@vypdev/copilot 3.9.2 → 3.9.3

package/build/cli/index.js

@@ -38089,6 +38089,55 @@ function runAtApplicationErrorBoundary(operation) {
 }
 
 
+/***/ }),
+
+/***/ 50519:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.approvalEvidenceError = approvalEvidenceError;
+exports.approvalDiagnosticError = approvalDiagnosticError;
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
+const application_error_1 = __nccwpck_require__(75999);
+function approvalEvidenceError(operation, reason) {
+    return approvalDiagnosticError({ operation, reason, permission: approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS[operation] });
+}
+function approvalDiagnosticError(diagnostic) {
+    const reason = diagnostic.reason;
+    const code = reason === 'http-401' ? 'authorization.credential-invalid'
+        : reason === 'http-403' ? 'authorization.denied'
+            : reason === 'http-404' ? 'provider.not-found'
+                : reason === 'http-429' ? 'provider.rate-limited'
+                    : reason === 'http-409' ? 'provider.conflict'
+                        : reason === 'transport-unavailable' || /^http-50[0234]$/u.test(reason) ? 'provider.unavailable'
+                            : 'provider.contract-invalid';
+    return new application_error_1.ApplicationError(code, `Approval evidence read failed (${diagnostic.operation}, ${reason}).`, {
+        recovery: { id: 'approval-evidence-read-failed', variables: diagnostic },
+    });
+}
+
+
+/***/ }),
+
+/***/ 12183:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.closedIssueReconciliationError = closedIssueReconciliationError;
+const application_error_1 = __nccwpck_require__(75999);
+/** Public diagnostic is fixed native facts and counters, never label/card/provider text. */
+function closedIssueReconciliationError(cause, facts) {
+    return new application_error_1.ApplicationError(cause instanceof application_error_1.ApplicationError ? cause.code : 'provider.unavailable', 'Closed issue reconciliation remains unverified.', {
+        ...(cause instanceof application_error_1.ApplicationError ? { correlationId: cause.correlationId, retryable: cause.retryable } : {}),
+        recovery: { id: 'closed-issue-reconciliation-failed', variables: facts },
+    });
+}
+
+
 /***/ }),
 
 /***/ 72594:
@@ -39265,6 +39314,16 @@ const SPANISH_CONTENT = Object.freeze({
     }),
 });
 const ENGLISH_RECOVERY_CONTENT = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze({
+        impact: 'Issue cleanup remains unverified: {resultId}, phase {phase}; native state {state}, reason {reason}.',
+        action: 'Inspect the closed-issue or merged-PR run and current native state. Retry cleanup only if the issue is still closed with the intended reason; leave reopened work open. Resolve the named failure before retrying.',
+        retainedState: 'Native state was preserved. Confirmed changes: {changed}; remaining required changes in the last verified plan: {remaining}. Unavailable reads do not establish completion.',
+    }),
+    'approval-evidence-read-failed': Object.freeze({
+        impact: 'Approval evidence could not be verified: {operation} ({reason}).',
+        action: 'Inspect {permission} access for the runtime credential and the named evidence response. Correct authorization, missing-resource or schema errors before rerunning; retry transient failures only after provider recovery or rate-limit reset.',
+        retainedState: 'No approval is authorized by this failed read. Existing PRs, reviews and completed external effects were preserved.',
+    }),
     'workspace-changes-rejected': Object.freeze({
         impact: 'The changes were rejected during workspace verification.',
         action: 'Inspect the rejected paths in the workflow and correct the workspace before retrying.',
@@ -39332,6 +39391,16 @@ const ENGLISH_RECOVERY_CONTENT = Object.freeze({
     }),
 });
 const SPANISH_RECOVERY_CONTENT = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze({
+        impact: 'La limpieza de la issue sigue sin verificarse: {resultId}, fase {phase}; estado nativo {state}, motivo {reason}.',
+        action: 'Revisa la ejecución de cierre o de la PR fusionada y el estado nativo actual. Reintenta la limpieza solo si la issue sigue cerrada con el motivo previsto; conserva abierto el trabajo reabierto. Resuelve el fallo indicado antes de reintentar.',
+        retainedState: 'Se conservó el estado nativo. Cambios confirmados: {changed}; cambios pendientes en el último plan verificado: {remaining}. Una lectura no disponible no demuestra que haya finalizado.',
+    }),
+    'approval-evidence-read-failed': Object.freeze({
+        impact: 'No se pudo verificar la evidencia de aprobación: {operation} ({reason}).',
+        action: 'Comprueba el acceso {permission} de la credencial de ejecución y la respuesta indicada. Corrige los errores de autorización, recurso o esquema antes de reejecutar; reintenta los fallos transitorios solo tras recuperarse el proveedor o restablecerse el límite.',
+        retainedState: 'Esta lectura fallida no autoriza ninguna aprobación. Se conservaron las PRs, revisiones y efectos externos completados.',
+    }),
     'workspace-changes-rejected': Object.freeze({
         impact: 'Los cambios se rechazaron durante la verificación del espacio de trabajo.',
         action: 'Revisa las rutas rechazadas en la ejecución y corrige el espacio de trabajo antes de reintentar.',
@@ -56396,8 +56465,9 @@ function failure(taskId, message, code) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconcileClosedIssueMetadataUseCase = void 0;
 const result_1 = __nccwpck_require__(73817);
-const issue_completion_1 = __nccwpck_require__(31147);
 const application_error_1 = __nccwpck_require__(75999);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const reconcile_issue_completion_metadata_1 = __nccwpck_require__(70614);
 /** Selective completion repair from fresh native facts; no native state authority. */
 class ReconcileClosedIssueMetadataUseCase {
     constructor(issues) {
@@ -56405,50 +56475,22 @@ class ReconcileClosedIssueMetadataUseCase {
         this.taskId = 'ReconcileClosedIssueMetadataUseCase';
     }
     async invoke(context) {
-        let labelsChanged = 0;
-        let nativeClosed = false;
+        const progress = (0, reconcile_issue_completion_metadata_1.completionRepairProgress)();
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1)
                 throw stale();
             const target = this.issues.forIssue(context.issueNumber);
-            const initial = await target.read();
-            nativeClosed = initial.number === context.issueNumber && initial.state === 'closed';
-            const initialPlan = (0, issue_completion_1.planIssueCompletion)(initial, context.completionLabels);
-            if (!nativeClosed || initialPlan.kind !== 'closed')
-                throw stale();
-            const fence = async () => {
-                const current = await target.read();
-                nativeClosed = current.number === context.issueNumber && current.state === 'closed';
-                const plan = (0, issue_completion_1.planIssueCompletion)(current, context.completionLabels);
-                if (!nativeClosed || plan.kind !== 'closed' || current.reason !== initial.reason)
-                    throw stale();
-                return plan;
-            };
-            for (const label of initialPlan.remove) {
-                if ((await fence()).remove.includes(label)) {
-                    await target.removeLabel(label);
-                    labelsChanged++;
-                }
-            }
-            for (const label of initialPlan.add) {
-                if ((await fence()).add.includes(label)) {
-                    await target.addLabel(label);
-                    labelsChanged++;
-                }
-            }
-            const final = await fence();
-            if (final.remove.length || final.add.length)
-                throw stale();
-            return [new result_1.Result({ id: this.taskId, success: true, executed: labelsChanged > 0,
+            const repaired = await (0, reconcile_issue_completion_metadata_1.reconcileIssueCompletionMetadata)(target, context.issueNumber, context.completionLabels, progress);
+            return [new result_1.Result({ id: this.taskId, success: true, executed: progress.labelsChanged > 0,
                     steps: ['The closed issue completion metadata was verified; historical and unrelated labels were retained.'],
-                    payload: { issueCompletion: { nativeClosed, labelsChanged, reconciled: true, reason: initial.reason } } })];
+                    payload: { issueCompletion: { nativeClosed: progress.nativeClosed, labelsChanged: progress.labelsChanged, reconciled: true, ...repaired } } })];
         }
         catch (cause) {
-            return [new result_1.Result({ id: this.taskId, success: false, executed: labelsChanged > 0,
-                    steps: [nativeClosed ? 'The issue remains closed; completion metadata could not be fully verified. Inspect and retry the closed-issue workflow.'
+            return [new result_1.Result({ id: this.taskId, success: false, executed: progress.labelsChanged > 0,
+                    steps: [progress.nativeClosed ? 'The issue remains closed; completion metadata could not be fully verified. Inspect and retry the closed-issue workflow.'
                             : 'Current native issue closure could not be verified; completion repair stopped without changing native state.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Closed issue completion metadata remains unverified.')],
-                    payload: { issueCompletion: { nativeClosed, labelsChanged, reconciled: false } } })];
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase: progress.phase, state: progress.state, reason: progress.reason, changed: progress.labelsChanged, remaining: progress.remaining })],
+                    payload: { issueCompletion: { nativeClosed: progress.nativeClosed, labelsChanged: progress.labelsChanged, reconciled: false } } })];
         }
     }
 }
@@ -56481,6 +56523,84 @@ class ReconcileClosedIssueUseCase {
 exports.ReconcileClosedIssueUseCase = ReconcileClosedIssueUseCase;
 
