archal 0.9.20 → 0.10.0

package/dist/commands/autoloop-pr-verification.cjs

@@ -152,8 +152,11 @@ var AUTOLOOP_INTERNAL_ONLY_EVENT_TYPES = [
   "codex_session.recorded",
   "source_snapshot.created",
   "source_snapshot.updated",
+  "canonical_trace_ingest.rejected",
+  "canonical_trace_ingest.digest_conflict",
   "autoloop_run.claimed",
   "autoloop_run.retry_scheduled",
+  "operator.requeued",
   ...AGENT_STREAM_EVENT_TYPES
 ];
 function autoloopRunCapabilitiesFromPostFixPayload(payload) {
@@ -171,6 +174,103 @@ var AUTOLOOP_EVENT_TYPES = [
   ...AUTOLOOP_INTERNAL_ONLY_EVENT_TYPES
 ];
 
+// ../packages/contracts/src/autoloop/trace-source-capabilities.ts
+var AUTOLOOP_TRACE_SOURCE_HOSTED_PROVIDER_CAPABILITIES = [
+  {
+    provider: "supabase",
+    tier: "supported",
+    ingestionMode: "hosted_poll",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "Hosted workers can poll Supabase-hosted Postgres trace tables through a read-only database URL.",
+    nextStep: "Register with archal autoloop --source supabase and a read-only database URL secret reference."
+  },
+  {
+    provider: "postgres",
+    tier: "supported",
+    ingestionMode: "hosted_poll",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "Hosted workers can poll Postgres trace tables or SQL views through a read-only database URL.",
+    nextStep: "Register with archal autoloop --source postgres and a read-only database URL secret reference."
+  },
+  {
+    provider: "http",
+    tier: "beta",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "HTTP push traces can be normalized locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Push traces to the workspace dashboard OTLP ingest endpoint, then run archal autoloop ./traces --repository owner/repo."
+  },
+  {
+    provider: "otel",
+    tier: "beta",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "OTel traces can be normalized locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Configure your OTel SDK to export to the workspace dashboard OTLP endpoint, then run archal autoloop ./traces --repository owner/repo."
+  },
+  {
+    provider: "langfuse",
+    tier: "import",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "Langfuse exports can be normalized locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Export traces from Langfuse and import via the dashboard, or place normalized JSON in an autoloop watch directory."
+  },
+  {
+    provider: "braintrust",
+    tier: "import",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "Braintrust exports can be normalized locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Export traces from Braintrust and import via the dashboard, or place normalized JSON in an autoloop watch directory."
+  },
+  {
+    provider: "s3",
+    tier: "import",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "S3 trace exports can be mirrored locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Configure bucket access from the dashboard Connect a trace database form, or drop normalized exports into a watch directory with archal autoloop ./traces --repository owner/repo."
+  },
+  {
+    provider: "gcs",
+    tier: "import",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "GCS trace exports can be mirrored locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Configure bucket access from the dashboard Connect a trace database form, or drop normalized exports into a watch directory with archal autoloop ./traces --repository owner/repo."
+  },
+  {
+    provider: "custom",
+    tier: "custom_contract",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "Custom trace JSON can be normalized locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Place normalized trace JSON in a watch directory and run archal autoloop ./traces --repository owner/repo."
+  },
+  {
+    provider: "file",
+    tier: "local_only",
+    ingestionMode: "client_upload",
+    hostedRegistration: "available",
+    hostedImport: "available",
+    summary: "File-backed traces can be normalized locally and uploaded into hosted autoloop as autoloop runs.",
+    nextStep: "Place trace JSON files in a watch directory and run archal autoloop ./traces --repository owner/repo."
+  }
+];
+var AUTOLOOP_TRACE_SOURCE_HOSTED_PROVIDER_CAPABILITY_BY_PROVIDER = new Map(
+  AUTOLOOP_TRACE_SOURCE_HOSTED_PROVIDER_CAPABILITIES.map((cap) => [cap.provider, cap])
+);
+
 // ../packages/contracts/src/autoloop.ts
 var AUTOLOOP_CUSTOMER_SAFE_CONTROL_PLANE_MESSAGE_SET = new Set(AUTOLOOP_CUSTOMER_SAFE_CONTROL_PLANE_MESSAGES);
 var AUTOLOOP_CUSTOMER_VISIBLE_ARTIFACT_TYPE_SET = new Set(
@@ -393,6 +493,24 @@ function autoloopPostFixReproductionEvidenceFromPayload(payload, input = {}) {
     { status, commitSha }
   );
 }
+function autoloopPostFixReproductionReason(input) {
+  if (input.hasInfrastructureFailure || input.evaluatorInfrastructureFailure) {
+    return "postfix_reproduction_infrastructure_failure";
+  }
+  if (input.status === "reproduced" || input.genuineFailureCount > 0) {
+    return "postfix_reproduction_still_failing";
+  }
+  if (input.status !== "not_reproduced") return "postfix_reproduction_not_verified";
+  if (input.requiresCloneEvidence !== false && !input.hasCloneEvidence) {
+    return "postfix_reproduction_clone_evidence_missing";
+  }
+  if (!input.hasCriteriaEvidence) return "postfix_reproduction_criteria_evidence_missing";
+  if (!input.identityMatchesPreFix) return "postfix_reproduction_trace_mismatch";
+  if (input.toolErrorCount > 0) return "postfix_reproduction_tool_errors";
+  if (input.inconclusiveCriteria > 0) return "postfix_reproduction_inconclusive";
+  if (input.satisfiedCriteria <= 0) return "postfix_reproduction_no_scored_criteria";
+  return "postfix_reproduction_passed";
+}
 function nestedAutoloopPostFixReproductionEvidence(payload, topLevelIdentityMatchesPreFix, commitSha, input) {
   const reproduction = payload["postFixReproduction"] ?? payload["post_fix_reproduction"];
   if (!isAutoloopFixPrEvidenceRecord(reproduction)) return null;
@@ -402,19 +520,30 @@ function nestedAutoloopPostFixReproductionEvidence(payload, topLevelIdentityMatc
   const status = autoloopFixPrEvidenceString(reproduction["status"]);
   const hasCloneEvidence = autoloopFixPrEvidenceBoolean(reproduction["hasCloneEvidence"]) === true;
   const hasCriteriaEvidence = autoloopFixPrEvidenceBoolean(reproduction["hasCriteriaEvidence"]) === true;
+  const satisfiedCriteria = autoloopFixPrEvidenceNumber(reproduction["satisfiedCriteria"]);
+  const genuineFailureCount = Math.max(
+    autoloopFixPrEvidenceNumber(reproduction["genuineFailureCount"]),
+    autoloopFixPrEvidenceArray(reproduction["failedCriteria"]).length,
+    autoloopFixPrEvidenceStringArray(reproduction["failedCriterionIds"]).length
+  );
+  const inconclusiveCriteria = autoloopFixPrEvidenceNumber(reproduction["inconclusiveCriteria"]);
+  const toolErrorCount = Math.max(
+    autoloopFixPrEvidenceNumber(reproduction["toolErrorCount"]),
+    autoloopFixPrEvidenceArray(reproduction["toolErrors"]).length
+  );
+  const hasInfrastructureFailure = autoloopFixPrEvidenceBoolean(reproduction["hasInfrastructureFailure"]) === true;
+  const evaluatorInfrastructureFailure = autoloopFixPrEvidenceBoolean(reproduction["evaluatorInfrastructureFailure"]) === true;
   const identityMatchesPreFix = autoloopFixPrEvidenceBoolean(
     reproduction["replayIdentityMatchesPreFix"] ?? reproduction["identityMatchesPreFix"]
   ) ?? topLevelIdentityMatchesPreFix ?? false;
-  const passedLegacyStatus = status === "passed" || status === "not_reproduced" && hasCloneEvidence && hasCriteriaEvidence;
-  if (passedLegacyStatus && hasEvidence) {
-    const legacyHasCloneEvidence = status === "passed" ? true : hasCloneEvidence;
-    const legacyHasCriteriaEvidence = status === "passed" ? true : hasCriteriaEvidence;
+  const cleanPostFixCriteria = status === "not_reproduced" && hasCloneEvidence && hasCriteriaEvidence && satisfiedCriteria > 0 && genuineFailureCount === 0 && inconclusiveCriteria === 0 && toolErrorCount === 0 && !hasInfrastructureFailure && !evaluatorInfrastructureFailure;
+  if (cleanPostFixCriteria && hasEvidence) {
     if (!identityMatchesPreFix) {
       return failedAutoloopPostFixReproduction("postfix_reproduction_trace_mismatch", {
         status,
         commitSha,
-        hasCloneEvidence: legacyHasCloneEvidence,
-        hasCriteriaEvidence: legacyHasCriteriaEvidence,
+        hasCloneEvidence,
+        hasCriteriaEvidence,
         identityMatchesPreFix: false,
         reproductionReverified: true
       });
@@ -422,8 +551,8 @@ function nestedAutoloopPostFixReproductionEvidence(payload, topLevelIdentityMatc
     if (!commitSha && input.expectedCommitSha) {
       return failedAutoloopPostFixReproduction("postfix_reproduction_commit_missing", {
         status,
-        hasCloneEvidence: legacyHasCloneEvidence,
-        hasCriteriaEvidence: legacyHasCriteriaEvidence,
+        hasCloneEvidence,
+        hasCriteriaEvidence,
         identityMatchesPreFix,
         reproductionReverified: true
       });
@@ -432,8 +561,8 @@ function nestedAutoloopPostFixReproductionEvidence(payload, topLevelIdentityMatc
       return failedAutoloopPostFixReproduction("postfix_reproduction_commit_mismatch", {
         status,
         commitSha,
-        hasCloneEvidence: legacyHasCloneEvidence,
-        hasCriteriaEvidence: legacyHasCriteriaEvidence,
+        hasCloneEvidence,
+        hasCriteriaEvidence,
         identityMatchesPreFix,
         reproductionReverified: true
       });
@@ -443,12 +572,36 @@ function nestedAutoloopPostFixReproductionEvidence(payload, topLevelIdentityMatc
       reason: "postfix_reproduction_passed",
       status,
       commitSha,
-      hasCloneEvidence: legacyHasCloneEvidence,
-      hasCriteriaEvidence: legacyHasCriteriaEvidence,
+      hasCloneEvidence,
+      hasCriteriaEvidence,
       identityMatchesPreFix,
       reproductionReverified: true
     };
   }
+  if (status === "not_reproduced" && hasEvidence) {
+    return failedAutoloopPostFixReproduction(
+      autoloopPostFixReproductionReason({
+        status,
+        genuineFailureCount,
+        hasCloneEvidence,
+        hasCriteriaEvidence,
+        identityMatchesPreFix,
+        hasInfrastructureFailure,
+        evaluatorInfrastructureFailure,
+        toolErrorCount,
+        inconclusiveCriteria,
+        satisfiedCriteria
+      }),
+      {
+        status,
+        commitSha,
+        hasCloneEvidence,
+        hasCriteriaEvidence,
+        identityMatchesPreFix,
+        reproductionReverified: false
+      }
+    );
+  }
   const reason = autoloopFixPrEvidenceString(reproduction["reason"]);
   return reason ? failedAutoloopPostFixReproduction(reason, { status, commitSha }) : null;
 }
@@ -581,18 +734,15 @@ function autoloopFixPrEvidenceStringArray(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((entry) => typeof entry === "string" && entry.length > 0);
 }
+function autoloopFixPrEvidenceArray(value) {
+  return Array.isArray(value) ? value : [];
+}
 function isAutoloopAttachEvalHarnessFile(file) {
-  return /(^|\/)archal(\/|$)/i.test(file) || /(^|\/)(evals?|evaluations?|harness)(\/|$)/i.test(file) || /(^|\/)run-[^/]*eval\.[cm]?[jt]s$/i.test(file) || /(^|\/)scripts\/.*(?:archal|eval|harness).*$/i.test(file);
+  return /(^|\/)archal(\/|$)/i.test(file) || /(^|\/)(evals?|evaluations?|harness)(\/|$)/i.test(file) || /(^|\/)run-[^/]*eval\.[cm]?[jt]s$/i.test(file) || /(^|\/)scripts\/.*(?:archal|eval|harness|replay).*$/i.test(file) || /(^|\/)services\/ai\/labs\//i.test(file);
 }
 function isDisallowedAutoloopEvalHarnessOnlyPatch(implementationFiles, runtimeEntrypointFiles) {
-  if (!implementationFiles.every(isAutoloopAttachEvalHarnessFile)) return false;
-  const runtimeEntrypoints = new Set(runtimeEntrypointFiles.map(normalizeAutoloopFixPrEvidencePath));
-  return !implementationFiles.some(
-    (file) => runtimeEntrypoints.has(normalizeAutoloopFixPrEvidencePath(file))
-  );
-}
-function normalizeAutoloopFixPrEvidencePath(file) {
-  return file.replace(/\\/g, "/").replace(/^\.\//, "").trim();
+  void runtimeEntrypointFiles;
+  return implementationFiles.length > 0 && implementationFiles.every(isAutoloopAttachEvalHarnessFile);
 }
 function autoloopFixPrEvidenceString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
@@ -619,6 +769,7 @@ var TOKEN_ENCRYPTION_PREFIX = "enc-v1";
 var CREDENTIALS_MASTER_KEY_ENV_VAR = "ARCHAL_CREDENTIALS_MASTER_KEY";
 var KEYCHAIN_SERVICE = "archal-cli";
 var KEYCHAIN_ACCOUNT = "credentials-master-key";
+var WORKSPACE_API_KEY_PREFIX = "archal_ws_";
 var ENV_TOKEN_FALLBACK_TTL_SECONDS = 24 * 60 * 60;
 
 // ../packages/node-auth/src/types.ts
@@ -626,18 +777,6 @@ function isPlan(value) {
   return value === "free" || value === "pro" || value === "enterprise";
 }
 
-// ../packages/node-auth/src/errors.ts
-var ExpiredEnvTokenError = class extends Error {
-  constructor(envVar = AUTH_TOKEN_ENV_VAR) {
-    super(`${envVar} is expired. Remove it or replace it with a valid token.`);
-    this.name = "ExpiredEnvTokenError";
-    Object.setPrototypeOf(this, new.target.prototype);
-  }
-};
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 // ../packages/node-auth/src/credential-store.ts
 var import_node_child_process = require("child_process");
 var import_node_crypto = require("crypto");
@@ -670,7 +809,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Cal.com",
     description: "Event types, schedules, availability slots, bookings, calendars, and webhooks.",
     stage: "preview",
-    toolCount: 18,
+    toolCount: 35,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -688,7 +827,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "ClickUp",
     description: "Teams, spaces, folders, lists, tasks, comments, tags, time tracking, and checklists.",
     stage: "preview",
-    toolCount: 40,
+    toolCount: 123,
     transport: "both",
     architectureClass: "standard-core",
     domainPrimitives: [],
@@ -701,7 +840,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Customer.io",
     description: "Messaging automation across campaigns, broadcasts, transactional email, segments, customers, and message delivery.",
     stage: "preview",
-    toolCount: 22,
+    toolCount: 129,
     transport: "rest",
     architectureClass: "standard-core",
     domainPrimitives: [],
@@ -766,7 +905,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "GitLab",
     description: "Projects, branches, commits, issues, merge requests, pipelines, labels, milestones, releases, and webhooks.",
     stage: "preview",
-    toolCount: 46,
+    toolCount: 559,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -801,7 +940,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "HubSpot",
     description: "CRM contacts, companies, deals, tickets, and engagements.",
     stage: "preview",
-    toolCount: 41,
+    toolCount: 44,
     transport: "rest",
     architectureClass: "replay-shell",
     domainPrimitives: [
@@ -836,7 +975,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Linear",
     description: "Issues, projects, teams, cycles, and workflows.",
     stage: "public",
-    toolCount: 50,
+    toolCount: 53,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -905,7 +1044,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Sentry",
     description: "Error monitoring across organizations, projects, teams, issues, events, releases, and DSN keys.",
     stage: "preview",
-    toolCount: 25,
+    toolCount: 34,
     transport: "rest",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -1007,14 +1146,10 @@ var GENERATED_CLONE_CATALOG = [
     name: "Webflow",
     description: "Sites, pages, CMS collections, items, assets, forms, and webhooks.",
     stage: "preview",
-    toolCount: 19,
-    transport: "rest",
-    architectureClass: "replay-shell",
-    domainPrimitives: [
-      "recording replay cursor",
-      "CMS collection/item overlays",
-      "publish lifecycle captures"
-    ],
+    toolCount: 104,
+    transport: "both",
+    architectureClass: "standard-core",
+    domainPrimitives: [],
     behaviorOwner: null,
     opsCoverage: 100
   }
@@ -1121,142 +1256,18 @@ var STARTABLE_CLONE_CATALOG = CLONE_CATALOG.filter(
   (entry) => STARTABLE_CLONE_ID_SET.has(entry.id)
 );
 
-// ../packages/billing-constants/src/credit-catalog.ts
-var CREDIT_COGS_MARKUP = 3;
-var CREDIT_TARGET_GROSS_MARGIN_PERCENT = Math.round(
-  (1 - 1 / CREDIT_COGS_MARKUP) * 100
-);
-
-// ../packages/billing-constants/src/index.ts
-var PLAN_MONTHLY_TWIN_MINUTE_LIMITS = {
-  free: 500,
-  pro: 5e3,
-  enterprise: null
-};
-var PLAN_CONCURRENT_SESSION_LIMITS = {
-  free: 3,
-  pro: 10,
-  enterprise: 50
-};
-var FREE_WORKSPACE_MEMBER_LIMIT = 2;
-var PRO_PLAN_PRICE_USD = 199;
-function formatMinutesLabel(minutes) {
-  return minutes.toLocaleString("en-US");
-}
-var FREE_MINUTES = PLAN_MONTHLY_TWIN_MINUTE_LIMITS.free;
-var PRO_MINUTES = PLAN_MONTHLY_TWIN_MINUTE_LIMITS.pro;
-if (FREE_MINUTES == null || PRO_MINUTES == null) {
-  throw new Error("PLAN_MONTHLY_TWIN_MINUTE_LIMITS: free and pro must be non-null");
-}
-var PRO_EVALS_PER_SEAT = 500;
-var PRO_SESSION_MINUTES_PER_SEAT = 5e3;
-var PRO_MAX_SEATS = 5;
-var FREE_EVALS_PER_MONTH = 100;
-var PLAN_DISPLAY = {
-  free: {
-    tag: "Free",
-    priceLabel: "$0",
-    periodLabel: "",
-    included: [
-      `${formatMinutesLabel(FREE_MINUTES)} session-minutes / account`,
-      `${FREE_EVALS_PER_MONTH} evals / account`,
-      `1 workspace (${FREE_WORKSPACE_MEMBER_LIMIT} users max)`,
-      `${PLAN_CONCURRENT_SESSION_LIMITS.free} concurrent sessions / workspace`,
-      "All clones included"
-    ]
-  },
-  pro: {
-    tag: "Pro",
-    priceLabel: `$${PRO_PLAN_PRICE_USD}`,
-    periodLabel: "/mo per seat",
-    included: [
-      `${formatMinutesLabel(PRO_SESSION_MINUTES_PER_SEAT)} session-minutes / seat / month`,
-      `${PRO_EVALS_PER_SEAT} evals / seat / month`,
-      "All clones included",
-      `${PLAN_CONCURRENT_SESSION_LIMITS.pro} concurrent sessions / workspace`,
-      `1 workspace, up to ${PRO_MAX_SEATS} seats with pooled usage`
-    ]
-  },
-  enterprise: {
-    tag: "Enterprise",
-    priceLabel: "Contact us",
-    periodLabel: "",
-    included: [
-      "Unlimited session-minutes",
-      "Unlimited seats per workspace",
-      "Unlimited workspaces",
-      `${PLAN_CONCURRENT_SESSION_LIMITS.enterprise} concurrent sessions / workspace`,
-      "SSO / SAML",
-      "SOC 2 (in progress)",
-      "Custom clones & eval support",
-      "Dedicated onboarding & support"
-    ]
+// ../packages/node-auth/src/credential-store.ts
+var ExpiredEnvTokenError = class extends Error {
+  constructor(envVar = AUTH_TOKEN_ENV_VAR) {
+    super(`${envVar} is expired. Remove it or replace it with a valid token.`);
+    this.name = "ExpiredEnvTokenError";
+    Object.setPrototypeOf(this, new.target.prototype);
   }
 };
-var PLAN_MAX_SESSION_TTL_SECONDS = {
-  free: 30 * 60,
-  // 30 minutes
-  pro: 60 * 60,
-  // 60 minutes
-  enterprise: 90 * 60
-  // 90 minutes
-};
-var MAX_ABSOLUTE_SESSION_LIFETIME_SECONDS = 4 * 60 * 60;
-var LIFETIME_PERIOD_RESETS_AT = new Date(Date.UTC(9999, 11, 31));
-var ALL_ENTITLED_CLONES = ALL_STARTABLE_CLONE_IDS;
-var SCENARIO_USAGE_WINDOW_DAYS = 7;
-var SCENARIO_USAGE_WINDOW_MS = SCENARIO_USAGE_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
-var SCENARIO_USAGE_WINDOW_SECONDS = SCENARIO_USAGE_WINDOW_DAYS * 24 * 60 * 60;
-var LLM_PRICING_USD_PER_M_TOKENS = {
-  // Google Gemini (verified 2026-05-05, standard tier <=200K input tokens)
-  "gemini-2.5-pro": { input: 1.25, output: 10 },
-  "gemini-2.5-flash": { input: 0.3, output: 2.5 },
-  // OpenAI flagship text models (verified 2026-05-21, standard short-context tier)
-  "gpt-5.5": { input: 5, output: 30 },
-  "gpt-5.5-pro": { input: 30, output: 180 },
-  "gpt-5.4": { input: 2.5, output: 15 },
-  "gpt-5.4-mini": { input: 0.75, output: 4.5 },
-  "gpt-5.4-nano": { input: 0.2, output: 1.25 },
-  "gpt-5.4-pro": { input: 30, output: 180 },
-  "gpt-4o-mini": { input: 0.15, output: 0.6 },
-  "gpt-4o": { input: 2.5, output: 10 },
-  "gpt-4.1-mini": { input: 0.4, output: 1.6 },
-  "gpt-4.1-nano": { input: 0.1, output: 0.4 },
-  "gpt-4.1": { input: 2, output: 8 },
-  // DeepSeek (verified 2026-05-05; legacy names map to v4-flash per vendor)
-  "deepseek-chat": { input: 0.14, output: 0.28 },
-  "deepseek-reasoner": { input: 0.14, output: 0.28 },
-  "deepseek-v4-flash": { input: 0.14, output: 0.28 }
-};
-var LLM_PRICING_FAMILY_RATES = [
-  { match: /^gemini-2\.5-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gemini-2.5-pro"] },
-  { match: /^gemini-2\.5-flash/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gemini-2.5-flash"] },
-  { match: /^gpt-5\.5-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.5-pro"] },
-  { match: /^gpt-5\.5/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.5"] },
-  { match: /^gpt-5\.4-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-pro"] },
-  { match: /^gpt-5\.4-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-mini"] },
-  { match: /^gpt-5\.4-nano/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-nano"] },
-  { match: /^gpt-5\.4/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4"] },
-  { match: /^gpt-4o-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4o-mini"] },
-  { match: /^gpt-4o(?!-mini)/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4o"] },
-  { match: /^gpt-4\.1-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1-mini"] },
-  { match: /^gpt-4\.1-nano/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1-nano"] },
-  { match: /^gpt-4\.1(?!-mini|-nano)/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1"] },
-  // Anthropic Claude 4.x list prices (verified 2026): Opus $5/$25, Sonnet
-  // $3/$15, Haiku 4.5 $1/$5 per 1M tokens (input/output).
-  { match: /^claude-opus-/i, rate: { input: 5, output: 25 } },
-  { match: /^claude-haiku-/i, rate: { input: 1, output: 5 } },
-  { match: /^claude-sonnet-/i, rate: { input: 3, output: 15 } },
-  { match: /^opus-/i, rate: { input: 5, output: 25 } },
-  { match: /^haiku-/i, rate: { input: 1, output: 5 } },
-  { match: /^sonnet-/i, rate: { input: 3, output: 15 } },
-  { match: /^deepseek-chat/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-chat"] },
-  { match: /^deepseek-reasoner/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-reasoner"] },
-  { match: /^deepseek-v4-flash/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-v4-flash"] }
-];
-
-// ../packages/node-auth/src/clone-entitlements.ts
-var ENTITLED_CLONE_SET = new Set(ALL_ENTITLED_CLONES);
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var ENTITLED_CLONE_SET = new Set(ALL_STARTABLE_CLONE_IDS);
 function normalizeEntitledCloneIds(cloneIds) {
   if (!cloneIds) {
     return [];
@@ -1273,8 +1284,6 @@ function normalizeEntitledCloneIds(cloneIds) {
   }
   return [...normalized];
 }
-
-// ../packages/node-auth/src/credential-store.ts
 var KEYCHAIN_COMMAND_TIMEOUT_MS = 1500;
 var ARCHAL_DIR_NAME = ".archal";
 var TEST_SANDBOX_ID_ENV_VAR = "ARCHAL_TEST_SANDBOX_ID";
@@ -1314,7 +1323,7 @@ function getTestSandboxDir() {
   return (0, import_node_path2.join)((0, import_node_os.tmpdir)(), `archal-test-sandbox-${workerId}-${process.pid}`);
 }
 function getArchalDir() {
-  const explicit = process.env["ARCHAL_HOME"];
+  const explicit = process.env["ARCHAL_HOME"]?.trim();
   if (explicit) {
     return explicit;
   }
@@ -1595,7 +1604,66 @@ function readCredentialsFile(options) {
   return readCredentialsFileAtPath(getCredentialsPath(), options);
 }
 function isWorkspaceApiKey(token) {
-  return token.startsWith("archal_ws_") || token.startsWith("archal_") && !token.includes(".");
+  return token.startsWith(WORKSPACE_API_KEY_PREFIX) || token.startsWith("archal_") && !token.includes(".");
+}
+var WORKSPACE_API_KEY_EXPIRES_SECONDS = 365 * 24 * 60 * 60;
+function parseEnvToken(token, envName = AUTH_TOKEN_ENV_VAR, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return { status: "invalid", message: `${envName} is empty.` };
+  }
+  if (isWorkspaceApiKey(trimmed)) {
+    return {
+      status: "ok",
+      credentials: {
+        token: trimmed,
+        refreshToken: "",
+        email: "(workspace-api-key)",
+        plan: "pro",
+        selectedCloneIds: [],
+        expiresAt: nowSeconds + WORKSPACE_API_KEY_EXPIRES_SECONDS
+      }
+    };
+  }
+  const claims = decodeJwtPayload(trimmed);
+  if (claims === null) {
+    return {
+      status: "invalid",
+      message: `${envName} must be a JWT with valid plan and exp claims or a workspace API key (archal_ws_...).`
+    };
+  }
+  const email = typeof claims["email"] === "string" ? claims["email"] : `(from ${envName})`;
+  if (!isPlan(claims["plan"])) {
+    return {
+      status: "invalid",
+      message: `${envName} JWT does not contain a valid plan claim.`
+    };
+  }
+  const plan = claims["plan"];
+  if (typeof claims["exp"] !== "number" || !Number.isFinite(claims["exp"])) {
+    return {
+      status: "invalid",
+      message: `${envName} JWT does not contain a valid exp claim.`
+    };
+  }
+  const expiresAt = claims["exp"];
+  if (expiresAt <= nowSeconds) {
+    return {
+      status: "expired",
+      message: `${envName} is expired. Remove it or replace it with a valid token.`
+    };
+  }
+  return {
+    status: "ok",
+    credentials: {
+      token: trimmed,
+      refreshToken: "",
+      email,
+      plan,
+      selectedCloneIds: [],
+      expiresAt
+    }
+  };
 }
 function readCredentialsFromEnv(options) {
   const raw = process.env[AUTH_TOKEN_ENV_VAR];
@@ -1606,56 +1674,28 @@ function readCredentialsFromEnv(options) {
   if (token.length === 0) {
     return null;
   }
-  if (isWorkspaceApiKey(token)) {
-    debug("ARCHAL_TOKEN is a workspace API key -- skipping JWT validation.");
-    return {
-      token,
-      refreshToken: "",
-      email: "(workspace-api-key)",
-      // Local-only default; the server enforces the workspace's real plan.
-      // Use 'pro' rather than 'enterprise' so the CLI never grants elevated
-      // local entitlements that the workspace hasn't actually purchased.
-      plan: "pro",
-      selectedCloneIds: [],
-      // Workspace keys have no local expiry -- the server enforces lifetime.
-      // Use a far-future sentinel so the CLI never rejects the token locally.
-      expiresAt: Math.floor(Date.now() / 1e3) + 365 * 24 * 60 * 60
-    };
+  const parsed = parseEnvToken(token);
+  if (parsed.status === "ok") {
+    if (isWorkspaceApiKey(token)) {
+      debug("ARCHAL_TOKEN is a workspace API key -- skipping JWT validation.");
+    }
+    return parsed.credentials;
   }
-  const claims = decodeJwtPayload(token);
-  const nowSeconds = Math.floor(Date.now() / 1e3);
-  if (claims === null) {
+  if (parsed.message.startsWith("ARCHAL_TOKEN must be a JWT")) {
     getWarn(options)(
       "ARCHAL_TOKEN must be a JWT or a workspace API key (archal_ws_...). Ignoring environment token.\nFor CI, set ARCHAL_TOKEN to a workspace API key created via `archal workspace api-key create`."
     );
     return null;
   }
-  const email = typeof claims["email"] === "string" ? claims["email"] : "(from ARCHAL_TOKEN)";
-  if (!isPlan(claims["plan"])) {
-    getWarn(options)("ARCHAL_TOKEN JWT does not contain a valid plan claim. Ignoring environment token.");
-    return null;
-  }
-  const plan = claims["plan"];
-  if (typeof claims["exp"] !== "number" || !Number.isFinite(claims["exp"])) {
-    getWarn(options)("ARCHAL_TOKEN JWT does not contain a valid exp claim. Ignoring environment token.");
-    return null;
-  }
-  const expiresAt = claims["exp"];
-  if (expiresAt <= nowSeconds) {
+  if (parsed.status === "expired") {
     if (options?.onExpiredEnvToken === "throw") {
       throw new ExpiredEnvTokenError();
     }
     debug("Ignoring expired ARCHAL_TOKEN from environment.");
     return null;
   }
-  return {
-    token,
-    refreshToken: "",
-    email,
-    plan,
-    selectedCloneIds: [],
-    expiresAt
-  };
+  getWarn(options)(`${parsed.message} Ignoring environment token.`);
+  return null;
 }
 function getCredentials(options) {
   const envValue = process.env[AUTH_TOKEN_ENV_VAR];
@@ -1703,7 +1743,7 @@ var import_node_net = require("net");
 // ../packages/node-auth/src/secure-token.ts
 var import_node_crypto2 = require("crypto");
 
-// ../packages/log/src/ansi.ts
+// ../packages/evaluator/src/log/ansi.ts
 var NO_COLOR = "NO_COLOR" in process.env || process.env["TERM"] === "dumb";
 var RESET = NO_COLOR ? "" : "\x1B[0m";
 var BOLD = NO_COLOR ? "" : "\x1B[1m";
@@ -1713,7 +1753,7 @@ var YELLOW = NO_COLOR ? "" : "\x1B[33m";
 var CYAN = NO_COLOR ? "" : "\x1B[36m";
 var GRAY = NO_COLOR ? "" : "\x1B[90m";
 
-// ../packages/log/src/logger.ts
+// ../packages/evaluator/src/log/logger.ts
 var LOG_LEVEL_PRIORITY = {
   debug: 0,
   info: 1,
@@ -1776,6 +1816,12 @@ function warn(message, data) {
   log("warn", message, data);
 }
 
+// src/auth/cli-read-options.ts
+var CLI_CREDENTIAL_READ_OPTIONS = {
+  onExpiredEnvToken: "throw",
+  warn
+};
+
 // src/utils/version.ts
 var import_node_fs2 = require("fs");
 var import_node_path3 = require("path");
@@ -1815,7 +1861,6 @@ var CLI_VERSION = loadVersion();
 var CLI_USER_AGENT = `archal-cli/${CLI_VERSION}`;
 
 // src/auth/credential-store.ts
-var READ_OPTIONS = { onExpiredEnvToken: "throw", warn };
 var cachedEnvToken = null;
 var cachedEnvCredentials = null;
 var cachedEnvCredentialsResolved = false;
@@ -1828,11 +1873,11 @@ function readExplicitEnvToken() {
 function getCredentials2() {
   const envToken = readExplicitEnvToken();
   if (!envToken) {
-    return getCredentials(READ_OPTIONS);
+    return getCredentials(CLI_CREDENTIAL_READ_OPTIONS);
   }
   if (!cachedEnvCredentialsResolved || cachedEnvToken !== envToken) {
     cachedEnvToken = envToken;
-    cachedEnvCredentials = getCredentials(READ_OPTIONS);
+    cachedEnvCredentials = getCredentials(CLI_CREDENTIAL_READ_OPTIONS);
     cachedEnvCredentialsResolved = true;
   }
   return cachedEnvCredentials;
@@ -3070,103 +3115,359 @@ var baseProperties = {
 };
 
 // src/commands/autoloop-github-app.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 
-// src/trace-source/redaction.ts
-var TRACE_REDACTED = "[REDACTED]";
-var DEFAULT_SENSITIVE_TRACE_KEY_PARTS = [
+// ../packages/contracts/src/evidence-redaction.ts
+var import_node_crypto4 = require("crypto");
+var EVIDENCE_REDACTED = "[REDACTED]";
+var EVIDENCE_SENSITIVE_KEY_PARTS = /* @__PURE__ */ new Set([
   "token",
   "secret",
   "password",
   "authorization",
   "apikey",
-  "api-key",
   "api_key",
   "credential",
+  "credentials",
   "cookie",
   "privatekey",
-  "private-key",
   "private_key",
   "accesskey",
-  "access-key",
   "access_key",
   "databaseurl",
-  "database-url",
   "database_url",
   "dburl",
-  "db-url",
   "db_url",
+  "redisurl",
+  "redis_url",
+  "mongodburi",
+  "mongo_uri",
   "connectionstring",
-  "connection-string",
   "connection_string",
   "dsn",
-  "card",
-  "cardnumber",
-  "creditcard",
-  "pan"
-];
-var DEFAULT_SECRET_TRACE_STRING_PATTERNS = [
+  "workspacekey",
+  "workspace_key",
+  "workspacetoken",
+  "workspace_token",
+  "accesscode",
+  "access_code",
+  "lockboxcode",
+  "lockbox_code",
+  "doorcode",
+  "door_code",
+  "otp",
+  "iban",
+  "clabe",
+  "swift",
+  "bic",
+  "secretref",
+  "secret_ref",
+  "secretname",
+  "secret_name"
+]);
+var EVIDENCE_SENSITIVE_ENV_KEY_PARTS = /* @__PURE__ */ new Set([
+  ...EVIDENCE_SENSITIVE_KEY_PARTS,
+  "apikey",
+  "api_key",
+  "secretkey",
+  "secret_key",
+  "accesstoken",
+  "access_token",
+  "refreshtoken",
+  "refresh_token",
+  "authtoken",
+  "auth_token",
+  "bearertoken",
+  "bearer_token",
+  "privatekey",
+  "private_key",
+  "databaseurl",
+  "database_url",
+  "dburl",
+  "db_url",
+  "redisurl",
+  "redis_url",
+  "mongodburi",
+  "mongo_uri",
+  "connectionstring",
+  "connection_string",
+  "dsn"
+]);
+var EVIDENCE_SERVICE_STRING_PATTERNS = [
   {
-    pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}\b/gi,
-    replacement: `$1${TRACE_REDACTED}`
+    pattern: /https?:\/\/[^\s"'<>]+\/runtime\/session\/[^\s"'<>]*/gi,
+    replacement: "[SERVICE_ENDPOINT_REDACTED]"
   },
   {
-    pattern: /\bgh[pousr]_[A-Za-z0-9]{16,}\b/g
+    pattern: /\/runtime\/session\/[^\s"'<>]*/gi,
+    replacement: "[SERVICE_ENDPOINT_REDACTED]"
   },
   {
-    pattern: /\bgithub_pat_[A-Za-z0-9_]{16,}\b/g
+    pattern: /\bx-archal-[\w-]+(?::|=)\s*["']?[^"',\s}]+/gi,
+    replacement: "[SERVICE_HEADER_REDACTED]"
   },
   {
-    pattern: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g
+    pattern: /\barchal_mcp_servers\b/gi,
+    replacement: "service_tool_servers"
   },
   {
-    pattern: /\bsk-proj-[A-Za-z0-9_-]{16,}\b/g
+    pattern: /\bARCHAL_(?:CLONE_URLS_PATH|TWIN_URLS_PATH|PROXY_EVENTS_PATH|METRICS_FILE|AGENT_TRACE_FILE|ENABLE_PROVIDER_EGRESS_PROXY)\b/g,
+    replacement: "[SERVICE_RUNTIME_CONFIG_REDACTED]"
   },
   {
-    pattern: /\bsk-ant-[A-Za-z0-9_-]{8,}\b/g
+    pattern: /\/archal-artifacts\/[^\s"'<>]*/gi,
+    replacement: "[SERVICE_ARTIFACT_PATH_REDACTED]"
   },
   {
-    pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g
+    pattern: /\b(?:host\.docker\.internal|localhost|127\.0\.0\.1):9100\b/gi,
+    replacement: "[SERVICE_PROXY_ENDPOINT_REDACTED]"
   },
   {
-    pattern: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|rediss):\/\/[^\s"'<>]+/gi,
-    replacement: "[CONNECTION_URL_REDACTED]"
+    pattern: /\b(?:aws-secretsmanager:\/\/|arn:aws:secretsmanager:[^\s"'<>:]+:\d{12}:secret:)[^\s"'<>]+/gi,
+    replacement: "[SECRET_REF_REDACTED]"
   },
   {
-    pattern: /\b(https?:\/\/)[^/\s"'<>@]+@/gi,
-    replacement: `$1${TRACE_REDACTED}@`
+    pattern: /\benv:[A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*\b/g,
+    replacement: "[SECRET_REF_REDACTED]"
   },
   {
-    pattern: /\bAIza[0-9A-Za-z_-]{12,}\b/g
+    pattern: /(?:file:\/\/)?(?:\/Users\/[^/\s"'<>]+|\/home\/[^/\s"'<>]+|\/private\/tmp|\/tmp|\/var\/folders|\/workspace|\/workspaces)(?:\/[^\s"'<>]*)?/g,
+    replacement: "[LOCAL_PATH_REDACTED]"
   },
   {
-    pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g
-  },
+    pattern: /\b[A-Za-z]:\\Users\\[^\\\s"'<>]+(?:\\[^\s"'<>]*)?/g,
+    replacement: "[LOCAL_PATH_REDACTED]"
+  }
+];
+var FINANCIAL_IDENTIFIER_CONTEXT = String.raw`(?:account|acct|bank|beneficiary|intermediary|payment|payout|recipient|routing|transfer|wire)`;
+var HIGH_ENTROPY_SECRET = String.raw`(?<![A-Za-z0-9_/-])(?=[A-Za-z0-9_-]{32,}(?![A-Za-z0-9_-]))(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]+(?![A-Za-z0-9_/-])`;
+var EVIDENCE_SECRET_LITERAL_STRING_PATTERNS = [
   {
-    pattern: /\bx(?:app|oxa|oxc|oxp|oxs)-[A-Za-z0-9-]{10,}\b/g
+    pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/=-]+\b/gi,
+    replacement: `$1${EVIDENCE_REDACTED}`
   },
   {
-    pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g
+    pattern: /\b(gh[pousr]_[A-Za-z0-9]{16,})\b/g,
+    replacement: EVIDENCE_REDACTED
   },
   {
-    pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g
+    pattern: /\bgithub_pat_[A-Za-z0-9_]{16,}\b/g,
+    replacement: EVIDENCE_REDACTED
   },
   {
-    pattern: /-----BEGIN(?:[ A-Z]+)?PRIVATE KEY-----[\s\S]*?-----END(?:[ A-Z]+)?PRIVATE KEY-----/g
+    pattern: /\b[srp]k_(?:live|test)_[A-Za-z0-9]{16,}\b/g,
+    replacement: EVIDENCE_REDACTED
   },
   {
-    pattern: /(^|[?&])((?:token|access_token|refresh_token|client_secret|secret|api_key|apikey|password|signature|sig|x-amz-signature|x-goog-signature|awsaccesskeyid|sv|se|sp)=)[^&\s]+/gi,
-    replacement: `$1$2${TRACE_REDACTED}`
+    pattern: /\bsk-proj-[A-Za-z0-9_-]{16,}\b/g,
+    replacement: EVIDENCE_REDACTED
   },
   {
-    pattern: /\b((?:"?(?:authorization|token|access_token|refresh_token|client_secret|secret|api_key|apikey|password|private_key|privatekey|database_url|databaseurl|db_url|dburl|connection_string|connectionstring|dsn)"?\s*[:=]\s*)(?!\[[A-Za-z0-9_ -]+\]))(?:"[^"]+"|'[^']+'|Bearer\s+\[[A-Za-z0-9_ -]+\]|Bearer\s+[^\s,}\]]+|[^\s,}\]]+)/gi,
-    replacement: `$1${TRACE_REDACTED}`
-  },
+    pattern: /\bsk-ant-[A-Za-z0-9_-]{8,}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\barchal_(?:ws|workspace|token|key|pat|secret)_[A-Za-z0-9_.-]{8,}\b/gi,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\bsb_(?:secret|publishable)_[A-Za-z0-9_-]{16,}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\bpostgres(?:ql)?:\/\/[^\s"'<>]+/gi,
+    replacement: "[DATABASE_URL_REDACTED]"
+  },
+  {
+    pattern: /\b(?:redis|rediss|mysql|mariadb|mongodb(?:\+srv)?|amqp|amqps):\/\/[^\s"'<>]+/gi,
+    replacement: "[CONNECTION_STRING_REDACTED]"
+  },
+  {
+    pattern: /\b[A-Za-z][A-Za-z0-9+.-]*:\/\/[^:\s/@]+:[^@\s/]+@[^\s"'<>]+/gi,
+    replacement: "[BASIC_AUTH_URL_REDACTED]"
+  },
   {
-    pattern: /\b([A-Z0-9_]*(?:API_KEY|SECRET_KEY|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY)[A-Z0-9_]*\s*[:=]\s*)(?!\[[A-Za-z0-9_ -]+\])(?:"[^"]+"|'[^']+'|[^\s,}\]]+)/g,
-    replacement: `$1${TRACE_REDACTED}`
+    pattern: /\bAIza[0-9A-Za-z_-]{12,}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\b(?:xox[baprs]-[A-Za-z0-9-]{10,})\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\bx(?:app|oxa|oxc|oxp|oxs)-[A-Za-z0-9-]{10,}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /-----BEGIN(?:[ A-Z]+)?PRIVATE KEY-----[\s\S]*?-----END(?:[ A-Z]+)?PRIVATE KEY-----/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: /(^|[?&])((?:token|access_token|refresh_token|auth_token|bearer_token|client_secret|secret|api_key|apikey|password)=)[^&\s]+/gi,
+    replacement: `$1$2${EVIDENCE_REDACTED}`
+  },
+  {
+    pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/g,
+    replacement: EVIDENCE_REDACTED
+  },
+  {
+    pattern: new RegExp(String.raw`\b(${FINANCIAL_IDENTIFIER_CONTEXT}\s+)\d{18}\b`, "gi"),
+    replacement: `$1${EVIDENCE_REDACTED}`
+  },
+  {
+    pattern: new RegExp(
+      String.raw`\b(${FINANCIAL_IDENTIFIER_CONTEXT}\s+)(?!REDACTED\b)[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b`,
+      "g"
+    ),
+    replacement: `$1${EVIDENCE_REDACTED}`
+  },
+  {
+    pattern: new RegExp(HIGH_ENTROPY_SECRET, "g"),
+    replacement: EVIDENCE_REDACTED
   }
 ];
+var EVIDENCE_SENSITIVE_LABEL = String.raw`(?:authorization|token|access[_ -]?token|refresh[_ -]?token|id[_ -]?token|auth[_ -]?token|session[_ -]?token|client[_ -]?secret|secret|secret[_ -]?ref|secretref|secret[_ -]?name|secretname|api[_ -]?key|apikey|password|private[_ -]?key|privatekey|database[_ -]?url|databaseurl|db[_ -]?url|dburl|redis[_ -]?url|redisurl|mongo[_ -]?uri|mongodburi|connection[_ -]?string|connectionstring|dsn|workspace[_ -]?token|workspacetoken|workspace[_ -]?key|workspacekey|access[_ -]?key|credential|credentials|access[_ -]?code|lockbox[_ -]?code|door[_ -]?code|otp|one[_ -]?time[_ -]?password|iban|clabe|swift|bic)`;
+var EVIDENCE_SENSITIVE_LABEL_ASSIGNMENT = String.raw`(?:\*\*)?["']?${EVIDENCE_SENSITIVE_LABEL}["']?\s*[:=](?:\*\*)?\s*`;
+var EVIDENCE_SENSITIVE_LABEL_HINT = new RegExp(
+  String.raw`\b${EVIDENCE_SENSITIVE_LABEL_ASSIGNMENT}`,
+  "i"
+);
+var EVIDENCE_FINANCIAL_IDENTIFIER_HINT = new RegExp(
+  String.raw`(\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b|\b${FINANCIAL_IDENTIFIER_CONTEXT}\s+\d{18}\b|\b${FINANCIAL_IDENTIFIER_CONTEXT}\s+(?!REDACTED\b)[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b)`,
+  "i"
+);
+var EVIDENCE_HIGH_ENTROPY_SECRET_HINT = new RegExp(HIGH_ENTROPY_SECRET);
+var EVIDENCE_SECRET_REDACTION_MARKER = String.raw`(?:\[[A-Z0-9_]*REDACTED\]|\[FILTERED\]|\[MASKED\]|<redacted>)`;
+var EVIDENCE_KEY_VALUE_STRING_PATTERNS = [
+  {
+    pattern: new RegExp(
+      String.raw`\b(${EVIDENCE_SENSITIVE_LABEL_ASSIGNMENT})(?!\s*(?:\[[A-Z0-9_]+\]|<redacted>))(?:"[^"\r\n]*"|'[^'\r\n]*'|Bearer\s+\[REDACTED\]|Bearer\s+.+?|.+?)(?=(?:\s+${EVIDENCE_SENSITIVE_LABEL_ASSIGNMENT})|[\r\n,}\]&]|$)`,
+      "gi"
+    ),
+    replacement: `$1${EVIDENCE_REDACTED}`
+  },
+  {
+    pattern: /\b((?:"?(?:authorization|token|access_token|refresh_token|client_secret|secret|secret_ref|secretref|secret_name|secretname|api_key|apikey|password|private_key|privatekey|database_url|databaseurl|db_url|dburl|redis_url|redisurl|mongo_uri|mongodburi|connection_string|connectionstring|dsn|workspace_token|workspacetoken|workspace_key|workspacekey)"?\s*[:=]\s*)(?!\[[A-Z0-9_]+\]))(?:"[^"]+"|'[^']+'|Bearer\s+\[REDACTED\]|Bearer\s+[^\s,}\]]+|[^\s,}\]]+)/gi,
+    replacement: `$1${EVIDENCE_REDACTED}`
+  },
+  {
+    pattern: /\b([A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*\s*[:=]\s*)(?!\[[A-Z0-9_]+\])(?:"[^"]+"|'[^']+'|[^\s,}\]]+)/g,
+    replacement: `$1${EVIDENCE_REDACTED}`
+  },
+  {
+    // Fail-open recovery. When a sensitive label's value was already replaced
+    // with a redaction marker but a bare secret still trails it
+    // (`password: [REDACTED] dGVzdA==`), the assignment patterns above skip the
+    // match — their `(?!marker)` guard fires on the marker — and leave the tail
+    // exposed. Redact the trailing token too. This fails closed but is
+    // deliberately narrow to avoid mangling ordinary prose that follows a
+    // redacted value (`token=[REDACTED] for /path`, `...=[REDACTED] rotated`):
+    //  - the marker must be a real secret marker (`[…REDACTED]`, `[FILTERED]`,
+    //    `[MASKED]`, `<redacted>`), NOT a semantic placeholder like `[url]` or
+    //    `[path]`, and a `[FILTERED]` producer is still covered;
+    //  - the recovered trailing token must be SECRET-SHAPED — quoted, or ≥6
+    //    chars containing at least one digit or base64/token symbol
+    //    (`0-9 + / = _ -`). base64 padding (`dGVzdA==`) qualifies; bare
+    //    dictionary words (`for`, `rotated`, `successfully`) do not, so prose is
+    //    left intact;
+    //  - the marker itself is skipped (idempotent) and a following sensitive
+    //    `key:`/`key=` assignment is deferred to the primary patterns, so this
+    //    does not gobble the next labeled field.
+    pattern: new RegExp(
+      String.raw`\b(${EVIDENCE_SENSITIVE_LABEL_ASSIGNMENT}${EVIDENCE_SECRET_REDACTION_MARKER}[ \t]+)(?!${EVIDENCE_SENSITIVE_LABEL_ASSIGNMENT})(?!${EVIDENCE_SECRET_REDACTION_MARKER})(?:"[^"\r\n]*"|'[^'\r\n]*'|(?=[^\s,}\]&]*[0-9+/=_-])[^\s,}\]&]{6,})`,
+      "gi"
+    ),
+    replacement: `$1${EVIDENCE_REDACTED}`
+  }
+];
+var EVIDENCE_SECRET_NAME_STRING_PATTERNS = [
+  {
+    pattern: /(?<!\[)\b[A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*\b(?!\s*[:=])/g,
+    replacement: "[SECRET_NAME_REDACTED]"
+  }
+];
+var EVIDENCE_STRING_PATTERNS = [
+  ...EVIDENCE_SERVICE_STRING_PATTERNS,
+  ...EVIDENCE_SECRET_LITERAL_STRING_PATTERNS,
+  ...EVIDENCE_KEY_VALUE_STRING_PATTERNS,
+  ...EVIDENCE_SECRET_NAME_STRING_PATTERNS
+];
+function getEvidenceSecretRedactionPatterns() {
+  return [...EVIDENCE_SECRET_LITERAL_STRING_PATTERNS, ...EVIDENCE_KEY_VALUE_STRING_PATTERNS].map(
+    ({ pattern, replacement }) => ({
+      pattern: new RegExp(pattern.source, pattern.flags),
+      replacement
+    })
+  );
+}
+var EVIDENCE_STRING_REDACTION_HINT = new RegExp(
+  String.raw`(\/runtime\/session\/|x-archal-|archal_mcp_servers|\bARCHAL_(?:CLONE_URLS_PATH|TWIN_URLS_PATH|PROXY_EVENTS_PATH|METRICS_FILE|AGENT_TRACE_FILE|ENABLE_PROVIDER_EGRESS_PROXY)\b|\/archal-artifacts\/|\b(?:host\.docker\.internal|localhost|127\.0\.0\.1):9100\b|\b(?:aws-secretsmanager:\/\/|arn:aws:secretsmanager:)|\benv:[A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*\b|(?:file:\/\/)?(?:\/Users\/|\/home\/|\/private\/tmp|\/tmp|\/var\/folders|\/workspace|\/workspaces)|\b[A-Za-z]:\\Users\\|bearer\s+|gh[pousr]_|github_pat_|[srp]k_(?:live|test)_|sk-proj-|sk-ant-|sk-|archal_(?:ws|workspace|token|key|pat|secret)_|sb_(?:secret|publishable)_|postgres(?:ql)?:\/\/|(?:redis|rediss|mysql|mariadb|mongodb(?:\+srv)?|amqp|amqps):\/\/|\b[A-Za-z][A-Za-z0-9+.-]*:\/\/[^:\s/@]+:[^@\s/]+@|AIza|xox[baprs]-|x(?:app|oxa|oxc|oxp|oxs)-|(?:AKIA|ASIA)|eyJ|\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b|\b${FINANCIAL_IDENTIFIER_CONTEXT}\s+\d{18}\b|\b${FINANCIAL_IDENTIFIER_CONTEXT}\s+(?!REDACTED\b)[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b|${HIGH_ENTROPY_SECRET}|private key|(?:^|[?&])(?:token|access_token|refresh_token|auth_token|bearer_token|client_secret|secret|api_key|apikey|password)=|\b${EVIDENCE_SENSITIVE_LABEL_ASSIGNMENT}|\b"?(?:authorization|token|access_token|refresh_token|client_secret|secret|secret_ref|secretref|secret_name|secretname|api_key|apikey|password|private_key|privatekey|database_url|databaseurl|db_url|dburl|redis_url|redisurl|mongo_uri|mongodburi|connection_string|connectionstring|dsn|workspace_token|workspacetoken|workspace_key|workspacekey)"?\s*[:=]|\b[A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*(?:\s*[:=]|\b))`,
+  "i"
+);
+
+// ../packages/trace-normalize/src/redaction.ts
+var TRACE_REDACTED = "[REDACTED]";
+var DEFAULT_SENSITIVE_TRACE_KEY_PARTS = [
+  "token",
+  "secret",
+  "password",
+  "authorization",
+  "apikey",
+  "api-key",
+  "api_key",
+  "credential",
+  "cookie",
+  "privatekey",
+  "private-key",
+  "private_key",
+  "accesskey",
+  "access-key",
+  "access_key",
+  "databaseurl",
+  "database-url",
+  "database_url",
+  "dburl",
+  "db-url",
+  "db_url",
+  "connectionstring",
+  "connection-string",
+  "connection_string",
+  "dsn",
+  "card",
+  "cardnumber",
+  "creditcard",
+  "pan"
+];
+var TRACE_SOURCE_URL_PATTERNS = [
+  {
+    pattern: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|rediss):\/\/[^\s"'<>]+/gi,
+    replacement: "[CONNECTION_URL_REDACTED]"
+  },
+  {
+    pattern: /\b(https?:\/\/)[^/\s"'<>@]+@/gi,
+    replacement: `$1${TRACE_REDACTED}@`
+  },
+  {
+    pattern: /(^|[?&])((?:token|access_token|refresh_token|client_secret|secret|api_key|apikey|password|signature|sig|x-amz-signature|x-goog-signature|awsaccesskeyid|sv|se|sp)=)[^&\s]+/gi,
+    replacement: `$1$2${TRACE_REDACTED}`
+  }
+];
+var DEFAULT_SECRET_TRACE_STRING_PATTERNS = [
+  ...TRACE_SOURCE_URL_PATTERNS,
+  ...getEvidenceSecretRedactionPatterns()
+];
 var DEFAULT_TRACE_REDACTION_POLICY = {
   enabled: true,
   mode: "mask",
@@ -3196,7 +3497,7 @@ function redactTraceString(value, policy = DEFAULT_TRACE_REDACTION_POLICY) {
   return redacted;
 }
 
-// src/commands/github-rest.ts
+// src/github/github-rest.ts
 function normalizeRepositoryFullName(value) {
   const trimmed = value?.trim();
   if (!trimmed || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(trimmed)) return void 0;
@@ -3208,7 +3509,6 @@ var GITHUB_APP_INSTALLATION_PERMISSIONS = {
   actions: "read",
   checks: "read",
   contents: "write",
-  issues: "write",
   metadata: "read",
   pull_requests: "write",
   statuses: "read"
@@ -3367,7 +3667,7 @@ function buildGithubAppJwt(input) {
     iss: input.appId
   });
   const signingInput = `${header}.${payload}`;
-  const signature = (0, import_node_crypto4.createSign)("RSA-SHA256").update(signingInput).end().sign(normalizePem2(input.privateKey), "base64url");
+  const signature = (0, import_node_crypto5.createSign)("RSA-SHA256").update(signingInput).end().sign(normalizePem2(input.privateKey), "base64url");
   return `${signingInput}.${signature}`;
 }
 function base64UrlJson(value) {
@@ -3377,217 +3677,6 @@ function normalizePem2(value) {
   return value.replace(/\\n/g, "\n").replace(/\\\r?\n/g, "\n").replace(/\\/g, "\n");
 }
 
-// src/shared/evidence-redaction.ts
-var import_node_crypto5 = require("crypto");
-var EVIDENCE_REDACTED = "[REDACTED]";
-var EVIDENCE_SENSITIVE_KEY_PARTS = /* @__PURE__ */ new Set([
-  "token",
-  "secret",
-  "password",
-  "authorization",
-  "apikey",
-  "api_key",
-  "credential",
-  "cookie",
-  "privatekey",
-  "private_key",
-  "accesskey",
-  "access_key",
-  "databaseurl",
-  "database_url",
-  "dburl",
-  "db_url",
-  "redisurl",
-  "redis_url",
-  "mongodburi",
-  "mongo_uri",
-  "connectionstring",
-  "connection_string",
-  "dsn",
-  "workspacekey",
-  "workspace_key",
-  "workspacetoken",
-  "workspace_token",
-  "secretref",
-  "secret_ref",
-  "secretname",
-  "secret_name"
-]);
-var EVIDENCE_SENSITIVE_ENV_KEY_PARTS = /* @__PURE__ */ new Set([
-  ...EVIDENCE_SENSITIVE_KEY_PARTS,
-  "apikey",
-  "api_key",
-  "secretkey",
-  "secret_key",
-  "accesstoken",
-  "access_token",
-  "refreshtoken",
-  "refresh_token",
-  "authtoken",
-  "auth_token",
-  "bearertoken",
-  "bearer_token",
-  "privatekey",
-  "private_key",
-  "databaseurl",
-  "database_url",
-  "dburl",
-  "db_url",
-  "redisurl",
-  "redis_url",
-  "mongodburi",
-  "mongo_uri",
-  "connectionstring",
-  "connection_string",
-  "dsn"
-]);
-var EVIDENCE_SERVICE_STRING_PATTERNS = [
-  {
-    pattern: /https?:\/\/[^\s"'<>]+\/runtime\/session\/[^\s"'<>]*/gi,
-    replacement: "[SERVICE_ENDPOINT_REDACTED]"
-  },
-  {
-    pattern: /\/runtime\/session\/[^\s"'<>]*/gi,
-    replacement: "[SERVICE_ENDPOINT_REDACTED]"
-  },
-  {
-    pattern: /\bx-archal-[\w-]+(?::|=)\s*["']?[^"',\s}]+/gi,
-    replacement: "[SERVICE_HEADER_REDACTED]"
-  },
-  {
-    pattern: /\barchal_mcp_servers\b/gi,
-    replacement: "service_tool_servers"
-  },
-  {
-    pattern: /\bARCHAL_(?:CLONE_URLS_PATH|TWIN_URLS_PATH|PROXY_EVENTS_PATH|METRICS_FILE|AGENT_TRACE_FILE|ENABLE_PROVIDER_EGRESS_PROXY)\b/g,
-    replacement: "[SERVICE_RUNTIME_CONFIG_REDACTED]"
-  },
-  {
-    pattern: /\/archal-artifacts\/[^\s"'<>]*/gi,
-    replacement: "[SERVICE_ARTIFACT_PATH_REDACTED]"
-  },
-  {
-    pattern: /\b(?:host\.docker\.internal|localhost|127\.0\.0\.1):9100\b/gi,
-    replacement: "[SERVICE_PROXY_ENDPOINT_REDACTED]"
-  },
-  {
-    pattern: /\b(?:aws-secretsmanager:\/\/|arn:aws:secretsmanager:[^\s"'<>:]+:\d{12}:secret:)[^\s"'<>]+/gi,
-    replacement: "[SECRET_REF_REDACTED]"
-  },
-  {
-    pattern: /\benv:[A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*\b/g,
-    replacement: "[SECRET_REF_REDACTED]"
-  },
-  {
-    pattern: /(?:file:\/\/)?(?:\/Users\/[^/\s"'<>]+|\/home\/[^/\s"'<>]+|\/private\/tmp|\/tmp|\/var\/folders|\/workspace|\/workspaces)(?:\/[^\s"'<>]*)?/g,
-    replacement: "[LOCAL_PATH_REDACTED]"
-  },
-  {
-    pattern: /\b[A-Za-z]:\\Users\\[^\\\s"'<>]+(?:\\[^\s"'<>]*)?/g,
-    replacement: "[LOCAL_PATH_REDACTED]"
-  }
-];
-var EVIDENCE_SECRET_LITERAL_STRING_PATTERNS = [
-  {
-    pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/=-]+\b/gi,
-    replacement: `$1${EVIDENCE_REDACTED}`
-  },
-  {
-    pattern: /\b(gh[pousr]_[A-Za-z0-9]{16,})\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bgithub_pat_[A-Za-z0-9_]{16,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bsk-proj-[A-Za-z0-9_-]{16,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bsk-ant-[A-Za-z0-9_-]{8,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\barchal_(?:ws|workspace|token|key|pat|secret)_[A-Za-z0-9_.-]{8,}\b/gi,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bsb_(?:secret|publishable)_[A-Za-z0-9_-]{16,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bpostgres(?:ql)?:\/\/[^\s"'<>]+/gi,
-    replacement: "[DATABASE_URL_REDACTED]"
-  },
-  {
-    pattern: /\b(?:redis|rediss|mysql|mariadb|mongodb(?:\+srv)?|amqp|amqps):\/\/[^\s"'<>]+/gi,
-    replacement: "[CONNECTION_STRING_REDACTED]"
-  },
-  {
-    pattern: /\b[A-Za-z][A-Za-z0-9+.-]*:\/\/[^:\s/@]+:[^@\s/]+@[^\s"'<>]+/gi,
-    replacement: "[BASIC_AUTH_URL_REDACTED]"
-  },
-  {
-    pattern: /\bAIza[0-9A-Za-z_-]{12,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\b(?:xox[baprs]-[A-Za-z0-9-]{10,})\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\bx(?:app|oxa|oxc|oxp|oxs)-[A-Za-z0-9-]{10,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /-----BEGIN(?:[ A-Z]+)?PRIVATE KEY-----[\s\S]*?-----END(?:[ A-Z]+)?PRIVATE KEY-----/g,
-    replacement: EVIDENCE_REDACTED
-  },
-  {
-    pattern: /(^|[?&])((?:token|access_token|refresh_token|client_secret|secret|api_key|apikey|password)=)[^&\s]+/gi,
-    replacement: `$1$2${EVIDENCE_REDACTED}`
-  }
-];
-var EVIDENCE_KEY_VALUE_STRING_PATTERNS = [
-  {
-    pattern: /\b((?:"?(?:authorization|token|access_token|refresh_token|client_secret|secret|secret_ref|secretref|secret_name|secretname|api_key|apikey|password|private_key|privatekey|database_url|databaseurl|db_url|dburl|redis_url|redisurl|mongo_uri|mongodburi|connection_string|connectionstring|dsn|workspace_token|workspacetoken|workspace_key|workspacekey)"?\s*[:=]\s*)(?!\[[A-Z0-9_]+\]))(?:"[^"]+"|'[^']+'|Bearer\s+\[REDACTED\]|Bearer\s+[^\s,}\]]+|[^\s,}\]]+)/gi,
-    replacement: `$1${EVIDENCE_REDACTED}`
-  },
-  {
-    pattern: /\b([A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*\s*[:=]\s*)(?!\[[A-Z0-9_]+\])(?:"[^"]+"|'[^']+'|[^\s,}\]]+)/g,
-    replacement: `$1${EVIDENCE_REDACTED}`
-  }
-];
-var EVIDENCE_SECRET_NAME_STRING_PATTERNS = [
-  {
-    pattern: /(?<!\[)\b[A-Z0-9_]*(?:API_KEY|SECRET_KEY|SECRET_NAME|SECRET_REF|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|BEARER_TOKEN|TOKEN|PASSWORD|SECRET|PRIVATE_KEY|DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|CONNECTION_STRING|DSN|WORKSPACE_TOKEN|WORKSPACE_KEY)[A-Z0-9_]*\b/g,
-    replacement: "[SECRET_NAME_REDACTED]"
-  }
-];
-var EVIDENCE_STRING_PATTERNS = [
-  ...EVIDENCE_SERVICE_STRING_PATTERNS,
-  ...EVIDENCE_SECRET_LITERAL_STRING_PATTERNS,
-  ...EVIDENCE_KEY_VALUE_STRING_PATTERNS,
-  ...EVIDENCE_SECRET_NAME_STRING_PATTERNS
-];
-
 // src/commands/autoloop-fix-pr-quality.ts
 function assessFixPrPayload(payload, input = {}) {
   const assessment = assessAutoloopStoredFixPrEvidence(payload, {
@@ -3639,25 +3728,21 @@ async function verifyFixResult(result, input) {
       if (verdict.state === "unverifiable") {
         return {
           ...result,
-          status: "blocked",
-          prUrl: null,
-          latestCheckState: "blocked",
-          blockingReason: "reported_pr_unverifiable",
-          summary: `${result.summary} Reported open PR could not be verified.`
+          status: "pr_open",
+          latestCheckState: "unknown",
+          blockingReason: void 0,
+          summary: `${result.summary} Reported open PR could not be verified yet.`
         };
       }
       const postFixReproduction2 = autoloopPostFixReproductionEvidenceFromPayload(result.payload, {
         expectedCommitSha: verdict.headSha
       });
       if (!postFixReproduction2.passed) {
-        return {
-          ...result,
-          status: "blocked",
-          prUrl: null,
-          latestCheckState: "blocked",
-          blockingReason: postFixReproduction2.reason,
-          summary: `${result.summary} PR not surfaced as post-fix clone reproduction evidence is insufficient: ${postFixReproduction2.reason}.`
-        };
+        return blockedOpenPrResult(
+          result,
+          postFixReproduction2.reason,
+          `PR not surfaced as ready because post-fix reproduction evidence is insufficient: ${postFixReproduction2.reason}.`
+        );
       }
       const mismatch2 = prReferenceMatchFailure(result, input.repositoryFullName, verdict, input);
       if (mismatch2) {
@@ -3672,14 +3757,11 @@ async function verifyFixResult(result, input) {
   }
   const initialPostFixReproduction = autoloopPostFixReproductionEvidenceFromPayload(result.payload);
   if (!initialPostFixReproduction.passed) {
-    return {
-      ...result,
-      status: "blocked",
-      prUrl: null,
-      latestCheckState: "blocked",
-      blockingReason: initialPostFixReproduction.reason,
-      summary: `${result.summary} Post-fix clone reproduction evidence is insufficient: ${initialPostFixReproduction.reason}.`
-    };
+    return blockedOpenPrResult(
+      result,
+      initialPostFixReproduction.reason,
+      `Post-fix clone reproduction evidence is insufficient: ${initialPostFixReproduction.reason}.`
+    );
   }
   const token = await resolveVerificationToken(input);
   const checks = token ? await fetchGithubPrChecks(pr, token).catch(() => unverifiedGithubPrChecks()) : unverifiedGithubPrChecks();
@@ -3698,14 +3780,11 @@ async function verifyFixResult(result, input) {
     expectedCommitSha: checks.headSha
   });
   if (!postFixReproduction.passed) {
-    return {
-      ...result,
-      status: "blocked",
-      prUrl: null,
-      latestCheckState: "blocked",
-      blockingReason: postFixReproduction.reason,
-      summary: `${result.summary} Post-fix clone reproduction evidence is insufficient: ${postFixReproduction.reason}.`
-    };
+    return blockedOpenPrResult(
+      result,
+      postFixReproduction.reason,
+      `Post-fix clone reproduction evidence is insufficient: ${postFixReproduction.reason}.`
+    );
   }
   const mismatch = prReferenceMatchFailure(result, input.repositoryFullName, checks, input);
   if (mismatch) {
@@ -3761,14 +3840,11 @@ async function verifyOpenFixPrPoll(result, input) {
     expectedCommitSha: checks.headSha
   });
   if (!postFixReproduction.passed) {
-    return {
-      ...result,
-      status: "blocked",
-      prUrl: null,
-      latestCheckState: "blocked",
-      blockingReason: postFixReproduction.reason,
-      summary: `${result.summary} Open PR cannot become ready because post-fix clone reproduction evidence is insufficient: ${postFixReproduction.reason}.`
-    };
+    return blockedOpenPrResult(
+      result,
+      postFixReproduction.reason,
+      `Open PR cannot become ready because post-fix clone reproduction evidence is insufficient: ${postFixReproduction.reason}.`
+    );
   }
   const branchReason = prReferenceMatchFailure(result, input.repositoryFullName, checks, input);
   if (branchReason) {
@@ -3820,6 +3896,15 @@ function verifiedQualityResult(result, checks, latestCheckState = "passing") {
     `Generated PR evidence is insufficient: ${quality.reason}.`
   );
 }
+function blockedOpenPrResult(result, blockingReason, summary) {
+  return {
+    ...result,
+    status: "blocked",
+    latestCheckState: "blocked",
+    blockingReason,
+    summary: `${result.summary} ${summary}`
+  };
+}
 function localValidationPassed(payload) {
   return isRecord2(payload) && payload["localValidationStatus"] === "passed";
 }