@webpresso/agent-kit 3.1.28 → 3.2.0

package/dist/esm/review/subject.js

@@ -39,6 +39,43 @@ export function resolveReviewCommit(cwd, ref) {
     }
     return commit;
 }
+/**
+ * Repo-relative paths with uncommitted changes (staged, unstaged, or
+ * untracked) that are NOT review evidence (reviews.md / review-events.jsonl /
+ * review-artifacts/*.md — see isReviewEvidenceRelativePath). A `wp-git-tree-v1`
+ * subject digest is computed purely from the committed tree at a ref, so any
+ * non-evidence path here means the working tree diverges from what that
+ * digest — and any approval bound to it — actually covers. Review evidence is
+ * excluded because the gate's own artifact/ledger writes routinely leave the
+ * tree dirty between reruns without representing unreviewed content.
+ */
+export function findUnreviewedWorkingTreeChanges(cwd) {
+    const output = gitBuffer(cwd, [
+        "status",
+        "--porcelain=v1",
+        "--untracked-files=all",
+        "--ignored=no",
+        "-z",
+    ]).toString("utf8");
+    const records = output.split("\0").filter((record) => record.length > 0);
+    const paths = new Set();
+    for (let index = 0; index < records.length; index += 1) {
+        const record = records[index];
+        const statusCode = record.slice(0, 2);
+        paths.add(record.slice(3));
+        if (/[RC]/u.test(statusCode)) {
+            // Rename/copy porcelain records are followed by the original path.
+            const originalPath = records[index + 1];
+            if (originalPath !== undefined) {
+                paths.add(originalPath);
+                index += 1;
+            }
+        }
+    }
+    return [...paths]
+        .filter((relativePath) => !isReviewEvidenceRelativePath(relativePath))
+        .toSorted();
+}
 function parseTree(cwd, commit) {
     const output = gitBuffer(cwd, ["ls-tree", "-r", "-z", "--full-tree", commit]);
     const entries = [];
@@ -74,31 +111,40 @@ function parseTree(cwd, commit) {
         throw new Error("Truncated git ls-tree output.");
     return entries.sort((left, right) => Buffer.compare(left.path, right.path));
 }
-function findBlueprintRoot(entries, blueprintSlug, blueprintPath) {
+function isRegularBlob(entry) {
+    return entry.type === "blob" && /^100(?:644|755)$/u.test(entry.mode.toString("ascii"));
+}
+function findBlueprintDocument(entries, blueprintSlug, blueprintPath) {
     if (blueprintPath) {
         const normalized = blueprintPath.replaceAll("\\", "/");
         const target = Buffer.from(normalized, "utf8");
-        const matches = entries.filter((entry) => entry.path.equals(target));
-        if (matches.length === 1 && normalized.endsWith("/_overview.md")) {
-            return target.subarray(0, target.length - Buffer.byteLength("_overview.md"));
+        const matches = entries.filter((entry) => entry.path.equals(target) && isRegularBlob(entry));
+        if (matches.length === 1 && normalized.endsWith(".md")) {
+            return matches[0];
         }
     }
-    const suffix = Buffer.from(`/${blueprintSlug}/_overview.md`, "utf8");
+    const folderSuffix = `/${blueprintSlug}/_overview.md`;
+    const flatSuffix = `/${blueprintSlug}.md`;
     const matches = entries.filter((entry) => {
         const normalized = entry.path.toString("utf8");
-        const segments = normalized.split("/");
-        return (segments[0] === "blueprints" &&
-            BLUEPRINT_STATUSES.has(segments[1] ?? "") &&
-            entry.path.subarray(-suffix.length).equals(suffix));
+        const suffix = normalized.endsWith(folderSuffix)
+            ? folderSuffix
+            : normalized.endsWith(flatSuffix)
+                ? flatSuffix
+                : undefined;
+        const lifecycle = suffix ? normalized.slice(0, -suffix.length).split("/").at(-1) : undefined;
+        return isRegularBlob(entry) && BLUEPRINT_STATUSES.has(lifecycle ?? "");
     });
     if (matches.length !== 1) {
         throw new Error(`Expected one tracked blueprint ${blueprintSlug} at target commit, found ${matches.length}.`);
     }
-    const overview = matches[0].path;
-    return overview.subarray(0, overview.length - Buffer.byteLength("_overview.md"));
+    return matches[0];
 }
-function isRegularBlob(entry) {
-    return entry.type === "blob" && /^100(?:644|755)$/u.test(entry.mode.toString("ascii"));
+function blueprintEvidenceRoot(documentPath) {
+    const value = documentPath.toString("utf8");
+    if (!value.endsWith("/_overview.md"))
+        return null;
+    return documentPath.subarray(0, documentPath.length - Buffer.byteLength("_overview.md"));
 }
 function isExcludedReviewEnvelope(entry, blueprintRoot) {
     if (!isRegularBlob(entry) ||
@@ -114,10 +160,10 @@ function isExcludedReviewEnvelope(entry, blueprintRoot) {
     const artifactName = relative.slice(prefix.length);
     return artifactName.length > 3 && !artifactName.includes("/") && artifactName.endsWith(".md");
 }
-function isReviewEvidencePath(entry) {
-    if (!isRegularBlob(entry))
-        return false;
-    const value = entry.path.toString("utf8");
+// String-based counterpart of isReviewEvidencePath, shared with callers that
+// only have a repo-relative path (no TreeEntry) — currently the working-tree
+// divergence check in findUnreviewedWorkingTreeChanges below.
+export function isReviewEvidenceRelativePath(value) {
     if (!/^blueprints\/(?:[^/]+\/)*[^/]+\//u.test(value))
         return false;
     if (/(?:^|\/)reviews\.md$/u.test(value) || /(?:^|\/)review-events\.jsonl$/u.test(value)) {
@@ -125,6 +171,11 @@ function isReviewEvidencePath(entry) {
     }
     return /(?:^|\/)review-artifacts\/[^/]+\.md$/u.test(value);
 }
+function isReviewEvidencePath(entry) {
+    if (!isRegularBlob(entry))
+        return false;
+    return isReviewEvidenceRelativePath(entry.path.toString("utf8"));
+}
 function loadBlobContents(cwd, entries) {
     const blobs = entries.filter((entry) => entry.type === "blob");
     if (blobs.length === 0)
@@ -195,11 +246,13 @@ function readTreeAtRef(cwd, ref) {
 }
 export function createDeliverySubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
     const { commit, objectFormat, entries: allEntries } = readTreeAtRef(cwd, ref);
-    const blueprintRoot = findBlueprintRoot(allEntries, blueprintSlug, blueprintPath);
+    const document = findBlueprintDocument(allEntries, blueprintSlug, blueprintPath);
+    const blueprintRoot = blueprintEvidenceRoot(document.path);
     // Exclude review evidence for the owning blueprint AND for every other blueprint
     // (the same global exclusion source snapshots use): recording evidence under an
     // unrelated blueprint must not invalidate an otherwise-identical delivery review.
-    const entries = allEntries.filter((entry) => !isExcludedReviewEnvelope(entry, blueprintRoot) && !isReviewEvidencePath(entry));
+    const entries = allEntries.filter((entry) => (blueprintRoot === null || !isExcludedReviewEnvelope(entry, blueprintRoot)) &&
+        !isReviewEvidencePath(entry));
     return {
         scheme: "wp-git-tree-v1",
         digest: hashTreeEntries(cwd, entries, objectFormat, DELIVERY_DOMAIN),
@@ -255,12 +308,39 @@ function neutralizePromotionGateResults(text) {
     }
     return lines.join("\n");
 }
-// Neutralize the lifecycle-owned frontmatter fields (`status:` value and the
-// `completed_at:` line) INSIDE the leading frontmatter block only. A body line
+// Frontmatter keys removed wholesale by the normalizer (value + folded
+// continuation lines). Each mirrors exactly one lifecycle writer:
+// `completed_at` (upsertCompletedAt) and the `wp blueprint start` /
+// progress-stamp fields (setBlueprintFrontmatterFields lifecycle intents).
+const PLAN_LIFECYCLE_STRIPPED_KEYS = [
+    "completed_at",
+    "last_updated",
+    "progress",
+    "worktree_owner_id",
+    "worktree_owner_branch",
+];
+// Neutralize the lifecycle-owned frontmatter fields (`status:` value plus the
+// stripped keys above) INSIDE the leading frontmatter block only. A body line
 // that merely looks like one of these (e.g. task text reading
 // "completed_at: must remain unset until release") is plan substance and must
-// keep affecting the digest.
+// keep affecting the digest. Stripping removes the key line and any indented
+// continuation lines so folded (`>-`) values normalize away too.
 function neutralizeLifecycleFrontmatter(text) {
+    const match = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/u.exec(text);
+    if (!match)
+        return text;
+    let frontmatter = match[0];
+    frontmatter = frontmatter.replace(/^(status:\s*)(['"]?)[^'"\r\n]+?(['"]?)(\s*)$/m, `$1${PLAN_STATUS_PLACEHOLDER}$4`);
+    for (const key of PLAN_LIFECYCLE_STRIPPED_KEYS) {
+        frontmatter = frontmatter.replace(new RegExp(String.raw `^${key}:[^\n]*\n?(?:[ \t]+[^\n]*\n?)*`, "gmu"), "");
+    }
+    return `${frontmatter}${text.slice(match[0].length)}`;
+}
+// The pre-extension normalizer (status + completed_at only). Review events
+// recorded before the stripped-key extension bound their subjectDigest to this
+// normalization; verification accepts either digest so committed approvals are
+// not stranded by the rollout. New events always record the current digest.
+function legacyNeutralizeLifecycleFrontmatter(text) {
     const match = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/u.exec(text);
     if (!match)
         return text;
@@ -305,26 +385,89 @@ function neutralizeReadinessStamps(text) {
 // NO_CODE_CHANGE / GitLab patch-id semantics: approvals are re-derivable from
 // substance-only digests, not carried). Each rule mirrors exactly one
 // lifecycle writer, scoped to the location that writer owns:
-// - frontmatter `status:` value       (updateFrontmatterStatus, blueprint mutations)
-// - frontmatter `completed_at:` line  (upsertCompletedAt)
+// - frontmatter status/progress/owner fields (blueprint lifecycle mutations)
+// - frontmatter `completed_at:` line       (upsertCompletedAt)
 // - Readiness Verdict `- verified-at:`/`- verified-head:` items (upsertReadinessValue)
 // - Promotion Gates "Last result" cells (updateGateLastResult)
 // Any other byte change — task text, acceptance criteria, scope, lookalike
 // lines outside the owned locations — still changes the digest and dismisses
 // prior plan approvals.
+const PLAN_TASK_STATUS_PLACEHOLDER = "__wp-task-status__";
+// Neutralize the task-execution state the lifecycle engine writes
+// (updateTaskStatus, applyVerification): `**Status:** <status>` lines,
+// acceptance checkbox marks, and `**Verification:**` +
+// ```webpresso-evidence-v1 fenced evidence blocks. Task execution is lifecycle
+// state, not plan substance — without this, the engine's own task_verify /
+// finalize writes dismiss the plan approval and no completion commit can ever
+// carry authority. Acceptance-criteria TEXT stays substance; only the check
+// mark is neutralized.
+function neutralizeTaskExecutionState(text) {
+    const lines = text.split("\n");
+    const out = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (/^\*\*Verification:\*\*\s*$/u.test(line)) {
+            // Skip the writer-owned block: "**Verification:**", blank(s), the
+            // evidence fence, and one trailing blank line.
+            let cursor = index + 1;
+            while (cursor < lines.length && lines[cursor].trim() === "")
+                cursor += 1;
+            if (/^```webpresso-evidence-v1\s*$/u.test(lines[cursor] ?? "")) {
+                cursor += 1;
+                while (cursor < lines.length && !/^```\s*$/u.test(lines[cursor]))
+                    cursor += 1;
+                cursor += 1; // closing fence
+                if ((lines[cursor] ?? "").trim() === "")
+                    cursor += 1;
+                index = cursor - 1;
+                continue;
+            }
+        }
+        if (/^\*\*Status:\*\* (?:todo|in-progress|blocked|done|dropped)\s*$/u.test(line)) {
+            out.push(`**Status:** ${PLAN_TASK_STATUS_PLACEHOLDER}`);
+            continue;
+        }
+        out.push(line.replace(/^(\s*)- \[[xX ]\] /u, "$1- [_] "));
+    }
+    return out.join("\n");
+}
 export function normalizePlanSubjectContent(content) {
     let text = typeof content === "string" ? content : content.toString("utf8");
     text = neutralizeLifecycleFrontmatter(text);
     text = neutralizeReadinessStamps(text);
     text = neutralizePromotionGateResults(text);
+    text = neutralizeTaskExecutionState(text);
     return Buffer.from(text, "utf8");
 }
-export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
+/**
+ * Plan-subject digest for in-memory (working-tree) blueprint content. Used to
+ * accept working-ledger review events that digest-bind the exact bytes being
+ * committed (pre-commit runs before those events reach any git ref).
+ */
+export function createPlanSubjectDigestForContent(blueprintSlug, content) {
+    const hash = createHash("sha256").update(PLAN_DOMAIN);
+    updateField(hash, blueprintSlug);
+    updateField(hash, normalizePlanSubjectContent(content));
+    return hash.digest("hex");
+}
+/**
+ * Digest-compatibility variant for review events recorded before the
+ * stripped-key extension of `neutralizeLifecycleFrontmatter`. Verification
+ * accepts a match against either normalization; new digests always use
+ * `normalizePlanSubjectContent`.
+ */
+export function legacyNormalizePlanSubjectContent(content) {
+    let text = typeof content === "string" ? content : content.toString("utf8");
+    text = legacyNeutralizeLifecycleFrontmatter(text);
+    text = neutralizeReadinessStamps(text);
+    text = neutralizePromotionGateResults(text);
+    return Buffer.from(text, "utf8");
+}
+function planSubjectAtRef(cwd, ref, blueprintSlug, normalize, blueprintPath) {
     const commit = resolveReviewCommit(cwd, ref);
     const entries = parseTree(cwd, commit);
-    const blueprintRoot = findBlueprintRoot(entries, blueprintSlug, blueprintPath);
-    const overviewPath = Buffer.concat([blueprintRoot, Buffer.from("_overview.md", "ascii")]);
-    const overview = entries.find((entry) => entry.path.equals(overviewPath));
+    const overview = findBlueprintDocument(entries, blueprintSlug, blueprintPath);
+    const overviewPath = overview.path;
     if (!overview || overview.type !== "blob") {
         throw new Error("Tracked blueprint overview is not a blob.");
     }
@@ -333,10 +476,7 @@ export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
         throw new Error("Tracked blueprint overview content is unavailable.");
     const hash = createHash("sha256").update(PLAN_DOMAIN);
     updateField(hash, blueprintSlug);
-    // Hash normalized content. This redefines wp-blueprint-v1 in place, which is
-    // safe pre-merge: no committed review-events.jsonl exists anywhere, so no
-    // recorded plan digest can break.
-    updateField(hash, normalizePlanSubjectContent(content));
+    updateField(hash, normalize(content));
     return {
         scheme: "wp-blueprint-v1",
         digest: hash.digest("hex"),
@@ -344,6 +484,13 @@ export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
         files: [overviewPath.toString("utf8")],
     };
 }
+export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
+    return planSubjectAtRef(cwd, ref, blueprintSlug, normalizePlanSubjectContent, blueprintPath);
+}
+/** Plan subject digested with the pre-extension normalization (see above). */
+export function createLegacyPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
+    return planSubjectAtRef(cwd, ref, blueprintSlug, legacyNormalizePlanSubjectContent, blueprintPath);
+}
 export const reviewSubjectInternals = {
     isExcludedReviewEnvelope,
     isReviewEvidencePath,

package/dist/esm/runtime/executor.d.ts

@@ -14,6 +14,7 @@ export interface ResolveRuntimeEnvironmentOptions {
 }
 export interface RuntimeSpawnOptions {
     readonly cwd?: string;
+    readonly envCwd?: string;
     readonly profile?: RuntimeSelector;
     readonly secretProfile?: string;
     readonly environment?: string;

package/dist/esm/runtime/executor.js

@@ -82,9 +82,10 @@ export function resolveRuntimeEnvironment(options = {}) {
 }
 export function buildRuntimeSpawnOptions(options = {}) {
     const cwd = options.cwd ?? process.cwd();
+    const envCwd = options.envCwd ?? cwd;
     const cache = options.cache ?? createRuntimeEnvCache();
     const resolvedEnv = resolveRuntimeEnvironment({
-        cwd,
+        cwd: envCwd,
         profile: options.profile,
         secretProfile: options.secretProfile,
         environment: options.environment,

package/dist/esm/runtime/opencode-account-materializer.d.ts

@@ -0,0 +1,34 @@
+import { type OpencodeAccount } from "#review/opencode-account.js";
+import { resolveRuntimeEnvironment } from "./executor.js";
+export type OpencodeAccountsResolution = {
+    readonly ok: true;
+    readonly accounts: readonly OpencodeAccount[];
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export interface ResolveOpencodeAccountsGracefullyInput {
+    readonly cwd: string;
+    /**
+     * Secret profile to resolve through — REQUIRED, never optional.
+     *
+     * Without it `resolveRuntimeEnvironment` passes no environment selector and
+     * the secret manager falls back to its own ambient, path-keyed config
+     * (Doppler's per-directory scopes, Infisical's discovered `.infisical.json`).
+     * That resolves only in a checkout that happens to sit under the scoped path,
+     * so discovery silently yields zero accounts in every managed worktree, CI
+     * clone, and fresh checkout — a failure mode that is invisible because callers
+     * degrade gracefully. Keeping this required makes that class of bug a compile
+     * error instead of a silent runtime degradation. Callers pass
+     * `resolveAgentSecretProfile(env)`.
+     */
+    readonly secretProfile: string;
+    readonly resolveRuntimeEnvironment?: typeof resolveRuntimeEnvironment;
+}
+/**
+ * Resolve `OPENCODE_GO_KEY_*` secrets into accounts without ever throwing.
+ * On any resolution failure (missing profile, secret-manager error, empty
+ * result), returns a failure reason derived only from the error's own
+ * message/type — never from a secret value.
+ */
+export declare function resolveOpencodeAccountsGracefully(input: ResolveOpencodeAccountsGracefullyInput): OpencodeAccountsResolution;

package/dist/esm/runtime/opencode-account-materializer.js

@@ -0,0 +1,33 @@
+import { resolveOpencodeAccounts } from "#review/opencode-account.js";
+import { resolveRuntimeEnvironment } from "./executor.js";
+function describeError(error) {
+    if (error instanceof Error)
+        return `${error.name}: ${error.message}`;
+    return typeof error === "string" ? error : "unknown error";
+}
+/**
+ * Resolve `OPENCODE_GO_KEY_*` secrets into accounts without ever throwing.
+ * On any resolution failure (missing profile, secret-manager error, empty
+ * result), returns a failure reason derived only from the error's own
+ * message/type — never from a secret value.
+ */
+export function resolveOpencodeAccountsGracefully(input) {
+    const resolveEnv = input.resolveRuntimeEnvironment ?? resolveRuntimeEnvironment;
+    let secrets;
+    try {
+        secrets = resolveEnv({
+            cwd: input.cwd,
+            profile: "secrets-only",
+            secretProfile: input.secretProfile,
+            environment: input.secretProfile,
+        });
+    }
+    catch (error) {
+        return { ok: false, reason: describeError(error) };
+    }
+    const accounts = resolveOpencodeAccounts(secrets);
+    if (accounts.length === 0) {
+        return { ok: false, reason: "no OPENCODE_GO_KEY_* secrets found" };
+    }
+    return { ok: true, accounts };
+}

package/dist/esm/secret-gate/runner.d.ts

@@ -11,6 +11,7 @@ export interface SecretGateCommandOptions {
     readonly command: string;
     readonly args?: readonly string[];
     readonly cwd?: string;
+    readonly commandCwd?: string;
     readonly timeoutMs?: number;
     readonly signal?: AbortSignal;
     readonly forceSecretGate?: boolean;

package/dist/esm/secret-gate/runner.js

@@ -35,6 +35,7 @@ export function buildSecretGateCommand(options) {
         sink,
         "--profile",
         profile,
+        ...(options.commandCwd ? ["--command-cwd", options.commandCwd] : []),
         "--",
         options.command,
         ...(options.args ?? []),
@@ -45,9 +46,11 @@ export function runSecretGateCommand(options) {
     const timeoutMs = options.timeoutMs ?? 30_000;
     const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
     const command = buildSecretGateCommand(options);
+    const runsInnerCommandDirectly = command.command === options.command;
+    const spawnCwd = runsInnerCommandDirectly && options.commandCwd ? options.commandCwd : options.cwd;
     return new Promise((resolve) => {
         const child = spawn(command.command, [...command.args], {
-            cwd: options.cwd,
+            cwd: spawnCwd,
             env: buildRuntimeProcessEnv(options.cwd, process.env),
             detached: process.platform !== "win32",
         });

package/dist/esm/status/snapshot.js

@@ -1,11 +1,13 @@
 import path from "node:path";
 import { z } from "zod";
 import { evaluateApprovalReviewers } from "#lifecycle/audit.js";
+import { collectV2ReviewProvenance } from "#lifecycle/review-provenance.js";
 import { evaluateRequiredChecks } from "#mcp/tools/_shared/required-checks.js";
 import { redactText } from "#mcp/tools/_shared/redact.js";
 import { runCommand } from "#mcp/tools/_shared/run-command.js";
 import { readReviewAuthorityAtRef } from "#review/authority.js";
 import { resolveBlueprintRoot } from "#utils/blueprint-root.js";
+import { parseBlueprintDocumentRelativePath } from "#utils/document-paths.js";
 export const statusLevelSchema = z.enum(["ready", "blocked", "partial", "unknown"]);
 export const requiredCheckEvaluationSchema = z.object({
     total: z.number().int().nonnegative(),
@@ -80,6 +82,11 @@ export const wpStatusSnapshotSchema = z.object({
 });
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_MAX_OUTPUT_BYTES = 64_000;
+// `gh pr view --json` includes the PR `body`, which alone can exceed the small
+// caller diagnostic budget (GitHub bodies run to tens of KB). Parse that JSON
+// against a generous semantic budget so mergeability/checks/blueprint-linkage
+// fields are never lost to truncation; diagnostics keep the small caller budget.
+const PR_VIEW_SEMANTIC_MAX_OUTPUT_BYTES = 1_048_576;
 const DISCLOSURE_FIELDS = [
     "Execution model(s)",
     "Planning/refinement model(s)",
@@ -115,8 +122,8 @@ async function probe(cwd, command, args, options = {}) {
         cwd,
         timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
     });
+    const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
     if ("error" in outcome) {
-        const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
         return {
             passed: false,
             semanticStdout: "",
@@ -125,11 +132,11 @@ async function probe(cwd, command, args, options = {}) {
             missingBinary: outcome.error.code === "ENOENT",
         };
     }
-    const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+    const semanticMaxOutputBytes = options.semanticMaxOutputBytes ?? maxOutputBytes;
     return {
         passed: outcome.exitCode === 0,
-        semanticStdout: clipBytes(outcome.stdout, maxOutputBytes),
-        semanticTruncated: Buffer.byteLength(outcome.stdout, "utf8") > maxOutputBytes,
+        semanticStdout: clipBytes(outcome.stdout, semanticMaxOutputBytes),
+        semanticTruncated: Buffer.byteLength(outcome.stdout, "utf8") > semanticMaxOutputBytes,
         stdout: clipDiagnostic(outcome.stdout, maxOutputBytes),
         stderr: clipDiagnostic(outcome.stderr, maxOutputBytes),
         exitCode: outcome.exitCode,
@@ -307,33 +314,29 @@ function selectBlueprintFile(projectRoot, pr) {
             const prefix = `${root}/`;
             if (!file.path.startsWith(prefix))
                 continue;
-            const segments = file.path.slice(prefix.length).split("/");
-            if (segments.length < 3 ||
-                segments.at(-1) !== "_overview.md" ||
-                segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
-                continue;
-            }
-            const stableSlug = segments.slice(1, -1).join("/");
-            if (stableSlug)
-                return [{ ...file, stableSlug }];
+            const parsed = parseBlueprintDocumentRelativePath(file.path.slice(prefix.length));
+            if (parsed)
+                return [{ ...file, stableSlug: parsed.slug }];
         }
         return [];
     });
     const priority = (file) => file.changeType === "ADDED" ? 0 : file.changeType === "RENAMED" ? 1 : 2;
     return candidates.toSorted((left, right) => priority(left) - priority(right))[0];
 }
-function resolveBlueprintEvidence(cwd, projectRoot, pr, targetHash) {
+function resolveBlueprintEvidence(projectRoot, pr, targetHash) {
     const blueprintFile = selectBlueprintFile(projectRoot, pr);
     if (!blueprintFile || !targetHash)
         return undefined;
     try {
-        const authority = readReviewAuthorityAtRef(cwd, targetHash, blueprintFile.stableSlug, "delivery");
+        const authority = readReviewAuthorityAtRef(projectRoot, targetHash, blueprintFile.stableSlug, "delivery");
         if (authority.blueprintPath !== blueprintFile.path)
             return undefined;
+        const approvals = collectV2ReviewProvenance(path.resolve(projectRoot, blueprintFile.path), "delivery", targetHash);
         return {
             path: blueprintFile.path,
             lifecycle: authority.lifecycle,
-            approvalsSatisfied: evaluateApprovalReviewers(authority.approvals.map((approval) => approval.reviewer)).satisfied,
+            approvalsSatisfied: evaluateApprovalReviewers(approvals.map((approval) => approval.reviewer))
+                .satisfied,
         };
     }
     catch {
@@ -582,7 +585,10 @@ export async function buildStatusSnapshot(options = {}) {
             "files",
         ].join(",");
         const [view, checksProbe] = await Promise.all([
-            probe(cwd, "gh", ["pr", "view", ...selector, "--json", fields], probeOptions),
+            probe(cwd, "gh", ["pr", "view", ...selector, "--json", fields], {
+                ...probeOptions,
+                semanticMaxOutputBytes: PR_VIEW_SEMANTIC_MAX_OUTPUT_BYTES,
+            }),
             probe(cwd, "gh", ["pr", "checks", ...selector, "--required", "--json", "name,state,bucket,link,description"], probeOptions),
         ]);
         pr = view.passed ? parseJsonObject(view.semanticStdout) : undefined;
@@ -599,7 +605,7 @@ export async function buildStatusSnapshot(options = {}) {
                 readGreptileComments(cwd, pr, probeOptions),
             ])
             : [{ complete: false, warning: "PR metadata unavailable." }, { comments: [] }];
-        const blueprint = resolveBlueprintEvidence(cwd, firstLine(topLevel.semanticStdout) ?? cwd, pr, localHead);
+        const blueprint = resolveBlueprintEvidence(firstLine(topLevel.semanticStdout) ?? cwd, pr, localHead);
         const readiness = evaluatePrReadiness({
             localHead,
             dirtyWorktree,
@@ -649,9 +655,14 @@ export async function buildStatusSnapshot(options = {}) {
             threadsComplete: threads.complete,
             greptile: classifyGreptile(checks ?? [], greptileComments.comments, stringField(pr?.headRefOid)),
         };
+        // `body` is fully consumed above (release-evidence + disclosure via
+        // `evaluatePrReadiness`, blueprint linkage via `resolveBlueprintEvidence`),
+        // so drop it from the emitted metadata to keep the payload from re-ballooning
+        // to the size that truncated the parse in the first place.
+        const { body: _body, ...metadataWithoutBody } = pr ?? {};
         context.pr = {
             selector: selector[0],
-            metadata: pr,
+            metadata: pr ? metadataWithoutBody : undefined,
             checks: readiness.checks
                 ? { ...readiness.checks, checks: [...readiness.checks.checks] }
                 : undefined,

package/dist/esm/test/duration-sequencer.d.ts

@@ -0,0 +1,20 @@
+import { BaseSequencer, type TestSpecification } from "vitest/node";
+export declare function weightFor(project: string, relativePath: string): number;
+interface WeightedSpec {
+    readonly spec: TestSpecification;
+    readonly weight: number;
+    readonly key: string;
+}
+/**
+ * Deterministic greedy LPT partition of `specs` into `count` bins. Files are
+ * sorted heaviest-first (ties broken by path so the order is stable across
+ * every shard job), then each is placed into the currently-lightest bin (ties
+ * broken by lowest bin index). Returns all bins in index order.
+ *
+ * Exported for the contract test; the sequencer only needs one bin.
+ */
+export declare function partitionByDuration(specs: readonly WeightedSpec[], count: number): readonly (readonly WeightedSpec[])[];
+export declare class DurationSequencer extends BaseSequencer {
+    shard(files: TestSpecification[]): Promise<TestSpecification[]>;
+}
+export {};

package/dist/esm/test/duration-sequencer.js

@@ -0,0 +1,54 @@
+import { relative } from "node:path";
+import { BaseSequencer } from "vitest/node";
+import rawSnapshot from "./shard-durations.json" with { type: "json" };
+const snapshot = rawSnapshot;
+// A generated snapshot always carries a positive defaultWeight; clamp to 1 only
+// to keep LPT well-defined if the JSON is ever hand-truncated to nothing.
+const DEFAULT_WEIGHT = snapshot.defaultWeight > 0 ? snapshot.defaultWeight : 1;
+export function weightFor(project, relativePath) {
+    return snapshot.durations[project]?.[relativePath] ?? DEFAULT_WEIGHT;
+}
+/**
+ * Deterministic greedy LPT partition of `specs` into `count` bins. Files are
+ * sorted heaviest-first (ties broken by path so the order is stable across
+ * every shard job), then each is placed into the currently-lightest bin (ties
+ * broken by lowest bin index). Returns all bins in index order.
+ *
+ * Exported for the contract test; the sequencer only needs one bin.
+ */
+export function partitionByDuration(specs, count) {
+    const bins = Array.from({ length: count }, () => []);
+    const loads = Array.from({ length: count }, () => 0);
+    const ordered = [...specs].sort((a, b) => b.weight !== a.weight ? b.weight - a.weight : a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+    for (const item of ordered) {
+        let target = 0;
+        let targetLoad = loads[0] ?? 0;
+        for (let i = 1; i < count; i += 1) {
+            const load = loads[i] ?? 0;
+            if (load < targetLoad) {
+                target = i;
+                targetLoad = load;
+            }
+        }
+        // target is always in [0, count): bins/loads were sized to `count`.
+        (bins[target] ??= []).push(item);
+        loads[target] = targetLoad + item.weight;
+    }
+    return bins;
+}
+export class DurationSequencer extends BaseSequencer {
+    async shard(files) {
+        const { config } = this.ctx;
+        // No --shard (serial lane, local full runs): nothing to partition.
+        if (!config.shard)
+            return files;
+        const { index, count } = config.shard;
+        const weighted = files.map((spec) => {
+            const key = relative(config.root, spec.moduleId);
+            return { spec, key, weight: weightFor(spec.project.name, key) };
+        });
+        const bins = partitionByDuration(weighted, count);
+        // index is 1-based in [1, count]; the bin is always present.
+        return (bins[index - 1] ?? []).map((item) => item.spec);
+    }
+}