@vypdev/copilot 3.9.1 → 3.9.3

package/build/cli/index.js

@@ -38002,6 +38002,23 @@ exports.TITLE = void 0;
 exports.TITLE = 'Copilot';
 
 
+/***/ }),
+
+/***/ 2396:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.SETUP_DOCUMENTATION = void 0;
+/** Public, source-controlled navigation. Never attach session, repository or credential data. */
+exports.SETUP_DOCUMENTATION = {
+    tutorial: 'https://docs.page/vypdev/copilot/setup-web',
+    firstWorkflow: 'https://docs.page/vypdev/copilot/first-workflow',
+    recovery: 'https://docs.page/vypdev/copilot/security-operations/operations/troubleshooting',
+};
+
+
 /***/ }),
 
 /***/ 75999:
@@ -38072,6 +38089,55 @@ function runAtApplicationErrorBoundary(operation) {
 }
 
 
+/***/ }),
+
+/***/ 50519:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.approvalEvidenceError = approvalEvidenceError;
+exports.approvalDiagnosticError = approvalDiagnosticError;
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
+const application_error_1 = __nccwpck_require__(75999);
+function approvalEvidenceError(operation, reason) {
+    return approvalDiagnosticError({ operation, reason, permission: approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS[operation] });
+}
+function approvalDiagnosticError(diagnostic) {
+    const reason = diagnostic.reason;
+    const code = reason === 'http-401' ? 'authorization.credential-invalid'
+        : reason === 'http-403' ? 'authorization.denied'
+            : reason === 'http-404' ? 'provider.not-found'
+                : reason === 'http-429' ? 'provider.rate-limited'
+                    : reason === 'http-409' ? 'provider.conflict'
+                        : reason === 'transport-unavailable' || /^http-50[0234]$/u.test(reason) ? 'provider.unavailable'
+                            : 'provider.contract-invalid';
+    return new application_error_1.ApplicationError(code, `Approval evidence read failed (${diagnostic.operation}, ${reason}).`, {
+        recovery: { id: 'approval-evidence-read-failed', variables: diagnostic },
+    });
+}
+
+
+/***/ }),
+
+/***/ 12183:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.closedIssueReconciliationError = closedIssueReconciliationError;
+const application_error_1 = __nccwpck_require__(75999);
+/** Public diagnostic is fixed native facts and counters, never label/card/provider text. */
+function closedIssueReconciliationError(cause, facts) {
+    return new application_error_1.ApplicationError(cause instanceof application_error_1.ApplicationError ? cause.code : 'provider.unavailable', 'Closed issue reconciliation remains unverified.', {
+        ...(cause instanceof application_error_1.ApplicationError ? { correlationId: cause.correlationId, retryable: cause.retryable } : {}),
+        recovery: { id: 'closed-issue-reconciliation-failed', variables: facts },
+    });
+}
+
+
 /***/ }),
 
 /***/ 72594:
@@ -39248,6 +39314,16 @@ const SPANISH_CONTENT = Object.freeze({
     }),
 });
 const ENGLISH_RECOVERY_CONTENT = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze({
+        impact: 'Issue cleanup remains unverified: {resultId}, phase {phase}; native state {state}, reason {reason}.',
+        action: 'Inspect the closed-issue or merged-PR run and current native state. Retry cleanup only if the issue is still closed with the intended reason; leave reopened work open. Resolve the named failure before retrying.',
+        retainedState: 'Native state was preserved. Confirmed changes: {changed}; remaining required changes in the last verified plan: {remaining}. Unavailable reads do not establish completion.',
+    }),
+    'approval-evidence-read-failed': Object.freeze({
+        impact: 'Approval evidence could not be verified: {operation} ({reason}).',
+        action: 'Inspect {permission} access for the runtime credential and the named evidence response. Correct authorization, missing-resource or schema errors before rerunning; retry transient failures only after provider recovery or rate-limit reset.',
+        retainedState: 'No approval is authorized by this failed read. Existing PRs, reviews and completed external effects were preserved.',
+    }),
     'workspace-changes-rejected': Object.freeze({
         impact: 'The changes were rejected during workspace verification.',
         action: 'Inspect the rejected paths in the workflow and correct the workspace before retrying.',
@@ -39315,6 +39391,16 @@ const ENGLISH_RECOVERY_CONTENT = Object.freeze({
     }),
 });
 const SPANISH_RECOVERY_CONTENT = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze({
+        impact: 'La limpieza de la issue sigue sin verificarse: {resultId}, fase {phase}; estado nativo {state}, motivo {reason}.',
+        action: 'Revisa la ejecución de cierre o de la PR fusionada y el estado nativo actual. Reintenta la limpieza solo si la issue sigue cerrada con el motivo previsto; conserva abierto el trabajo reabierto. Resuelve el fallo indicado antes de reintentar.',
+        retainedState: 'Se conservó el estado nativo. Cambios confirmados: {changed}; cambios pendientes en el último plan verificado: {remaining}. Una lectura no disponible no demuestra que haya finalizado.',
+    }),
+    'approval-evidence-read-failed': Object.freeze({
+        impact: 'No se pudo verificar la evidencia de aprobación: {operation} ({reason}).',
+        action: 'Comprueba el acceso {permission} de la credencial de ejecución y la respuesta indicada. Corrige los errores de autorización, recurso o esquema antes de reejecutar; reintenta los fallos transitorios solo tras recuperarse el proveedor o restablecerse el límite.',
+        retainedState: 'Esta lectura fallida no autoriza ninguna aprobación. Se conservaron las PRs, revisiones y efectos externos completados.',
+    }),
     'workspace-changes-rejected': Object.freeze({
         impact: 'Los cambios se rechazaron durante la verificación del espacio de trabajo.',
         action: 'Revisa las rutas rechazadas en la ejecución y corrige el espacio de trabajo antes de reintentar.',
@@ -45862,6 +45948,34 @@ function verifiedReadinessLink(snapshot, number) {
 }
 
 
+/***/ }),
+
+/***/ 59756:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.hasConventionalPullRequestTitle = hasConventionalPullRequestTitle;
+exports.generatedPullRequestTitle = generatedPullRequestTitle;
+/** Recognizes the conventional header shape; the consumer's CI owns its allowed types and subject rules. */
+function hasConventionalPullRequestTitle(title) {
+    return !title.includes('\n') && !title.includes('\r')
+        && /^\p{L}[\p{L}\p{N}_-]*(?:\([^()\r\n]+\))?!?: +\S[^\r\n]*$/u.test(title);
+}
+function generatedPullRequestTitle(sourceTitle, sanitizedSubject, issueNumber, labels) {
+    if (hasConventionalPullRequestTitle(sourceTitle))
+        return sourceTitle;
+    const type = labels.isHotfix || labels.isBugfix || labels.isBug ? 'fix'
+        : labels.isFeature || labels.isEnhancement ? 'feat'
+            : labels.isDocs || labels.isDocumentation ? 'docs' : 'chore';
+    const prefix = `${type}: `;
+    const suffix = ` (#${issueNumber})`;
+    const subject = (sanitizedSubject || 'Update linked issue').slice(0, 256 - prefix.length - suffix.length).trimEnd();
+    return `${prefix}${subject}${suffix}`;
+}
+
+
 /***/ }),
 
 /***/ 39410:
@@ -46053,6 +46167,12 @@ Do not add the \`${profile.deployment.launcherLabel}\` label, dispatch a deploym
 
 Never expose credentials, tokens, private keys, or other secrets in issues, commits, pull requests, logs, or diagnostic comments.
 
+## Repository verification prerequisites
+
+The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job.
+
+Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites).
+
 For the full contributor flow, read [repository collaboration](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-collaboration.mdx). For drift and recovery, read [guidance troubleshooting](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-guidance-troubleshooting.mdx).
 `;
 }
@@ -50159,13 +50279,16 @@ function validateDiscoveredProjectStatuses(configuration, discovery) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.setupQuestionDocumentation = setupQuestionDocumentation;
 const docs = {
-    features: { title: 'Copilot features and workflow triggers', url: 'https://docs.page/vypdev/copilot/features' },
-    issueWorkflows: { title: 'Copilot issue workflow setup', url: 'https://docs.page/vypdev/copilot/issues/workflow-setup' },
+    features: { title: 'Choose a Copilot goal', url: 'https://docs.page/vypdev/copilot/guides' },
+    issueWorkflows: { title: 'Select issue kinds and forms', url: 'https://docs.page/vypdev/copilot/issues/configurable-workflows' },
+    issuesGuide: { title: 'Manage issues and branches', url: 'https://docs.page/vypdev/copilot/guides/issues-and-branches' },
+    reviewGuide: { title: 'Review PRs and resolve findings', url: 'https://docs.page/vypdev/copilot/guides/review-pull-requests' },
+    botGuide: { title: 'Work with the bot', url: 'https://docs.page/vypdev/copilot/guides/work-with-the-bot' },
+    releaseGuide: { title: 'Release and hotfix guide', url: 'https://docs.page/vypdev/copilot/guides/releases-and-hotfixes' },
     branchManagement: { title: 'Issue branch management', url: 'https://docs.page/vypdev/copilot/issues/branch-management' },
     preBranchSdd: { title: 'Pre-branch design documents', url: 'https://docs.page/vypdev/copilot/issues/pre-branch-sdds' },
     issueLifecycle: { title: 'Issue notifications and automatic closure', url: 'https://docs.page/vypdev/copilot/issues/notifications-and-auto-close' },
     assignments: { title: 'Assignees and GitHub Projects', url: 'https://docs.page/vypdev/copilot/issues/assignees-and-projects' },
-    pullRequestWorkflows: { title: 'Pull-request workflow setup', url: 'https://docs.page/vypdev/copilot/pull-requests/workflow-setup' },
     pullRequestDescription: { title: 'AI pull-request descriptions', url: 'https://docs.page/vypdev/copilot/pull-requests/ai-description' },
     repositoryGuidance: { title: 'Repository guidance for agents', url: 'https://docs.page/vypdev/copilot/agents/repository-collaboration' },
     runtime: { title: 'Agent runtime selection', url: 'https://docs.page/vypdev/copilot/agents/runtime-selection' },
@@ -50180,7 +50303,7 @@ const docs = {
     projects: { title: 'Assignees and GitHub Projects', url: 'https://docs.page/vypdev/copilot/issues/assignees-and-projects' },
     githubProjects: { title: 'GitHub: About Projects', url: 'https://docs.github.com/en/issues/planning-and-tracking-with-projects/learning-about-projects/about-projects' },
     githubStatus: { title: 'GitHub: About single-select fields', url: 'https://docs.github.com/en/issues/planning-and-tracking-with-projects/understanding-fields/about-single-select-fields' },
-    provisioning: { title: 'Copilot setup and provisioning', url: 'https://docs.page/vypdev/copilot/how-to-use' },
+    provisioning: { title: 'Set up with the web assistant', url: 'https://docs.page/vypdev/copilot/setup-web' },
     storage: { title: 'GitHub Actions Secrets and Variables', url: 'https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets' },
 };
 /** Links are selected from source-controlled constants, never derived from answers or remote text. */
@@ -50190,10 +50313,14 @@ function setupQuestionDocumentation(question) {
         return { title: 'Runner profiles', url: 'https://docs.page/vypdev/copilot/configuration#runner-profiles' };
     if (id === 'issueWorkflows.enabled')
         return docs.issueWorkflows;
-    if (id === 'features.issues')
-        return docs.issueWorkflows;
+    if (id === 'features.issues' || id === 'features.commits')
+        return docs.issuesGuide;
     if (id === 'features.pullRequests')
-        return docs.pullRequestWorkflows;
+        return docs.reviewGuide;
+    if (id === 'features.issueComments' || id === 'features.pullRequestComments')
+        return docs.botGuide;
+    if (id === 'features.release' || id === 'features.hotfix')
+        return docs.releaseGuide;
     if (id === 'repository.issueManagedBranches' || /^repository\.(feature|bugfix|hotfix|release|docs|chore)Tree$/u.test(id))
         return docs.branchManagement;
     if (id === 'repository.preBranchSdd')
@@ -53048,6 +53175,87 @@ function projectCurrentNativeStatus(status, facts) {
 }
 
 
+/***/ }),
+
+/***/ 89347:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.VerificationPrerequisiteError = exports.VERIFICATION_RUNTIME_SPECS = exports.VERIFICATION_RUNTIME_HELP = exports.VERIFICATION_RUNTIME_MANIFEST = void 0;
+exports.parseVerificationRuntimeManifest = parseVerificationRuntimeManifest;
+exports.verificationRuntimeVersion = verificationRuntimeVersion;
+exports.verificationRuntimeMatches = verificationRuntimeMatches;
+exports.VERIFICATION_RUNTIME_MANIFEST = '.copilot/verification-prerequisites.json';
+exports.VERIFICATION_RUNTIME_HELP = 'https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites';
+exports.VERIFICATION_RUNTIME_SPECS = {
+    java: { label: 'Java', program: 'java', args: ['-version'] },
+    node: { label: 'Node.js', program: 'node', args: ['--version'] },
+    pnpm: { label: 'pnpm', program: 'pnpm', args: ['--version'] },
+    python: { label: 'Python', program: 'python3', args: ['--version'] },
+    go: { label: 'Go', program: 'go', args: ['version'] },
+    dotnet: { label: '.NET SDK', program: 'dotnet', args: ['--version'] },
+    ruby: { label: 'Ruby', program: 'ruby', args: ['--version'] },
+    rust: { label: 'Rust', program: 'rustc', args: ['--version'] },
+};
+const VERSION_PREFIX = /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,2}$/u;
+/** Only reviewed, closed runtime/version facts enter user-visible diagnostics. Raw tool output never does. */
+class VerificationPrerequisiteError extends Error {
+    constructor(reason, requirement, observed, job) {
+        const jobLabel = job && /^[A-Za-z_][A-Za-z0-9_-]{0,99}$/u.test(job) ? ` in job ${job}` : ' in this job';
+        const runtime = requirement && Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, requirement.runtime)
+            ? exports.VERIFICATION_RUNTIME_SPECS[requirement.runtime].label : 'Required runtime';
+        const version = requirement && VERSION_PREFIX.test(requirement.version) ? requirement.version : 'declared version';
+        const actual = observed && /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,3}$/u.test(observed) ? observed : 'unavailable';
+        const cause = reason === 'manifest-invalid' ? `${exports.VERIFICATION_RUNTIME_MANIFEST} is invalid or unsafe`
+            : reason === 'version-mismatch' ? `${runtime} ${version} is required; observed ${actual}`
+                : reason === 'unreadable-version' ? `${runtime} ${version} could not be verified`
+                    : `${runtime} ${version} is unavailable`;
+        const action = reason === 'manifest-invalid' ? 'Correct the reviewed runtime declaration.'
+            : `Provision the declared runtime in the same job before Copilot, then retry.${requirement?.runtime === 'java' ? ' For Java, configure actions/setup-java or a managed JAVA_HOME.' : ''}`;
+        super(`Repository verification is blocked${jobLabel}: ${cause}. ${action} The repository verification command was not run. Help: ${exports.VERIFICATION_RUNTIME_HELP}`);
+        this.name = 'VerificationPrerequisiteError';
+    }
+}
+exports.VerificationPrerequisiteError = VerificationPrerequisiteError;
+function parseVerificationRuntimeManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    const object = value;
+    if (object.schemaVersion !== 1 || Object.keys(object).some(key => !['schemaVersion', 'runtimes'].includes(key))
+        || !object.runtimes || typeof object.runtimes !== 'object' || Array.isArray(object.runtimes)) {
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    }
+    const runtimes = object.runtimes;
+    if (Object.keys(runtimes).length > 8)
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    return Object.entries(runtimes).map(([runtime, version]) => {
+        if (!Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, runtime) || typeof version !== 'string' || !VERSION_PREFIX.test(version)) {
+            throw new VerificationPrerequisiteError('manifest-invalid');
+        }
+        return Object.freeze({ runtime: runtime, version });
+    });
+}
+function verificationRuntimeVersion(runtime, output) {
+    const patterns = {
+        java: /^(?:openjdk|java) (?:version )?["']?(\d+(?:\.\d+){0,3})/imu,
+        node: /^v(\d+\.\d+\.\d+)/mu,
+        pnpm: /^(\d+\.\d+\.\d+)/mu,
+        python: /^Python (\d+\.\d+\.\d+)/mu,
+        go: /^go version go(\d+\.\d+(?:\.\d+)?)/mu,
+        dotnet: /^(\d+\.\d+\.\d+)/mu,
+        ruby: /^ruby (\d+\.\d+\.\d+)/mu,
+        rust: /^rustc (\d+\.\d+\.\d+)/mu,
+    };
+    const version = patterns[runtime].exec(output)?.[1];
+    return runtime === 'java' && version?.startsWith('1.') ? version.slice(2) : version;
+}
+function verificationRuntimeMatches(required, observed) {
+    return observed === required || observed.startsWith(`${required}.`);
+}
+
+
 /***/ }),
 
 /***/ 43193:
@@ -56257,8 +56465,9 @@ function failure(taskId, message, code) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconcileClosedIssueMetadataUseCase = void 0;
 const result_1 = __nccwpck_require__(73817);
-const issue_completion_1 = __nccwpck_require__(31147);
 const application_error_1 = __nccwpck_require__(75999);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const reconcile_issue_completion_metadata_1 = __nccwpck_require__(70614);
 /** Selective completion repair from fresh native facts; no native state authority. */
 class ReconcileClosedIssueMetadataUseCase {
     constructor(issues) {
@@ -56266,50 +56475,22 @@ class ReconcileClosedIssueMetadataUseCase {
         this.taskId = 'ReconcileClosedIssueMetadataUseCase';
     }
     async invoke(context) {
-        let labelsChanged = 0;
-        let nativeClosed = false;
+        const progress = (0, reconcile_issue_completion_metadata_1.completionRepairProgress)();
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1)
                 throw stale();
             const target = this.issues.forIssue(context.issueNumber);
-            const initial = await target.read();
-            nativeClosed = initial.number === context.issueNumber && initial.state === 'closed';
-            const initialPlan = (0, issue_completion_1.planIssueCompletion)(initial, context.completionLabels);
-            if (!nativeClosed || initialPlan.kind !== 'closed')
-                throw stale();
-            const fence = async () => {
-                const current = await target.read();
-                nativeClosed = current.number === context.issueNumber && current.state === 'closed';
-                const plan = (0, issue_completion_1.planIssueCompletion)(current, context.completionLabels);
-                if (!nativeClosed || plan.kind !== 'closed' || current.reason !== initial.reason)
-                    throw stale();
-                return plan;
-            };
-            for (const label of initialPlan.remove) {
-                if ((await fence()).remove.includes(label)) {
-                    await target.removeLabel(label);
-                    labelsChanged++;
-                }
-            }
-            for (const label of initialPlan.add) {
-                if ((await fence()).add.includes(label)) {
-                    await target.addLabel(label);
-                    labelsChanged++;
-                }
-            }
-            const final = await fence();
-            if (final.remove.length || final.add.length)
-                throw stale();
-            return [new result_1.Result({ id: this.taskId, success: true, executed: labelsChanged > 0,
+            const repaired = await (0, reconcile_issue_completion_metadata_1.reconcileIssueCompletionMetadata)(target, context.issueNumber, context.completionLabels, progress);
+            return [new result_1.Result({ id: this.taskId, success: true, executed: progress.labelsChanged > 0,
                     steps: ['The closed issue completion metadata was verified; historical and unrelated labels were retained.'],
-                    payload: { issueCompletion: { nativeClosed, labelsChanged, reconciled: true, reason: initial.reason } } })];
+                    payload: { issueCompletion: { nativeClosed: progress.nativeClosed, labelsChanged: progress.labelsChanged, reconciled: true, ...repaired } } })];
         }
         catch (cause) {
-            return [new result_1.Result({ id: this.taskId, success: false, executed: labelsChanged > 0,
-                    steps: [nativeClosed ? 'The issue remains closed; completion metadata could not be fully verified. Inspect and retry the closed-issue workflow.'
+            return [new result_1.Result({ id: this.taskId, success: false, executed: progress.labelsChanged > 0,
+                    steps: [progress.nativeClosed ? 'The issue remains closed; completion metadata could not be fully verified. Inspect and retry the closed-issue workflow.'
                             : 'Current native issue closure could not be verified; completion repair stopped without changing native state.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Closed issue completion metadata remains unverified.')],
-                    payload: { issueCompletion: { nativeClosed, labelsChanged, reconciled: false } } })];
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase: progress.phase, state: progress.state, reason: progress.reason, changed: progress.labelsChanged, remaining: progress.remaining })],
+                    payload: { issueCompletion: { nativeClosed: progress.nativeClosed, labelsChanged: progress.labelsChanged, reconciled: false } } })];
         }
     }
 }
@@ -56342,6 +56523,84 @@ class ReconcileClosedIssueUseCase {
 exports.ReconcileClosedIssueUseCase = ReconcileClosedIssueUseCase;
 