 
+/***/ }),
+
+/***/ 70614:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.completionRepairProgress = void 0;
+exports.reconcileIssueCompletionMetadata = reconcileIssueCompletionMetadata;
+const application_error_1 = __nccwpck_require__(75999);
+const issue_completion_1 = __nccwpck_require__(31147);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
+const completionRepairProgress = () => ({ nativeClosed: false, labelsChanged: 0,
+    phase: 'identity', state: 'unavailable', reason: 'unavailable', remaining: 0 });
+exports.completionRepairProgress = completionRepairProgress;
+/** At most two bounded selective passes, with fresh native fences before every write. */
+async function reconcileIssueCompletionMetadata(target, number, configuration, progress, initial) {
+    let expectedReason;
+    let superseded = false;
+    const read = async (phase, snapshot) => {
+        progress.phase = phase;
+        progress.state = 'unavailable';
+        progress.reason = 'unavailable';
+        const facts = snapshot ?? await target.read();
+        progress.nativeClosed = facts?.number === number && facts.state === 'closed';
+        progress.state = facts?.number === number && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+        progress.reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(reason => reason === facts?.reason) ? facts.reason : 'unavailable';
+        const plan = (0, issue_completion_1.planIssueCompletion)(facts, configuration);
+        if (!progress.nativeClosed || plan.kind !== 'closed' || expectedReason !== undefined && facts.reason !== expectedReason) {
+            throw new application_error_1.ApplicationError('workflow.stale', 'The native issue identity, state or closure reason changed.');
+        }
+        expectedReason = facts.reason;
+        progress.remaining = plan.remove.length + plan.add.length;
+        return plan;
+    };
+    let plan = await read('read', initial);
+    for (let pass = 0; pass < 2; pass++) {
+        for (const label of plan.remove) {
+            if (!(await read('label-remove')).remove.includes(label)) {
+                superseded = true;
+                continue;
+            }
+            try {
+                await target.removeLabel(label);
+                progress.labelsChanged++;
+            }
+            catch (cause) {
+                if ((await read('label-remove')).remove.includes(label))
+                    throw cause;
+                superseded = true;
+            }
+        }
+        for (const label of plan.add) {
+            if (!(await read('label-add')).add.includes(label)) {
+                superseded = true;
+                continue;
+            }
+            try {
+                await target.addLabel(label);
+                progress.labelsChanged++;
+            }
+            catch (cause) {
+                if ((await read('label-add')).add.includes(label))
+                    throw cause;
+                superseded = true;
+            }
+        }
+        plan = await read('metadata-verification');
+        if (!progress.remaining)
+            return { reason: plan.reason,
+                outcome: progress.labelsChanged ? 'reconciled' : 'already-converged', superseded };
+        superseded = true;
+    }
+    throw new application_error_1.ApplicationError('provider.conflict', 'Completion metadata remains incomplete after two bounded passes.');
+}
+
+
 /***/ }),
 
 /***/ 74111:
@@ -56490,7 +56610,9 @@ exports.ReconcileClosedIssueUseCase = ReconcileClosedIssueUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.RetireBranchSyncUseCase = void 0;
-const reply_request_digest_1 = __nccwpck_require__(47971);
+const verify_closed_issue_card_retirement_1 = __nccwpck_require__(78813);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
 const result_1 = __nccwpck_require__(73817);
 const github_user_policy_1 = __nccwpck_require__(84403);
 const publication_identity_policy_1 = __nccwpck_require__(45403);
@@ -56508,17 +56630,33 @@ class RetireBranchSyncUseCase {
     async invoke(context) {
         let retired = 0;
         let nativeClosed = false;
+        let phase = 'identity';
+        let state = 'unavailable';
+        let reason = 'unavailable';
+        let remaining = 0;
+        let superseded = false;
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1 || !context.trustedBotLogin) {
                 return [this.result(retired, nativeClosed)];
             }
-            const initial = await this.issues.readIssue(context.issueNumber);
-            if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state))
+            const read = async () => {
+                state = 'unavailable';
+                reason = 'unavailable';
+                const facts = await this.issues.readIssue(context.issueNumber);
+                nativeClosed = facts?.number === context.issueNumber && facts.state === 'closed';
+                state = facts?.number === context.issueNumber && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+                reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === facts?.reason) ? facts.reason : 'unavailable';
+                return facts;
+            };
+            phase = 'read';
+            const initial = await read();
+            if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state) || initial.state === 'closed' && !['completed', 'not_planned', 'duplicate', 'unknown'].includes(initial.reason))
                 throw stale();
             if (initial.state !== 'closed')
                 return [this.result(retired, nativeClosed)];
             nativeClosed = true;
             const messages = (0, branch_sync_message_catalog_1.resolveStaticBranchSyncCatalog)(context.locale);
+            phase = 'card-inventory';
             const cards = (await this.comments.listIssueComments(context.issueNumber)).filter(comment => {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(comment.body);
                 return marker?.identity.topic === 'branch-sync' && marker.identity.target.kind === 'issue'
@@ -56527,38 +56665,40 @@ class RetireBranchSyncUseCase {
                     && Number.isSafeInteger(comment.id) && comment.id > 0
                     && Boolean(comment.user?.login && (0, github_user_policy_1.githubUsersMatch)(context.trustedBotLogin, comment.user.login));
             });
+            remaining = Math.min(cards.length, 3000);
             if (cards.length > 20)
                 throw stale();
+            const verifyClosed = async () => {
+                phase = 'native-fence';
+                const fresh = await read();
+                if (!nativeClosed || fresh.reason !== initial.reason)
+                    throw stale();
+            };
             for (const card of cards) {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(card.body);
                 const body = (0, branch_sync_notification_policy_1.buildRetiredBranchSyncComment)(marker.identity, messages);
-                if (card.body === body)
-                    continue;
-                const witness = Object.freeze({ surface: 'issue-comment', commentId: card.id,
-                    author: context.trustedBotLogin, target: Object.freeze({ kind: 'issue', number: context.issueNumber }),
-                    bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(card.body ?? '') });
-                if (!await this.cardFreshness.matches(witness))
-                    throw stale();
-                const fresh = await this.issues.readIssue(context.issueNumber);
-                nativeClosed = fresh.number === context.issueNumber && fresh.state === 'closed';
-                if (!nativeClosed || fresh.reason !== initial.reason)
-                    throw stale();
-                await this.comments.updateComment(context.issueNumber, card.id, body);
-                retired++;
+                const verified = await (0, verify_closed_issue_card_retirement_1.verifyClosedIssueCardRetirement)({ issueNumber: context.issueNumber,
+                    commentId: card.id, author: context.trustedBotLogin, originalBody: card.body ?? '', finalBody: body,
+                    freshness: this.cardFreshness, verifyClosed, onUpdated: () => { retired++; }, phase: value => { phase = value; },
+                    update: () => this.comments.updateComment(context.issueNumber, card.id, body) });
+                superseded || (superseded = verified.superseded);
+                remaining--;
             }
-            return [this.result(retired, nativeClosed)];
+            await verifyClosed();
+            return [this.result(retired, nativeClosed, superseded)];
         }
         catch (cause) {
             return [new result_1.Result({ id: this.taskId, success: false, executed: retired > 0,
                     steps: [nativeClosed ? 'Issue closure is retained; synchronization recommendation retirement could not be fully verified. Retry the closed-issue event or merged-PR operation.' : 'Native issue closure could not be verified; synchronization recommendations were left unchanged.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Unable to retire synchronization recommendations safely.')],
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase, state, reason, changed: retired, remaining })],
                     payload: { nativeClosed, retiredCards: retired, reconciled: false } })];
         }
     }
-    result(retired, nativeClosed) {
+    result(retired, nativeClosed, superseded = false) {
         return new result_1.Result({ id: this.taskId, success: true, executed: retired > 0,
             steps: [retired ? 'The closed issue’s synchronization recommendations were retired.' : 'No synchronization recommendation required retirement.'],
-            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true } });
+            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true, superseded,
+                outcome: nativeClosed ? retired ? 'reconciled' : 'already-converged' : 'not-applicable' } });
     }
 }
 exports.RetireBranchSyncUseCase = RetireBranchSyncUseCase;
@@ -56599,7 +56739,9 @@ exports.RetireClosedIssueCardsUseCase = RetireClosedIssueCardsUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.RetireProgressUseCase = void 0;
-const reply_request_digest_1 = __nccwpck_require__(47971);
+const verify_closed_issue_card_retirement_1 = __nccwpck_require__(78813);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
 const result_1 = __nccwpck_require__(73817);
 const github_user_policy_1 = __nccwpck_require__(84403);
 const publication_identity_policy_1 = __nccwpck_require__(45403);
@@ -56616,16 +56758,32 @@ class RetireProgressUseCase {
     async invoke(context) {
         let retired = 0;
         let nativeClosed = false;
+        let phase = 'identity';
+        let state = 'unavailable';
+        let reason = 'unavailable';
+        let remaining = 0;
+        let superseded = false;
         try {
             if (!Number.isSafeInteger(context.issueNumber) || context.issueNumber < 1 || !context.trustedBotLogin) {
                 return [this.result(retired, nativeClosed)];
             }
-            const initial = await this.issues.readIssue(context.issueNumber);
+            const read = async () => {
+                state = 'unavailable';
+                reason = 'unavailable';
+                const facts = await this.issues.readIssue(context.issueNumber);
+                nativeClosed = facts?.number === context.issueNumber && facts.state === 'closed';
+                state = facts?.number === context.issueNumber && ['open', 'closed'].includes(facts.state) ? facts.state : 'unavailable';
+                reason = closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === facts?.reason) ? facts.reason : 'unavailable';
+                return facts;
+            };
+            phase = 'read';
+            const initial = await read();
             if (initial.number !== context.issueNumber || !['open', 'closed'].includes(initial.state) || initial.state === 'closed' && !['completed', 'not_planned', 'duplicate', 'unknown'].includes(initial.reason))
                 throw stale();
             if (initial.state !== 'closed')
                 return [this.result(retired, nativeClosed)];
             nativeClosed = true;
+            phase = 'card-inventory';
             const cards = (await this.comments.listIssueComments(context.issueNumber)).filter(comment => {
                 const marker = (0, publication_identity_policy_1.parsePublicationMarker)(comment.body);
                 return marker?.identity.topic === 'progress' && marker.identity.target.kind === 'issue'
@@ -56634,37 +56792,39 @@ class RetireProgressUseCase {
                     && Number.isSafeInteger(comment.id) && comment.id > 0
                     && Boolean(comment.user?.login && (0, github_user_policy_1.githubUsersMatch)(context.trustedBotLogin, comment.user.login));
             });
+            remaining = Math.min(cards.length, 3000);
             if (cards.length > 20)
                 throw stale();
-            for (const card of cards) {
-                const body = (0, retired_progress_presentation_policy_1.buildRetiredProgressComment)(card.body ?? '', context.locale, initial.reason);
-                if (card.body === body)
-                    continue;
-                const witness = Object.freeze({ surface: 'issue-comment', commentId: card.id,
-                    author: context.trustedBotLogin, target: Object.freeze({ kind: 'issue', number: context.issueNumber }),
-                    bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(card.body ?? '') });
-                if (!await this.cardFreshness.matches(witness))
-                    throw stale();
-                const fresh = await this.issues.readIssue(context.issueNumber);
-                nativeClosed = fresh.number === context.issueNumber && fresh.state === 'closed';
+            const verifyClosed = async () => {
+                phase = 'native-fence';
+                const fresh = await read();
                 if (!nativeClosed || fresh.reason !== initial.reason)
                     throw stale();
-                await this.comments.updateComment(context.issueNumber, card.id, body);
-                retired++;
+            };
+            for (const card of cards) {
+                const body = (0, retired_progress_presentation_policy_1.buildRetiredProgressComment)(card.body ?? '', context.locale, initial.reason);
+                const verified = await (0, verify_closed_issue_card_retirement_1.verifyClosedIssueCardRetirement)({ issueNumber: context.issueNumber,
+                    commentId: card.id, author: context.trustedBotLogin, originalBody: card.body ?? '', finalBody: body,
+                    freshness: this.cardFreshness, verifyClosed, onUpdated: () => { retired++; }, phase: value => { phase = value; },
+                    update: () => this.comments.updateComment(context.issueNumber, card.id, body) });
+                superseded || (superseded = verified.superseded);
+                remaining--;
             }
-            return [this.result(retired, nativeClosed)];
+            await verifyClosed();
+            return [this.result(retired, nativeClosed, superseded)];
         }
         catch (cause) {
             return [new result_1.Result({ id: this.taskId, success: false, executed: retired > 0,
                     steps: [nativeClosed ? 'Issue closure is retained; progress card retirement could not be fully verified. Retry the closed-issue event or merged-PR operation.' : 'Native issue closure could not be verified; progress cards were left unchanged.'],
-                    errors: [(0, application_error_1.toApplicationError)(cause, 'provider.unavailable', 'Unable to retire progress cards safely.')],
+                    errors: [(0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(cause, { resultId: this.taskId, phase, state, reason, changed: retired, remaining })],
                     payload: { nativeClosed, retiredCards: retired, reconciled: false } })];
         }
     }
-    result(retired, nativeClosed) {
+    result(retired, nativeClosed, superseded = false) {
         return new result_1.Result({ id: this.taskId, success: true, executed: retired > 0,
             steps: [retired ? 'The closed issue’s progress cards were retired.' : 'No progress card required retirement.'],
-            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true } });
+            payload: { ...(nativeClosed ? { state: 'closed' } : {}), nativeClosed, retiredCards: retired, reconciled: true, superseded,
+                outcome: nativeClosed ? retired ? 'reconciled' : 'already-converged' : 'not-applicable' } });
     }
 }
 exports.RetireProgressUseCase = RetireProgressUseCase;
@@ -57055,6 +57215,48 @@ function sameLabels(left, right) {
 }
 
 
+/***/ }),
+
+/***/ 78813:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.verifyClosedIssueCardRetirement = verifyClosedIssueCardRetirement;
+const reply_request_digest_1 = __nccwpck_require__(47971);
+const application_error_1 = __nccwpck_require__(75999);
+/** Adopt another invocation only after the exact final owned body and native closure are fresh. */
+async function verifyClosedIssueCardRetirement(input) {
+    const witness = (body) => Object.freeze({ surface: 'issue-comment',
+        commentId: input.commentId, author: input.author,
+        target: Object.freeze({ kind: 'issue', number: input.issueNumber }), bodyDigest: (0, reply_request_digest_1.replyRequestBodyDigest)(body) });
+    let updated = false;
+    let failedWrite;
+    if (input.originalBody !== input.finalBody) {
+        input.phase('card-freshness');
+        if (await input.freshness.matches(witness(input.originalBody))) {
+            await input.verifyClosed();
+            input.phase('card-update');
+            try {
+                await input.update();
+                updated = true;
+                input.onUpdated();
+            }
+            catch (cause) {
+                failedWrite = cause;
+            }
+        }
+    }
+    input.phase('card-verification');
+    if (!await input.freshness.matches(witness(input.finalBody))) {
+        throw failedWrite ?? new application_error_1.ApplicationError('workflow.stale', 'The required final owned card could not be verified.');
+    }
+    await input.verifyClosed();
+    return { updated, superseded: !updated && input.originalBody !== input.finalBody };
+}
+
+
 /***/ }),
 
 /***/ 4643:
@@ -70739,6 +70941,8 @@ exports.CheckPriorityIssueSizeUseCase = CheckPriorityIssueSizeUseCase;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CloseIssueAfterMergingUseCase = void 0;
+const reconcile_issue_completion_metadata_1 = __nccwpck_require__(70614);
+const closed_issue_reconciliation_error_1 = __nccwpck_require__(12183);
 const result_1 = __nccwpck_require__(73817);
 const issue_completion_1 = __nccwpck_require__(31147);
 const application_error_1 = __nccwpck_require__(75999);
@@ -70757,7 +70961,7 @@ class CloseIssueAfterMergingUseCase {
                     steps: ['No separate safe linked issue and pull request were found; issue closure was skipped.'] })];
         let closedThisRun = false;
         let nativeClosed = false;
-        let labelsChanged = 0;
+        const progress = (0, reconcile_issue_completion_metadata_1.completionRepairProgress)();
         try {
             const pull = await this.issues.readPullRequest(pullNumber);
             if (pull.number !== pullNumber || pull.state !== 'closed' || pull.merged !== true)
@@ -70781,44 +70985,21 @@ class CloseIssueAfterMergingUseCase {
             nativeClosed = facts.state === 'closed';
             if (!nativeClosed || closedThisRun && facts.reason !== 'completed')
                 throw stale();
-            const fence = async () => {
-                const freshFacts = await read();
-                const freshPlan = (0, issue_completion_1.planIssueCompletion)(freshFacts, param.completionLabels);
-                if (freshPlan.kind !== 'closed' || freshFacts.reason !== facts.reason)
-                    throw stale();
-                return freshPlan;
-            };
-            const plan = (0, issue_completion_1.planIssueCompletion)(facts, param.completionLabels);
-            if (plan.kind !== 'closed')
-                throw stale();
-            for (const label of plan.remove) {
-                const fresh = await fence();
-                if (fresh.remove.includes(label)) {
-                    await target.removeLabel(label);
-                    labelsChanged++;
-                }
-            }
-            for (const label of plan.add) {
-                const fresh = await fence();
-                if (fresh.add.includes(label)) {
-                    await target.addLabel(label);
-                    labelsChanged++;
-                }
-            }
-            const final = await fence();
-            if (final.remove.length || final.add.length)
-                throw stale();
-            return [new result_1.Result({ id: this.taskId, success: true, executed: closedThisRun || labelsChanged > 0,
+            const repaired = await (0, reconcile_issue_completion_metadata_1.reconcileIssueCompletionMetadata)(target, number, param.completionLabels, progress, facts);
+            nativeClosed = progress.nativeClosed;
+            return [new result_1.Result({ id: this.taskId, success: true, executed: closedThisRun || progress.labelsChanged > 0,
                     steps: [`Issue #${number} is closed and its completion metadata was verified after PR #${pullNumber} merged.`],
-                    payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged, reason: facts.reason, reconciled: true }) } })];
+                    payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged: progress.labelsChanged, ...repaired, reconciled: true }) } })];
         }
         catch (error) {
-            const semanticError = (0, application_error_1.toApplicationError)(error, 'provider.unavailable', nativeClosed
-                ? 'The issue is closed, but completion metadata could not be fully verified. Retry the verified merged-PR operation.'
-                : 'Native issue completion could not be verified. Inspect the linked run before retrying.');
-            return [new result_1.Result({ id: this.taskId, success: false, executed: closedThisRun || labelsChanged > 0,
+            if (progress.phase !== 'identity')
+                nativeClosed = progress.nativeClosed;
+            const semanticError = (0, closed_issue_reconciliation_error_1.closedIssueReconciliationError)(error, { resultId: this.taskId,
+                phase: progress.phase, state: progress.state, reason: progress.reason,
+                changed: progress.labelsChanged, remaining: progress.remaining });
+            return [new result_1.Result({ id: this.taskId, success: false, executed: closedThisRun || progress.labelsChanged > 0,
                     steps: [nativeClosed ? 'The native issue closure was retained; completion metadata remains unverified.' : 'Native issue completion remains unverified.'],
-                    errors: [semanticError], payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged, reconciled: false }) } })];
+                    errors: [semanticError], payload: { issueCompletion: Object.freeze({ number, nativeClosed, closedThisRun, labelsChanged: progress.labelsChanged, reconciled: false }) } })];
         }
     }
 }
@@ -78173,6 +78354,8 @@ var _ApplicationError_cause;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ApplicationError = exports.APPLICATION_ERROR_METADATA = exports.APPLICATION_ERROR_RECOVERY_IDS = void 0;
 exports.isApplicationErrorCorrelationId = isApplicationErrorCorrelationId;
+const closed_issue_reconciliation_1 = __nccwpck_require__(21565);
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
 const branch_sync_validation_1 = __nccwpck_require__(90981);
 exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'pull-request-link-restored',
@@ -78188,6 +78371,8 @@ exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'sdd-draft-size-exceeded',
     'sdd-draft-format-invalid',
     'workspace-changes-rejected',
+    'closed-issue-reconciliation-failed',
+    'approval-evidence-read-failed',
 ]);
 const PRESERVED_STATE = 'Existing persisted state and completed external effects were preserved.';
 const UNCHANGED_STATE = 'No new state or external effect was created.';
@@ -78379,6 +78564,8 @@ class ApplicationError extends Error {
 exports.ApplicationError = ApplicationError;
 _ApplicationError_cause = new WeakMap();
 const RECOVERY_VARIABLE_KEYS = Object.freeze({
+    'closed-issue-reconciliation-failed': Object.freeze(['resultId', 'phase', 'state', 'reason', 'changed', 'remaining']),
+    'approval-evidence-read-failed': Object.freeze(['operation', 'reason', 'permission']),
     'pull-request-link-restored': Object.freeze([]),
     'pull-request-link-base-retained': Object.freeze([]),
     'pull-request-link-reference-retained': Object.freeze([]),
@@ -78431,6 +78618,20 @@ function normalizeApplicationErrorRecovery(recovery) {
         && !branch_sync_validation_1.BRANCH_SYNC_VALIDATION_CODES.some(code => code === variables.validationCode)) {
         throw new TypeError('Application error recovery synchronization validation code is invalid.');
     }
+    if (recovery.id === 'closed-issue-reconciliation-failed'
+        && (!closed_issue_reconciliation_1.CLOSED_ISSUE_RESULTS.some(value => value === variables.resultId)
+            || !closed_issue_reconciliation_1.CLOSED_ISSUE_PHASES.some(value => value === variables.phase)
+            || !['open', 'closed', 'unavailable'].includes(variables.state)
+            || !closed_issue_reconciliation_1.CLOSED_ISSUE_REASONS.some(value => value === variables.reason)
+            || ![variables.changed, variables.remaining].every(value => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= 3000))) {
+        throw new TypeError('Closed issue reconciliation diagnostic is invalid.');
+    }
+    if (recovery.id === 'approval-evidence-read-failed'
+        && (!Object.prototype.hasOwnProperty.call(approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS, variables.operation)
+            || !approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_REASONS.some(reason => reason === variables.reason)
+            || approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS[variables.operation] !== variables.permission)) {
+        throw new TypeError('Approval evidence diagnostic is invalid.');
+    }
     return Object.freeze({
         id: recovery.id,
         variables: Object.freeze({ ...variables }),
@@ -86219,6 +86420,41 @@ function parseApprovalCoverageZip(value) {
 }
 
 
+/***/ }),
+
+/***/ 9958:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readApprovalEvidence = readApprovalEvidence;
+const application_error_1 = __nccwpck_require__(75999);
+const approval_evidence_error_1 = __nccwpck_require__(50519);
+const approval_evidence_diagnostic_1 = __nccwpck_require__(98205);
+/** Terminates provider exceptions; even unknown statuses never interpolate provider text. */
+async function readApprovalEvidence(operation, read) {
+    try {
+        return await read();
+    }
+    catch (cause) {
+        if (cause instanceof application_error_1.ApplicationError && cause.recovery?.id === 'approval-evidence-read-failed')
+            throw cause;
+        const error = cause && typeof cause === 'object' ? cause : undefined;
+        const response = error?.response;
+        const status = error?.status;
+        const rateLimited = status === 403 && (response?.headers?.['x-ratelimit-remaining'] === '0'
+            || typeof response?.headers?.['retry-after'] === 'string' && /^\d{1,8}$/u.test(response.headers['retry-after']));
+        const http = typeof status === 'number' ? `http-${status}` : undefined;
+        const reason = rateLimited ? 'http-429'
+            : approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_REASONS.some(value => value === http) ? http
+                : cause instanceof application_error_1.ApplicationError && cause.code === 'provider.contract-invalid' ? 'invalid-response'
+                    : status === undefined ? 'transport-unavailable' : 'invalid-response';
+        throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, reason);
+    }
+}
+
+
 /***/ }),
 
 /***/ 55165:
@@ -86253,21 +86489,22 @@ exports.BugbotPullRequestRepository = BugbotPullRequestRepository;
 /***/ }),
 
 /***/ 68742:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.readCurrentBaseRevision = readCurrentBaseRevision;
+const application_error_1 = __nccwpck_require__(75999);
 /** PR base metadata can lag a parent push; read the exact native branch ref. */
 async function readCurrentBaseRevision(port, target, baseRef) {
     if (typeof baseRef !== 'string' || baseRef.length === 0 || baseRef.length > 1024
         || baseRef.includes('\u0000') || /[\r\n]/u.test(baseRef))
-        throw new Error('The PR base ref is invalid.');
+        throw new application_error_1.ApplicationError('provider.contract-invalid', 'The PR base ref is invalid.');
     const { data } = await port.getRef({ owner: target.owner, repo: target.repository, ref: `heads/${baseRef}` });
     if (data?.ref !== `refs/heads/${baseRef}` || data.object?.type !== 'commit' || typeof data.object.sha !== 'string'
         || !/^[a-f0-9]{40}$/u.test(data.object.sha))
-        throw new Error('The PR base ref cannot be verified.');
+        throw new application_error_1.ApplicationError('provider.contract-invalid', 'The PR base ref cannot be verified.');
     return data.object.sha;
 }
 
@@ -86315,6 +86552,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PullRequestApprovalRepository = void 0;
 exports.readEffectiveApprovalPolicy = readEffectiveApprovalPolicy;
+const approval_evidence_read_1 = __nccwpck_require__(9958);
+const approval_evidence_error_1 = __nccwpck_require__(50519);
+const application_error_1 = __nccwpck_require__(75999);
 const current_base_revision_query_1 = __nccwpck_require__(68742);
 const logging_ports_1 = __nccwpck_require__(6152);
 const github = __importStar(__nccwpck_require__(78227));
@@ -86341,40 +86581,64 @@ class PullRequestApprovalRepository {
         }
     }
     async readPolicy(target) {
-        return (await this.readEffectivePolicy(target))?.value;
+        return (0, approval_evidence_read_1.readApprovalEvidence)('policy', async () => (await this.readEffectivePolicy(target))?.value);
     }
     async readEffectivePolicy(target) {
         return readEffectiveApprovalPolicy(this.octokit, target);
     }
     async loadEvidence(target) {
-        const { data: pull } = await this.octokit.rest.pulls.get({
-            owner: target.owner, repo: target.repository, pull_number: target.pullNumber,
+        const diagnostics = [];
+        const { data: pull } = await (0, approval_evidence_read_1.readApprovalEvidence)('pull-request', async () => {
+            const response = await this.octokit.rest.pulls.get({ owner: target.owner, repo: target.repository, pull_number: target.pullNumber });
+            if (!response.data?.head || !response.data?.base || typeof response.data.head.sha !== 'string'
+                || typeof response.data.head.ref !== 'string' || !Number.isSafeInteger(response.data.number)) {
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('pull-request', 'invalid-response');
+            }
+            return response;
         });
         const headSha = pull.head.sha;
         const baseSha = await this.readCurrentBaseSha(target, pull.base.ref);
-        const policy = (0, pull_request_approval_policy_1.parsePullRequestApprovalPolicy)(await this.readPolicy(target));
+        const policy = await (0, approval_evidence_read_1.readApprovalEvidence)('policy', async () => {
+            const raw = await this.readPolicy(target);
+            try {
+                return (0, pull_request_approval_policy_1.parsePullRequestApprovalPolicy)(raw);
+            }
+            catch {
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('policy', 'invalid-response');
+            }
+        });
         let testedMergeSha;
         if (pull.mergeable === true && /^[a-f0-9]{40}$/iu.test(pull.merge_commit_sha ?? '')) {
             try {
-                const merge = await this.octokit.rest.git.getCommit({
-                    owner: target.owner, repo: target.repository, commit_sha: pull.merge_commit_sha,
+                const merge = await (0, approval_evidence_read_1.readApprovalEvidence)('merge-commit', async () => {
+                    const response = await this.octokit.rest.git.getCommit({ owner: target.owner, repo: target.repository, commit_sha: pull.merge_commit_sha });
+                    if (!Array.isArray(response.data?.parents))
+                        throw (0, approval_evidence_error_1.approvalEvidenceError)('merge-commit', 'invalid-response');
+                    return response;
                 });
                 if (merge.data.parents[0]?.sha === baseSha && merge.data.parents[1]?.sha === headSha
                     && merge.data.parents.length === 2)
                     testedMergeSha = pull.merge_commit_sha;
             }
-            catch { /* Missing or unreadable merge parentage is non-authorizing. */ }
+            catch (cause) {
+                collectDiagnostic(diagnostics, cause);
+            }
         }
         const [files, reviews, comments, headChecks, mergeChecks, headRuns, mergeRuns, rules, user] = await Promise.all([
-            this.allPages(this.octokit.rest.pulls.listFiles, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.pulls.listReviews, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.issues.listComments, { owner: target.owner, repo: target.repository, issue_number: target.pullNumber }),
-            this.allPages(this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: headSha, filter: 'all' }),
-            testedMergeSha ? this.allPages(this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: testedMergeSha, filter: 'all' }) : Promise.resolve([]),
-            this.allPages(this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: headSha }),
-            testedMergeSha ? this.allPages(this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: testedMergeSha }) : Promise.resolve([]),
-            this.effectiveRules(target.owner, target.repository, pull.base.ref),
-            this.octokit.rest.users.getAuthenticated(),
+            this.allPages('files', this.octokit.rest.pulls.listFiles, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
+            this.allPages('reviews', this.octokit.rest.pulls.listReviews, { owner: target.owner, repo: target.repository, pull_number: target.pullNumber }),
+            this.allPages('comments', this.octokit.rest.issues.listComments, { owner: target.owner, repo: target.repository, issue_number: target.pullNumber }),
+            this.allPages('head-checks', this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: headSha, filter: 'all' }),
+            testedMergeSha ? this.allPages('merge-checks', this.octokit.rest.checks.listForRef, { owner: target.owner, repo: target.repository, ref: testedMergeSha, filter: 'all' }) : Promise.resolve([]),
+            this.allPages('head-runs', this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: headSha }),
+            testedMergeSha ? this.allPages('merge-runs', this.octokit.rest.actions.listWorkflowRunsForRepo, { owner: target.owner, repo: target.repository, head_sha: testedMergeSha }) : Promise.resolve([]),
+            this.effectiveRules(target.owner, target.repository, pull.base.ref, diagnostics),
+            (0, approval_evidence_read_1.readApprovalEvidence)('authenticated-user', async () => {
+                const response = await this.octokit.rest.users.getAuthenticated();
+                if (!Number.isSafeInteger(response.data?.id) || response.data.id < 1)
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)('authenticated-user', 'invalid-response');
+                return response;
+            }),
         ]);
         const branch = Object.entries(this.settings.branchPrefixes)
             .find(([, prefix]) => pull.head.ref.startsWith(`${prefix}/`));
@@ -86395,7 +86659,7 @@ class PullRequestApprovalRepository {
         });
         const currentJobs = await Promise.all(latestRuns.map(async (run) => ({
             run,
-            jobs: await this.allPages(this.octokit.rest.actions.listJobsForWorkflowRunAttempt, {
+            jobs: await this.allPages('jobs', this.octokit.rest.actions.listJobsForWorkflowRunAttempt, {
                 owner: target.owner, repo: target.repository, run_id: run.id, attempt_number: run.run_attempt,
             }),
         })));
@@ -86426,9 +86690,10 @@ class PullRequestApprovalRepository {
             submittedAt: review.submitted_at ?? '',
         }));
         const numericCoverage = policy.coverage.mode === 'numeric'
-            ? await this.numericCoverage(target, policy.coverage.artifactWorkflowName, headSha, baseSha, testedMergeSha, workflowRuns)
+            ? await this.numericCoverage(target, policy.coverage.artifactWorkflowName, headSha, baseSha, testedMergeSha, workflowRuns, diagnostics)
             : undefined;
         return {
+            ...(diagnostics.length ? { diagnostics: Object.freeze(diagnostics) } : {}),
             repositoryId: pull.base.repo?.id ?? 0,
             pullNumber: pull.number,
             headSha,
@@ -86462,7 +86727,7 @@ class PullRequestApprovalRepository {
             ...(numericCoverage ? { numericCoverage } : {}),
         };
     }
-    async numericCoverage(target, workflowName, headSha, baseSha, testedMergeSha, workflowRuns) {
+    async numericCoverage(target, workflowName, headSha, baseSha, testedMergeSha, workflowRuns, diagnostics) {
         const candidates = workflowRuns.filter(run => run.name === workflowName
             && (run.head_sha === headSha || run.head_sha === testedMergeSha));
         const mergeCandidates = candidates.filter(run => run.head_sha === testedMergeSha);
@@ -86471,25 +86736,27 @@ class PullRequestApprovalRepository {
         if (!run || run.conclusion !== 'success' || run.status !== 'completed')
             return undefined;
         try {
-            const artifacts = await this.allPages(this.octokit.rest.actions.listWorkflowRunArtifacts, {
+            const artifacts = await this.allPages('coverage-artifacts', this.octokit.rest.actions.listWorkflowRunArtifacts, {
                 owner: target.owner, repo: target.repository, run_id: run.id,
             });
             const matches = artifacts.filter(artifact => artifact.name === 'copilot-diff-coverage-v1' && !artifact.expired);
             if (matches.length !== 1 || matches[0].size_in_bytes > 64 * 1024)
-                return undefined;
-            const response = await this.octokit.rest.actions.downloadArtifact({
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-artifacts', 'artifact-unavailable');
+            const response = await (0, approval_evidence_read_1.readApprovalEvidence)('coverage-download', async () => this.octokit.rest.actions.downloadArtifact({
                 owner: target.owner, repo: target.repository, artifact_id: matches[0].id, archive_format: 'zip',
-            });
+            }));
             const data = response.data;
             const bytes = data instanceof ArrayBuffer ? new Uint8Array(data)
                 : data instanceof Uint8Array ? data
                     : typeof data === 'string' ? Buffer.from(data, 'binary') : undefined;
             const attestation = bytes ? (0, approval_coverage_artifact_1.parseApprovalCoverageZip)(bytes) : undefined;
-            if (!attestation || attestation.repositoryId !== target.repositoryId
+            if (!attestation)
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-parse', 'artifact-invalid');
+            if (attestation.repositoryId !== target.repositoryId
                 || attestation.pullNumber !== target.pullNumber || attestation.headSha !== headSha
                 || attestation.baseSha !== baseSha || attestation.workflowRunId !== run.id
                 || attestation.workflowRunAttempt !== run.run_attempt)
-                return undefined;
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('coverage-parse', 'artifact-mismatch');
             return {
                 coveredChangedLines: attestation.coveredChangedLines,
                 totalChangedLines: attestation.totalChangedLines,
@@ -86497,7 +86764,8 @@ class PullRequestApprovalRepository {
                 baseSha,
             };
         }
-        catch {
+        catch (cause) {
+            collectDiagnostic(diagnostics, cause);
             return undefined;
         }
     }
@@ -86523,7 +86791,7 @@ class PullRequestApprovalRepository {
             throw new Error('PR head or base changed before assessment publication.');
         }
         const user = await this.octokit.rest.users.getAuthenticated();
-        const comments = await this.allPages(this.octokit.rest.issues.listComments, {
+        const comments = await this.allPages('comments', this.octokit.rest.issues.listComments, {
             owner: target.owner, repo: target.repository, issue_number: target.pullNumber,
         });
         const card = [...comments].reverse().find(comment => comment.user?.id === user.data.id
@@ -86569,24 +86837,26 @@ class PullRequestApprovalRepository {
         }
     }
     async readCurrentBaseSha(target, baseRef) {
-        return (0, current_base_revision_query_1.readCurrentBaseRevision)(this.octokit.rest.git, target, baseRef);
+        return (0, approval_evidence_read_1.readApprovalEvidence)('base-ref', () => (0, current_base_revision_query_1.readCurrentBaseRevision)(this.octokit.rest.git, target, baseRef));
     }
-    async effectiveRules(owner, repo, branch) {
+    async effectiveRules(owner, repo, branch, diagnostics) {
         try {
-            const rulesResponse = await this.octokit.request('GET /repos/{owner}/{repo}/rules/branches/{branch}', { owner, repo, branch });
+            const rulesResponse = await (0, approval_evidence_read_1.readApprovalEvidence)('rules', async () => this.octokit.request('GET /repos/{owner}/{repo}/rules/branches/{branch}', { owner, repo, branch }));
             if (!Array.isArray(rulesResponse.data) || rulesResponse.data.some((rule) => !record(rule)
                 || typeof record(rule)?.type !== 'string' || record(rule)?.type === '')) {
-                throw new Error('GitHub returned an invalid effective rules inventory.');
+                throw (0, approval_evidence_error_1.approvalEvidenceError)('rules', 'invalid-response');
             }
             const rules = rulesResponse.data;
             let classic;
             try {
                 const response = await this.octokit.rest.repos.getBranchProtection({ owner, repo, branch });
+                if (!record(response.data))
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)('classic-protection', 'invalid-response');
                 classic = response.data;
             }
             catch (error) {
                 if (statusOf(error) !== 404)
-                    throw error;
+                    await (0, approval_evidence_read_1.readApprovalEvidence)('classic-protection', async () => { throw error; });
             }
             const reviewRules = rules.filter(rule => rule.type === 'pull_request');
             const classicReview = classic?.required_pull_request_reviews;
@@ -86612,23 +86882,26 @@ class PullRequestApprovalRepository {
             }
             return { readable: true, dismissesStaleReviews: hasStaleRule && allStale, requiredChecks: [...requiredChecks] };
         }
-        catch {
+        catch (cause) {
+            collectDiagnostic(diagnostics, cause);
             return { readable: false, dismissesStaleReviews: false, requiredChecks: [] };
         }
     }
-    async allPages(method, params) {
-        const result = [];
-        for await (const response of this.octokit.paginate.iterator(method, { ...params, per_page: 100 })) {
-            const page = Array.isArray(response.data) ? response.data
-                : record(response.data)?.check_runs ?? record(response.data)?.workflow_runs
-                    ?? record(response.data)?.artifacts ?? record(response.data)?.jobs;
-            if (!Array.isArray(page))
-                throw new Error('GitHub pagination returned an invalid page.');
-            result.push(...page);
-            if (result.length > 3000)
-                throw new Error('Approval evidence pagination exceeded the safe bound.');
-        }
-        return result;
+    async allPages(operation, method, params) {
+        return (0, approval_evidence_read_1.readApprovalEvidence)(operation, async () => {
+            const result = [];
+            for await (const response of this.octokit.paginate.iterator(method, { ...params, per_page: 100 })) {
+                const page = Array.isArray(response.data) ? response.data
+                    : record(response.data)?.check_runs ?? record(response.data)?.workflow_runs
+                        ?? record(response.data)?.artifacts ?? record(response.data)?.jobs;
+                if (!Array.isArray(page))
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, 'invalid-page');
+                result.push(...page);
+                if (result.length > 3000)
+                    throw (0, approval_evidence_error_1.approvalEvidenceError)(operation, 'page-limit');
+            }
+            return result;
+        });
     }
 }
 exports.PullRequestApprovalRepository = PullRequestApprovalRepository;
@@ -86665,7 +86938,7 @@ function array(value) { return Array.isArray(value) ? value : []; }
 async function readEffectiveApprovalPolicy(octokit, target) {
     const admit = (source, value) => {
         if (typeof value !== 'string' || value.length > 65536)
-            throw new Error('Approval policy response is malformed or unbounded.');
+            throw new application_error_1.ApplicationError('provider.contract-invalid', 'Approval policy response is malformed or unbounded.');
         return { source, value };
     };
     try {
@@ -86689,6 +86962,14 @@ async function readEffectiveApprovalPolicy(octokit, target) {
         throw error;
     }
 }
+function collectDiagnostic(diagnostics, cause) {
+    if (cause instanceof application_error_1.ApplicationError && cause.recovery?.id === 'approval-evidence-read-failed') {
+        diagnostics.push(cause.recovery.variables);
+    }
+    else {
+        diagnostics.push((0, approval_evidence_error_1.approvalEvidenceError)('evidence', 'invalid-response').recovery.variables);
+    }
+}
 
 
 /***/ }),
@@ -88929,6 +89210,44 @@ class AgentResponseLengthFailure extends Error {
 exports.AgentResponseLengthFailure = AgentResponseLengthFailure;
 
 
+/***/ }),
+
+/***/ 98205:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.APPROVAL_EVIDENCE_REASONS = exports.APPROVAL_EVIDENCE_PERMISSIONS = void 0;
+/** Closed vocabulary: no provider text, URLs, headers, policy values or credentials. */
+exports.APPROVAL_EVIDENCE_PERMISSIONS = Object.freeze({
+    'evidence': 'repository-read',
+    'pull-request': 'pull-requests-read',
+    'base-ref': 'contents-read',
+    'merge-commit': 'contents-read',
+    'policy': 'actions-variables-read',
+    'files': 'pull-requests-read',
+    'reviews': 'pull-requests-read',
+    'comments': 'issues-read',
+    'head-checks': 'checks-read',
+    'merge-checks': 'checks-read',
+    'head-runs': 'actions-read',
+    'merge-runs': 'actions-read',
+    'jobs': 'actions-read',
+    'rules': 'metadata-read',
+    'classic-protection': 'administration-read',
+    'authenticated-user': 'authenticated-user-read',
+    'coverage-artifacts': 'actions-read',
+    'coverage-download': 'actions-read',
+    'coverage-parse': 'actions-read',
+});
+exports.APPROVAL_EVIDENCE_REASONS = Object.freeze([
+    'http-400', 'http-401', 'http-403', 'http-404', 'http-409', 'http-422', 'http-429',
+    'http-500', 'http-502', 'http-503', 'http-504', 'transport-unavailable',
+    'invalid-response', 'invalid-page', 'page-limit', 'artifact-unavailable', 'artifact-invalid', 'artifact-mismatch',
+]);
+
+
 /***/ }),
 
 /***/ 51114:
@@ -89557,6 +89876,25 @@ function isNewerCliVersion(installedVersion, publishedVersion) {
 }
 
 
+/***/ }),
+
+/***/ 21565:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CLOSED_ISSUE_REASONS = exports.CLOSED_ISSUE_PHASES = exports.CLOSED_ISSUE_RESULTS = void 0;
+exports.CLOSED_ISSUE_RESULTS = Object.freeze([
+    'ReconcileClosedIssueMetadataUseCase', 'CloseIssueAfterMergingUseCase', 'RetireBranchSyncUseCase', 'RetireProgressUseCase',
+]);
+exports.CLOSED_ISSUE_PHASES = Object.freeze([
+    'identity', 'read', 'native-fence', 'label-remove', 'label-add', 'metadata-verification',
+    'card-inventory', 'card-freshness', 'card-update', 'card-verification',
+]);
+exports.CLOSED_ISSUE_REASONS = Object.freeze(['completed', 'not_planned', 'duplicate', 'reopened', 'unknown', 'unavailable']);
+
+
 /***/ }),
 
 /***/ 77454: