (!alive(run)) {
+      unlinkSync(file);
+      continue;
+    }
+    const tree = resolve2(run.tree);
+    if (tree.startsWith(resolve2(cacheDir) + sep)) paths.add(tree);
+    if (run.storeKey && /^[a-f0-9]{64}$/.test(run.storeKey)) {
+      paths.add(join4(cacheDir, "stores", run.storeKey));
+    }
+  }
+  return { paths, unknown };
+}
+function protectLegacyRuns(cacheDir, active) {
+  const trees = join4(cacheDir, "trees");
+  if (!existsSync4(trees)) return;
+  for (const entry of readdirSync(trees, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const tree = join4(trees, entry.name);
+    if (active.paths.has(tree) || !existsSync4(join4(tree, ".git"))) continue;
+    const match = /-(\d+)$/.exec(entry.name);
+    if (!match) continue;
+    const pid = Number(match[1]);
+    if (alive({ pid, host: hostname(), processStart: null, tree, storeKey: null })) {
+      active.paths.add(tree);
+      active.unknown = true;
+    }
+  }
+}
+async function openSignoffCacheSession(cacheDir, tree) {
+  const root = cacheRoot(cacheDir);
+  const treePath = resolve2(root, relative(resolve2(cacheDir), resolve2(tree)));
+  const file = join4(markerDir(root), `${process.pid}-${randomUUID()}.json`);
+  let run = {
+    pid: process.pid,
+    host: hostname(),
+    processStart: processStart(process.pid),
+    tree: treePath,
+    storeKey: null
+  };
+  await withCacheLock(root, () => {
+    mkdirSync(markerDir(root), { recursive: true });
+    writeMarker(file, run);
+  });
+  return {
+    cacheDir: root,
+    protectStore: async (cacheKey) => {
+      if (!/^[a-f0-9]{64}$/.test(cacheKey)) throw new Error("signoff: invalid store cache key");
+      await withCacheLock(root, () => {
+        run = { ...run, storeKey: cacheKey };
+        writeMarker(file, run);
+      });
+    },
+    close: async () => {
+      await withCacheLock(root, () => {
+        if (existsSync4(file)) unlinkSync(file);
+      });
+    }
+  };
+}
+function activeStoreKeys(cacheDir) {
+  cacheDir = cacheRoot(cacheDir);
+  const active = protectedPaths(cacheDir);
+  protectLegacyRuns(cacheDir, active);
+  const { paths, unknown } = active;
+  if (unknown && existsSync4(join4(cacheDir, "stores"))) return new Set(readdirSync(join4(cacheDir, "stores"), { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name));
+  return new Set([...paths].filter((path) => path.startsWith(join4(cacheDir, "stores") + sep)).map((path) => basename2(path)));
+}
+function allocatedBytes(stat) {
+  return process.platform === "win32" ? stat.size : stat.blocks * 512;
+}
+function collectInodes(path, keys, sizes) {
+  let stat;
+  try {
+    stat = lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  const key = `${stat.dev}:${stat.ino}`;
+  keys.add(key);
+  sizes.set(key, allocatedBytes(stat));
+  if (!stat.isDirectory() || stat.isSymbolicLink()) return;
+  let children;
+  try {
+    children = readdirSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  for (const child of children) collectInodes(join4(path, child), keys, sizes);
+}
+function entries(cacheDir, protectedSet, unknown) {
+  const found = [];
+  for (const [kind, child] of [["tree", "trees"], ["store", "stores"]]) {
+    const root = join4(cacheDir, child);
+    if (!existsSync4(root)) continue;
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const path = join4(root, entry.name);
+      const recognized = kind === "store" ? /^[a-f0-9]{64}$/.test(entry.name) : existsSync4(join4(path, ".git"));
+      let mtimeMs;
+      try {
+        mtimeMs = statSync2(path).mtimeMs;
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        throw error;
+      }
+      found.push({
+        path,
+        kind,
+        mtimeMs,
+        protected: unknown || protectedSet.has(path) || !recognized,
+        inodes: /* @__PURE__ */ new Set()
+      });
+    }
+  }
+  return found;
+}
+function removeEntry(entry) {
+  if (entry.kind === "store") {
+    rmSync2(entry.path, { recursive: true, force: true });
+    return;
+  }
+  const git2 = spawnSync3("git", ["-C", entry.path, "worktree", "remove", "--force", entry.path], { encoding: "utf8" });
+  if (git2.status !== 0) throw new Error(`signoff: cannot retire cached worktree ${entry.path}: ${git2.stderr.trim()}`);
+}
+async function pruneSignoffCache(cacheDir, options = {}) {
+  const root = cacheRoot(cacheDir);
+  const nowMs = options.nowMs ?? Date.now();
+  const maxAgeMs = options.maxAgeMs ?? SIGNOFF_CACHE_MAX_AGE_MS;
+  const maxBytes = options.maxBytes ?? SIGNOFF_CACHE_MAX_BYTES;
+  if (!Number.isFinite(maxAgeMs) || maxAgeMs < 0 || !Number.isFinite(maxBytes) || maxBytes < 0) {
+    throw new Error("signoff: cache limits must be non-negative finite numbers");
+  }
+  return withCacheLock(root, () => {
+    const active = protectedPaths(root);
+    protectLegacyRuns(root, active);
+    for (const path of options.keepPaths ?? []) active.paths.add(resolve2(path));
+    const candidates = entries(root, active.paths, active.unknown);
+    const sizes = /* @__PURE__ */ new Map();
+    const references = /* @__PURE__ */ new Map();
+    for (const entry of candidates) {
+      collectInodes(entry.path, entry.inodes, sizes);
+      for (const key of entry.inodes) references.set(key, (references.get(key) ?? 0) + 1);
+    }
+    let bytes = [...sizes.values()].reduce((sum, size) => sum + size, 0);
+    const beforeBytes = bytes;
+    const selected = [];
+    const select = (entry) => {
+      selected.push(entry);
+      for (const key of entry.inodes) {
+        const remaining = (references.get(key) ?? 1) - 1;
+        references.set(key, remaining);
+        if (remaining === 0) bytes -= sizes.get(key) ?? 0;
+      }
+    };
+    const eligible = candidates.filter((entry) => !entry.protected).sort((a, b) => a.mtimeMs - b.mtimeMs);
+    for (const entry of eligible) {
+      if (nowMs - entry.mtimeMs >= maxAgeMs) select(entry);
+    }
+    for (const entry of eligible) {
+      if (bytes <= maxBytes) break;
+      if (!selected.includes(entry)) select(entry);
+    }
+    for (const entry of selected) removeEntry(entry);
+    return {
+      beforeBytes,
+      afterBytes: bytes,
+      removed: selected.map((entry) => entry.path),
+      overBudgetBytes: Math.max(0, bytes - maxBytes)
+    };
+  });
+}
 
 // src/signoff/node-version.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 
 // src/signoff/workflow-pin.ts
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
-var WORKFLOW_DIR = join3(".github", "workflows");
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+var WORKFLOW_DIR = join5(".github", "workflows");
 function scalarValue(raw) {
   const withoutComment = raw.replace(/\s+#.*$/, "").trim();
   const quoted = /^(['"])(.*)\1$/.exec(withoutComment);
@@ -268,24 +907,24 @@ function pinsInWorkflow(repoRoot, file, source) {
       pins.push({ file, value, via: "node-version" });
       continue;
     }
-    const target = join3(repoRoot, value);
-    if (!existsSync3(target)) {
+    const target = join5(repoRoot, value);
+    if (!existsSync5(target)) {
       throw new Error(
         `signoff: ${file} reads its Node pin from "${value}" (node-version-file) and that file does not exist. The workflow this gate replaces cannot itself run, so there is nothing to verify against.`
       );
     }
-    const declared = readFileSync2(target, "utf8").split("\n").map((entry) => entry.trim()).find((entry) => entry.length > 0 && !entry.startsWith("#"));
+    const declared = readFileSync4(target, "utf8").split("\n").map((entry) => entry.trim()).find((entry) => entry.length > 0 && !entry.startsWith("#"));
     if (declared !== void 0) pins.push({ file, value: declared, via: `node-version-file ${value}` });
   }
   return pins;
 }
 function scanMergeGateNodePins(repoRoot) {
-  const dir = join3(repoRoot, WORKFLOW_DIR);
-  if (!existsSync3(dir)) return [];
+  const dir = join5(repoRoot, WORKFLOW_DIR);
+  if (!existsSync5(dir)) return [];
   const pins = [];
-  const files = readdirSync(dir).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).sort();
+  const files = readdirSync2(dir).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).sort();
   for (const name of files) {
-    const source = readFileSync2(join3(dir, name), "utf8");
+    const source = readFileSync4(join5(dir, name), "utf8");
     if (!triggersOnPullRequest(source)) continue;
     pins.push(...pinsInWorkflow(repoRoot, `${WORKFLOW_DIR}/${name}`, source));
   }
@@ -335,9 +974,9 @@ function resolveNodeRequirement(repoRoot, configured) {
     return { major, declared: configured.trim(), source: "signoff config `nodeVersion`" };
   }
   let fromNvmrc = null;
-  const nvmrc = join4(repoRoot, ".nvmrc");
-  if (existsSync4(nvmrc)) {
-    const raw = readFileSync3(nvmrc, "utf8").trim();
+  const nvmrc = join6(repoRoot, ".nvmrc");
+  if (existsSync6(nvmrc)) {
+    const raw = readFileSync5(nvmrc, "utf8").trim();
     const major = majorOf(raw);
     if (major !== null) fromNvmrc = { major, declared: raw, source: ".nvmrc" };
   }
@@ -361,9 +1000,9 @@ function assertNodeVersion(requirement, running = process.version) {
 }
 function assertNodeTypesVersion(repoRoot, requirement) {
   if (!requirement) return;
-  const packagePath = join4(repoRoot, "package.json");
-  if (!existsSync4(packagePath)) return;
-  const manifest = JSON.parse(readFileSync3(packagePath, "utf8"));
+  const packagePath = join6(repoRoot, "package.json");
+  if (!existsSync6(packagePath)) return;
+  const manifest = JSON.parse(readFileSync5(packagePath, "utf8"));
   const declared = manifest.devDependencies?.["@types/node"] ?? manifest.dependencies?.["@types/node"] ?? manifest.optionalDependencies?.["@types/node"];
   if (!declared) return;
   const declaredMajor = /^[~^]?v?(\d+)(?:\.|$)/.exec(declared.trim())?.[1];
@@ -372,11 +1011,11 @@ function assertNodeTypesVersion(repoRoot, requirement) {
       `signoff: this repo pins Node ${requirement.declared} but declares @types/node ${declared}. Use the latest @types/node ${requirement.major}.x release.`
     );
   }
-  const installedPath = join4(repoRoot, "node_modules", "@types", "node", "package.json");
-  if (!existsSync4(installedPath)) {
+  const installedPath = join6(repoRoot, "node_modules", "@types", "node", "package.json");
+  if (!existsSync6(installedPath)) {
     throw new Error(`signoff: @types/node is declared but missing after install in ${repoRoot}.`);
   }
-  const installed = JSON.parse(readFileSync3(installedPath, "utf8"));
+  const installed = JSON.parse(readFileSync5(installedPath, "utf8"));
   const installedMajor = majorOf(installed.version ?? "");
   if (installedMajor !== requirement.major) {
     throw new Error(
@@ -443,7 +1082,7 @@ function runCommand(options) {
     killGraceMs = DEFAULT_KILL_GRACE_MS,
     onData
   } = options;
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const startedAt = Date.now();
     const buffer = new BoundedOutput(maxOutputBytes);
     let timedOut = false;
@@ -493,7 +1132,7 @@ function runCommand(options) {
     });
     child.on("close", (code, sig) => {
       cleanup();
-      resolve7({
+      resolve8({
         command,
         cwd,
         // A signalled process reports code `null`; 128+n is the shell's own
@@ -660,8 +1299,8 @@ function planAttempts(step, seedBase, overrideRuns) {
 
 // src/signoff/store.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync, statSync, utimesSync, writeFileSync } from "fs";
-import { join as join5, relative, sep } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync6, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync3, utimesSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename3, join as join7, relative as relative2, sep as sep2 } from "path";
 var MANIFEST_FILES = [
   "pnpm-lock.yaml",
   "pnpm-workspace.yaml",
@@ -674,12 +1313,12 @@ var MANIFEST_FILES = [
 ];
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", ".wrangler", ".react-router"]);
 function collectManifests(dir, root, out) {
-  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (SKIP_DIRS.has(entry.name)) continue;
-      collectManifests(join5(dir, entry.name), root, out);
+      collectManifests(join7(dir, entry.name), root, out);
     } else if (MANIFEST_FILES.includes(entry.name)) {
-      out.push(relative(root, join5(dir, entry.name)).split(sep).join("/"));
+      out.push(relative2(root, join7(dir, entry.name)).split(sep2).join("/"));
     }
   }
 }
@@ -693,26 +1332,27 @@ function manifestCacheKey(treePath, files) {
   for (const rel of files) {
     hash.update(rel);
     hash.update("\0");
-    hash.update(createHash2("sha256").update(readFileSync4(join5(treePath, rel))).digest("hex"));
+    hash.update(createHash2("sha256").update(readFileSync6(join7(treePath, rel))).digest("hex"));
     hash.update("\n");
   }
   return hash.digest("hex");
 }
-function pruneStores(storesRoot, keep) {
-  if (!existsSync5(storesRoot)) return [];
-  const entries = readdirSync2(storesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const full = join5(storesRoot, entry.name);
-    return { full, mtimeMs: statSync(full).mtimeMs };
+function pruneStores(storesRoot, keep, protectedKeys) {
+  if (!existsSync7(storesRoot)) return [];
+  const entries2 = readdirSync3(storesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^[a-f0-9]{64}$/.test(entry.name)).map((entry) => {
+    const full = join7(storesRoot, entry.name);
+    return { full, mtimeMs: statSync3(full).mtimeMs };
   }).sort((a, b) => b.mtimeMs - a.mtimeMs);
   const pruned = [];
-  for (const stale of entries.slice(keep)) {
-    rmSync(stale.full, { recursive: true, force: true });
+  for (const stale of entries2.slice(keep)) {
+    if (protectedKeys.has(basename3(stale.full))) continue;
+    rmSync3(stale.full, { recursive: true, force: true });
     pruned.push(stale.full);
   }
   return pruned;
 }
 function resolveStore(options) {
-  const { treePath, cacheDir, generations = 4 } = options;
+  const { treePath, cacheDir, generations = 4, protectedStoreKeys = /* @__PURE__ */ new Set() } = options;
   const files = manifestFiles(treePath);
   if (files.length === 0) {
     throw new Error(
@@ -720,25 +1360,25 @@ function resolveStore(options) {
     );
   }
   const cacheKey = manifestCacheKey(treePath, files);
-  const storesRoot = join5(cacheDir, "stores");
-  const storeDir = join5(storesRoot, cacheKey);
-  const marker = join5(storeDir, ".signoff-store.json");
-  const hit = existsSync5(storeDir) && readdirSync2(storeDir).some((entry) => entry !== ".signoff-store.json");
-  mkdirSync(storeDir, { recursive: true });
-  writeFileSync(marker, `${JSON.stringify({ cacheKey, keyedOn: files, usedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+  const storesRoot = join7(cacheDir, "stores");
+  const storeDir = join7(storesRoot, cacheKey);
+  const marker = join7(storeDir, ".signoff-store.json");
+  const hit = existsSync7(storeDir) && readdirSync3(storeDir).some((entry) => entry !== ".signoff-store.json");
+  mkdirSync2(storeDir, { recursive: true });
+  writeFileSync2(marker, `${JSON.stringify({ cacheKey, keyedOn: files, usedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `);
   const now = /* @__PURE__ */ new Date();
   utimesSync(storeDir, now, now);
-  return { storeDir, cacheKey, hit, keyedOn: files, pruned: pruneStores(storesRoot, generations) };
+  return { storeDir, cacheKey, hit, keyedOn: files, pruned: pruneStores(storesRoot, generations, protectedStoreKeys) };
 }
 
 // src/signoff/workspace.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, join as join6, resolve as resolve2 } from "path";
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, isAbsolute, join as join8, resolve as resolve3 } from "path";
 function git(args, cwd) {
-  const result = spawnSync2("git", args, { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  const result = spawnSync4("git", args, { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
   if (result.error) throw new Error(`signoff: git ${args.join(" ")} failed to start: ${result.error.message}`);
   if (result.status !== 0) {
     throw new Error(`signoff: git ${args.join(" ")} exited ${result.status}
@@ -758,8 +1398,8 @@ function materializeCleanTree(options) {
   const head = git(["rev-parse", "HEAD"], root).trim();
   const branch = git(["rev-parse", "--abbrev-ref", "HEAD"], root).trim();
   git(["worktree", "prune"], root);
-  mkdirSync2(dirname2(dest), { recursive: true });
-  if (existsSync6(dest)) rmSync2(dest, { recursive: true, force: true });
+  mkdirSync3(dirname2(dest), { recursive: true });
+  if (existsSync8(dest)) rmSync4(dest, { recursive: true, force: true });
   git(["worktree", "add", "--detach", "--quiet", dest, head], root);
   let diffSha256 = null;
   let untrackedFiles = [];
@@ -767,29 +1407,29 @@ function materializeCleanTree(options) {
     const patch = git(["diff", "HEAD", "--binary", "--no-color", "--no-ext-diff"], root);
     if (patch.length > 0) {
       diffSha256 = createHash3("sha256").update(patch).digest("hex");
-      const patchFile = join6(dirname2(dest), `${dest.split("/").pop() ?? "tree"}.patch`);
-      writeFileSync2(patchFile, patch);
+      const patchFile = join8(dirname2(dest), `${dest.split("/").pop() ?? "tree"}.patch`);
+      writeFileSync3(patchFile, patch);
       git(["apply", "--binary", "--whitespace=nowarn", patchFile], dest);
-      rmSync2(patchFile, { force: true });
+      rmSync4(patchFile, { force: true });
     }
     untrackedFiles = zsplit(git(["ls-files", "--others", "--exclude-standard", "-z"], root));
     for (const rel of untrackedFiles) {
-      const target = join6(dest, rel);
-      mkdirSync2(dirname2(target), { recursive: true });
-      copyFileSync(join6(root, rel), target);
+      const target = join8(dest, rel);
+      mkdirSync3(dirname2(target), { recursive: true });
+      copyFileSync(join8(root, rel), target);
     }
   }
   const carried = [];
   for (const rel of carryFiles) {
     if (isAbsolute(rel)) throw new Error(`signoff: carryFiles must be repo-relative; got "${rel}"`);
-    const from = resolve2(root, rel);
-    if (!existsSync6(from)) {
+    const from = resolve3(root, rel);
+    if (!existsSync8(from)) {
       throw new Error(
         `signoff: carryFiles names "${rel}", which does not exist at ${from}. Remove it from the config or create the file \u2014 installing without it would resolve against a different registry than the one you think you are verifying.`
       );
     }
-    const target = join6(dest, rel);
-    mkdirSync2(dirname2(target), { recursive: true });
+    const target = join8(dest, rel);
+    mkdirSync3(dirname2(target), { recursive: true });
     copyFileSync(from, target);
     carried.push(rel);
   }
@@ -810,9 +1450,9 @@ function removeCleanTree(tree) {
 }
 
 // src/signoff/run.ts
-var DEFAULT_CACHE_DIR = join7(homedir(), ".cache", "agent-app-signoff");
+var DEFAULT_CACHE_DIR = join9(homedir(), ".cache", "agent-app-signoff");
 function hostFacts(treePath, requirement) {
-  const pm = spawnSync3("pnpm", ["--version"], { cwd: treePath, encoding: "utf8" });
+  const pm = spawnSync5("pnpm", ["--version"], { cwd: treePath, encoding: "utf8" });
   return {
     node: process.version,
     nodePinned: requirement?.declared ?? null,
@@ -850,17 +1490,35 @@ function withStoreDir(command, flag, storeDir) {
 async function runSignoff(options = {}) {
   const startedAt = /* @__PURE__ */ new Date();
   const wallStart = Date.now();
-  const repoDir = resolve3(options.repoDir ?? process.cwd());
+  const repoDir = resolve4(options.repoDir ?? process.cwd());
   const repoRoot = repoRootOf(repoDir);
   const source = options.source ?? "working-tree";
-  let cacheDir = resolve3(options.cacheDir ?? DEFAULT_CACHE_DIR);
-  const treePath = () => join7(cacheDir, "trees", `${basename2(repoRoot)}-${process.pid}`);
+  let cacheDir = resolve4(options.cacheDir ?? DEFAULT_CACHE_DIR);
+  const treeName = `${basename4(repoRoot)}-${process.pid}-${randomUUID2()}`;
+  const treePath = () => join9(cacheDir, "trees", treeName);
   let tree = null;
+  const sessions = [];
+  let session = await openSignoffCacheSession(cacheDir, treePath());
+  sessions.push(session);
+  cacheDir = session.cacheDir;
+  const prune = async (root, keepPaths = []) => {
+    const result = await pruneSignoffCache(root, { keepPaths });
+    if (result.removed.length || result.overBudgetBytes) {
+      options.onEvent?.({ kind: "cache-prune", ...result });
+    }
+  };
   try {
+    await prune(cacheDir);
     tree = materializeCleanTree({ repoDir: repoRoot, dest: treePath(), source });
     let loaded = await loadSignoffConfig({ repoRoot: tree.path, configPath: options.configPath });
-    cacheDir = resolve3(options.cacheDir ?? loaded.config.cacheDir ?? DEFAULT_CACHE_DIR);
+    cacheDir = resolve4(options.cacheDir ?? loaded.config.cacheDir ?? DEFAULT_CACHE_DIR);
     if (tree.path !== treePath() || (loaded.config.carryFiles?.length ?? 0) > 0) {
+      if (session.cacheDir !== cacheDir) {
+        session = await openSignoffCacheSession(cacheDir, treePath());
+        sessions.push(session);
+        cacheDir = session.cacheDir;
+        await prune(cacheDir);
+      }
       removeCleanTree(tree);
       tree = materializeCleanTree({ repoDir: repoRoot, dest: treePath(), source, carryFiles: loaded.config.carryFiles });
       loaded = await loadSignoffConfig({ repoRoot: tree.path, configPath: options.configPath });
@@ -871,10 +1529,16 @@ async function runSignoff(options = {}) {
     const nodeRequirement = resolveNodeRequirement(tree.path, config.nodeVersion);
     assertNodeVersion(nodeRequirement);
     options.onEvent?.({ kind: "tree", path: tree.path, head: tree.head, dirty: tree.dirty });
-    const store = resolveStore({ treePath: tree.path, cacheDir, generations: config.storeGenerations });
+    await session.protectStore(manifestCacheKey(tree.path, manifestFiles(tree.path)));
+    const store = await withCacheLock(cacheDir, () => resolveStore({
+      treePath: tree.path,
+      cacheDir,
+      generations: config.storeGenerations,
+      protectedStoreKeys: activeStoreKeys(cacheDir)
+    }));
     options.onEvent?.({ kind: "store", storeDir: store.storeDir, cacheHit: store.hit, cacheKey: store.cacheKey });
     const installSpec = config.install ?? {};
-    const installCwd = join7(tree.path, installSpec.cwd ?? ".");
+    const installCwd = join9(tree.path, installSpec.cwd ?? ".");
     const installCommand = withStoreDir(
       installSpec.run ?? "pnpm install --frozen-lockfile",
       installSpec.storeDirFlag,
@@ -921,7 +1585,7 @@ async function runSignoff(options = {}) {
         origin,
         host,
         install,
-        steps: [...config.steps.map((step) => step.name), WORKER_DEFAULTS_STEP].map(
+        steps: [...config.steps.map((step) => step.name), WORKER_DEFAULTS_STEP, APP_DEFAULTS_STEP].map(
           (name) => ({
             name,
             status: "skipped",
@@ -951,7 +1615,7 @@ async function runSignoff(options = {}) {
           options.onEvent?.({ kind: "step-start", name: step.name, command: plan.command, seed: plan.seed });
           const result = await runCommand({
             command: plan.command,
-            cwd: join7(treeRoot, step.cwd ?? "."),
+            cwd: join9(treeRoot, step.cwd ?? "."),
             env: buildEnv(sharedEnv, [step.env]),
             timeoutMs: step.timeoutMs,
             signal
@@ -967,7 +1631,8 @@ async function runSignoff(options = {}) {
         return { ok: true, value: attempts };
       }
     });
-    const steps = [...outcomes.map(toStepResult), workerDefaults];
+    const appDefaults = runAppDefaults(tree.path, config, options);
+    const steps = [...outcomes.map(toStepResult), workerDefaults, appDefaults];
     return finish({
       ok: steps.every((step) => step.status === "passed"),
       startedAt,
@@ -984,7 +1649,14 @@ async function runSignoff(options = {}) {
       options
     });
   } finally {
-    if (tree && !options.keepWorkspace && existsSync7(tree.path)) removeCleanTree(tree);
+    try {
+      if (tree && !options.keepWorkspace && existsSync9(tree.path)) removeCleanTree(tree);
+    } finally {
+      for (const active of sessions) {
+        await active.close();
+        await prune(active.cacheDir, options.keepWorkspace && tree ? [tree.path] : []);
+      }
+    }
   }
 }
 function runWorkerDefaults(treeRoot, workerConfigs, options) {
@@ -1009,6 +1681,28 @@ function runWorkerDefaults(treeRoot, workerConfigs, options) {
   emitStepEnd(options, WORKER_DEFAULTS_STEP, ok ? "passed" : "failed", attempts);
   return { name: WORKER_DEFAULTS_STEP, status: ok ? "passed" : "failed", attempts, durationMs, startedAtMs: null, finishedAtMs: null };
 }
+function runAppDefaults(treeRoot, config, options) {
+  const command = `agent-app-signoff ${APP_DEFAULTS_STEP}`;
+  options.onEvent?.({ kind: "step-start", name: APP_DEFAULTS_STEP, command, seed: null });
+  const started = Date.now();
+  let output;
+  let ok;
+  try {
+    const result = checkAppDefaults(treeRoot, { exemptions: config.agentApp?.exemptions });
+    output = formatAppDefaults(result);
+    ok = result.findings.length === 0;
+  } catch (error) {
+    output = `${error instanceof Error ? error.stack ?? error.message : String(error)}
+`;
+    ok = false;
+  }
+  const durationMs = Date.now() - started;
+  const attempts = [
+    { command, seed: null, exitCode: ok ? 0 : 1, signal: null, durationMs, timedOut: false, output, outputTruncated: false }
+  ];
+  emitStepEnd(options, APP_DEFAULTS_STEP, ok ? "passed" : "failed", attempts);
+  return { name: APP_DEFAULTS_STEP, status: ok ? "passed" : "failed", attempts, durationMs, startedAtMs: null, finishedAtMs: null };
+}
 function emitStepEnd(options, name, status, attempts) {
   options.onEvent?.({
     kind: "step-end",
@@ -1394,8 +2088,8 @@ function round(value) {
 }
 
 // src/signoff/shell-alignment-cli.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, resolve as resolve4 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, resolve as resolve5 } from "path";
 function shellAlignmentUsage() {
   return [
     "Usage: agent-app-signoff shell-alignment --base-url <url> --route <path> [--route <path> ...] [options]",
@@ -1445,10 +2139,10 @@ function parseShellAlignmentArgs(argv) {
         });
         break;
       case "--storage-state":
-        out.storageState = resolve4(take());
+        out.storageState = resolve5(take());
         break;
       case "--theme-script":
-        out.themeScript = readFileSync5(resolve4(take()), "utf8");
+        out.themeScript = readFileSync7(resolve5(take()), "utf8");
         break;
       case "--ready":
         out.readySelector = take();
@@ -1460,7 +2154,7 @@ function parseShellAlignmentArgs(argv) {
         break;
       }
       case "--screenshots":
-        out.screenshotDir = resolve4(take());
+        out.screenshotDir = resolve5(take());
         break;
       case "--json":
         out.jsonPath = take();
@@ -1490,12 +2184,12 @@ ${shellAlignmentUsage()}
 `);
     return 2;
   }
-  if (options.screenshotDir) mkdirSync3(options.screenshotDir, { recursive: true });
+  if (options.screenshotDir) mkdirSync4(options.screenshotDir, { recursive: true });
   const report = await checkShellAlignment(options);
   if (options.jsonPath) {
-    const abs = resolve4(options.jsonPath);
-    mkdirSync3(dirname3(abs), { recursive: true });
-    writeFileSync3(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve5(options.jsonPath);
+    mkdirSync4(dirname3(abs), { recursive: true });
+    writeFileSync4(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${formatShellAlignmentReport(report)}
@@ -1787,8 +2481,8 @@ function formatSurfaceLadderReport(report) {
 }
 
 // src/signoff/surface-ladder-cli.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, resolve as resolve5 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, resolve as resolve6 } from "path";
 function surfaceLadderUsage() {
   return [
     "Usage: agent-app-signoff surface-ladder --base-url <url> --route <path> [--route <path> ...] [options]",
@@ -1846,10 +2540,10 @@ function parseSurfaceLadderArgs(argv) {
         });
         break;
       case "--storage-state":
-        out.storageState = resolve5(take());
+        out.storageState = resolve6(take());
         break;
       case "--theme-script":
-        out.themeScript = readFileSync6(resolve5(take()), "utf8");
+        out.themeScript = readFileSync8(resolve6(take()), "utf8");
         break;
       case "--ready":
         out.readySelector = take();
@@ -1867,10 +2561,10 @@ function parseSurfaceLadderArgs(argv) {
         break;
       }
       case "--inject-css":
-        out.injectCss = readFileSync6(resolve5(take()), "utf8");
+        out.injectCss = readFileSync8(resolve6(take()), "utf8");
         break;
       case "--screenshots":
-        out.screenshotDir = resolve5(take());
+        out.screenshotDir = resolve6(take());
         break;
       case "--json":
         out.jsonPath = take();
@@ -1900,12 +2594,12 @@ ${surfaceLadderUsage()}
 `);
     return 2;
   }
-  if (options.screenshotDir) mkdirSync4(options.screenshotDir, { recursive: true });
+  if (options.screenshotDir) mkdirSync5(options.screenshotDir, { recursive: true });
   const report = await checkSurfaceLadder(options);
   if (options.jsonPath) {
-    const abs = resolve5(options.jsonPath);
-    mkdirSync4(dirname4(abs), { recursive: true });
-    writeFileSync4(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve6(options.jsonPath);
+    mkdirSync5(dirname4(abs), { recursive: true });
+    writeFileSync5(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${formatSurfaceLadderReport(report)}
@@ -1998,8 +2692,8 @@ function formatWorkspaceSurfaceReport(report) {
 }
 
 // src/signoff/workspace-surface-cli.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname5, resolve as resolve6 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, resolve as resolve7 } from "path";
 var USAGE = [
   "Usage: agent-app-signoff workspace-surface --base-url <url> --route <path> [--route <path> ...] [options]",
   "",
@@ -2028,12 +2722,12 @@ ${USAGE}
 `);
     return 2;
   }
-  if (options.screenshotDir) mkdirSync5(options.screenshotDir, { recursive: true });
+  if (options.screenshotDir) mkdirSync6(options.screenshotDir, { recursive: true });
   const report = await checkWorkspaceSurface(options);
   if (options.jsonPath) {
-    const abs = resolve6(options.jsonPath);
-    mkdirSync5(dirname5(abs), { recursive: true });
-    writeFileSync5(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve7(options.jsonPath);
+    mkdirSync6(dirname5(abs), { recursive: true });
+    writeFileSync6(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${formatWorkspaceSurfaceReport(report)}
@@ -2047,6 +2741,9 @@ export {
   WORKER_COMPATIBILITY_DATE_FLOOR,
   checkWorkerDefaults,
   formatWorkerDefaults,
+  checkAppDefaults,
+  formatAppDefaults,
+  collectLastExports,
   loadSignoffConfig,
   runSignoff,
   formatSignoffReport,
@@ -2088,4 +2785,4 @@ export {
   formatWorkspaceSurfaceReport,
   runWorkspaceSurfaceCli
 };
-//# sourceMappingURL=chunk-KDPTXXOQ.js.map
+//# sourceMappingURL=chunk-WDY47GBR.js.map