 
+/***/ }),
+
+/***/ 70614:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.completionRepairProgress = void 0;
+exports.reconcileIssueCompletionMetadata = reconcileIssueCompletionMetadata;
+const application_error_1 = __nccwpck_require__(75999);
+const issue_completion_1 = __nccwpck_require__(31147);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
+const completionRepairProgress = () => ({ nativeClosed: false, labelsChanged: 0,
+    phase: 'identity', state: 'unavailable', reason: 'unavailable', remaining: 0 });
+exports.completionRepairProgress = completionRepairProgress;
+/** At most two bounded selective passes, with fresh native fences before every write. */
+async function reconcileIssueCompletionMetadata(target, number, configuration, progress, initial) {
+    let expectedReason;
+    let superseded = false;
+    const read = async (phase, snapshot) => {
+        progress.phase = phase;
+        progress.state = 'unavailable';
+        progress.reason = 'unavailable';
+        const facts = snapshot ?? await target.read();
+        progress.nativeClosed = facts?.number === number && facts.state === 'closed';
+        progress.state = facts?.number === number && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+        progress.reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(reason => reason === facts?.reason) ? facts.reason : 'unavailable';
+        const plan = (0, issue_completion_1.planIssueCompletion)(facts, configuration);
+        if (!progress.nativeClosed || plan.kind !== 'closed' || expectedReason !== undefined && facts.reason !== expectedReason) {
+            throw new application_error_1.ApplicationError('workflow.stale', 'The native issue identity, state or closure reason changed.');
+        }
+        expectedReason = facts.reason;
+        progress.remaining = plan.remove.length + plan.add.length;
+        return plan;
+    };
+    let plan = await read('read', initial);
+    for (let pass = 0; pass < 2; pass++) {
+        for (const label of plan.remove) {
+            if (!(await read('label-remove')).remove.includes(label)) {
+                superseded = true;
+                continue;
+            }
+            try {
+                await target.removeLabel(label);
+                progress.labelsChanged++;
+            }
+            catch (cause) {
+                if ((await read('label-remove')).remove.includes(label))
+                    throw cause;
+                superseded = true;
+            }
+        }
+        for (const label of plan.add) {
+            if (!(await read('label-add')).add.includes(label)) {
+                superseded = true;
+                continue;
+            }
+            try {
+                await target.addLabel(label);
+                progress.labelsChanged++;
+            }
+            catch (cause) {
+                if ((await read('label-add')).add.includes(label))
+                    throw cause;
+                superseded = true;
+            }
+        }
+        plan = await read('metadata-verification');
+        if (!progress.remaining)
+            return { reason: plan.reason,
+                outcome: progress.labelsChanged ? 'reconciled' : 'already-converged', superseded };
+        superseded = true;
+    }
+    throw new application_error_1.ApplicationError('provider.conflict', 'Completion metadata remains incomplete after two bounded passes.');
+}
+
+
 /***/ }),
 
 /***/ 74111:
@@ -56351,7 +56610,9 @@ exports.ReconcileClosedIssueUseCase = ReconcileClosedIssueUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.RetireBranchSyncUseCase = void 0;
-const reply_request_digest_1 = __nccwpck_require__(47971);
+const verify_closed_issue_card_retirement_1 = __nccwpck_require__(78813);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
 const result_1 = __nccwpck_require__(73817);
 const github_user_policy_1 = __nccwpck_require__(84403);
 const publication_identity_policy_1 = __nccwpck_require__(45403);
@@ -56369,17 +56630,33 @@ class RetireBranchSyncUseCase {
     async invoke(context) {
         let retired = 0;
         let nativeClosed = false;
+        let phase = 'identity';
+        let state = 'unavailable';
+        let reason = 'unavailable';
+        let remaining = 0;
+        let superseded = false;
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1 || !context.trustedBotLogin) {
                 return [this.result(retired, nativeClosed)];
             }
-            const initial = await this.issues.readIssue(context.issueNumber);
-            if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state))
+            const read = async () => {
+                state = 'unavailable';
+                reason = 'unavailable';
+                const facts = await this.issues.readIssue(context.issueNumber);
+                nativeClosed = facts?.number === context.issueNumber && facts.state === 'closed';
+                state = facts?.number === context.issueNumber && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+                reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === facts?.reason) ? facts.reason : 'unavailable';
+                return facts;
+            };
+            phase = 'read';
+            const initial = await read();
+            if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state) || initial.state === 'closed' && !['completed', 'not_planned', 'duplicate', 'unknown'].includes(initial.reason))
                 throw stale();
             if (initial.state !== 'closed')
                 return [this.result(retired, nativeClosed)];
             nativeClosed = true;
             const messages = (0, branch_sync_message_catalog_1.resolveStaticBranchSyncCatalog)(context.locale);
+            phase = 'card-inventory';
             const cards = (await this.comments.listIssueComments(context.issueNumber)).filter(comment => {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(comment.body);
                 return marker?.identity.topic === 'branch-sync' && marker.identity.target.kind === 'issue'
@@ -56388,38 +56665,40 @@ class RetireBranchSyncUseCase {
                     && Number.isSafeInteger(comment.id) && comment.id > 0
                     && Boolean(comment.user?.login && (0, github_user_policy_1.githubUsersMatch)(context.trustedBotLogin, comment.user.login));
             });
+            remaining = Math.min(cards.length, 3000);
             if (cards.length > 20)
                 throw stale();
+            const verifyClosed = async () => {
+                phase = 'native-fence';
+                const fresh = await read();
+                if (!nativeClosed || fresh.reason !== initial.reason)
+                    throw stale();
+            };
             for (const card of cards) {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(card.body);
                 const body = (0, branch_sync_notification_policy_1.buildRetiredBranchSyncComment)(marker.identity, messages);
-                if (card.body === body)
-                    continue;
-                const witness = Object.freeze({ surface: 'issue-comment', commentId: card.id,
-                    author: context.trustedBotLogin, target: Object.freeze({ kind: 'issue', number: context.issueNumber }),
-                    bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(card.body ?? '') });
-                if (!await this.cardFreshness.matches(witness))
-                    throw stale();
-                const fresh = await this.issues.readIssue(context.issueNumber);
-                nativeClosed = fresh.number === context.issueNumber && fresh.state === 'closed';
-                if (!nativeClosed || fresh.reason !== initial.reason)
-                    throw stale();
-                await this.comments.updateComment(context.issueNumber, card.id, body);
-                retired++;
+                const verified = await (0, verify_closed_issue_card_retirement_1.verifyClosedIssueCardRetirement)({ issueNumber: context.issueNumber,
+                    commentId: card.id, author: context.trustedBotLogin, originalBody: card.body ?? '', finalBody: body,
+                    freshness: this.cardFreshness, verifyClosed, onUpdated: () => { retired++; }, phase: value => { phase = value; },
+                    update: () => this.comments.updateComment(context.issueNumber, card.id, body) });
+                superseded || (superseded = verified.superseded);
+                remaining--;
             }
-            return [this.result(retired, nativeClosed)];
+            await verifyClosed();
+            return [this.result(retired, nativeClosed, superseded)];
         }
         catch (cause) {
             return [new result_1.Result({ id: this.taskId, success: false, executed: retired > 0,
                     steps: [nativeClosed ? 'Issue closure is retained; synchronization recommendation retirement could not be fully verified. Retry the closed-issue event or merged-PR operation.' : 'Native issue closure could not be verified; synchronization recommendations were left unchanged.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Unable to retire synchronization recommendations safely.')],
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase, state, reason, changed: retired, remaining })],
                     payload: { nativeClosed, retiredCards: retired, reconciled: false } })];
         }
     }
-    result(retired, nativeClosed) {
+    result(retired, nativeClosed, superseded = false) {
         return new result_1.Result({ id: this.taskId, success: true, executed: retired > 0,
             steps: [retired ? 'The closed issue’s synchronization recommendations were retired.' : 'No synchronization recommendation required retirement.'],
-            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true } });
+            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true, superseded,
+                outcome: nativeClosed ? retired ? 'reconciled' : 'already-converged' : 'not-applicable' } });
     }
 }
 exports.RetireBranchSyncUseCase = RetireBranchSyncUseCase;
@@ -56460,7 +56739,9 @@ exports.RetireClosedIssueCardsUseCase = RetireClosedIssueCardsUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.RetireProgressUseCase = void 0;
-const reply_request_digest_1 = __nccwpck_require__(47971);
+const verify_closed_issue_card_retirement_1 = __nccwpck_require__(78813);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
 const result_1 = __nccwpck_require__(73817);
 const github_user_policy_1 = __nccwpck_require__(84403);
 const publication_identity_policy_1 = __nccwpck_require__(45403);
@@ -56477,16 +56758,32 @@ class RetireProgressUseCase {
     async invoke(context) {
         let retired = 0;
         let nativeClosed = false;
+        let phase = 'identity';
+        let state = 'unavailable';
+        let reason = 'unavailable';
+        let remaining = 0;
+        let superseded = false;
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1 || !context.trustedBotLogin) {
                 return [this.result(retired, nativeClosed)];
             }
-            const initial = await this.issues.readIssue(context.issueNumber);
+            const read = async () => {
+                state = 'unavailable';
+                reason = 'unavailable';
+                const facts = await this.issues.readIssue(context.issueNumber);
+                nativeClosed = facts?.number === context.issueNumber && facts.state === 'closed';
+                state = facts?.number === context.issueNumber && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+                reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === facts?.reason) ? facts.reason : 'unavailable';
+                return facts;
+            };
+            phase = 'read';
+            const initial = await read();
             if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state) || initial.state === 'closed' && !['completed', 'not_planned', 'duplicate', 'unknown'].includes(initial.reason))
                 throw stale();
             if (initial.state !== 'closed')
                 return [this.result(retired, nativeClosed)];
             nativeClosed = true;
+            phase = 'card-inventory';
             const cards = (await this.comments.listIssueComments(context.issueNumber)).filter(comment => {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(comment.body);
                 return marker?.identity.topic === 'progress' && marker.identity.target.kind === 'issue'
@@ -56495,37 +56792,39 @@ class RetireProgressUseCase {
                     && Number.isSafeInteger(comment.id) && comment.id > 0
                     && Boolean(comment.user?.login && (0, github_user_policy_1.githubUsersMatch)(context.trustedBotLogin, comment.user.login));
             });
+            remaining = Math.min(cards.length, 3000);
             if (cards.length > 20)
                 throw stale();
-            for (const card of cards) {
-                const body = (0, retired_progress_presentation_policy_1.buildRetiredProgressComment)(card.body ?? '', context.locale, initial.reason);
-                if (card.body === body)
-                    continue;
-                const witness = Object.freeze({ surface: 'issue-comment', commentId: card.id,
-                    author: context.trustedBotLogin, target: Object.freeze({ kind: 'issue', number: context.issueNumber }),
-                    bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(card.body ?? '') });
-                if (!await this.cardFreshness.matches(witness))
-                    throw stale();
-                const fresh = await this.issues.readIssue(context.issueNumber);
-                nativeClosed = fresh.number === context.issueNumber && fresh.state === 'closed';
+            const verifyClosed = async () => {
+                phase = 'native-fence';
+                const fresh = await read();
                 if (!nativeClosed || fresh.reason !== initial.reason)
                     throw stale();
-                await this.comments.updateComment(context.issueNumber, card.id, body);
-                retired++;
+            };
+            for (const card of cards) {
+                const body = (0, retired_progress_presentation_policy_1.buildRetiredProgressComment)(card.body ?? '', context.locale, initial.reason);
+                const verified = await (0, verify_closed_issue_card_retirement_1.verifyClosedIssueCardRetirement)({ issueNumber: context.issueNumber,
+                    commentId: card.id, author: context.trustedBotLogin, originalBody: card.body ?? '', finalBody: body,
+                    freshness: this.cardFreshness, verifyClosed, onUpdated: () => { retired++; }, phase: value => { phase = value; },
+                    update: () => this.comments.updateComment(context.issueNumber, card.id, body) });
+                superseded || (superseded = verified.superseded);
+                remaining--;
             }
-            return [this.result(retired, nativeClosed)];
+            await verifyClosed();
+            return [this.result(retired, nativeClosed, superseded)];
         }
         catch (cause) {
             return [new result_1.Result({ id: this.taskId, success: false, executed: retired > 0,
                     steps: [nativeClosed ? 'Issue closure is retained; progress card retirement could not be fully verified. Retry the closed-issue event or merged-PR operation.' : 'Native issue closure could not be verified; progress cards were left unchanged.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Unable to retire progress cards safely.')],
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase, state, reason, changed: retired, remaining })],
                     payload: { nativeClosed, retiredCards: retired, reconciled: false } })];
         }
     }
-    result(retired, nativeClosed) {
+    result(retired, nativeClosed, superseded = false) {
         return new result_1.Result({ id: this.taskId, success: true, executed: retired > 0,
             steps: [retired ? 'The closed issue’s progress cards were retired.' : 'No progress card required retirement.'],
-            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true } });
+            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true, superseded,
+                outcome: nativeClosed ? retired ? 'reconciled' : 'already-converged' : 'not-applicable' } });
     }
 }
 exports.RetireProgressUseCase = RetireProgressUseCase;
@@ -56916,6 +57215,48 @@ function sameLabels(left, right) {
 }
 
 
+/***/ }),
+
+/***/ 78813:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.verifyClosedIssueCardRetirement = verifyClosedIssueCardRetirement;
+const reply_request_digest_1 = __nccwpck_require__(47971);
+const application_error_1 = __nccwpck_require__(75999);
+/** Adopt another invocation only after the exact final owned body and native closure are fresh. */
+async function verifyClosedIssueCardRetirement(input) {
+    const witness = (body) => Object.freeze({ surface: 'issue-comment',
+        commentId: input.commentId, author: input.author,
+        target: Object.freeze({ kind: 'issue', number: input.issueNumber }), bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(body) });
+    let updated = false;
+    let failedWrite;
+    if (input.originalBody !== input.finalBody) {
+        input.phase('card-freshness');
+        if (await input.freshness.matches(witness(input.originalBody))) {
+            await input.verifyClosed();
+            input.phase('card-update');
+            try {
+                await input.update();
+                updated = true;
+                input.onUpdated();
+            }
+            catch (cause) {
+                failedWrite = cause;
+            }
+        }
+    }
+    input.phase('card-verification');
+    if (!await input.freshness.matches(witness(input.finalBody))) {
+        throw failedWrite ?? new application_error_1.ApplicationError('workflow.stale', 'The required final owned card could not be verified.');
+    }
+    await input.verifyClosed();
+    return { updated, superseded: !updated && input.originalBody !== input.finalBody };
+}
+
+
 /***/ }),
 
 /***/ 4643:
@@ -57143,7 +57484,7 @@ class SyncBranchUseCase {
         const commands = (0, verify_command_policy_1.limitVerifyCommands)([...context.verifyCommands]);
         if (commands.length === verify_command_policy_1.MAX_VERIFY_COMMANDS)
             (0, logging_ports_1.logInfo)(`Branch sync verification is capped at ${verify_command_policy_1.MAX_VERIFY_COMMANDS} commands.`);
-        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true }));
+        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
         if (!verification.success) {
             return {
                 commandCount: commands.length,
@@ -65658,7 +65999,7 @@ async function runVerification(context, gitCommitPort) {
     if (verifyCommands.length === 0)
         return undefined;
     (0, logging_ports_1.logInfo)(`Running ${verifyCommands.length} verify ${verifyCommands.length === 1 ? 'command' : 'commands'}...`);
-    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true }));
+    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
     return verify.success
         ? undefined
         : verify.error ?? `Verify command failed: ${verify.failedCommand ?? "unknown"}.`;
@@ -67881,6 +68222,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runVerifyCommands = runVerifyCommands;
 const logging_ports_1 = __nccwpck_require__(6152);
 const verify_command_policy_1 = __nccwpck_require__(96031);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
 async function runVerifyCommands(commands, execute) {
     for (const command of commands) {
         const result = await executeVerifyCommand(command, execute);
@@ -67899,7 +68241,11 @@ async function executeVerifyCommand(command, execute) {
             ? { success: true }
             : { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
-    catch {
+    catch (error) {
+        if (error instanceof verification_runtime_policy_1.VerificationPrerequisiteError) {
+            return { success: false, failedCommand: formatCommandForDiagnostics(parsed),
+                error: `${error.message} Verification command: ${formatCommandForDiagnostics(parsed)}.` };
+        }
         (0, logging_ports_1.logError)('Verify command failed.');
         return { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
@@ -70081,6 +70427,7 @@ exports.titleUpdateFailure = titleUpdateFailure;
 const result_1 = __nccwpck_require__(73817);
 const application_error_1 = __nccwpck_require__(75999);
 const positive_integer_policy_1 = __nccwpck_require__(19879);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 function projectUpdateTitleContext(source) {
     if (source.isIssue) {
         return Object.freeze({
@@ -70131,19 +70478,27 @@ async function runPullRequestTitleUpdate(param, taskId, issueRepository) {
     if (!linkedIssueNumber || linkedIssueNumber === param.pullRequestNumber) {
         return [skippedResult(taskId)];
     }
+    const currentTitle = await issueRepository.getTitle(param.pullRequestNumber);
+    if (currentTitle === undefined) {
+        return [new result_1.Result({ id: taskId, success: false, executed: true,
+                steps: ['The current pull request title could not be read. No title change was attempted.'],
+                errors: [new application_error_1.ApplicationError('provider.unavailable', 'Unable to read the current pull request title.')] })];
+    }
+    if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(currentTitle))
+        return [skippedResult(taskId)];
     const issueTitle = await issueRepository.getTitle(linkedIssueNumber);
     if (issueTitle === undefined) {
         return [new result_1.Result({ id: taskId, success: false, executed: true, steps: ['Tried to update title, but there was a problem.'] })];
     }
     const title = await issueRepository.updatePullRequestTitle({
-        pullRequestTitle: param.pullRequestTitle,
+        pullRequestTitle: currentTitle,
         issueTitle,
         issueNumber: linkedIssueNumber,
         pullRequestNumber: param.pullRequestNumber,
         labelFacts: param.labelFacts,
     });
     return title
-        ? [updatedResult(taskId, `The pull request's title was updated from \`${param.pullRequestTitle}\` to \`${title}\`.`)]
+        ? [updatedResult(taskId, `The pull request's title was updated from \`${currentTitle}\` to \`${title}\`.`)]
         : [skippedResult(taskId)];
 }
 function titleUpdateFailure(taskId, error) {
@@ -70586,6 +70941,8 @@ exports.CheckPriorityIssueSizeUseCase = CheckPriorityIssueSizeUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CloseIssueAfterMergingUseCase = void 0;
+const reconcile_issue_completion_metadata_1 = __nccwpck_require__(70614);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
 const result_1 = __nccwpck_require__(73817);
 const issue_completion_1 = __nccwpck_require__(31147);
 const application_error_1 = __nccwpck_require__(75999);
@@ -70604,7 +70961,7 @@ class CloseIssueAfterMergingUseCase {
                     steps: ['No separate safe linked issue and pull request were found; issue closure was skipped.'] })];
         let closedThisRun = false;
         let nativeClosed = false;
-        let labelsChanged = 0;
+        const progress = (0, reconcile_issue_completion_metadata_1.completionRepairProgress)();
         try {
             const pull = await this.issues.readPullRequest(pullNumber);
             if (pull.number !== pullNumber || pull.state !== 'closed' || pull.merged !== true)
@@ -70628,44 +70985,21 @@ class CloseIssueAfterMergingUseCase {
             nativeClosed = facts.state === 'closed';
             if (!nativeClosed || closedThisRun && facts.reason !== 'completed')
                 throw stale();
-            const fence = async () => {
-                const freshFacts = await read();
-                const freshPlan = (0, issue_completion_1.planIssueCompletion)(freshFacts, param.completionLabels);
-                if (freshPlan.kind !== 'closed' || freshFacts.reason !== facts.reason)
-                    throw stale();
-                return freshPlan;
-            };
-            const plan = (0, issue_completion_1.planIssueCompletion)(facts, param.completionLabels);
-            if (plan.kind !== 'closed')
-                throw stale();
-            for (const label of plan.remove) {
-                const fresh = await fence();
-                if (fresh.remove.includes(label)) {
-                    await target.removeLabel(label);
-                    labelsChanged++;
-                }
-            }
-            for (const label of plan.add) {
-                const fresh = await fence();
-                if (fresh.add.includes(label)) {
-                    await target.addLabel(label);
-                    labelsChanged++;
-                }
-            }
-            const final = await fence();
-            if (final.remove.length || final.add.length)
-                throw stale();
-            return [new result_1.Result({ id: this.taskId, success: true, executed: closedThisRun || labelsChanged > 0,
+            const repaired = await (0, reconcile_issue_completion_metadata_1.reconcileIssueCompletionMetadata)(target, number, param.completionLabels, progress, facts);
+            nativeClosed = progress.nativeClosed;
+            return [new result_1.Result({ id: this.taskId, success: true, executed: closedThisRun || progress.labelsChanged > 0,
                     steps: [`Issue #${number} is closed and its completion metadata was verified after PR #${pullNumber} merged.`],
-                    payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged, reason: facts.reason, reconciled: true }) } })];
+                    payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged: progress.labelsChanged, ...repaired, reconciled: true }) } })];
         }
         catch (error) {
-            const semanticError = (0, application_error_1.toApplicationError)(error, 'provider.unavailable', nativeClosed
-                ? 'The issue is closed, but completion metadata could not be fully verified. Retry the verified merged-PR operation.'
-                : 'Native issue completion could not be verified. Inspect the linked run before retrying.');
-            return [new result_1.Result({ id: this.taskId, success: false, executed: closedThisRun || labelsChanged > 0,
+            if (progress.phase !== 'identity')
+                nativeClosed = progress.nativeClosed;
+            const semanticError = (0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(error, { resultId: this.taskId,
+                phase: progress.phase, state: progress.state, reason: progress.reason,
+                changed: progress.labelsChanged, remaining: progress.remaining });
+            return [new result_1.Result({ id: this.taskId, success: false, executed: closedThisRun || progress.labelsChanged > 0,
                     steps: [nativeClosed ? 'The native issue closure was retained; completion metadata remains unverified.' : 'Native issue completion remains unverified.'],
-                    errors: [semanticError], payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged, reconciled: false }) } })];
+                    errors: [semanticError], payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged: progress.labelsChanged, reconciled: false }) } })];
         }
     }
 }
@@ -73494,6 +73828,7 @@ exports.registerSetupCommand = registerSetupCommand;
 const product_identity_1 = __nccwpck_require__(18739);
 const setup_command_options_1 = __nccwpck_require__(99254);
 const setup_execution_1 = __nccwpck_require__(51293);
+const setup_documentation_1 = __nccwpck_require__(2396);
 function registerSetupCommand(program) {
     program
         .command('setup')
@@ -73527,6 +73862,7 @@ function registerSetupCommand(program) {
         .option('--update-workflows', 'Allow setup-managed workflows already in the repository to be updated', false)
         .option('--workflow-pat <token>', 'Workflow PAT for the bot account (prefer the hidden interactive prompt)')
         .option('--secret <name=value>', 'Secret value for non-interactive setup; repeat for each API key', setup_command_options_1.collectSecret, {})
+        .addHelpText('after', `\nGuides (open only when you choose):\n  Web setup tutorial: ${setup_documentation_1.SETUP_DOCUMENTATION.tutorial}\n  First issue-to-PR workflow: ${setup_documentation_1.SETUP_DOCUMENTATION.firstWorkflow}\n  Troubleshooting: ${setup_documentation_1.SETUP_DOCUMENTATION.recovery}\n\nDuring interactive setup, type ? for question help and :back to revisit an answer.\n`)
         .action(setup_execution_1.executeSetupCommand);
 }
 
@@ -75440,9 +75776,19 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ConsoleSetupJourneyPresenter = void 0;
 exports.renderSetupJourney = renderSetupJourney;
 const setup_prompt_rendering_1 = __nccwpck_require__(76673);
+const setup_documentation_1 = __nccwpck_require__(2396);
 class ConsoleSetupJourneyPresenter {
     present(view) {
         console.log(renderSetupJourney(view));
+        if (view.outcome === 'complete') {
+            console.log(`Next: install the reviewed files, then verify your first workflow: ${setup_documentation_1.SETUP_DOCUMENTATION.firstWorkflow}`);
+        }
+        else if (view.outcome === 'blocked' || view.outcome === 'partial') {
+            console.log(`Inspect the result before retrying. Troubleshooting: ${setup_documentation_1.SETUP_DOCUMENTATION.recovery}`);
+        }
+        else if (view.current === 'Repository' || view.outcome === 'dry-run') {
+            console.log(`Setup tutorial (opens only when you choose): ${setup_documentation_1.SETUP_DOCUMENTATION.tutorial}`);
+        }
     }
 }
 exports.ConsoleSetupJourneyPresenter = ConsoleSetupJourneyPresenter;
@@ -78008,6 +78354,8 @@ var _ApplicationError_cause;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ApplicationError = exports.APPLICATION_ERROR_METADATA = exports.APPLICATION_ERROR_RECOVERY_IDS = void 0;
 exports.isApplicationErrorCorrelationId = isApplicationErrorCorrelationId;
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
 const branch_sync_validation_1 = __nccwpck_require__(90981);
 exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'pull-request-link-restored',
@@ -78023,6 +78371,8 @@ exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'sdd-draft-size-exceeded',
     'sdd-draft-format-invalid',
     'workspace-changes-rejected',
+    'closed-issue-reconciliation-failed',
+    'approval-evidence-read-failed',
 ]);
 const PRESERVED_STATE = 'Existing persisted state and completed external effects were preserved.';
 const UNCHANGED_STATE = 'No new state or external effect was created.';
@@ -78214,6 +78564,8 @@ class ApplicationError extends Error {
 exports.ApplicationError = ApplicationError;
 _ApplicationError_cause = new WeakMap();
 const RECOVERY_VARIABLE_KEYS = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze(['resultId', 'phase', 'state', 'reason', 'changed', 'remaining']),
+    'approval-evidence-read-failed': Object.freeze(['operation', 'reason', 'permission']),
     'pull-request-link-restored': Object.freeze([]),
     'pull-request-link-base-retained': Object.freeze([]),
     'pull-request-link-reference-retained': Object.freeze([]),
@@ -78266,6 +78618,20 @@ function normalizeApplicationErrorRecovery(recovery) {
         && !branch_sync_validation_1.BRANCH_SYNC_VALIDATION_CODES.some(code => code === variables.validationCode)) {
         throw new TypeError('Application error recovery synchronization validation code is invalid.');
     }
+    if (recovery.id === 'closed-issue-reconciliation-failed'
+        && (!closed_issue_reconciliation_1.CLOSED_ISSUE_RESULTS.some(value => value === variables.resultId)
+            || !closed_issue_reconciliation_1.CLOSED_ISSUE_PHASES.some(value => value === variables.phase)
+            || !['open', 'closed', 'unavailable'].includes(variables.state)
+            || !closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === variables.reason)
+            || ![variables.changed, variables.remaining].every(value => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= 3000))) {
+        throw new TypeError('Closed issue reconciliation diagnostic is invalid.');
+    }
+    if (recovery.id === 'approval-evidence-read-failed'
+        && (!Object.prototype.hasOwnProperty.call(approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS, variables.operation)
+            || !approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_REASONS.some(reason => reason === variables.reason)
+            || approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS[variables.operation] !== variables.permission)) {
+        throw new TypeError('Approval evidence diagnostic is invalid.');
+    }
     return Object.freeze({
         id: recovery.id,
         variables: Object.freeze({ ...variables }),
@@ -84736,6 +85102,7 @@ exports.IssueProgressTrackingRepository = IssueProgressTrackingRepository;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.IssueTitleRepository = void 0;
 const issue_emoji_policy_1 = __nccwpck_require__(81201);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 const issue_title_policy_1 = __nccwpck_require__(83179);
 const issue_title_update_1 = __nccwpck_require__(9229);
 class IssueTitleRepository {
@@ -84753,10 +85120,12 @@ class IssueTitleRepository {
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, issueTitle, formattedTitle, issueNumber, token);
             });
         };
-        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, branchManagementEmoji, labels, token) => {
+        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, _branchManagementEmoji, labels, token) => {
             return (0, issue_title_update_1.withTitleUpdateLogging)(() => {
-                const emoji = (0, issue_emoji_policy_1.resolvePullRequestTitleEmoji)(labels, branchManagementEmoji);
-                const formattedTitle = `[#${issueNumber}] ${emoji} - ${(0, issue_title_policy_1.sanitizePullRequestTitle)((0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber))}`;
+                if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(pullRequestTitle))
+                    return Promise.resolve(undefined);
+                const sourceTitle = (0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber);
+                const formattedTitle = (0, pull_request_title_policy_1.generatedPullRequestTitle)(sourceTitle, (0, issue_title_policy_1.sanitizePullRequestTitle)(sourceTitle), issueNumber, labels);
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, pullRequestTitle, formattedTitle, pullRequestNumber, token);
             });
         };
@@ -86051,6 +86420,41 @@ function parseApprovalCoverageZip(value) {
 }
 
 
+/***/ }),
+
+/***/ 9958:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readApprovalEvidence = readApprovalEvidence;
+const application_error_1 = __nccwpck_require__(75999);
+const approval_evidence_error_1 = __nccwpck_require__(50519);
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
+/** Terminates provider exceptions; even unknown statuses never interpolate provider text. */
+async function readApprovalEvidence(operation, read) {
+    try {
+        return await read();
+    }
+    catch (cause) {
+        if (cause instanceof application_error_1.ApplicationError && cause.recovery?.id === 'approval-evidence-read-failed')
+            throw cause;
+        const error = cause && typeof cause === 'object' ? cause : undefined;
+        const response = error?.response;
+        const status = error?.status;
+        const rateLimited = status === 403 && (response?.headers?.['x-ratelimit-remaining'] === '0'
+            || typeof response?.headers?.['retry-after'] === 'string' && /^\d{1,8}$/u.test(response.headers['retry-after']));
+        const http = typeof status === 'number' ? `http-${status}` : undefined;
+        const reason = rateLimited ? 'http-429'
+            : approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_REASONS.some(value => value === http) ? http
+                : cause instanceof application_error_1.ApplicationError && cause.code === 'provider.contract-invalid' ? 'invalid-response'
+                    : status === undefined ? 'transport-unavailable' : 'invalid-response';
+        throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, reason);
+    }
+}
+
+
 /***/ }),
 
 /***/ 55165:
@@ -86085,21 +86489,22 @@ exports.BugbotPullRequestRepository = BugbotPullRequestRepository;
 /***/ }),
 
 /***/ 68742:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.readCurrentBaseRevision = readCurrentBaseRevision;
+const application_error_1 = __nccwpck_require__(75999);
 /** PR base metadata can lag a parent push; read the exact native branch ref. */
 async function readCurrentBaseRevision(port, target, baseRef) {
     if (typeof baseRef !== 'string' || baseRef.length === 0 || baseRef.length > 1024
         || baseRef.includes('\u0000') || /[\r\n]/u.test(baseRef))
-        throw new Error('The PR base ref is invalid.');
+        throw new application_error_1.ApplicationError('provider.contract-invalid', 'The PR base ref is invalid.');
     const { data } = await port.getRef({ owner: target.owner, repo: target.repository, ref: `heads/${baseRef}` });
     if (data?.ref !== `refs/heads/${baseRef}` || data.object?.type !== 'commit' || typeof data.object.sha !== 'string'
         || !/^[a-f0-9]{40}$/u.test(data.object.sha))
-        throw new Error('The PR base ref cannot be verified.');
+        throw new application_error_1.ApplicationError('provider.contract-invalid', 'The PR base ref cannot be verified.');
     return data.object.sha;
 }
 
@@ -86147,6 +86552,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PullRequestApprovalRepository = void 0;
 exports.readEffectiveApprovalPolicy = readEffectiveApprovalPolicy;
+const approval_evidence_read_1 = __nccwpck_require__(9958);
+const approval_evidence_error_1 = __nccwpck_require__(50519);
+const application_error_1 = __nccwpck_require__(75999);
 const current_base_revision_query_1 = __nccwpck_require__(68742);
 const logging_ports_1 = __nccwpck_require__(6152);
 const github = __importStar(__nccwpck_require__(78227));
@@ -86173,40 +86581,64 @@ class PullRequestApprovalRepository {
         }
     }
     async readPolicy(target) {
-        return (await this.readEffectivePolicy(target))?.value;
+        return (0, approval_evidence_read_1.readApprovalEvidence)('policy', async () => (await this.readEffectivePolicy(target))?.value);
     }
     async readEffectivePolicy(target) {
         return readEffectiveApprovalPolicy(this.octokit, target);
     }
     async loadEvidence(target) {
-        const { data: pull } = await this.octokit.rest.pulls.get({
-            owner: target.owner, repo: target.repository, pull_number: target.pullNumber,
+        const diagnostics = [];
+        const { data: pull } = await (0, approval_evidence_read_1.readApprovalEvidence)('pull-request', async () => {
+            const response = await this.octokit.rest.pulls.get({ owner: target.owner, repo: target.repository, pull_number: target.pullNumber });
+            if (!response.data?.head || !response.data?.base || typeof response.data.head.sha !== 'string'
+                || typeof response.data.head.ref !== 'string' || !Number.isSafeInteger(response.data.number)) {
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('pull-request', 'invalid-response');
+            }
+            return response;
         });
         const headSha = pull.head.sha;
         const baseSha = await this.readCurrentBaseSha(target, pull.base.ref);
-        const policy = (0, pull_request_approval_policy_1.parsePullRequestApprovalPolicy)(await this.readPolicy(target));
+        const policy = await (0, approval_evidence_read_1.readApprovalEvidence)('policy', async () => {
+            const raw = await this.readPolicy(target);
+            try {
+                return (0, pull_request_approval_policy_1.parsePullRequestApprovalPolicy)(raw);
+            }
+            catch {
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('policy', 'invalid-response');
+            }
+        });
         let testedMergeSha;
         if (pull.mergeable === true && /^[a-f0-9]{40}$/iu.test(pull.merge_commit_sha ?? '')) {
             try {
-                const merge = await this.octokit.rest.git.getCommit({
-                    owner: target.owner, repo: target.repository, commit_sha: pull.merge_commit_sha,
+                const merge = await (0, approval_evidence_read_1.readApprovalEvidence)('merge-commit', async () => {
+                    const response = await this.octokit.rest.git.getCommit({ owner: target.owner, repo: target.repository, commit_sha: pull.merge_commit_sha });
+                    if (!Array.isArray(response.data?.parents))
+                        throw (0, approval_evidence_error_1.approvalEvidenceError)('merge-commit', 'invalid-response');
+                    return response;
                 });
                 if (merge.data.parents[0]?.sha === baseSha && merge.data.parents[1]?.sha === headSha
                     && merge.data.parents.length === 2)
                     testedMergeSha = pull.merge_commit_sha;
             }
-            catch { /* Missing or unreadable merge parentage is non-authorizing. */ }
+            catch (cause) {
+                collectDiagnostic(diagnostics, cause);
+            }
         }
         const [files, reviews, comments, headChecks, mergeChecks, headRuns, mergeRuns, rules, user] = await Promise.all([
-            this.allPages(this.octokit.rest.pulls.listFiles, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.pulls.listReviews, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.issues.listComments, { owner: target.owner, repo: target.repository, issue_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: headSha, filter: 'all' }),
-            testedMergeSha ? this.allPages(this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: testedMergeSha, filter: 'all' }) : Promise.resolve([]),
-            this.allPages(this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: headSha }),
-            testedMergeSha ? this.allPages(this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: testedMergeSha }) : Promise.resolve([]),
-            this.effectiveRules(target.owner, target.repository, pull.base.ref),
-            this.octokit.rest.users.getAuthenticated(),
+            this.allPages('files', this.octokit.rest.pulls.listFiles, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
+            this.allPages('reviews', this.octokit.rest.pulls.listReviews, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
+            this.allPages('comments', this.octokit.rest.issues.listComments, { owner: target.owner, repo: target.repository, issue_number: target.pullNumber }),
+            this.allPages('head-checks', this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: headSha, filter: 'all' }),
+            testedMergeSha ? this.allPages('merge-checks', this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: testedMergeSha, filter: 'all' }) : Promise.resolve([]),
+            this.allPages('head-runs', this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: headSha }),
+            testedMergeSha ? this.allPages('merge-runs', this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: testedMergeSha }) : Promise.resolve([]),
+            this.effectiveRules(target.owner, target.repository, pull.base.ref, diagnostics),
+            (0, approval_evidence_read_1.readApprovalEvidence)('authenticated-user', async () => {
+                const response = await this.octokit.rest.users.getAuthenticated();
+                if (!Number.isSafeInteger(response.data?.id) || response.data.id < 1)
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)('authenticated-user', 'invalid-response');
+                return response;
+            }),
         ]);
         const branch = Object.entries(this.settings.branchPrefixes)
             .find(([, prefix]) => pull.head.ref.startsWith(`${prefix}/`));
@@ -86227,7 +86659,7 @@ class PullRequestApprovalRepository {
         });
         const currentJobs = await Promise.all(latestRuns.map(async (run) => ({
             run,
-            jobs: await this.allPages(this.octokit.rest.actions.listJobsForWorkflowRunAttempt, {
+            jobs: await this.allPages('jobs', this.octokit.rest.actions.listJobsForWorkflowRunAttempt, {
                 owner: target.owner, repo: target.repository, run_id: run.id, attempt_number: run.run_attempt,
             }),
         })));
@@ -86258,9 +86690,10 @@ class PullRequestApprovalRepository {
             submittedAt: review.submitted_at ?? '',
         }));
         const numericCoverage = policy.coverage.mode === 'numeric'
-            ? await this.numericCoverage(target, policy.coverage.artifactWorkflowName, headSha, baseSha, testedMergeSha, workflowRuns)
+            ? await this.numericCoverage(target, policy.coverage.artifactWorkflowName, headSha, baseSha, testedMergeSha, workflowRuns, diagnostics)
             : undefined;
         return {
+            ...(diagnostics.length ? { diagnostics: Object.freeze(diagnostics) } : {}),
             repositoryId: pull.base.repo?.id ?? 0,
             pullNumber: pull.number,
             headSha,
@@ -86294,7 +86727,7 @@ class PullRequestApprovalRepository {
             ...(numericCoverage ? { numericCoverage } : {}),
         };
     }
-    async numericCoverage(target, workflowName, headSha, baseSha, testedMergeSha, workflowRuns) {
+    async numericCoverage(target, workflowName, headSha, baseSha, testedMergeSha, workflowRuns, diagnostics) {
         const candidates = workflowRuns.filter(run => run.name === workflowName
             && (run.head_sha === headSha || run.head_sha === testedMergeSha));
         const mergeCandidates = candidates.filter(run => run.head_sha === testedMergeSha);
@@ -86303,25 +86736,27 @@ class PullRequestApprovalRepository {
         if (!run || run.conclusion !== 'success' || run.status !== 'completed')
             return undefined;
         try {
-            const artifacts = await this.allPages(this.octokit.rest.actions.listWorkflowRunArtifacts, {
+            const artifacts = await this.allPages('coverage-artifacts', this.octokit.rest.actions.listWorkflowRunArtifacts, {
                 owner: target.owner, repo: target.repository, run_id: run.id,
             });
             const matches = artifacts.filter(artifact => artifact.name === 'copilot-diff-coverage-v1' && !artifact.expired);
             if (matches.length !== 1 || matches[0].size_in_bytes > 64 * 1024)
-                return undefined;
-            const response = await this.octokit.rest.actions.downloadArtifact({
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-artifacts', 'artifact-unavailable');
+            const response = await (0, approval_evidence_read_1.readApprovalEvidence)('coverage-download', async () => this.octokit.rest.actions.downloadArtifact({
                 owner: target.owner, repo: target.repository, artifact_id: matches[0].id, archive_format: 'zip',
-            });
+            }));
             const data = response.data;
             const bytes = data instanceof ArrayBuffer ? new Uint8Array(data)
                 : data instanceof Uint8Array ? data
                     : typeof data === 'string' ? Buffer.from(data, 'binary') : undefined;
             const attestation = bytes ? (0, approval_coverage_artifact_1.parseApprovalCoverageZip)(bytes) : undefined;
-            if (!attestation || attestation.repositoryId !== target.repositoryId
+            if (!attestation)
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-parse', 'artifact-invalid');
+            if (attestation.repositoryId !== target.repositoryId
                 || attestation.pullNumber !== target.pullNumber || attestation.headSha !== headSha
                 || attestation.baseSha !== baseSha || attestation.workflowRunId !== run.id
                 || attestation.workflowRunAttempt !== run.run_attempt)
-                return undefined;
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-parse', 'artifact-mismatch');
             return {
                 coveredChangedLines: attestation.coveredChangedLines,
                 totalChangedLines: attestation.totalChangedLines,
@@ -86329,7 +86764,8 @@ class PullRequestApprovalRepository {
                 baseSha,
             };
         }
-        catch {
+        catch (cause) {
+            collectDiagnostic(diagnostics, cause);
             return undefined;
         }
     }
@@ -86355,7 +86791,7 @@ class PullRequestApprovalRepository {
             throw new Error('PR head or base changed before assessment publication.');
         }
         const user = await this.octokit.rest.users.getAuthenticated();
-        const comments = await this.allPages(this.octokit.rest.issues.listComments, {
+        const comments = await this.allPages('comments', this.octokit.rest.issues.listComments, {
             owner: target.owner, repo: target.repository, issue_number: target.pullNumber,
         });
         const card = [...comments].reverse().find(comment => comment.user?.id === user.data.id
@@ -86401,24 +86837,26 @@ class PullRequestApprovalRepository {
         }
     }
     async readCurrentBaseSha(target, baseRef) {
-        return (0, current_base_revision_query_1.readCurrentBaseRevision)(this.octokit.rest.git, target, baseRef);
+        return (0, approval_evidence_read_1.readApprovalEvidence)('base-ref', () => (0, current_base_revision_query_1.readCurrentBaseRevision)(this.octokit.rest.git, target, baseRef));
     }
-    async effectiveRules(owner, repo, branch) {
+    async effectiveRules(owner, repo, branch, diagnostics) {
         try {
-            const rulesResponse = await this.octokit.request('GET /repos/{owner}/{repo}/rules/branches/{branch}', { owner, repo, branch });
+            const rulesResponse = await (0, approval_evidence_read_1.readApprovalEvidence)('rules', async () => this.octokit.request('GET /repos/{owner}/{repo}/rules/branches/{branch}', { owner, repo, branch }));
             if (!Array.isArray(rulesResponse.data) || rulesResponse.data.some((rule) => !record(rule)
                 || typeof record(rule)?.type !== 'string' || record(rule)?.type === '')) {
-                throw new Error('GitHub returned an invalid effective rules inventory.');
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('rules', 'invalid-response');
             }
             const rules = rulesResponse.data;
             let classic;
             try {
                 const response = await this.octokit.rest.repos.getBranchProtection({ owner, repo, branch });
+                if (!record(response.data))
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)('classic-protection', 'invalid-response');
                 classic = response.data;
             }
             catch (error) {
                 if (statusOf(error) !== 404)
-                    throw error;
+                    await (0, approval_evidence_read_1.readApprovalEvidence)('classic-protection', async () => { throw error; });
             }
             const reviewRules = rules.filter(rule => rule.type === 'pull_request');
             const classicReview = classic?.required_pull_request_reviews;
@@ -86444,23 +86882,26 @@ class PullRequestApprovalRepository {
             }
             return { readable: true, dismissesStaleReviews: hasStaleRule && allStale, requiredChecks: [...requiredChecks] };
         }
-        catch {
+        catch (cause) {
+            collectDiagnostic(diagnostics, cause);
             return { readable: false, dismissesStaleReviews: false, requiredChecks: [] };
         }
     }
-    async allPages(method, params) {
-        const result = [];
-        for await (const response of this.octokit.paginate.iterator(method, { ...params, per_page: 100 })) {
-            const page = Array.isArray(response.data) ? response.data
-                : record(response.data)?.check_runs ?? record(response.data)?.workflow_runs
-                    ?? record(response.data)?.artifacts ?? record(response.data)?.jobs;
-            if (!Array.isArray(page))
-                throw new Error('GitHub pagination returned an invalid page.');
-            result.push(...page);
-            if (result.length > 3000)
-                throw new Error('Approval evidence pagination exceeded the safe bound.');
-        }
-        return result;
+    async allPages(operation, method, params) {
+        return (0, approval_evidence_read_1.readApprovalEvidence)(operation, async () => {
+            const result = [];
+            for await (const response of this.octokit.paginate.iterator(method, { ...params, per_page: 100 })) {
+                const page = Array.isArray(response.data) ? response.data
+                    : record(response.data)?.check_runs ?? record(response.data)?.workflow_runs
+                        ?? record(response.data)?.artifacts ?? record(response.data)?.jobs;
+                if (!Array.isArray(page))
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, 'invalid-page');
+                result.push(...page);
+                if (result.length > 3000)
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, 'page-limit');
+            }
+            return result;
+        });
     }
 }
 exports.PullRequestApprovalRepository = PullRequestApprovalRepository;
@@ -86497,7 +86938,7 @@ function array(value) { return Array.isArray(value) ? value : []; }
 async function readEffectiveApprovalPolicy(octokit, target) {
     const admit = (source, value) => {
         if (typeof value !== 'string' || value.length > 65536)
-            throw new Error('Approval policy response is malformed or unbounded.');
+            throw new application_error_1.ApplicationError('provider.contract-invalid', 'Approval policy response is malformed or unbounded.');
         return { source, value };
     };
     try {
@@ -86521,6 +86962,14 @@ async function readEffectiveApprovalPolicy(octokit, target) {
         throw error;
     }
 }
+function collectDiagnostic(diagnostics, cause) {
+    if (cause instanceof application_error_1.ApplicationError && cause.recovery?.id === 'approval-evidence-read-failed') {
+        diagnostics.push(cause.recovery.variables);
+    }
+    else {
+        diagnostics.push((0, approval_evidence_error_1.approvalEvidenceError)('evidence', 'invalid-response').recovery.variables);
+    }
+}
 
 
 /***/ }),
@@ -88761,6 +89210,44 @@ class AgentResponseLengthFailure extends Error {
 exports.AgentResponseLengthFailure = AgentResponseLengthFailure;
 
 
+/***/ }),
+
+/***/ 98205:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.APPROVAL_EVIDENCE_REASONS = exports.APPROVAL_EVIDENCE_PERMISSIONS = void 0;
+/** Closed vocabulary: no provider text, URLs, headers, policy values or credentials. */
+exports.APPROVAL_EVIDENCE_PERMISSIONS = Object.freeze({
+    'evidence': 'repository-read',
+    'pull-request': 'pull-requests-read',
+    'base-ref': 'contents-read',
+    'merge-commit': 'contents-read',
+    'policy': 'actions-variables-read',
+    'files': 'pull-requests-read',
+    'reviews': 'pull-requests-read',
+    'comments': 'issues-read',
+    'head-checks': 'checks-read',
+    'merge-checks': 'checks-read',
+    'head-runs': 'actions-read',
+    'merge-runs': 'actions-read',
+    'jobs': 'actions-read',
+    'rules': 'metadata-read',
+    'classic-protection': 'administration-read',
+    'authenticated-user': 'authenticated-user-read',
+    'coverage-artifacts': 'actions-read',
+    'coverage-download': 'actions-read',
+    'coverage-parse': 'actions-read',
+});
+exports.APPROVAL_EVIDENCE_REASONS = Object.freeze([
+    'http-400', 'http-401', 'http-403', 'http-404', 'http-409', 'http-422', 'http-429',
+    'http-500', 'http-502', 'http-503', 'http-504', 'transport-unavailable',
+    'invalid-response', 'invalid-page', 'page-limit', 'artifact-unavailable', 'artifact-invalid', 'artifact-mismatch',
+]);
+
+
 /***/ }),
 
 /***/ 51114:
@@ -89389,6 +89876,25 @@ function isNewerCliVersion(installedVersion, publishedVersion) {
 }
 
 
+/***/ }),
+
+/***/ 21565:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CLOSED_ISSUE_REASONS = exports.CLOSED_ISSUE_PHASES = exports.CLOSED_ISSUE_RESULTS = void 0;
+exports.CLOSED_ISSUE_RESULTS = Object.freeze([
+    'ReconcileClosedIssueMetadataUseCase', 'CloseIssueAfterMergingUseCase', 'RetireBranchSyncUseCase', 'RetireProgressUseCase',
+]);
+exports.CLOSED_ISSUE_PHASES = Object.freeze([
+    'identity', 'read', 'native-fence', 'label-remove', 'label-add', 'metadata-verification',
+    'card-inventory', 'card-freshness', 'card-update', 'card-verification',
+]);
+exports.CLOSED_ISSUE_REASONS = Object.freeze(['completed', 'not_planned', 'duplicate', 'reopened', 'unknown', 'unavailable']);
+
+
 /***/ }),
 
 /***/ 77454:
@@ -96391,6 +96897,7 @@ const exec = __importStar(__nccwpck_require__(18538));
 const git_authentication_environment_1 = __nccwpck_require__(16535);
 const untrusted_command_environment_1 = __nccwpck_require__(2304);
 const git_hook_isolation_1 = __nccwpck_require__(39764);
+const verification_runtime_preflight_1 = __nccwpck_require__(23100);
 class GitCommitAdapter {
     constructor(executeCommand = (program, args, options) => options
         ? exec.exec(program, args, {
@@ -96400,16 +96907,21 @@ class GitCommitAdapter {
             ...(options.stdout ? { listeners: { stdout: options.stdout } } : {}),
             ...(options.env ? { env: options.env } : {}),
         })
-        : exec.exec(program, args)) {
+        : exec.exec(program, args), checkPrerequisites = verification_runtime_preflight_1.assertVerificationRuntimePrerequisites) {
         this.executeCommand = executeCommand;
+        this.checkPrerequisites = checkPrerequisites;
     }
     async execute(program, args, options) {
+        if (options?.verifyRuntimePrerequisites && !options.untrusted)
+            throw new Error('Runtime preflight requires credential-free verification.');
         if (!options?.untrusted)
             return options ? this.executeCommand(program, args, options) : this.executeCommand(program, args);
         if (options.env)
             throw new Error('Untrusted command execution does not accept a caller-supplied environment.');
         const runtime = (0, untrusted_command_environment_1.prepareUntrustedCommandEnvironment)();
         try {
+            if (options.verifyRuntimePrerequisites)
+                this.checkPrerequisites(runtime.environment);
             return await this.executeCommand(program, args, {
                 ...(options.stdout ? { stdout: options.stdout } : {}),
                 env: runtime.environment,
@@ -101890,6 +102402,7 @@ const node_path_1 = __nccwpck_require__(49411);
 const agent_private_install_root_1 = __nccwpck_require__(44640);
 const ALLOWED_VARIABLES = [
     'PATH',
+    'JAVA_HOME',
     'LANG',
     'LANGUAGE',
     'LC_ALL',
@@ -101949,6 +102462,132 @@ function prepareUntrustedCommandEnvironment(source = process.env, platform = pro
 }
 
 
+/***/ }),
+
+/***/ 91053:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readVerificationRuntimeManifest = readVerificationRuntimeManifest;
+const node_fs_1 = __nccwpck_require__(87561);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const MAX_MANIFEST_BYTES = 16 * 1024;
+function readVerificationRuntimeManifest(root) {
+    const path = (0, node_path_1.resolve)(root, verification_runtime_policy_1.VERIFICATION_RUNTIME_MANIFEST);
+    let descriptor;
+    try {
+        let directory;
+        try {
+            directory = (0, node_fs_1.lstatSync)((0, node_path_1.join)(root, '.copilot'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!directory.isDirectory() || directory.isSymbolicLink()
+            || (0, node_fs_1.realpathSync)((0, node_path_1.join)(root, '.copilot')) !== (0, node_path_1.join)((0, node_fs_1.realpathSync)(root), '.copilot'))
+            throw new Error('Unsafe manifest parent');
+        let entry;
+        try {
+            entry = (0, node_fs_1.lstatSync)(path, { bigint: true });
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1n || entry.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Unsafe manifest');
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const opened = (0, node_fs_1.fstatSync)(descriptor, { bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== entry.dev || opened.ino !== entry.ino
+            || opened.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Manifest changed');
+        const bytes = Buffer.alloc(MAX_MANIFEST_BYTES + 1);
+        const size = (0, node_fs_1.readSync)(descriptor, bytes, 0, bytes.length, 0);
+        if (size > MAX_MANIFEST_BYTES)
+            throw new Error('Oversized manifest');
+        return (0, verification_runtime_policy_1.parseVerificationRuntimeManifest)(JSON.parse(bytes.subarray(0, size).toString('utf8')));
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('manifest-invalid');
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+    }
+}
+
+
+/***/ }),
+
+/***/ 23100:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertVerificationRuntimePrerequisites = assertVerificationRuntimePrerequisites;
+const node_child_process_1 = __nccwpck_require__(17718);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_manifest_1 = __nccwpck_require__(91053);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const probe = (program, args, environment) => {
+    const result = (0, node_child_process_1.spawnSync)(program, [...args], { env: environment, encoding: 'utf8', shell: false,
+        windowsHide: true, timeout: 5000, maxBuffer: 8192, stdio: ['ignore', 'pipe', 'pipe'] });
+    return { status: result.status, output: `${result.stdout ?? ''}\n${result.stderr ?? ''}`, failed: !!result.error };
+};
+const hasControlCharacter = (value) => [...value].some(character => character.charCodeAt(0) < 32);
+/** Fixed version probes only; never installs a runtime or executes a repository-provided bootstrap. */
+function assertVerificationRuntimePrerequisites(environment, root = process.cwd(), run = probe, platform = process.platform, job = process.env.GITHUB_JOB) {
+    for (const requirement of (0, verification_runtime_manifest_1.readVerificationRuntimeManifest)(root)) {
+        checkRuntime(requirement, environment, run, platform, job);
+    }
+}
+function checkRuntime(requirement, environment, run, platform, job) {
+    const spec = verification_runtime_policy_1.VERIFICATION_RUNTIME_SPECS[requirement.runtime];
+    let program = spec.program;
+    let args = spec.args;
+    if (requirement.runtime === 'java' && environment.JAVA_HOME) {
+        const paths = platform === 'win32' ? node_path_1.win32 : node_path_1.posix;
+        if (!paths.isAbsolute(environment.JAVA_HOME) || hasControlCharacter(environment.JAVA_HOME)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = paths.join(environment.JAVA_HOME, 'bin', platform === 'win32' ? 'java.exe' : 'java');
+    }
+    else if (requirement.runtime === 'python' && platform === 'win32')
+        program = 'python';
+    else if (requirement.runtime === 'pnpm' && platform === 'win32') {
+        const systemRoot = environment.SystemRoot;
+        if (!systemRoot || !node_path_1.win32.isAbsolute(systemRoot) || hasControlCharacter(systemRoot)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = node_path_1.win32.join(systemRoot, 'System32', 'cmd.exe');
+        args = ['/d', '/s', '/c', 'pnpm --version'];
+    }
+    let result;
+    try {
+        result = run(program, args, environment);
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    if (result.failed || result.status !== 0 || result.output.length > 8192) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    const observed = (0, verification_runtime_policy_1.verificationRuntimeVersion)(requirement.runtime, result.output);
+    if (!observed)
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unreadable-version', requirement, undefined, job);
+    if (!(0, verification_runtime_policy_1.verificationRuntimeMatches)(requirement.version, observed)) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('version-mismatch', requirement, observed, job);
+    }
+}
+
+
 /***/ }),
 
 /***/ 92540: