@vypdev/copilot 3.9.1 → 3.9.3

package/build/github_action/index.js

@@ -38189,6 +38189,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runPullRequestApprovalAction = runPullRequestApprovalAction;
+const application_error_presentation_policy_1 = __nccwpck_require__(95067);
+const application_error_message_catalog_1 = __nccwpck_require__(64809);
 const core = __importStar(__nccwpck_require__(75855));
 const github = __importStar(__nccwpck_require__(78227));
 const observe_pull_request_approval_use_case_1 = __nccwpck_require__(36169);
@@ -38238,15 +38240,22 @@ async function runPullRequestApprovalAction(token) {
     });
     const useCase = new observe_pull_request_approval_use_case_1.ObservePullRequestApprovalUseCase(port);
     const failedPulls = [];
+    let firstFailure;
     for (const pullNumber of targetNumbers) {
         const target = { owner, repository: repo, repositoryId, pullNumber };
         const result = await useCase.execute(target);
+        if (result.failure) {
+            firstFailure ?? (firstFailure = result.failure);
+            const diagnostic = (0, application_error_presentation_policy_1.renderApplicationErrorText)(result.failure, (0, application_error_message_catalog_1.resolveStaticApplicationErrorCatalog)(locale).message);
+            core.info(diagnostic);
+            core.summary.addRaw(`<pre>${diagnostic.replace(/&/gu, '&amp;').replace(/</gu, '&lt;').replace(/>/gu, '&gt;')}</pre>\n`);
+        }
         const safeCode = result.decision.code.replace(/[^a-z0-9-]/gu, '').slice(0, 60);
         core.info(`PR #${pullNumber}: ${result.decision.status} (${safeCode}); assessment ${result.publication}.`);
         if (result.publication === 'failed' || [
             'invalid-policy', 'policy-unavailable', 'evidence-unavailable', 'target-mismatch',
             'pre-submit-unavailable', 'publication-unknown',
-        ].includes(result.decision.code))
+        ].includes(result.decision.code) || result.failure)
             failedPulls.push(pullNumber);
         if (result.evidence) {
             core.summary.addRaw((0, pull_request_approval_presentation_policy_1.renderApprovalRunSummary)({
@@ -38267,6 +38276,8 @@ async function runPullRequestApprovalAction(token) {
         }
     }
     await core.summary.write();
+    if (firstFailure)
+        throw firstFailure;
     if (failedPulls.length > 0) {
         throw new Error(`Approval observation needs attention for PR(s) ${failedPulls.join(', ')}; inspect the Job Summary and rerun after recovery.`);
     }
@@ -38816,6 +38827,55 @@ function runAtApplicationErrorBoundary(operation) {
 }
 
 
+/***/ }),
+
+/***/ 50519:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.approvalEvidenceError = approvalEvidenceError;
+exports.approvalDiagnosticError = approvalDiagnosticError;
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
+const application_error_1 = __nccwpck_require__(75999);
+function approvalEvidenceError(operation, reason) {
+    return approvalDiagnosticError({ operation, reason, permission: approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS[operation] });
+}
+function approvalDiagnosticError(diagnostic) {
+    const reason = diagnostic.reason;
+    const code = reason === 'http-401' ? 'authorization.credential-invalid'
+        : reason === 'http-403' ? 'authorization.denied'
+            : reason === 'http-404' ? 'provider.not-found'
+                : reason === 'http-429' ? 'provider.rate-limited'
+                    : reason === 'http-409' ? 'provider.conflict'
+                        : reason === 'transport-unavailable' || /^http-50[0234]$/u.test(reason) ? 'provider.unavailable'
+                            : 'provider.contract-invalid';
+    return new application_error_1.ApplicationError(code, `Approval evidence read failed (${diagnostic.operation}, ${reason}).`, {
+        recovery: { id: 'approval-evidence-read-failed', variables: diagnostic },
+    });
+}
+
+
+/***/ }),
+
+/***/ 12183:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.closedIssueReconciliationError = closedIssueReconciliationError;
+const application_error_1 = __nccwpck_require__(75999);
+/** Public diagnostic is fixed native facts and counters, never label/card/provider text. */
+function closedIssueReconciliationError(cause, facts) {
+    return new application_error_1.ApplicationError(cause instanceof application_error_1.ApplicationError ? cause.code : 'provider.unavailable', 'Closed issue reconciliation remains unverified.', {
+        ...(cause instanceof application_error_1.ApplicationError ? { correlationId: cause.correlationId, retryable: cause.retryable } : {}),
+        recovery: { id: 'closed-issue-reconciliation-failed', variables: facts },
+    });
+}
+
+
 /***/ }),
 
 /***/ 72594:
@@ -38854,7 +38914,7 @@ const application_error_message_catalog_1 = __nccwpck_require__(64809);
 const SIMPLE_MESSAGE_KEYS = Object.freeze([
     'heading', 'repository', 'property', 'value', 'status', 'event', 'target',
     'lifecycle', 'descriptionPolicy', 'results', 'findingStates', 'bugbotReview',
-    'inactivity', 'unavailable',
+    'inactivity', 'unavailable', 'issueCleanup',
     'sourceFreshness', 'staleSourceSuppressed',
     'duplicateCleanup', 'actionNotifications', 'actionNotificationCreated',
     'actionNotificationReused',
@@ -38876,6 +38936,7 @@ const TEMPLATE_MESSAGE_IDS = Object.freeze([
     'summary.duplicateCleanup.bounded',
     'summary.actionNotification.entry',
     'summary.inactivityCounts',
+    'summary.issueCleanupCounts',
 ]);
 const FINDING_STATE_KEYS = Object.freeze([
     'open', 'reopened', 'fixed', 'obsolete', 'dismissed',
@@ -38899,6 +38960,7 @@ const ENGLISH_SIMPLE = Object.freeze({
     descriptionPolicy: 'PR description policy',
     results: 'Results',
     inactivity: 'Issue inactivity',
+    issueCleanup: 'Issue cleanup',
     unavailable: 'unavailable',
     findingStates: 'Finding states',
     bugbotReview: 'Bugbot review',
@@ -38948,6 +39010,7 @@ const SPANISH_SIMPLE = Object.freeze({
     descriptionPolicy: 'Política de descripción de PR',
     results: 'Resultados',
     inactivity: 'Inactividad de issues',
+    issueCleanup: 'Limpieza de la issue',
     unavailable: 'no disponible',
     findingStates: 'Estados de los hallazgos',
     bugbotReview: 'Revisión de Bugbot',
@@ -38995,6 +39058,7 @@ const ENGLISH_TEMPLATES = Object.freeze({
     'summary.duplicateCleanup.bounded': 'Deletion was forbidden; retained compact pointers for {count} comments (first {reported} IDs: {ids})',
     'summary.actionNotification.entry': '{topic} on {target}: {effect} (fingerprint {fingerprint})',
     'summary.inactivityCounts': 'Scanned: {scanned} · Closed: {closed} · Skipped: {skipped}',
+    'summary.issueCleanupCounts': 'Reconciled: {reconciled} · Already converged: {converged}. Required cleanup was freshly verified.',
 });
 const SPANISH_TEMPLATES = Object.freeze({
     'summary.target.pullRequest': 'PR n.º {number}',
@@ -39006,6 +39070,7 @@ const SPANISH_TEMPLATES = Object.freeze({
     'summary.duplicateCleanup.bounded': 'Se denegó el borrado; se conservaron enlaces compactos para {count} comentarios (primeros {reported} ID: {ids})',
     'summary.actionNotification.entry': '{topic} en {target}: {effect} (huella {fingerprint})',
     'summary.inactivityCounts': 'Examinadas: {scanned} · Cerradas: {closed} · Omitidas: {skipped}',
+    'summary.issueCleanupCounts': 'Reconciliadas: {reconciled} · Ya convergidas: {converged}. Se verificó de nuevo la limpieza necesaria.',
 });
 const ENGLISH_FINDING_STATES = Object.freeze({
     open: 'open',
@@ -39068,6 +39133,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.buildActionSummary = buildActionSummary;
 exports.actionSummaryLocalizationLabels = actionSummaryLocalizationLabels;
 exports.renderLocalizationSummarySection = renderLocalizationSummarySection;
+const closed_issue_reconciliation_outcome_policy_1 = __nccwpck_require__(85462);
 const inactivity_result_counts_projection_policy_1 = __nccwpck_require__(14960);
 const github_comment_publication_policy_1 = __nccwpck_require__(72712);
 const bugbot_telemetry_projection_policy_1 = __nccwpck_require__(43244);
@@ -39117,6 +39183,7 @@ function buildActionSummary(context, catalog = (0, action_summary_message_catalo
         `| ${catalogText(catalog, 'summary.descriptionPolicy')} | ${escapeTable(context.pullRequestDescriptionMode ?? '—')} |`,
         `| ${catalogText(catalog, 'summary.results')} | ${formatResultCounts(context.results, catalog)} |`,
         ...inactivitySummaryRows(context.results, catalog),
+        ...closedIssueCleanupRows(context.results, catalog),
         `| ${catalogText(catalog, 'summary.findingStates')} | ${formatFindingStates(findingStateProjection, catalog)} |`,
         `| ${catalogText(catalog, 'summary.bugbotReview')} | ${formatBugbotTelemetry(telemetryProjection, catalog)} |`,
         ...(staleSourceSuppressed ? [
@@ -39147,6 +39214,14 @@ function buildActionSummary(context, catalog = (0, action_summary_message_catalo
         ...(localization ? ['', localization] : []),
     ].join('\n');
 }
+function closedIssueCleanupRows(results, catalog) {
+    const projection = (0, closed_issue_reconciliation_outcome_policy_1.projectClosedIssueCleanupCounts)(results);
+    if (projection.status === 'absent')
+        return [];
+    const value = projection.status === 'valid' ? catalogText(catalog, 'summary.issueCleanupCounts', projection.counts)
+        : catalogText(catalog, 'summary.unavailable');
+    return [`| ${catalogText(catalog, 'summary.issueCleanup')} | ${value} |`];
+}
 function inactivitySummaryRows(results, catalog) {
     const projection = (0, inactivity_result_counts_projection_policy_1.projectInactivityResultCounts)(results);
     if (projection.status === 'absent')
@@ -40592,6 +40667,16 @@ const SPANISH_CONTENT = Object.freeze({
     }),
 });
 const ENGLISH_RECOVERY_CONTENT = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze({
+        impact: 'Issue cleanup remains unverified: {resultId}, phase {phase}; native state {state}, reason {reason}.',
+        action: 'Inspect the closed-issue or merged-PR run and current native state. Retry cleanup only if the issue is still closed with the intended reason; leave reopened work open. Resolve the named failure before retrying.',
+        retainedState: 'Native state was preserved. Confirmed changes: {changed}; remaining required changes in the last verified plan: {remaining}. Unavailable reads do not establish completion.',
+    }),
+    'approval-evidence-read-failed': Object.freeze({
+        impact: 'Approval evidence could not be verified: {operation} ({reason}).',
+        action: 'Inspect {permission} access for the runtime credential and the named evidence response. Correct authorization, missing-resource or schema errors before rerunning; retry transient failures only after provider recovery or rate-limit reset.',
+        retainedState: 'No approval is authorized by this failed read. Existing PRs, reviews and completed external effects were preserved.',
+    }),
     'workspace-changes-rejected': Object.freeze({
         impact: 'The changes were rejected during workspace verification.',
         action: 'Inspect the rejected paths in the workflow and correct the workspace before retrying.',
@@ -40659,6 +40744,16 @@ const ENGLISH_RECOVERY_CONTENT = Object.freeze({
     }),
 });
 const SPANISH_RECOVERY_CONTENT = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze({
+        impact: 'La limpieza de la issue sigue sin verificarse: {resultId}, fase {phase}; estado nativo {state}, motivo {reason}.',
+        action: 'Revisa la ejecución de cierre o de la PR fusionada y el estado nativo actual. Reintenta la limpieza solo si la issue sigue cerrada con el motivo previsto; conserva abierto el trabajo reabierto. Resuelve el fallo indicado antes de reintentar.',
+        retainedState: 'Se conservó el estado nativo. Cambios confirmados: {changed}; cambios pendientes en el último plan verificado: {remaining}. Una lectura no disponible no demuestra que haya finalizado.',
+    }),
+    'approval-evidence-read-failed': Object.freeze({
+        impact: 'No se pudo verificar la evidencia de aprobación: {operation} ({reason}).',
+        action: 'Comprueba el acceso {permission} de la credencial de ejecución y la respuesta indicada. Corrige los errores de autorización, recurso o esquema antes de reejecutar; reintenta los fallos transitorios solo tras recuperarse el proveedor o restablecerse el límite.',
+        retainedState: 'Esta lectura fallida no autoriza ninguna aprobación. Se conservaron las PRs, revisiones y efectos externos completados.',
+    }),
     'workspace-changes-rejected': Object.freeze({
         impact: 'Los cambios se rechazaron durante la verificación del espacio de trabajo.',
         action: 'Revisa las rutas rechazadas en la ejecución y corrige el espacio de trabajo antes de reintentar.',
@@ -42877,6 +42972,51 @@ function hasBugbotTelemetryField(value) {
 }
 
 
+/***/ }),
+
+/***/ 85462:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.projectClosedIssueCleanupCounts = projectClosedIssueCleanupCounts;
+const result_1 = __nccwpck_require__(73817);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
+/** Summary consumes semantic counts; internal result identifiers never become presentation. */
+function projectClosedIssueCleanupCounts(results) {
+    let reconciled = 0;
+    let converged = 0;
+    let invalid = false;
+    for (const result of results.filter(result => closed_issue_reconciliation_1.CLOSED_ISSUE_RESULTS.some(id => id === result.id))) {
+        const payload = (0, result_1.getResultPayload)(result.payload);
+        if (!result.success || result.errors?.length) {
+            invalid = true;
+            continue;
+        }
+        if (!payload)
+            continue;
+        const completion = result.id === 'CloseIssueAfterMergingUseCase' || result.id === 'ReconcileClosedIssueMetadataUseCase'
+            ? (0, result_1.getResultPayload)(payload.issueCompletion) : payload;
+        if (completion?.outcome === 'not-applicable' && completion.nativeClosed === false)
+            continue;
+        if (completion?.nativeClosed !== true || completion.reconciled !== true) {
+            invalid = true;
+            continue;
+        }
+        if (completion.outcome === 'already-converged')
+            converged++;
+        else if (completion.outcome === 'reconciled')
+            reconciled++;
+        else
+            invalid = true;
+    }
+    if (!invalid && !reconciled && !converged)
+        return { status: 'absent' };
+    return invalid ? { status: 'invalid' } : { status: 'valid', counts: { reconciled, converged } };
+}
+
+
 /***/ }),
 
 /***/ 27150:
@@ -47341,6 +47481,34 @@ function verifiedReadinessLink(snapshot, number) {
 }
 
 
+/***/ }),
+
+/***/ 59756:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.hasConventionalPullRequestTitle = hasConventionalPullRequestTitle;
+exports.generatedPullRequestTitle = generatedPullRequestTitle;
+/** Recognizes the conventional header shape; the consumer's CI owns its allowed types and subject rules. */
+function hasConventionalPullRequestTitle(title) {
+    return !title.includes('\n') && !title.includes('\r')
+        && /^\p{L}[\p{L}\p{N}_-]*(?:\([^()\r\n]+\))?!?: +\S[^\r\n]*$/u.test(title);
+}
+function generatedPullRequestTitle(sourceTitle, sanitizedSubject, issueNumber, labels) {
+    if (hasConventionalPullRequestTitle(sourceTitle))
+        return sourceTitle;
+    const type = labels.isHotfix || labels.isBugfix || labels.isBug ? 'fix'
+        : labels.isFeature || labels.isEnhancement ? 'feat'
+            : labels.isDocs || labels.isDocumentation ? 'docs' : 'chore';
+    const prefix = `${type}: `;
+    const suffix = ` (#${issueNumber})`;
+    const subject = (sanitizedSubject || 'Update linked issue').slice(0, 256 - prefix.length - suffix.length).trimEnd();
+    return `${prefix}${subject}${suffix}`;
+}
+
+
 /***/ }),
 
 /***/ 39410:
@@ -47532,6 +47700,12 @@ Do not add the \`${profile.deployment.launcherLabel}\` label, dispatch a deploym
 
 Never expose credentials, tokens, private keys, or other secrets in issues, commits, pull requests, logs, or diagnostic comments.
 
+## Repository verification prerequisites
+
+The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job.
+
+Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites).
+
 For the full contributor flow, read [repository collaboration](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-collaboration.mdx). For drift and recovery, read [guidance troubleshooting](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-guidance-troubleshooting.mdx).
 `;
 }
@@ -50738,6 +50912,87 @@ function projectCurrentNativeStatus(status, facts) {
 }
 
 
+/***/ }),
+
+/***/ 89347:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.VerificationPrerequisiteError = exports.VERIFICATION_RUNTIME_SPECS = exports.VERIFICATION_RUNTIME_HELP = exports.VERIFICATION_RUNTIME_MANIFEST = void 0;
+exports.parseVerificationRuntimeManifest = parseVerificationRuntimeManifest;
+exports.verificationRuntimeVersion = verificationRuntimeVersion;
+exports.verificationRuntimeMatches = verificationRuntimeMatches;
+exports.VERIFICATION_RUNTIME_MANIFEST = '.copilot/verification-prerequisites.json';
+exports.VERIFICATION_RUNTIME_HELP = 'https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites';
+exports.VERIFICATION_RUNTIME_SPECS = {
+    java: { label: 'Java', program: 'java', args: ['-version'] },
+    node: { label: 'Node.js', program: 'node', args: ['--version'] },
+    pnpm: { label: 'pnpm', program: 'pnpm', args: ['--version'] },
+    python: { label: 'Python', program: 'python3', args: ['--version'] },
+    go: { label: 'Go', program: 'go', args: ['version'] },
+    dotnet: { label: '.NET SDK', program: 'dotnet', args: ['--version'] },
+    ruby: { label: 'Ruby', program: 'ruby', args: ['--version'] },
+    rust: { label: 'Rust', program: 'rustc', args: ['--version'] },
+};
+const VERSION_PREFIX = /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,2}$/u;
+/** Only reviewed, closed runtime/version facts enter user-visible diagnostics. Raw tool output never does. */
+class VerificationPrerequisiteError extends Error {
+    constructor(reason, requirement, observed, job) {
+        const jobLabel = job && /^[A-Za-z_][A-Za-z0-9_-]{0,99}$/u.test(job) ? ` in job ${job}` : ' in this job';
+        const runtime = requirement && Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, requirement.runtime)
+            ? exports.VERIFICATION_RUNTIME_SPECS[requirement.runtime].label : 'Required runtime';
+        const version = requirement && VERSION_PREFIX.test(requirement.version) ? requirement.version : 'declared version';
+        const actual = observed && /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,3}$/u.test(observed) ? observed : 'unavailable';
+        const cause = reason === 'manifest-invalid' ? `${exports.VERIFICATION_RUNTIME_MANIFEST} is invalid or unsafe`
+            : reason === 'version-mismatch' ? `${runtime} ${version} is required; observed ${actual}`
+                : reason === 'unreadable-version' ? `${runtime} ${version} could not be verified`
+                    : `${runtime} ${version} is unavailable`;
+        const action = reason === 'manifest-invalid' ? 'Correct the reviewed runtime declaration.'
+            : `Provision the declared runtime in the same job before Copilot, then retry.${requirement?.runtime === 'java' ? ' For Java, configure actions/setup-java or a managed JAVA_HOME.' : ''}`;
+        super(`Repository verification is blocked${jobLabel}: ${cause}. ${action} The repository verification command was not run. Help: ${exports.VERIFICATION_RUNTIME_HELP}`);
+        this.name = 'VerificationPrerequisiteError';
+    }
+}
+exports.VerificationPrerequisiteError = VerificationPrerequisiteError;
+function parseVerificationRuntimeManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    const object = value;
+    if (object.schemaVersion !== 1 || Object.keys(object).some(key => !['schemaVersion', 'runtimes'].includes(key))
+        || !object.runtimes || typeof object.runtimes !== 'object' || Array.isArray(object.runtimes)) {
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    }
+    const runtimes = object.runtimes;
+    if (Object.keys(runtimes).length > 8)
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    return Object.entries(runtimes).map(([runtime, version]) => {
+        if (!Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, runtime) || typeof version !== 'string' || !VERSION_PREFIX.test(version)) {
+            throw new VerificationPrerequisiteError('manifest-invalid');
+        }
+        return Object.freeze({ runtime: runtime, version });
+    });
+}
+function verificationRuntimeVersion(runtime, output) {
+    const patterns = {
+        java: /^(?:openjdk|java) (?:version )?["']?(\d+(?:\.\d+){0,3})/imu,
+        node: /^v(\d+\.\d+\.\d+)/mu,
+        pnpm: /^(\d+\.\d+\.\d+)/mu,
+        python: /^Python (\d+\.\d+\.\d+)/mu,
+        go: /^go version go(\d+\.\d+(?:\.\d+)?)/mu,
+        dotnet: /^(\d+\.\d+\.\d+)/mu,
+        ruby: /^ruby (\d+\.\d+\.\d+)/mu,
+        rust: /^rustc (\d+\.\d+\.\d+)/mu,
+    };
+    const version = patterns[runtime].exec(output)?.[1];
+    return runtime === 'java' && version?.startsWith('1.') ? version.slice(2) : version;
+}
+function verificationRuntimeMatches(required, observed) {
+    return observed === required || observed.startsWith(`${required}.`);
+}
+
+
 /***/ }),
 
 /***/ 43193:
@@ -53947,8 +54202,9 @@ function failure(taskId, message, code) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconcileClosedIssueMetadataUseCase = void 0;
 const result_1 = __nccwpck_require__(73817);
-const issue_completion_1 = __nccwpck_require__(31147);
 const application_error_1 = __nccwpck_require__(75999);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const reconcile_issue_completion_metadata_1 = __nccwpck_require__(70614);
 /** Selective completion repair from fresh native facts; no native state authority. */
 class ReconcileClosedIssueMetadataUseCase {
     constructor(issues) {
@@ -53956,50 +54212,22 @@ class ReconcileClosedIssueMetadataUseCase {
         this.taskId = 'ReconcileClosedIssueMetadataUseCase';
     }
     async invoke(context) {
-        let labelsChanged = 0;
-        let nativeClosed = false;
+        const progress = (0, reconcile_issue_completion_metadata_1.completionRepairProgress)();
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1)
                 throw stale();
             const target = this.issues.forIssue(context.issueNumber);
-            const initial = await target.read();
-            nativeClosed = initial.number === context.issueNumber && initial.state === 'closed';
-            const initialPlan = (0, issue_completion_1.planIssueCompletion)(initial, context.completionLabels);
-            if (!nativeClosed || initialPlan.kind !== 'closed')
-                throw stale();
-            const fence = async () => {
-                const current = await target.read();
-                nativeClosed = current.number === context.issueNumber && current.state === 'closed';
-                const plan = (0, issue_completion_1.planIssueCompletion)(current, context.completionLabels);
-                if (!nativeClosed || plan.kind !== 'closed' || current.reason !== initial.reason)
-                    throw stale();
-                return plan;
-            };
-            for (const label of initialPlan.remove) {
-                if ((await fence()).remove.includes(label)) {
-                    await target.removeLabel(label);
-                    labelsChanged++;
-                }
-            }
-            for (const label of initialPlan.add) {
-                if ((await fence()).add.includes(label)) {
-                    await target.addLabel(label);
-                    labelsChanged++;
-                }
-            }
-            const final = await fence();
-            if (final.remove.length || final.add.length)
-                throw stale();
-            return [new result_1.Result({ id: this.taskId, success: true, executed: labelsChanged > 0,
+            const repaired = await (0, reconcile_issue_completion_metadata_1.reconcileIssueCompletionMetadata)(target, context.issueNumber, context.completionLabels, progress);
+            return [new result_1.Result({ id: this.taskId, success: true, executed: progress.labelsChanged > 0,
                     steps: ['The closed issue completion metadata was verified; historical and unrelated labels were retained.'],
-                    payload: { issueCompletion: { nativeClosed, labelsChanged, reconciled: true, reason: initial.reason } } })];
+                    payload: { issueCompletion: { nativeClosed: progress.nativeClosed, labelsChanged: progress.labelsChanged, reconciled: true, ...repaired } } })];
         }
         catch (cause) {
-            return [new result_1.Result({ id: this.taskId, success: false, executed: labelsChanged > 0,
-                    steps: [nativeClosed ? 'The issue remains closed; completion metadata could not be fully verified. Inspect and retry the closed-issue workflow.'
+            return [new result_1.Result({ id: this.taskId, success: false, executed: progress.labelsChanged > 0,
+                    steps: [progress.nativeClosed ? 'The issue remains closed; completion metadata could not be fully verified. Inspect and retry the closed-issue workflow.'
                             : 'Current native issue closure could not be verified; completion repair stopped without changing native state.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Closed issue completion metadata remains unverified.')],
-                    payload: { issueCompletion: { nativeClosed, labelsChanged, reconciled: false } } })];
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase: progress.phase, state: progress.state, reason: progress.reason, changed: progress.labelsChanged, remaining: progress.remaining })],
+                    payload: { issueCompletion: { nativeClosed: progress.nativeClosed, labelsChanged: progress.labelsChanged, reconciled: false } } })];
         }
     }
 }
@@ -54032,6 +54260,84 @@ class ReconcileClosedIssueUseCase {
 exports.ReconcileClosedIssueUseCase = ReconcileClosedIssueUseCase;
 
 
+/***/ }),
+
+/***/ 70614:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.completionRepairProgress = void 0;
+exports.reconcileIssueCompletionMetadata = reconcileIssueCompletionMetadata;
+const application_error_1 = __nccwpck_require__(75999);
+const issue_completion_1 = __nccwpck_require__(31147);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
+const completionRepairProgress = () => ({ nativeClosed: false, labelsChanged: 0,
+    phase: 'identity', state: 'unavailable', reason: 'unavailable', remaining: 0 });
+exports.completionRepairProgress = completionRepairProgress;
+/** At most two bounded selective passes, with fresh native fences before every write. */
+async function reconcileIssueCompletionMetadata(target, number, configuration, progress, initial) {
+    let expectedReason;
+    let superseded = false;
+    const read = async (phase, snapshot) => {
+        progress.phase = phase;
+        progress.state = 'unavailable';
+        progress.reason = 'unavailable';
+        const facts = snapshot ?? await target.read();
+        progress.nativeClosed = facts?.number === number && facts.state === 'closed';
+        progress.state = facts?.number === number && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+        progress.reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(reason => reason === facts?.reason) ? facts.reason : 'unavailable';
+        const plan = (0, issue_completion_1.planIssueCompletion)(facts, configuration);
+        if (!progress.nativeClosed || plan.kind !== 'closed' || expectedReason !== undefined && facts.reason !== expectedReason) {
+            throw new application_error_1.ApplicationError('workflow.stale', 'The native issue identity, state or closure reason changed.');
+        }
+        expectedReason = facts.reason;
+        progress.remaining = plan.remove.length + plan.add.length;
+        return plan;
+    };
+    let plan = await read('read', initial);
+    for (let pass = 0; pass < 2; pass++) {
+        for (const label of plan.remove) {
+            if (!(await read('label-remove')).remove.includes(label)) {
+                superseded = true;
+                continue;
+            }
+            try {
+                await target.removeLabel(label);
+                progress.labelsChanged++;
+            }
+            catch (cause) {
+                if ((await read('label-remove')).remove.includes(label))
+                    throw cause;
+                superseded = true;
+            }
+        }
+        for (const label of plan.add) {
+            if (!(await read('label-add')).add.includes(label)) {
+                superseded = true;
+                continue;
+            }
+            try {
+                await target.addLabel(label);
+                progress.labelsChanged++;
+            }
+            catch (cause) {
+                if ((await read('label-add')).add.includes(label))
+                    throw cause;
+                superseded = true;
+            }
+        }
+        plan = await read('metadata-verification');
+        if (!progress.remaining)
+            return { reason: plan.reason,
+                outcome: progress.labelsChanged ? 'reconciled' : 'already-converged', superseded };
+        superseded = true;
+    }
+    throw new application_error_1.ApplicationError('provider.conflict', 'Completion metadata remains incomplete after two bounded passes.');
+}
+
+
 /***/ }),
 
 /***/ 74111:
@@ -54041,7 +54347,9 @@ exports.ReconcileClosedIssueUseCase = ReconcileClosedIssueUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.RetireBranchSyncUseCase = void 0;
-const reply_request_digest_1 = __nccwpck_require__(47971);
+const verify_closed_issue_card_retirement_1 = __nccwpck_require__(78813);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
 const result_1 = __nccwpck_require__(73817);
 const github_user_policy_1 = __nccwpck_require__(84403);
 const publication_identity_policy_1 = __nccwpck_require__(45403);
@@ -54059,17 +54367,33 @@ class RetireBranchSyncUseCase {
     async invoke(context) {
         let retired = 0;
         let nativeClosed = false;
+        let phase = 'identity';
+        let state = 'unavailable';
+        let reason = 'unavailable';
+        let remaining = 0;
+        let superseded = false;
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1 || !context.trustedBotLogin) {
                 return [this.result(retired, nativeClosed)];
             }
-            const initial = await this.issues.readIssue(context.issueNumber);
-            if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state))
+            const read = async () => {
+                state = 'unavailable';
+                reason = 'unavailable';
+                const facts = await this.issues.readIssue(context.issueNumber);
+                nativeClosed = facts?.number === context.issueNumber && facts.state === 'closed';
+                state = facts?.number === context.issueNumber && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+                reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === facts?.reason) ? facts.reason : 'unavailable';
+                return facts;
+            };
+            phase = 'read';
+            const initial = await read();
+            if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state) || initial.state === 'closed' && !['completed', 'not_planned', 'duplicate', 'unknown'].includes(initial.reason))
                 throw stale();
             if (initial.state !== 'closed')
                 return [this.result(retired, nativeClosed)];
             nativeClosed = true;
             const messages = (0, branch_sync_message_catalog_1.resolveStaticBranchSyncCatalog)(context.locale);
+            phase = 'card-inventory';
             const cards = (await this.comments.listIssueComments(context.issueNumber)).filter(comment => {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(comment.body);
                 return marker?.identity.topic === 'branch-sync' && marker.identity.target.kind === 'issue'
@@ -54078,38 +54402,40 @@ class RetireBranchSyncUseCase {
                     && Number.isSafeInteger(comment.id) && comment.id > 0
                     && Boolean(comment.user?.login && (0, github_user_policy_1.githubUsersMatch)(context.trustedBotLogin, comment.user.login));
             });
+            remaining = Math.min(cards.length, 3000);
             if (cards.length > 20)
                 throw stale();
+            const verifyClosed = async () => {
+                phase = 'native-fence';
+                const fresh = await read();
+                if (!nativeClosed || fresh.reason !== initial.reason)
+                    throw stale();
+            };
             for (const card of cards) {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(card.body);
                 const body = (0, branch_sync_notification_policy_1.buildRetiredBranchSyncComment)(marker.identity, messages);
-                if (card.body === body)
-                    continue;
-                const witness = Object.freeze({ surface: 'issue-comment', commentId: card.id,
-                    author: context.trustedBotLogin, target: Object.freeze({ kind: 'issue', number: context.issueNumber }),
-                    bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(card.body ?? '') });
-                if (!await this.cardFreshness.matches(witness))
-                    throw stale();
-                const fresh = await this.issues.readIssue(context.issueNumber);
-                nativeClosed = fresh.number === context.issueNumber && fresh.state === 'closed';
-                if (!nativeClosed || fresh.reason !== initial.reason)
-                    throw stale();
-                await this.comments.updateComment(context.issueNumber, card.id, body);
-                retired++;
+                const verified = await (0, verify_closed_issue_card_retirement_1.verifyClosedIssueCardRetirement)({ issueNumber: context.issueNumber,
+                    commentId: card.id, author: context.trustedBotLogin, originalBody: card.body ?? '', finalBody: body,
+                    freshness: this.cardFreshness, verifyClosed, onUpdated: () => { retired++; }, phase: value => { phase = value; },
+                    update: () => this.comments.updateComment(context.issueNumber, card.id, body) });
+                superseded || (superseded = verified.superseded);
+                remaining--;
             }
-            return [this.result(retired, nativeClosed)];
+            await verifyClosed();
+            return [this.result(retired, nativeClosed, superseded)];
         }
         catch (cause) {
             return [new result_1.Result({ id: this.taskId, success: false, executed: retired > 0,
                     steps: [nativeClosed ? 'Issue closure is retained; synchronization recommendation retirement could not be fully verified. Retry the closed-issue event or merged-PR operation.' : 'Native issue closure could not be verified; synchronization recommendations were left unchanged.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Unable to retire synchronization recommendations safely.')],
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase, state, reason, changed: retired, remaining })],
                     payload: { nativeClosed, retiredCards: retired, reconciled: false } })];
         }
     }
-    result(retired, nativeClosed) {
+    result(retired, nativeClosed, superseded = false) {
         return new result_1.Result({ id: this.taskId, success: true, executed: retired > 0,
             steps: [retired ? 'The closed issue’s synchronization recommendations were retired.' : 'No synchronization recommendation required retirement.'],
-            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true } });
+            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true, superseded,
+                outcome: nativeClosed ? retired ? 'reconciled' : 'already-converged' : 'not-applicable' } });
     }
 }
 exports.RetireBranchSyncUseCase = RetireBranchSyncUseCase;
@@ -54150,7 +54476,9 @@ exports.RetireClosedIssueCardsUseCase = RetireClosedIssueCardsUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.RetireProgressUseCase = void 0;
-const reply_request_digest_1 = __nccwpck_require__(47971);
+const verify_closed_issue_card_retirement_1 = __nccwpck_require__(78813);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
 const result_1 = __nccwpck_require__(73817);
 const github_user_policy_1 = __nccwpck_require__(84403);
 const publication_identity_policy_1 = __nccwpck_require__(45403);
@@ -54167,16 +54495,32 @@ class RetireProgressUseCase {
     async invoke(context) {
         let retired = 0;
         let nativeClosed = false;
+        let phase = 'identity';
+        let state = 'unavailable';
+        let reason = 'unavailable';
+        let remaining = 0;
+        let superseded = false;
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1 || !context.trustedBotLogin) {
                 return [this.result(retired, nativeClosed)];
             }
-            const initial = await this.issues.readIssue(context.issueNumber);
+            const read = async () => {
+                state = 'unavailable';
+                reason = 'unavailable';
+                const facts = await this.issues.readIssue(context.issueNumber);
+                nativeClosed = facts?.number === context.issueNumber && facts.state === 'closed';
+                state = facts?.number === context.issueNumber && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+                reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === facts?.reason) ? facts.reason : 'unavailable';
+                return facts;
+            };
+            phase = 'read';
+            const initial = await read();
             if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state) || initial.state === 'closed' && !['completed', 'not_planned', 'duplicate', 'unknown'].includes(initial.reason))
                 throw stale();
             if (initial.state !== 'closed')
                 return [this.result(retired, nativeClosed)];
             nativeClosed = true;
+            phase = 'card-inventory';
             const cards = (await this.comments.listIssueComments(context.issueNumber)).filter(comment => {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(comment.body);
                 return marker?.identity.topic === 'progress' && marker.identity.target.kind === 'issue'
@@ -54185,37 +54529,39 @@ class RetireProgressUseCase {
                     && Number.isSafeInteger(comment.id) && comment.id > 0
                     && Boolean(comment.user?.login && (0, github_user_policy_1.githubUsersMatch)(context.trustedBotLogin, comment.user.login));
             });
+            remaining = Math.min(cards.length, 3000);
             if (cards.length > 20)
                 throw stale();
-            for (const card of cards) {
-                const body = (0, retired_progress_presentation_policy_1.buildRetiredProgressComment)(card.body ?? '', context.locale, initial.reason);
-                if (card.body === body)
-                    continue;
-                const witness = Object.freeze({ surface: 'issue-comment', commentId: card.id,
-                    author: context.trustedBotLogin, target: Object.freeze({ kind: 'issue', number: context.issueNumber }),
-                    bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(card.body ?? '') });
-                if (!await this.cardFreshness.matches(witness))
-                    throw stale();
-                const fresh = await this.issues.readIssue(context.issueNumber);
-                nativeClosed = fresh.number === context.issueNumber && fresh.state === 'closed';
+            const verifyClosed = async () => {
+                phase = 'native-fence';
+                const fresh = await read();
                 if (!nativeClosed || fresh.reason !== initial.reason)
                     throw stale();
-                await this.comments.updateComment(context.issueNumber, card.id, body);
-                retired++;
+            };
+            for (const card of cards) {
+                const body = (0, retired_progress_presentation_policy_1.buildRetiredProgressComment)(card.body ?? '', context.locale, initial.reason);
+                const verified = await (0, verify_closed_issue_card_retirement_1.verifyClosedIssueCardRetirement)({ issueNumber: context.issueNumber,
+                    commentId: card.id, author: context.trustedBotLogin, originalBody: card.body ?? '', finalBody: body,
+                    freshness: this.cardFreshness, verifyClosed, onUpdated: () => { retired++; }, phase: value => { phase = value; },
+                    update: () => this.comments.updateComment(context.issueNumber, card.id, body) });
+                superseded || (superseded = verified.superseded);
+                remaining--;
             }
-            return [this.result(retired, nativeClosed)];
+            await verifyClosed();
+            return [this.result(retired, nativeClosed, superseded)];
         }
         catch (cause) {
             return [new result_1.Result({ id: this.taskId, success: false, executed: retired > 0,
                     steps: [nativeClosed ? 'Issue closure is retained; progress card retirement could not be fully verified. Retry the closed-issue event or merged-PR operation.' : 'Native issue closure could not be verified; progress cards were left unchanged.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Unable to retire progress cards safely.')],
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase, state, reason, changed: retired, remaining })],
                     payload: { nativeClosed, retiredCards: retired, reconciled: false } })];
         }
     }
-    result(retired, nativeClosed) {
+    result(retired, nativeClosed, superseded = false) {
         return new result_1.Result({ id: this.taskId, success: true, executed: retired > 0,
             steps: [retired ? 'The closed issue’s progress cards were retired.' : 'No progress card required retirement.'],
-            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true } });
+            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true, superseded,
+                outcome: nativeClosed ? retired ? 'reconciled' : 'already-converged' : 'not-applicable' } });
     }
 }
 exports.RetireProgressUseCase = RetireProgressUseCase;
@@ -54738,6 +55084,48 @@ function sameLabels(left, right) {
 }
 
 
+/***/ }),
+
+/***/ 78813:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.verifyClosedIssueCardRetirement = verifyClosedIssueCardRetirement;
+const reply_request_digest_1 = __nccwpck_require__(47971);
+const application_error_1 = __nccwpck_require__(75999);
+/** Adopt another invocation only after the exact final owned body and native closure are fresh. */
+async function verifyClosedIssueCardRetirement(input) {
+    const witness = (body) => Object.freeze({ surface: 'issue-comment',
+        commentId: input.commentId, author: input.author,
+        target: Object.freeze({ kind: 'issue', number: input.issueNumber }), bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(body) });
+    let updated = false;
+    let failedWrite;
+    if (input.originalBody !== input.finalBody) {
+        input.phase('card-freshness');
+        if (await input.freshness.matches(witness(input.originalBody))) {
+            await input.verifyClosed();
+            input.phase('card-update');
+            try {
+                await input.update();
+                updated = true;
+                input.onUpdated();
+            }
+            catch (cause) {
+                failedWrite = cause;
+            }
+        }
+    }
+    input.phase('card-verification');
+    if (!await input.freshness.matches(witness(input.finalBody))) {
+        throw failedWrite ?? new application_error_1.ApplicationError('workflow.stale', 'The required final owned card could not be verified.');
+    }
+    await input.verifyClosed();
+    return { updated, superseded: !updated && input.originalBody !== input.finalBody };
+}
+
+
 /***/ }),
 
 /***/ 4643:
@@ -54965,7 +55353,7 @@ class SyncBranchUseCase {
         const commands = (0, verify_command_policy_1.limitVerifyCommands)([...context.verifyCommands]);
         if (commands.length === verify_command_policy_1.MAX_VERIFY_COMMANDS)
             (0, logging_ports_1.logInfo)(`Branch sync verification is capped at ${verify_command_policy_1.MAX_VERIFY_COMMANDS} commands.`);
-        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true }));
+        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
         if (!verification.success) {
             return {
                 commandCount: commands.length,
@@ -57082,6 +57470,8 @@ function buildCatalogResponseSchema(source, ids, targetLocale = 'en-US') {
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ObservePullRequestApprovalUseCase = void 0;
+const application_error_1 = __nccwpck_require__(75999);
+const approval_evidence_error_1 = __nccwpck_require__(50519);
 const pull_request_approval_1 = __nccwpck_require__(8024);
 const pull_request_approval_policy_1 = __nccwpck_require__(98820);
 /** Read-first replay and exact-revision guard around the non-atomic GitHub review API. */
@@ -57095,8 +57485,9 @@ class ObservePullRequestApprovalUseCase {
         try {
             rawPolicy = await this.port.readPolicy(target);
         }
-        catch {
+        catch (cause) {
             return {
+                failure: evidenceFailure(cause, 'policy'),
                 decision: { status: 'blocked', code: 'policy-unavailable', detail: 'The installed PR approval policy could not be read from GitHub. Verify the runtime PAT can read Actions Variables, then rerun the observer. Existing PRs and reviews are unchanged.' },
                 publication: 'not-applicable',
             };
@@ -57117,8 +57508,9 @@ class ObservePullRequestApprovalUseCase {
         try {
             initial = await this.port.loadEvidence(target);
         }
-        catch {
+        catch (cause) {
             return {
+                failure: evidenceFailure(cause),
                 decision: { status: 'blocked', code: 'evidence-unavailable', detail: 'GitHub approval evidence could not be read; rerun this observer.' },
                 publication: 'not-applicable',
             };
@@ -57126,18 +57518,30 @@ class ObservePullRequestApprovalUseCase {
         if (initial.repositoryId !== target.repositoryId || initial.pullNumber !== target.pullNumber) {
             return { decision: { status: 'blocked', code: 'target-mismatch', detail: 'The resolved PR does not match the bound repository and number.' }, publication: 'not-applicable' };
         }
-        let decision = (0, pull_request_approval_1.decidePullRequestApproval)(policy, initial);
+        let failure = initial.diagnostics?.[0] ? (0, approval_evidence_error_1.approvalDiagnosticError)(initial.diagnostics[0]) : undefined;
+        let decision = failure
+            ? { status: 'blocked', code: 'evidence-unavailable', detail: 'Approval evidence is unavailable; inspect the causal diagnostic in the observer Job Summary.' }
+            : (0, pull_request_approval_1.decidePullRequestApproval)(policy, initial);
         let reviewId;
         if (decision.status === 'eligible') {
             let current;
             let currentPolicy;
+            let readOperation = 'evidence';
             try {
                 current = await this.port.loadEvidence(target);
+                readOperation = 'policy';
                 currentPolicy = await this.port.readPolicy(target);
             }
-            catch {
+            catch (cause) {
+                failure = evidenceFailure(cause, readOperation);
+                current = undefined;
                 decision = { status: 'blocked', code: 'pre-submit-unavailable', detail: 'Current approval evidence could not be reread before submission.' };
             }
+            if (current?.diagnostics?.length) {
+                failure = (0, approval_evidence_error_1.approvalDiagnosticError)(current.diagnostics[0]);
+                current = undefined;
+                decision = { status: 'blocked', code: 'pre-submit-unavailable', detail: 'Current evidence is unavailable; inspect the observer diagnostic.' };
+            }
             if (current && currentPolicy !== rawPolicy) {
                 decision = { status: 'pending', code: 'superseded', detail: 'The approval policy changed before submission; recheck the current head.' };
             }
@@ -57159,7 +57563,11 @@ class ObservePullRequestApprovalUseCase {
                         const botReviews = readback.reviews.filter(review => review.userId === current.botUserId)
                             .sort((left, right) => right.submittedAt.localeCompare(left.submittedAt) || right.id - left.id);
                         const observed = botReviews.find(review => review.state === 'APPROVED' && review.commitId === current.headSha);
-                        if (observed && observed.userId === current.botUserId
+                        if (readback.diagnostics?.length) {
+                            failure = (0, approval_evidence_error_1.approvalDiagnosticError)(readback.diagnostics[0]);
+                            decision = { status: 'pending', code: 'publication-unknown', detail: 'GitHub may have accepted the review; its final evidence is unavailable. Inspect the observer diagnostic before rechecking.' };
+                        }
+                        else if (observed && observed.userId === current.botUserId
                             && observed.state === 'APPROVED' && observed.commitId === current.headSha
                             && !botReviews.some(review => review.state === 'DISMISSED' && review.commitId === current.headSha)
                             && readback.headSha === current.headSha && readback.baseSha === current.baseSha) {
@@ -57170,7 +57578,8 @@ class ObservePullRequestApprovalUseCase {
                             decision = { status: 'pending', code: 'publication-unknown', detail: 'GitHub may have accepted the review; rerun to read it before any new submission.' };
                         }
                     }
-                    catch {
+                    catch (cause) {
+                        failure = evidenceFailure(cause);
                         decision = { status: 'pending', code: 'publication-unknown', detail: 'GitHub may have accepted the review; rerun to read it before any new submission.' };
                     }
                 }
@@ -57179,11 +57588,11 @@ class ObservePullRequestApprovalUseCase {
         try {
             // The adapter guards the current head again before editing the single card.
             await this.port.publishAssessment(target, initial, decision, reviewId);
-            return { decision, headSha: initial.headSha, evidence: initial, mode: policy.mode,
+            return { decision, ...(failure ? { failure } : {}), headSha: initial.headSha, evidence: initial, mode: policy.mode,
                 ...(reviewId ? { reviewId } : {}), publication: 'published' };
         }
         catch {
-            return { decision, headSha: initial.headSha, evidence: initial, mode: policy.mode,
+            return { decision, ...(failure ? { failure } : {}), headSha: initial.headSha, evidence: initial, mode: policy.mode,
                 ...(reviewId ? { reviewId } : {}), publication: 'failed' };
         }
     }
@@ -57199,6 +57608,10 @@ function sameRevisionAndEvidence(left, right) {
 function approvalReviewBody(headSha) {
     return `<!-- copilot:guarded-approval:v1 head="${headSha}" -->\nCopilot approved this revision (${headSha.slice(0, 7)}) after its configured CI and coverage gates passed and Bugbot reported no blocking findings. GitHub still applies branch rules. Configure a separate human-review requirement if needed; a bot approval may count toward a generic approval minimum.`;
 }
+function evidenceFailure(cause, operation = 'evidence') {
+    return cause instanceof application_error_1.ApplicationError && cause.recovery?.id === 'approval-evidence-read-failed'
+        ? cause : (0, approval_evidence_error_1.approvalEvidenceError)(operation, 'transport-unavailable');
+}
 
 
 /***/ }),
@@ -60806,7 +61219,7 @@ async function runVerification(context, gitCommitPort) {
     if (verifyCommands.length === 0)
         return undefined;
     (0, logging_ports_1.logInfo)(`Running ${verifyCommands.length} verify ${verifyCommands.length === 1 ? 'command' : 'commands'}...`);
-    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true }));
+    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
     return verify.success
         ? undefined
         : verify.error ?? `Verify command failed: ${verify.failedCommand ?? "unknown"}.`;
@@ -63029,6 +63442,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runVerifyCommands = runVerifyCommands;
 const logging_ports_1 = __nccwpck_require__(6152);
 const verify_command_policy_1 = __nccwpck_require__(96031);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
 async function runVerifyCommands(commands, execute) {
     for (const command of commands) {
         const result = await executeVerifyCommand(command, execute);
@@ -63047,7 +63461,11 @@ async function executeVerifyCommand(command, execute) {
             ? { success: true }
             : { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
-    catch {
+    catch (error) {
+        if (error instanceof verification_runtime_policy_1.VerificationPrerequisiteError) {
+            return { success: false, failedCommand: formatCommandForDiagnostics(parsed),
+                error: `${error.message} Verification command: ${formatCommandForDiagnostics(parsed)}.` };
+        }
         (0, logging_ports_1.logError)('Verify command failed.');
         return { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
@@ -65764,6 +66182,7 @@ exports.titleUpdateFailure = titleUpdateFailure;
 const result_1 = __nccwpck_require__(73817);
 const application_error_1 = __nccwpck_require__(75999);
 const positive_integer_policy_1 = __nccwpck_require__(19879);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 function projectUpdateTitleContext(source) {
     if (source.isIssue) {
         return Object.freeze({
@@ -65814,19 +66233,27 @@ async function runPullRequestTitleUpdate(param, taskId, issueRepository) {
     if (!linkedIssueNumber || linkedIssueNumber === param.pullRequestNumber) {
         return [skippedResult(taskId)];
     }
+    const currentTitle = await issueRepository.getTitle(param.pullRequestNumber);
+    if (currentTitle === undefined) {
+        return [new result_1.Result({ id: taskId, success: false, executed: true,
+                steps: ['The current pull request title could not be read. No title change was attempted.'],
+                errors: [new application_error_1.ApplicationError('provider.unavailable', 'Unable to read the current pull request title.')] })];
+    }
+    if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(currentTitle))
+        return [skippedResult(taskId)];
     const issueTitle = await issueRepository.getTitle(linkedIssueNumber);
     if (issueTitle === undefined) {
         return [new result_1.Result({ id: taskId, success: false, executed: true, steps: ['Tried to update title, but there was a problem.'] })];
     }
     const title = await issueRepository.updatePullRequestTitle({
-        pullRequestTitle: param.pullRequestTitle,
+        pullRequestTitle: currentTitle,
         issueTitle,
         issueNumber: linkedIssueNumber,
         pullRequestNumber: param.pullRequestNumber,
         labelFacts: param.labelFacts,
     });
     return title
-        ? [updatedResult(taskId, `The pull request's title was updated from \`${param.pullRequestTitle}\` to \`${title}\`.`)]
+        ? [updatedResult(taskId, `The pull request's title was updated from \`${currentTitle}\` to \`${title}\`.`)]
         : [skippedResult(taskId)];
 }
 function titleUpdateFailure(taskId, error) {
@@ -66269,6 +66696,8 @@ exports.CheckPriorityIssueSizeUseCase = CheckPriorityIssueSizeUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CloseIssueAfterMergingUseCase = void 0;
+const reconcile_issue_completion_metadata_1 = __nccwpck_require__(70614);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
 const result_1 = __nccwpck_require__(73817);
 const issue_completion_1 = __nccwpck_require__(31147);
 const application_error_1 = __nccwpck_require__(75999);
@@ -66287,7 +66716,7 @@ class CloseIssueAfterMergingUseCase {
                     steps: ['No separate safe linked issue and pull request were found; issue closure was skipped.'] })];
         let closedThisRun = false;
         let nativeClosed = false;
-        let labelsChanged = 0;
+        const progress = (0, reconcile_issue_completion_metadata_1.completionRepairProgress)();
         try {
             const pull = await this.issues.readPullRequest(pullNumber);
             if (pull.number !== pullNumber || pull.state !== 'closed' || pull.merged !== true)
@@ -66311,44 +66740,21 @@ class CloseIssueAfterMergingUseCase {
             nativeClosed = facts.state === 'closed';
             if (!nativeClosed || closedThisRun && facts.reason !== 'completed')
                 throw stale();
-            const fence = async () => {
-                const freshFacts = await read();
-                const freshPlan = (0, issue_completion_1.planIssueCompletion)(freshFacts, param.completionLabels);
-                if (freshPlan.kind !== 'closed' || freshFacts.reason !== facts.reason)
-                    throw stale();
-                return freshPlan;
-            };
-            const plan = (0, issue_completion_1.planIssueCompletion)(facts, param.completionLabels);
-            if (plan.kind !== 'closed')
-                throw stale();
-            for (const label of plan.remove) {
-                const fresh = await fence();
-                if (fresh.remove.includes(label)) {
-                    await target.removeLabel(label);
-                    labelsChanged++;
-                }
-            }
-            for (const label of plan.add) {
-                const fresh = await fence();
-                if (fresh.add.includes(label)) {
-                    await target.addLabel(label);
-                    labelsChanged++;
-                }
-            }
-            const final = await fence();
-            if (final.remove.length || final.add.length)
-                throw stale();
-            return [new result_1.Result({ id: this.taskId, success: true, executed: closedThisRun || labelsChanged > 0,
+            const repaired = await (0, reconcile_issue_completion_metadata_1.reconcileIssueCompletionMetadata)(target, number, param.completionLabels, progress, facts);
+            nativeClosed = progress.nativeClosed;
+            return [new result_1.Result({ id: this.taskId, success: true, executed: closedThisRun || progress.labelsChanged > 0,
                     steps: [`Issue #${number} is closed and its completion metadata was verified after PR #${pullNumber} merged.`],
-                    payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged, reason: facts.reason, reconciled: true }) } })];
+                    payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged: progress.labelsChanged, ...repaired, reconciled: true }) } })];
         }
         catch (error) {
-            const semanticError = (0, application_error_1.toApplicationError)(error, 'provider.unavailable', nativeClosed
-                ? 'The issue is closed, but completion metadata could not be fully verified. Retry the verified merged-PR operation.'
-                : 'Native issue completion could not be verified. Inspect the linked run before retrying.');
-            return [new result_1.Result({ id: this.taskId, success: false, executed: closedThisRun || labelsChanged > 0,
+            if (progress.phase !== 'identity')
+                nativeClosed = progress.nativeClosed;
+            const semanticError = (0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(error, { resultId: this.taskId,
+                phase: progress.phase, state: progress.state, reason: progress.reason,
+                changed: progress.labelsChanged, remaining: progress.remaining });
+            return [new result_1.Result({ id: this.taskId, success: false, executed: closedThisRun || progress.labelsChanged > 0,
                     steps: [nativeClosed ? 'The native issue closure was retained; completion metadata remains unverified.' : 'Native issue completion remains unverified.'],
-                    errors: [semanticError], payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged, reconciled: false }) } })];
+                    errors: [semanticError], payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged: progress.labelsChanged, reconciled: false }) } })];
         }
     }
 }
@@ -68363,6 +68769,8 @@ var _ApplicationError_cause;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ApplicationError = exports.APPLICATION_ERROR_METADATA = exports.APPLICATION_ERROR_RECOVERY_IDS = void 0;
 exports.isApplicationErrorCorrelationId = isApplicationErrorCorrelationId;
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
 const branch_sync_validation_1 = __nccwpck_require__(90981);
 exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'pull-request-link-restored',
@@ -68378,6 +68786,8 @@ exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'sdd-draft-size-exceeded',
     'sdd-draft-format-invalid',
     'workspace-changes-rejected',
+    'closed-issue-reconciliation-failed',
+    'approval-evidence-read-failed',
 ]);
 const PRESERVED_STATE = 'Existing persisted state and completed external effects were preserved.';
 const UNCHANGED_STATE = 'No new state or external effect was created.';
@@ -68569,6 +68979,8 @@ class ApplicationError extends Error {
 exports.ApplicationError = ApplicationError;
 _ApplicationError_cause = new WeakMap();
 const RECOVERY_VARIABLE_KEYS = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze(['resultId', 'phase', 'state', 'reason', 'changed', 'remaining']),
+    'approval-evidence-read-failed': Object.freeze(['operation', 'reason', 'permission']),
     'pull-request-link-restored': Object.freeze([]),
     'pull-request-link-base-retained': Object.freeze([]),
     'pull-request-link-reference-retained': Object.freeze([]),
@@ -68621,6 +69033,20 @@ function normalizeApplicationErrorRecovery(recovery) {
         && !branch_sync_validation_1.BRANCH_SYNC_VALIDATION_CODES.some(code => code === variables.validationCode)) {
         throw new TypeError('Application error recovery synchronization validation code is invalid.');
     }
+    if (recovery.id === 'closed-issue-reconciliation-failed'
+        && (!closed_issue_reconciliation_1.CLOSED_ISSUE_RESULTS.some(value => value === variables.resultId)
+            || !closed_issue_reconciliation_1.CLOSED_ISSUE_PHASES.some(value => value === variables.phase)
+            || !['open', 'closed', 'unavailable'].includes(variables.state)
+            || !closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === variables.reason)
+            || ![variables.changed, variables.remaining].every(value => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= 3000))) {
+        throw new TypeError('Closed issue reconciliation diagnostic is invalid.');
+    }
+    if (recovery.id === 'approval-evidence-read-failed'
+        && (!Object.prototype.hasOwnProperty.call(approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS, variables.operation)
+            || !approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_REASONS.some(reason => reason === variables.reason)
+            || approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS[variables.operation] !== variables.permission)) {
+        throw new TypeError('Approval evidence diagnostic is invalid.');
+    }
     return Object.freeze({
         id: recovery.id,
         variables: Object.freeze({ ...variables }),
@@ -75228,6 +75654,7 @@ exports.IssueProgressTrackingRepository = IssueProgressTrackingRepository;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.IssueTitleRepository = void 0;
 const issue_emoji_policy_1 = __nccwpck_require__(81201);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 const issue_title_policy_1 = __nccwpck_require__(83179);
 const issue_title_update_1 = __nccwpck_require__(9229);
 class IssueTitleRepository {
@@ -75245,10 +75672,12 @@ class IssueTitleRepository {
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, issueTitle, formattedTitle, issueNumber, token);
             });
         };
-        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, branchManagementEmoji, labels, token) => {
+        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, _branchManagementEmoji, labels, token) => {
             return (0, issue_title_update_1.withTitleUpdateLogging)(() => {
-                const emoji = (0, issue_emoji_policy_1.resolvePullRequestTitleEmoji)(labels, branchManagementEmoji);
-                const formattedTitle = `[#${issueNumber}] ${emoji} - ${(0, issue_title_policy_1.sanitizePullRequestTitle)((0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber))}`;
+                if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(pullRequestTitle))
+                    return Promise.resolve(undefined);
+                const sourceTitle = (0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber);
+                const formattedTitle = (0, pull_request_title_policy_1.generatedPullRequestTitle)(sourceTitle, (0, issue_title_policy_1.sanitizePullRequestTitle)(sourceTitle), issueNumber, labels);
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, pullRequestTitle, formattedTitle, pullRequestNumber, token);
             });
         };
@@ -76543,6 +76972,41 @@ function parseApprovalCoverageZip(value) {
 }
 
 
+/***/ }),
+
+/***/ 9958:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readApprovalEvidence = readApprovalEvidence;
+const application_error_1 = __nccwpck_require__(75999);
+const approval_evidence_error_1 = __nccwpck_require__(50519);
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
+/** Terminates provider exceptions; even unknown statuses never interpolate provider text. */
+async function readApprovalEvidence(operation, read) {
+    try {
+        return await read();
+    }
+    catch (cause) {
+        if (cause instanceof application_error_1.ApplicationError && cause.recovery?.id === 'approval-evidence-read-failed')
+            throw cause;
+        const error = cause && typeof cause === 'object' ? cause : undefined;
+        const response = error?.response;
+        const status = error?.status;
+        const rateLimited = status === 403 && (response?.headers?.['x-ratelimit-remaining'] === '0'
+            || typeof response?.headers?.['retry-after'] === 'string' && /^\d{1,8}$/u.test(response.headers['retry-after']));
+        const http = typeof status === 'number' ? `http-${status}` : undefined;
+        const reason = rateLimited ? 'http-429'
+            : approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_REASONS.some(value => value === http) ? http
+                : cause instanceof application_error_1.ApplicationError && cause.code === 'provider.contract-invalid' ? 'invalid-response'
+                    : status === undefined ? 'transport-unavailable' : 'invalid-response';
+        throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, reason);
+    }
+}
+
+
 /***/ }),
 
 /***/ 55165:
@@ -76577,21 +77041,22 @@ exports.BugbotPullRequestRepository = BugbotPullRequestRepository;
 /***/ }),
 
 /***/ 68742:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.readCurrentBaseRevision = readCurrentBaseRevision;
+const application_error_1 = __nccwpck_require__(75999);
 /** PR base metadata can lag a parent push; read the exact native branch ref. */
 async function readCurrentBaseRevision(port, target, baseRef) {
     if (typeof baseRef !== 'string' || baseRef.length === 0 || baseRef.length > 1024
         || baseRef.includes('\u0000') || /[\r\n]/u.test(baseRef))
-        throw new Error('The PR base ref is invalid.');
+        throw new application_error_1.ApplicationError('provider.contract-invalid', 'The PR base ref is invalid.');
     const { data } = await port.getRef({ owner: target.owner, repo: target.repository, ref: `heads/${baseRef}` });
     if (data?.ref !== `refs/heads/${baseRef}` || data.object?.type !== 'commit' || typeof data.object.sha !== 'string'
         || !/^[a-f0-9]{40}$/u.test(data.object.sha))
-        throw new Error('The PR base ref cannot be verified.');
+        throw new application_error_1.ApplicationError('provider.contract-invalid', 'The PR base ref cannot be verified.');
     return data.object.sha;
 }
 
@@ -76639,6 +77104,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PullRequestApprovalRepository = void 0;
 exports.readEffectiveApprovalPolicy = readEffectiveApprovalPolicy;
+const approval_evidence_read_1 = __nccwpck_require__(9958);
+const approval_evidence_error_1 = __nccwpck_require__(50519);
+const application_error_1 = __nccwpck_require__(75999);
 const current_base_revision_query_1 = __nccwpck_require__(68742);
 const logging_ports_1 = __nccwpck_require__(6152);
 const github = __importStar(__nccwpck_require__(78227));
@@ -76665,40 +77133,64 @@ class PullRequestApprovalRepository {
         }
     }
     async readPolicy(target) {
-        return (await this.readEffectivePolicy(target))?.value;
+        return (0, approval_evidence_read_1.readApprovalEvidence)('policy', async () => (await this.readEffectivePolicy(target))?.value);
     }
     async readEffectivePolicy(target) {
         return readEffectiveApprovalPolicy(this.octokit, target);
     }
     async loadEvidence(target) {
-        const { data: pull } = await this.octokit.rest.pulls.get({
-            owner: target.owner, repo: target.repository, pull_number: target.pullNumber,
+        const diagnostics = [];
+        const { data: pull } = await (0, approval_evidence_read_1.readApprovalEvidence)('pull-request', async () => {
+            const response = await this.octokit.rest.pulls.get({ owner: target.owner, repo: target.repository, pull_number: target.pullNumber });
+            if (!response.data?.head || !response.data?.base || typeof response.data.head.sha !== 'string'
+                || typeof response.data.head.ref !== 'string' || !Number.isSafeInteger(response.data.number)) {
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('pull-request', 'invalid-response');
+            }
+            return response;
         });
         const headSha = pull.head.sha;
         const baseSha = await this.readCurrentBaseSha(target, pull.base.ref);
-        const policy = (0, pull_request_approval_policy_1.parsePullRequestApprovalPolicy)(await this.readPolicy(target));
+        const policy = await (0, approval_evidence_read_1.readApprovalEvidence)('policy', async () => {
+            const raw = await this.readPolicy(target);
+            try {
+                return (0, pull_request_approval_policy_1.parsePullRequestApprovalPolicy)(raw);
+            }
+            catch {
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('policy', 'invalid-response');
+            }
+        });
         let testedMergeSha;
         if (pull.mergeable === true && /^[a-f0-9]{40}$/iu.test(pull.merge_commit_sha ?? '')) {
             try {
-                const merge = await this.octokit.rest.git.getCommit({
-                    owner: target.owner, repo: target.repository, commit_sha: pull.merge_commit_sha,
+                const merge = await (0, approval_evidence_read_1.readApprovalEvidence)('merge-commit', async () => {
+                    const response = await this.octokit.rest.git.getCommit({ owner: target.owner, repo: target.repository, commit_sha: pull.merge_commit_sha });
+                    if (!Array.isArray(response.data?.parents))
+                        throw (0, approval_evidence_error_1.approvalEvidenceError)('merge-commit', 'invalid-response');
+                    return response;
                 });
                 if (merge.data.parents[0]?.sha === baseSha && merge.data.parents[1]?.sha === headSha
                     && merge.data.parents.length === 2)
                     testedMergeSha = pull.merge_commit_sha;
             }
-            catch { /* Missing or unreadable merge parentage is non-authorizing. */ }
+            catch (cause) {
+                collectDiagnostic(diagnostics, cause);
+            }
         }
         const [files, reviews, comments, headChecks, mergeChecks, headRuns, mergeRuns, rules, user] = await Promise.all([
-            this.allPages(this.octokit.rest.pulls.listFiles, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.pulls.listReviews, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.issues.listComments, { owner: target.owner, repo: target.repository, issue_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: headSha, filter: 'all' }),
-            testedMergeSha ? this.allPages(this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: testedMergeSha, filter: 'all' }) : Promise.resolve([]),
-            this.allPages(this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: headSha }),
-            testedMergeSha ? this.allPages(this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: testedMergeSha }) : Promise.resolve([]),
-            this.effectiveRules(target.owner, target.repository, pull.base.ref),
-            this.octokit.rest.users.getAuthenticated(),
+            this.allPages('files', this.octokit.rest.pulls.listFiles, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
+            this.allPages('reviews', this.octokit.rest.pulls.listReviews, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
+            this.allPages('comments', this.octokit.rest.issues.listComments, { owner: target.owner, repo: target.repository, issue_number: target.pullNumber }),
+            this.allPages('head-checks', this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: headSha, filter: 'all' }),
+            testedMergeSha ? this.allPages('merge-checks', this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: testedMergeSha, filter: 'all' }) : Promise.resolve([]),
+            this.allPages('head-runs', this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: headSha }),
+            testedMergeSha ? this.allPages('merge-runs', this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: testedMergeSha }) : Promise.resolve([]),
+            this.effectiveRules(target.owner, target.repository, pull.base.ref, diagnostics),
+            (0, approval_evidence_read_1.readApprovalEvidence)('authenticated-user', async () => {
+                const response = await this.octokit.rest.users.getAuthenticated();
+                if (!Number.isSafeInteger(response.data?.id) || response.data.id < 1)
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)('authenticated-user', 'invalid-response');
+                return response;
+            }),
         ]);
         const branch = Object.entries(this.settings.branchPrefixes)
             .find(([, prefix]) => pull.head.ref.startsWith(`${prefix}/`));
@@ -76719,7 +77211,7 @@ class PullRequestApprovalRepository {
         });
         const currentJobs = await Promise.all(latestRuns.map(async (run) => ({
             run,
-            jobs: await this.allPages(this.octokit.rest.actions.listJobsForWorkflowRunAttempt, {
+            jobs: await this.allPages('jobs', this.octokit.rest.actions.listJobsForWorkflowRunAttempt, {
                 owner: target.owner, repo: target.repository, run_id: run.id, attempt_number: run.run_attempt,
             }),
         })));
@@ -76750,9 +77242,10 @@ class PullRequestApprovalRepository {
             submittedAt: review.submitted_at ?? '',
         }));
         const numericCoverage = policy.coverage.mode === 'numeric'
-            ? await this.numericCoverage(target, policy.coverage.artifactWorkflowName, headSha, baseSha, testedMergeSha, workflowRuns)
+            ? await this.numericCoverage(target, policy.coverage.artifactWorkflowName, headSha, baseSha, testedMergeSha, workflowRuns, diagnostics)
             : undefined;
         return {
+            ...(diagnostics.length ? { diagnostics: Object.freeze(diagnostics) } : {}),
             repositoryId: pull.base.repo?.id ?? 0,
             pullNumber: pull.number,
             headSha,
@@ -76786,7 +77279,7 @@ class PullRequestApprovalRepository {
             ...(numericCoverage ? { numericCoverage } : {}),
         };
     }
-    async numericCoverage(target, workflowName, headSha, baseSha, testedMergeSha, workflowRuns) {
+    async numericCoverage(target, workflowName, headSha, baseSha, testedMergeSha, workflowRuns, diagnostics) {
         const candidates = workflowRuns.filter(run => run.name === workflowName
             && (run.head_sha === headSha || run.head_sha === testedMergeSha));
         const mergeCandidates = candidates.filter(run => run.head_sha === testedMergeSha);
@@ -76795,25 +77288,27 @@ class PullRequestApprovalRepository {
         if (!run || run.conclusion !== 'success' || run.status !== 'completed')
             return undefined;
         try {
-            const artifacts = await this.allPages(this.octokit.rest.actions.listWorkflowRunArtifacts, {
+            const artifacts = await this.allPages('coverage-artifacts', this.octokit.rest.actions.listWorkflowRunArtifacts, {
                 owner: target.owner, repo: target.repository, run_id: run.id,
             });
             const matches = artifacts.filter(artifact => artifact.name === 'copilot-diff-coverage-v1' && !artifact.expired);
             if (matches.length !== 1 || matches[0].size_in_bytes > 64 * 1024)
-                return undefined;
-            const response = await this.octokit.rest.actions.downloadArtifact({
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-artifacts', 'artifact-unavailable');
+            const response = await (0, approval_evidence_read_1.readApprovalEvidence)('coverage-download', async () => this.octokit.rest.actions.downloadArtifact({
                 owner: target.owner, repo: target.repository, artifact_id: matches[0].id, archive_format: 'zip',
-            });
+            }));
             const data = response.data;
             const bytes = data instanceof ArrayBuffer ? new Uint8Array(data)
                 : data instanceof Uint8Array ? data
                     : typeof data === 'string' ? Buffer.from(data, 'binary') : undefined;
             const attestation = bytes ? (0, approval_coverage_artifact_1.parseApprovalCoverageZip)(bytes) : undefined;
-            if (!attestation || attestation.repositoryId !== target.repositoryId
+            if (!attestation)
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-parse', 'artifact-invalid');
+            if (attestation.repositoryId !== target.repositoryId
                 || attestation.pullNumber !== target.pullNumber || attestation.headSha !== headSha
                 || attestation.baseSha !== baseSha || attestation.workflowRunId !== run.id
                 || attestation.workflowRunAttempt !== run.run_attempt)
-                return undefined;
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-parse', 'artifact-mismatch');
             return {
                 coveredChangedLines: attestation.coveredChangedLines,
                 totalChangedLines: attestation.totalChangedLines,
@@ -76821,7 +77316,8 @@ class PullRequestApprovalRepository {
                 baseSha,
             };
         }
-        catch {
+        catch (cause) {
+            collectDiagnostic(diagnostics, cause);
             return undefined;
         }
     }
@@ -76847,7 +77343,7 @@ class PullRequestApprovalRepository {
             throw new Error('PR head or base changed before assessment publication.');
         }
         const user = await this.octokit.rest.users.getAuthenticated();
-        const comments = await this.allPages(this.octokit.rest.issues.listComments, {
+        const comments = await this.allPages('comments', this.octokit.rest.issues.listComments, {
             owner: target.owner, repo: target.repository, issue_number: target.pullNumber,
         });
         const card = [...comments].reverse().find(comment => comment.user?.id === user.data.id
@@ -76893,24 +77389,26 @@ class PullRequestApprovalRepository {
         }
     }
     async readCurrentBaseSha(target, baseRef) {
-        return (0, current_base_revision_query_1.readCurrentBaseRevision)(this.octokit.rest.git, target, baseRef);
+        return (0, approval_evidence_read_1.readApprovalEvidence)('base-ref', () => (0, current_base_revision_query_1.readCurrentBaseRevision)(this.octokit.rest.git, target, baseRef));
     }
-    async effectiveRules(owner, repo, branch) {
+    async effectiveRules(owner, repo, branch, diagnostics) {
         try {
-            const rulesResponse = await this.octokit.request('GET /repos/{owner}/{repo}/rules/branches/{branch}', { owner, repo, branch });
+            const rulesResponse = await (0, approval_evidence_read_1.readApprovalEvidence)('rules', async () => this.octokit.request('GET /repos/{owner}/{repo}/rules/branches/{branch}', { owner, repo, branch }));
             if (!Array.isArray(rulesResponse.data) || rulesResponse.data.some((rule) => !record(rule)
                 || typeof record(rule)?.type !== 'string' || record(rule)?.type === '')) {
-                throw new Error('GitHub returned an invalid effective rules inventory.');
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('rules', 'invalid-response');
             }
             const rules = rulesResponse.data;
             let classic;
             try {
                 const response = await this.octokit.rest.repos.getBranchProtection({ owner, repo, branch });
+                if (!record(response.data))
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)('classic-protection', 'invalid-response');
                 classic = response.data;
             }
             catch (error) {
                 if (statusOf(error) !== 404)
-                    throw error;
+                    await (0, approval_evidence_read_1.readApprovalEvidence)('classic-protection', async () => { throw error; });
             }
             const reviewRules = rules.filter(rule => rule.type === 'pull_request');
             const classicReview = classic?.required_pull_request_reviews;
@@ -76936,23 +77434,26 @@ class PullRequestApprovalRepository {
             }
             return { readable: true, dismissesStaleReviews: hasStaleRule && allStale, requiredChecks: [...requiredChecks] };
         }
-        catch {
+        catch (cause) {
+            collectDiagnostic(diagnostics, cause);
             return { readable: false, dismissesStaleReviews: false, requiredChecks: [] };
         }
     }
-    async allPages(method, params) {
-        const result = [];
-        for await (const response of this.octokit.paginate.iterator(method, { ...params, per_page: 100 })) {
-            const page = Array.isArray(response.data) ? response.data
-                : record(response.data)?.check_runs ?? record(response.data)?.workflow_runs
-                    ?? record(response.data)?.artifacts ?? record(response.data)?.jobs;
-            if (!Array.isArray(page))
-                throw new Error('GitHub pagination returned an invalid page.');
-            result.push(...page);
-            if (result.length > 3000)
-                throw new Error('Approval evidence pagination exceeded the safe bound.');
-        }
-        return result;
+    async allPages(operation, method, params) {
+        return (0, approval_evidence_read_1.readApprovalEvidence)(operation, async () => {
+            const result = [];
+            for await (const response of this.octokit.paginate.iterator(method, { ...params, per_page: 100 })) {
+                const page = Array.isArray(response.data) ? response.data
+                    : record(response.data)?.check_runs ?? record(response.data)?.workflow_runs
+                        ?? record(response.data)?.artifacts ?? record(response.data)?.jobs;
+                if (!Array.isArray(page))
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, 'invalid-page');
+                result.push(...page);
+                if (result.length > 3000)
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, 'page-limit');
+            }
+            return result;
+        });
     }
 }
 exports.PullRequestApprovalRepository = PullRequestApprovalRepository;
@@ -76989,7 +77490,7 @@ function array(value) { return Array.isArray(value) ? value : []; }
 async function readEffectiveApprovalPolicy(octokit, target) {
     const admit = (source, value) => {
         if (typeof value !== 'string' || value.length > 65536)
-            throw new Error('Approval policy response is malformed or unbounded.');
+            throw new application_error_1.ApplicationError('provider.contract-invalid', 'Approval policy response is malformed or unbounded.');
         return { source, value };
     };
     try {
@@ -77013,6 +77514,14 @@ async function readEffectiveApprovalPolicy(octokit, target) {
         throw error;
     }
 }
+function collectDiagnostic(diagnostics, cause) {
+    if (cause instanceof application_error_1.ApplicationError && cause.recovery?.id === 'approval-evidence-read-failed') {
+        diagnostics.push(cause.recovery.variables);
+    }
+    else {
+        diagnostics.push((0, approval_evidence_error_1.approvalEvidenceError)('evidence', 'invalid-response').recovery.variables);
+    }
+}
 
 
 /***/ }),
@@ -79253,6 +79762,44 @@ class AgentResponseLengthFailure extends Error {
 exports.AgentResponseLengthFailure = AgentResponseLengthFailure;
 
 
+/***/ }),
+
+/***/ 98205:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.APPROVAL_EVIDENCE_REASONS = exports.APPROVAL_EVIDENCE_PERMISSIONS = void 0;
+/** Closed vocabulary: no provider text, URLs, headers, policy values or credentials. */
+exports.APPROVAL_EVIDENCE_PERMISSIONS = Object.freeze({
+    'evidence': 'repository-read',
+    'pull-request': 'pull-requests-read',
+    'base-ref': 'contents-read',
+    'merge-commit': 'contents-read',
+    'policy': 'actions-variables-read',
+    'files': 'pull-requests-read',
+    'reviews': 'pull-requests-read',
+    'comments': 'issues-read',
+    'head-checks': 'checks-read',
+    'merge-checks': 'checks-read',
+    'head-runs': 'actions-read',
+    'merge-runs': 'actions-read',
+    'jobs': 'actions-read',
+    'rules': 'metadata-read',
+    'classic-protection': 'administration-read',
+    'authenticated-user': 'authenticated-user-read',
+    'coverage-artifacts': 'actions-read',
+    'coverage-download': 'actions-read',
+    'coverage-parse': 'actions-read',
+});
+exports.APPROVAL_EVIDENCE_REASONS = Object.freeze([
+    'http-400', 'http-401', 'http-403', 'http-404', 'http-409', 'http-422', 'http-429',
+    'http-500', 'http-502', 'http-503', 'http-504', 'transport-unavailable',
+    'invalid-response', 'invalid-page', 'page-limit', 'artifact-unavailable', 'artifact-invalid', 'artifact-mismatch',
+]);
+
+
 /***/ }),
 
 /***/ 51114:
@@ -79813,6 +80360,25 @@ function countActionableBugbotFindings(counts) {
 }
 
 
+/***/ }),
+
+/***/ 21565:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CLOSED_ISSUE_REASONS = exports.CLOSED_ISSUE_PHASES = exports.CLOSED_ISSUE_RESULTS = void 0;
+exports.CLOSED_ISSUE_RESULTS = Object.freeze([
+    'ReconcileClosedIssueMetadataUseCase', 'CloseIssueAfterMergingUseCase', 'RetireBranchSyncUseCase', 'RetireProgressUseCase',
+]);
+exports.CLOSED_ISSUE_PHASES = Object.freeze([
+    'identity', 'read', 'native-fence', 'label-remove', 'label-add', 'metadata-verification',
+    'card-inventory', 'card-freshness', 'card-update', 'card-verification',
+]);
+exports.CLOSED_ISSUE_REASONS = Object.freeze(['completed', 'not_planned', 'duplicate', 'reopened', 'unknown', 'unavailable']);
+
+
 /***/ }),
 
 /***/ 77454:
@@ -86711,6 +87277,7 @@ const exec = __importStar(__nccwpck_require__(18538));
 const git_authentication_environment_1 = __nccwpck_require__(16535);
 const untrusted_command_environment_1 = __nccwpck_require__(2304);
 const git_hook_isolation_1 = __nccwpck_require__(39764);
+const verification_runtime_preflight_1 = __nccwpck_require__(23100);
 class GitCommitAdapter {
     constructor(executeCommand = (program, args, options) => options
         ? exec.exec(program, args, {
@@ -86720,16 +87287,21 @@ class GitCommitAdapter {
             ...(options.stdout ? { listeners: { stdout: options.stdout } } : {}),
             ...(options.env ? { env: options.env } : {}),
         })
-        : exec.exec(program, args)) {
+        : exec.exec(program, args), checkPrerequisites = verification_runtime_preflight_1.assertVerificationRuntimePrerequisites) {
         this.executeCommand = executeCommand;
+        this.checkPrerequisites = checkPrerequisites;
     }
     async execute(program, args, options) {
+        if (options?.verifyRuntimePrerequisites && !options.untrusted)
+            throw new Error('Runtime preflight requires credential-free verification.');
         if (!options?.untrusted)
             return options ? this.executeCommand(program, args, options) : this.executeCommand(program, args);
         if (options.env)
             throw new Error('Untrusted command execution does not accept a caller-supplied environment.');
         const runtime = (0, untrusted_command_environment_1.prepareUntrustedCommandEnvironment)();
         try {
+            if (options.verifyRuntimePrerequisites)
+                this.checkPrerequisites(runtime.environment);
             return await this.executeCommand(program, args, {
                 ...(options.stdout ? { stdout: options.stdout } : {}),
                 env: runtime.environment,
@@ -88044,6 +88616,7 @@ const node_path_1 = __nccwpck_require__(49411);
 const agent_private_install_root_1 = __nccwpck_require__(44640);
 const ALLOWED_VARIABLES = [
     'PATH',
+    'JAVA_HOME',
     'LANG',
     'LANGUAGE',
     'LC_ALL',
@@ -88103,6 +88676,132 @@ function prepareUntrustedCommandEnvironment(source = process.env, platform = pro
 }
 
 
+/***/ }),
+
+/***/ 91053:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readVerificationRuntimeManifest = readVerificationRuntimeManifest;
+const node_fs_1 = __nccwpck_require__(87561);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const MAX_MANIFEST_BYTES = 16 * 1024;
+function readVerificationRuntimeManifest(root) {
+    const path = (0, node_path_1.resolve)(root, verification_runtime_policy_1.VERIFICATION_RUNTIME_MANIFEST);
+    let descriptor;
+    try {
+        let directory;
+        try {
+            directory = (0, node_fs_1.lstatSync)((0, node_path_1.join)(root, '.copilot'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!directory.isDirectory() || directory.isSymbolicLink()
+            || (0, node_fs_1.realpathSync)((0, node_path_1.join)(root, '.copilot')) !== (0, node_path_1.join)((0, node_fs_1.realpathSync)(root), '.copilot'))
+            throw new Error('Unsafe manifest parent');
+        let entry;
+        try {
+            entry = (0, node_fs_1.lstatSync)(path, { bigint: true });
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1n || entry.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Unsafe manifest');
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const opened = (0, node_fs_1.fstatSync)(descriptor, { bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== entry.dev || opened.ino !== entry.ino
+            || opened.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Manifest changed');
+        const bytes = Buffer.alloc(MAX_MANIFEST_BYTES + 1);
+        const size = (0, node_fs_1.readSync)(descriptor, bytes, 0, bytes.length, 0);
+        if (size > MAX_MANIFEST_BYTES)
+            throw new Error('Oversized manifest');
+        return (0, verification_runtime_policy_1.parseVerificationRuntimeManifest)(JSON.parse(bytes.subarray(0, size).toString('utf8')));
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('manifest-invalid');
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+    }
+}
+
+
+/***/ }),
+
+/***/ 23100:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertVerificationRuntimePrerequisites = assertVerificationRuntimePrerequisites;
+const node_child_process_1 = __nccwpck_require__(17718);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_manifest_1 = __nccwpck_require__(91053);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const probe = (program, args, environment) => {
+    const result = (0, node_child_process_1.spawnSync)(program, [...args], { env: environment, encoding: 'utf8', shell: false,
+        windowsHide: true, timeout: 5000, maxBuffer: 8192, stdio: ['ignore', 'pipe', 'pipe'] });
+    return { status: result.status, output: `${result.stdout ?? ''}\n${result.stderr ?? ''}`, failed: !!result.error };
+};
+const hasControlCharacter = (value) => [...value].some(character => character.charCodeAt(0) < 32);
+/** Fixed version probes only; never installs a runtime or executes a repository-provided bootstrap. */
+function assertVerificationRuntimePrerequisites(environment, root = process.cwd(), run = probe, platform = process.platform, job = process.env.GITHUB_JOB) {
+    for (const requirement of (0, verification_runtime_manifest_1.readVerificationRuntimeManifest)(root)) {
+        checkRuntime(requirement, environment, run, platform, job);
+    }
+}
+function checkRuntime(requirement, environment, run, platform, job) {
+    const spec = verification_runtime_policy_1.VERIFICATION_RUNTIME_SPECS[requirement.runtime];
+    let program = spec.program;
+    let args = spec.args;
+    if (requirement.runtime === 'java' && environment.JAVA_HOME) {
+        const paths = platform === 'win32' ? node_path_1.win32 : node_path_1.posix;
+        if (!paths.isAbsolute(environment.JAVA_HOME) || hasControlCharacter(environment.JAVA_HOME)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = paths.join(environment.JAVA_HOME, 'bin', platform === 'win32' ? 'java.exe' : 'java');
+    }
+    else if (requirement.runtime === 'python' && platform === 'win32')
+        program = 'python';
+    else if (requirement.runtime === 'pnpm' && platform === 'win32') {
+        const systemRoot = environment.SystemRoot;
+        if (!systemRoot || !node_path_1.win32.isAbsolute(systemRoot) || hasControlCharacter(systemRoot)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = node_path_1.win32.join(systemRoot, 'System32', 'cmd.exe');
+        args = ['/d', '/s', '/c', 'pnpm --version'];
+    }
+    let result;
+    try {
+        result = run(program, args, environment);
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    if (result.failed || result.status !== 0 || result.output.length > 8192) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    const observed = (0, verification_runtime_policy_1.verificationRuntimeVersion)(requirement.runtime, result.output);
+    if (!observed)
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unreadable-version', requirement, undefined, job);
+    if (!(0, verification_runtime_policy_1.verificationRuntimeMatches)(requirement.version, observed)) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('version-mismatch', requirement, observed, job);
+    }
+}
+
+
 /***/ }),
 
 /***/ 92540: