codex-orchestrator 0.1.43 → 0.1.44

package/dist/src/runner/local-execution-session.js

@@ -1,14 +1,19 @@
+import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve } from 'node:path';
 import { mergeArtifacts, runConfiguredChecks } from './command-utils.js';
-import { readScopedCompletionReport } from './completion-report.js';
+import { readScopedCompletionReportDetailed, } from './completion-report.js';
+import { sessionPromptPath, writeDurablePrompt } from './prompt.js';
+import { sessionLogPath } from './run-log.js';
 import { evaluateReviewGates, shouldApplyVisualProofGate } from './review-gates.js';
 import { validateChangedPaths, validateCompletionReportSafety, validateNoAgentOwnedGitPublication, } from './safety.js';
 import { evaluateScopeIsolation } from './scope-isolation-policy.js';
 import { runRunnerVisualProofAdapter } from './visual-proof-runner.js';
 import { runAcceptanceProofAdapter, } from './acceptance-proof-runner.js';
 import { runAcceptanceProofLoopAttempt } from './acceptance-proof-loop.js';
-import { MISSING_COMPLETION_REPORT_REASON, OPTIONAL_FIGMA_MCP_FAILURE_REASON, REQUIRED_FIGMA_MCP_FAILURE_REASON, } from './rework-policy.js';
+import { INCOMPLETE_AFTER_PROGRESS_REASON, MISSING_COMPLETION_REPORT_REASON, OPTIONAL_FIGMA_MCP_FAILURE_REASON, REQUIRED_FIGMA_MCP_FAILURE_REASON, } from './rework-policy.js';
+import { cleanupSessionCodexHome, sessionCodexHomePath } from './session-home.js';
 export async function runLocalExecutionSession(input) {
     const phaseResults = [];
     for (const phaseId of input.phases) {
@@ -34,26 +39,43 @@ export async function runLocalExecutionSession(input) {
     };
 }
 export async function runImplementationPublishabilityCheck(input) {
+    const repairAttempts = [];
     const publicationViolations = input.config.runner.allowAgentLocalCommits
         ? []
         : validateNoAgentOwnedGitPublication(input.beforeHead, input.afterHead);
     if (publicationViolations.length > 0) {
         return blocked(publicationViolations.map((violation) => violation.message));
     }
-    if (input.codexResult.exitCode !== 0) {
-        return blocked([formatCodexExitReason(input.codexResult)]);
-    }
     let report;
-    try {
-        const reportResult = await readScopedCompletionReport(input.reportPath);
-        if (reportResult.kind === 'missing') {
-            return blocked([MISSING_COMPLETION_REPORT_REASON]);
+    const idleTimeout = isIdleTimeoutResult(input.codexResult);
+    if (input.codexResult.exitCode !== 0) {
+        const figmaReason = formatFigmaMcpFailureReason(input.codexResult);
+        if (figmaReason) {
+            return blocked([figmaReason]);
+        }
+        if (!idleTimeout) {
+            return blocked([formatCodexExitReason(input.codexResult)]);
+        }
+        const reportResult = await readScopedCompletionReportDetailed(input.reportPath);
+        const preparedReport = await resolveInitialReportRead(input, reportResult, {
+            idleTimeout,
+            repairAttempts,
+        });
+        if (preparedReport.kind === 'blocked') {
+            return preparedReport.result;
         }
-        report = reportResult.report;
+        report = preparedReport.report;
     }
-    catch (error) {
-        const message = error instanceof Error ? error.message : 'Invalid scoped completion report';
-        return blocked([message]);
+    else {
+        const reportResult = await readScopedCompletionReportDetailed(input.reportPath);
+        const preparedReport = await resolveInitialReportRead(input, reportResult, {
+            idleTimeout,
+            repairAttempts,
+        });
+        if (preparedReport.kind === 'blocked') {
+            return preparedReport.result;
+        }
+        report = preparedReport.report;
     }
     if (report.status === 'needs-promotion') {
         return { status: 'promotion-requested', report };
@@ -76,6 +98,7 @@ export async function runImplementationPublishabilityCheck(input) {
             skippedChecks: applicableSkippedChecks(input, report, changeSet.changedPaths),
             residualRisks: [...report.residualRisks, ...localSession.phaseResults.flatMap((phase) => phase.residualRisks)],
             commits: changeSet.commits,
+            ...repairAttemptsField(repairAttempts),
         };
     }
     report = {
@@ -102,6 +125,7 @@ export async function runImplementationPublishabilityCheck(input) {
             skippedChecks: report.skippedChecks,
             residualRisks: report.residualRisks,
             commits: changeSet.commits,
+            ...repairAttemptsField(repairAttempts),
         };
     }
     const scopeIsolation = evaluateScopeIsolation({
@@ -118,6 +142,7 @@ export async function runImplementationPublishabilityCheck(input) {
             skippedChecks: report.skippedChecks,
             residualRisks: report.residualRisks,
             commits: changeSet.commits,
+            ...repairAttemptsField(repairAttempts),
         };
     }
     const violations = [
@@ -133,6 +158,7 @@ export async function runImplementationPublishabilityCheck(input) {
             skippedChecks: report.skippedChecks,
             residualRisks: report.residualRisks,
             commits: changeSet.commits,
+            ...repairAttemptsField(repairAttempts),
         };
     }
     const validationBeforeChecks = report.validation.length;
@@ -245,6 +271,7 @@ export async function runImplementationPublishabilityCheck(input) {
                 residualRisks,
                 commits: changeSet.commits,
                 acceptanceProofAttempt,
+                ...repairAttemptsField(repairAttempts),
             };
         }
     }
@@ -263,6 +290,7 @@ export async function runImplementationPublishabilityCheck(input) {
             residualRisks,
             commits: changeSet.commits,
             acceptanceProofAttempt,
+            ...repairAttemptsField(repairAttempts),
         };
     }
     const reviewGate = evaluateReviewGates({
@@ -274,23 +302,46 @@ export async function runImplementationPublishabilityCheck(input) {
         report,
         worktreePath: input.worktreePath,
     });
+    let reviewGateWarnings = reviewGate.warnings;
     if (!reviewGate.ok) {
-        return {
-            status: 'blocked',
-            reasons: reviewGate.reasons,
+        const evidenceRepair = await maybeRunEvidenceReportRepair(input, {
+            report,
+            reviewGate,
             changedFiles,
+            changeSet,
             validation,
-            skippedChecks: report.skippedChecks,
             residualRisks,
-            commits: changeSet.commits,
             acceptanceProofAttempt,
-        };
+            repairAttempts,
+        });
+        if (evidenceRepair.kind === 'publish-ready') {
+            report = evidenceRepair.report;
+            validation = evidenceRepair.validation;
+            reviewGateWarnings = evidenceRepair.reviewWarnings;
+        }
+        else if (evidenceRepair.kind === 'blocked') {
+            return evidenceRepair.result;
+        }
+        else {
+            return {
+                status: 'blocked',
+                reasons: reviewGate.reasons,
+                blockers: reviewGate.blockers,
+                changedFiles,
+                validation,
+                skippedChecks: report.skippedChecks,
+                residualRisks,
+                commits: changeSet.commits,
+                acceptanceProofAttempt,
+                ...repairAttemptsField(repairAttempts),
+            };
+        }
     }
-    if (reviewGate.warnings.length > 0) {
-        residualRisks.push(...reviewGate.warnings);
+    if (reviewGateWarnings.length > 0) {
+        residualRisks.push(...reviewGateWarnings);
         report = {
             ...report,
-            residualRisks: [...report.residualRisks, ...reviewGate.warnings],
+            residualRisks: [...report.residualRisks, ...reviewGateWarnings],
         };
     }
     if (!(await input.git.isWorktreeClean(input.worktreePath))) {
@@ -310,8 +361,574 @@ export async function runImplementationPublishabilityCheck(input) {
         residualRisks,
         commits: changeSet.commits,
         acceptanceProofAttempt,
+        ...repairAttemptsField(repairAttempts),
+    };
+}
+async function resolveInitialReportRead(input, reportResult, state) {
+    if (reportResult.kind === 'valid') {
+        return { kind: 'valid', report: reportResult.report };
+    }
+    const repair = state.idleTimeout
+        ? { kind: 'not-eligible' }
+        : await maybeRunCompletionReportRepair(input, reportResult, state.repairAttempts);
+    if (repair.kind === 'valid') {
+        return repair;
+    }
+    if (repair.kind === 'blocked') {
+        return repair;
+    }
+    if (reportResult.kind === 'missing') {
+        if (!state.idleTimeout) {
+            return {
+                kind: 'blocked',
+                result: blocked([MISSING_COMPLETION_REPORT_REASON], {
+                    blockers: [runnerBlocker('missing-completion-report', MISSING_COMPLETION_REPORT_REASON, 'completion-report', 'completion-report')],
+                    repairAttempts: state.repairAttempts,
+                }),
+            };
+        }
+        const changeSet = repair.changeSet ?? await input.git.collectSessionChangeSet({
+            worktreePath: input.worktreePath,
+            baseHead: input.beforeHead,
+        });
+        const changedFiles = changeSet.changedPaths;
+        if (changedFiles.length === 0) {
+            return {
+                kind: 'blocked',
+                result: blocked(['Codex completed without file changes'], { repairAttempts: state.repairAttempts }),
+            };
+        }
+        const changedPathViolations = validateChangedPaths(changedFiles, input.config);
+        if (changedPathViolations.length > 0) {
+            return {
+                kind: 'blocked',
+                result: blocked(changedPathViolations.map((violation) => violation.message), {
+                    changedFiles,
+                    commits: changeSet.commits,
+                    repairAttempts: state.repairAttempts,
+                }),
+            };
+        }
+        const scopeIsolation = evaluateScopeIsolation({
+            config: input.config,
+            issue: input.issue,
+            changedFiles,
+        });
+        if (scopeIsolation.blockers.length > 0) {
+            return {
+                kind: 'blocked',
+                result: blocked(scopeIsolation.blockers, {
+                    changedFiles,
+                    commits: changeSet.commits,
+                    repairAttempts: state.repairAttempts,
+                }),
+            };
+        }
+        return {
+            kind: 'blocked',
+            result: blocked([INCOMPLETE_AFTER_PROGRESS_REASON], {
+                changedFiles,
+                validation: [],
+                commits: changeSet.commits,
+                repairAttempts: state.repairAttempts,
+                blockers: [runnerBlocker('incomplete-after-progress', INCOMPLETE_AFTER_PROGRESS_REASON, 'recovery', 'implementation-rework')],
+            }),
+        };
+    }
+    return {
+        kind: 'blocked',
+        result: blocked([reportResult.message], {
+            blockers: [runnerBlocker('invalid-completion-report', reportResult.message, 'completion-report', 'completion-report')],
+            repairAttempts: state.repairAttempts,
+        }),
+    };
+}
+async function maybeRunCompletionReportRepair(input, reportIssue, repairAttempts) {
+    const changeSet = await input.git.collectSessionChangeSet({
+        worktreePath: input.worktreePath,
+        baseHead: input.beforeHead,
+    });
+    const changedFiles = changeSet.changedPaths;
+    if (changedFiles.length === 0) {
+        return { kind: 'not-eligible', changeSet };
+    }
+    const changedPathViolations = validateChangedPaths(changedFiles, input.config);
+    if (changedPathViolations.length > 0) {
+        return {
+            kind: 'blocked',
+            result: blocked(changedPathViolations.map((violation) => violation.message), {
+                changedFiles,
+                commits: changeSet.commits,
+            }),
+        };
+    }
+    const scopeIsolation = evaluateScopeIsolation({
+        config: input.config,
+        issue: input.issue,
+        changedFiles,
+    });
+    if (scopeIsolation.blockers.length > 0) {
+        return {
+            kind: 'blocked',
+            result: blocked(scopeIsolation.blockers, {
+                changedFiles,
+                commits: changeSet.commits,
+            }),
+        };
+    }
+    if (!input.reportRepair || !input.git.getHead) {
+        return { kind: 'not-eligible', changeSet };
+    }
+    const repairSessionId = `${input.reportRepair.sessionId}-completion-report-repair`;
+    const promptPath = sessionPromptPath({
+        targetRoot: input.reportRepair.targetRoot,
+        config: input.config,
+        issueNumber: input.issue.number,
+        sessionId: repairSessionId,
+    });
+    const logPath = sessionLogPath({
+        targetRoot: input.reportRepair.targetRoot,
+        config: input.config,
+        issueNumber: input.issue.number,
+        sessionId: repairSessionId,
+    });
+    const repairAttemptBase = {
+        kind: 'completion-report',
+        sessionId: repairSessionId,
+        promptPath,
+        reportPath: input.reportPath,
+        logPath,
+    };
+    const preRepairHead = await input.git.getHead(input.worktreePath);
+    const protectedBefore = await captureRepairProtectedFingerprint(input, changeSet);
+    const promptText = buildCompletionReportRepairPrompt({
+        input,
+        reportIssue,
+        changedFiles,
+    });
+    await writeDurablePrompt({
+        targetRoot: input.reportRepair.targetRoot,
+        config: input.config,
+        issueNumber: input.issue.number,
+        sessionId: repairSessionId,
+        promptText,
+    });
+    const isolatedHomePath = sessionCodexHomePath({
+        targetRoot: input.reportRepair.targetRoot,
+        sessionId: repairSessionId,
+    });
+    let repairResult;
+    try {
+        repairResult = await input.reportRepair.codexAdapter.run({
+            targetRoot: input.reportRepair.targetRoot,
+            config: input.config,
+            worktreePath: input.worktreePath,
+            promptPath,
+            promptText,
+            reportPath: input.reportPath,
+            isolatedHomePath,
+            issueNumber: input.issue.number,
+            sessionId: repairSessionId,
+            branchName: input.reportRepair.branchName,
+            phase: 'scoped-issue',
+            logPath,
+            env: {
+                CODEX_ORCHESTRATOR_REPAIR_MODE: 'completion-report',
+            },
+        });
+    }
+    finally {
+        await cleanupSessionCodexHome(isolatedHomePath);
+    }
+    if (repairResult.exitCode !== 0) {
+        const reason = `Completion report repair failed: ${formatCodexExitReason(repairResult)}`;
+        const blockers = [runnerBlocker('invalid-completion-report', reason, 'completion-report', 'none')];
+        repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles,
+                commits: changeSet.commits,
+                blockers,
+                repairAttempts,
+            }),
+        };
+    }
+    const postRepairHead = await input.git.getHead(input.worktreePath);
+    if (postRepairHead !== preRepairHead) {
+        const reason = 'Completion report repair created or moved HEAD; repair sessions must not create local commits.';
+        const blockers = [runnerBlocker('publication-violation', reason, 'safety', 'none')];
+        repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles,
+                commits: changeSet.commits,
+                blockers,
+                repairAttempts,
+            }),
+        };
+    }
+    const postChangeSet = await input.git.collectSessionChangeSet({
+        worktreePath: input.worktreePath,
+        baseHead: input.beforeHead,
+    });
+    const protectedAfter = await captureRepairProtectedFingerprint(input, postChangeSet);
+    if (protectedAfter !== protectedBefore) {
+        const reason = 'Completion report repair changed protected worktree content; repair may only write the completion report JSON.';
+        const blockers = [runnerBlocker('destructive-or-production-action', reason, 'safety', 'none')];
+        repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles: postChangeSet.changedPaths,
+                commits: postChangeSet.commits,
+                blockers,
+                repairAttempts,
+            }),
+        };
+    }
+    const repairedReport = await readScopedCompletionReportDetailed(input.reportPath);
+    if (repairedReport.kind === 'missing') {
+        const reason = `${MISSING_COMPLETION_REPORT_REASON} Completion report repair did not write CODEX_ORCHESTRATOR_REPORT_FILE.`;
+        const blockers = [runnerBlocker('missing-completion-report', reason, 'completion-report', 'none')];
+        repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles,
+                commits: changeSet.commits,
+                blockers,
+                repairAttempts,
+            }),
+        };
+    }
+    if (repairedReport.kind === 'invalid') {
+        const reason = `Completion report repair wrote an invalid report: ${repairedReport.message}`;
+        const blockers = [runnerBlocker('invalid-completion-report', reason, 'completion-report', 'none')];
+        repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles,
+                commits: changeSet.commits,
+                blockers,
+                repairAttempts,
+            }),
+        };
+    }
+    repairAttempts.push({ ...repairAttemptBase, status: 'passed', reason: 'Completion report repair wrote a valid scoped report.' });
+    return { kind: 'valid', report: repairedReport.report };
+}
+async function maybeRunEvidenceReportRepair(input, context) {
+    const repairableBlockers = (context.reviewGate.blockers ?? [])
+        .filter((blocker) => blocker.repair === 'evidence'
+        && (blocker.key === 'missing-quality-gate-evidence' || blocker.key === 'risk-routing-policy'));
+    if (repairableBlockers.length === 0 || !input.reportRepair || !input.git.getHead) {
+        return { kind: 'not-eligible' };
+    }
+    const repairSessionId = `${input.reportRepair.sessionId}-evidence-repair`;
+    const promptPath = sessionPromptPath({
+        targetRoot: input.reportRepair.targetRoot,
+        config: input.config,
+        issueNumber: input.issue.number,
+        sessionId: repairSessionId,
+    });
+    const logPath = sessionLogPath({
+        targetRoot: input.reportRepair.targetRoot,
+        config: input.config,
+        issueNumber: input.issue.number,
+        sessionId: repairSessionId,
+    });
+    const repairAttemptBase = {
+        kind: 'evidence',
+        sessionId: repairSessionId,
+        promptPath,
+        reportPath: input.reportPath,
+        logPath,
+    };
+    const preRepairHead = await input.git.getHead(input.worktreePath);
+    const protectedBefore = await captureRepairProtectedFingerprint(input, context.changeSet);
+    const promptText = buildEvidenceReportRepairPrompt({
+        input,
+        changedFiles: context.changedFiles,
+        reviewGate: context.reviewGate,
+        validation: context.validation,
+    });
+    await writeDurablePrompt({
+        targetRoot: input.reportRepair.targetRoot,
+        config: input.config,
+        issueNumber: input.issue.number,
+        sessionId: repairSessionId,
+        promptText,
+    });
+    const isolatedHomePath = sessionCodexHomePath({
+        targetRoot: input.reportRepair.targetRoot,
+        sessionId: repairSessionId,
+    });
+    let repairResult;
+    try {
+        repairResult = await input.reportRepair.codexAdapter.run({
+            targetRoot: input.reportRepair.targetRoot,
+            config: input.config,
+            worktreePath: input.worktreePath,
+            promptPath,
+            promptText,
+            reportPath: input.reportPath,
+            isolatedHomePath,
+            issueNumber: input.issue.number,
+            sessionId: repairSessionId,
+            branchName: input.reportRepair.branchName,
+            phase: 'scoped-issue',
+            logPath,
+            env: {
+                CODEX_ORCHESTRATOR_REPAIR_MODE: 'evidence',
+            },
+        });
+    }
+    finally {
+        await cleanupSessionCodexHome(isolatedHomePath);
+    }
+    if (repairResult.exitCode !== 0) {
+        const reason = `Evidence repair failed: ${formatCodexExitReason(repairResult)}`;
+        const blockers = [runnerBlocker('missing-quality-gate-evidence', reason, 'review-gate', 'none')];
+        context.repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles: context.changedFiles,
+                validation: context.validation,
+                skippedChecks: context.report.skippedChecks,
+                residualRisks: context.residualRisks,
+                commits: context.changeSet.commits,
+                acceptanceProofAttempt: context.acceptanceProofAttempt,
+                blockers,
+                repairAttempts: context.repairAttempts,
+            }),
+        };
+    }
+    const postRepairHead = await input.git.getHead(input.worktreePath);
+    if (postRepairHead !== preRepairHead) {
+        const reason = 'Evidence repair created or moved HEAD; repair sessions must not create local commits.';
+        const blockers = [runnerBlocker('publication-violation', reason, 'safety', 'none')];
+        context.repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles: context.changedFiles,
+                validation: context.validation,
+                skippedChecks: context.report.skippedChecks,
+                residualRisks: context.residualRisks,
+                commits: context.changeSet.commits,
+                acceptanceProofAttempt: context.acceptanceProofAttempt,
+                blockers,
+                repairAttempts: context.repairAttempts,
+            }),
+        };
+    }
+    const postChangeSet = await input.git.collectSessionChangeSet({
+        worktreePath: input.worktreePath,
+        baseHead: input.beforeHead,
+    });
+    const protectedAfter = await captureRepairProtectedFingerprint(input, postChangeSet);
+    if (protectedAfter !== protectedBefore) {
+        const reason = 'Evidence repair changed protected worktree content; repair may only write corrected completion report evidence.';
+        const blockers = [runnerBlocker('destructive-or-production-action', reason, 'safety', 'none')];
+        context.repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles: postChangeSet.changedPaths,
+                validation: context.validation,
+                skippedChecks: context.report.skippedChecks,
+                residualRisks: context.residualRisks,
+                commits: postChangeSet.commits,
+                acceptanceProofAttempt: context.acceptanceProofAttempt,
+                blockers,
+                repairAttempts: context.repairAttempts,
+            }),
+        };
+    }
+    const repairedRead = await readScopedCompletionReportDetailed(input.reportPath);
+    if (repairedRead.kind !== 'valid') {
+        const reason = repairedRead.kind === 'missing'
+            ? `${MISSING_COMPLETION_REPORT_REASON} Evidence repair did not write CODEX_ORCHESTRATOR_REPORT_FILE.`
+            : `Evidence repair wrote an invalid report: ${repairedRead.message}`;
+        const blockers = [runnerBlocker(repairedRead.kind === 'missing' ? 'missing-completion-report' : 'invalid-completion-report', reason, 'completion-report', 'none')];
+        context.repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles: context.changedFiles,
+                validation: context.validation,
+                skippedChecks: context.report.skippedChecks,
+                residualRisks: context.residualRisks,
+                commits: context.changeSet.commits,
+                acceptanceProofAttempt: context.acceptanceProofAttempt,
+                blockers,
+                repairAttempts: context.repairAttempts,
+            }),
+        };
+    }
+    if (repairedRead.report.status !== context.report.status) {
+        const reason = 'Evidence repair changed completion report status; repair may only correct review-gate evidence.';
+        const blockers = [runnerBlocker('missing-quality-gate-evidence', reason, 'review-gate', 'none')];
+        context.repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked([reason], {
+                changedFiles: context.changedFiles,
+                validation: context.validation,
+                skippedChecks: context.report.skippedChecks,
+                residualRisks: context.residualRisks,
+                commits: context.changeSet.commits,
+                acceptanceProofAttempt: context.acceptanceProofAttempt,
+                blockers,
+                repairAttempts: context.repairAttempts,
+            }),
+        };
+    }
+    const externalValidation = context.validation.slice(context.report.validation.length);
+    const repairedReport = {
+        ...context.report,
+        ...repairedRead.report,
+        skippedChecks: applicableSkippedChecks(input, repairedRead.report, context.changedFiles),
+        artifacts: mergeArtifacts(repairedRead.report.artifacts, context.report.artifacts),
+    };
+    const repairedValidation = [...repairedReport.validation, ...externalValidation];
+    const repairedReviewGate = evaluateReviewGates({
+        config: input.config,
+        issue: input.issue,
+        changedFiles: context.changedFiles,
+        validation: repairedValidation,
+        skippedChecks: repairedReport.skippedChecks,
+        report: repairedReport,
+        worktreePath: input.worktreePath,
+    });
+    if (!repairedReviewGate.ok) {
+        const reason = `Evidence repair did not satisfy review gates: ${repairedReviewGate.reasons.join('; ')}`;
+        const blockers = repairedReviewGate.blockers ?? repairableBlockers;
+        context.repairAttempts.push({ ...repairAttemptBase, status: 'blocked', reason, blockers });
+        return {
+            kind: 'blocked',
+            result: blocked(repairedReviewGate.reasons, {
+                changedFiles: context.changedFiles,
+                validation: repairedValidation,
+                skippedChecks: repairedReport.skippedChecks,
+                residualRisks: context.residualRisks,
+                commits: context.changeSet.commits,
+                acceptanceProofAttempt: context.acceptanceProofAttempt,
+                blockers,
+                repairAttempts: context.repairAttempts,
+            }),
+        };
+    }
+    context.repairAttempts.push({ ...repairAttemptBase, status: 'passed', reason: 'Evidence repair wrote review-gate evidence that passed rerun review gates.' });
+    return {
+        kind: 'publish-ready',
+        report: repairedReport,
+        validation: repairedValidation,
+        reviewWarnings: repairedReviewGate.warnings,
     };
 }
+async function captureRepairProtectedFingerprint(input, changeSet) {
+    const reportRelativePath = relativeReportPathInsideWorktree(input);
+    const entries = [];
+    for (const changedPath of changeSet.changedPaths) {
+        if (reportRelativePath && changedPath === reportRelativePath) {
+            continue;
+        }
+        const absolutePath = join(input.worktreePath, changedPath);
+        try {
+            const content = await readFile(absolutePath);
+            entries.push({
+                path: changedPath,
+                state: 'file',
+                sha256: createHash('sha256').update(content).digest('hex'),
+            });
+        }
+        catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                entries.push({ path: changedPath, state: 'missing' });
+                continue;
+            }
+            throw error;
+        }
+    }
+    return JSON.stringify(entries);
+}
+function relativeReportPathInsideWorktree(input) {
+    const worktreePath = resolve(input.worktreePath);
+    const reportPath = resolve(input.reportPath);
+    const relativePath = relative(worktreePath, reportPath);
+    if (relativePath === '' || relativePath.startsWith('..') || isAbsolute(relativePath)) {
+        return undefined;
+    }
+    return relativePath.split(/[\\/]+/u).join('/');
+}
+function buildCompletionReportRepairPrompt(input) {
+    const issue = input.input.issue;
+    const reportIssueText = input.reportIssue.kind === 'missing'
+        ? 'The completion report is missing.'
+        : [
+            input.reportIssue.message,
+            ...input.reportIssue.errors,
+            input.reportIssue.rawContent ? `Raw invalid report content (truncated):\n${input.reportIssue.rawContent}` : undefined,
+        ].filter(Boolean).join('\n');
+    return [
+        '# Completion Report Repair',
+        '',
+        'Repair only the completion report JSON at CODEX_ORCHESTRATOR_REPORT_FILE.',
+        'Do not edit product files. Do not edit GitHub. Do not create commits.',
+        'Use the changed files, issue text, schema errors/raw content, and validation/check evidence to write the corrected scoped completion report.',
+        'Final response raw JSON only.',
+        '',
+        `Issue #${issue.number}: ${issue.title}`,
+        issue.body,
+        '',
+        'Changed files:',
+        ...input.changedFiles.map((file) => `- ${file}`),
+        '',
+        'Report problem:',
+        reportIssueText,
+        '',
+        'Original workflow prompt:',
+        input.input.reportRepair?.workflowPromptText ?? '',
+    ].join('\n');
+}
+function buildEvidenceReportRepairPrompt(input) {
+    const issue = input.input.issue;
+    return [
+        '# Evidence Repair',
+        '',
+        'Repair only missing review-gate evidence in the completion report JSON at CODEX_ORCHESTRATOR_REPORT_FILE.',
+        'Do not edit product files. Do not edit GitHub. Do not create commits.',
+        'Only correct completion report JSON evidence fields such as validation, skippedChecks, residualRisks, and reviewHandoff.',
+        'You may run read-only review commands or review skills if needed, but final publication still depends on the runner rerunning gates.',
+        'Final response raw JSON only.',
+        '',
+        `Issue #${issue.number}: ${issue.title}`,
+        issue.body,
+        '',
+        'Changed files:',
+        ...input.changedFiles.map((file) => `- ${file}`),
+        '',
+        'Review gate reasons to repair:',
+        ...input.reviewGate.reasons.map((reason) => `- ${reason}`),
+        '',
+        'Typed blocker keys:',
+        ...(input.reviewGate.blockers ?? []).map((blocker) => `- ${blocker.key}: ${blocker.reason}`),
+        '',
+        'Current validation evidence:',
+        ...input.validation.map((line) => `- ${line.command}: ${line.status} - ${line.summary}`),
+        '',
+        'Original workflow prompt:',
+        input.input.reportRepair?.workflowPromptText ?? '',
+    ].join('\n');
+}
+function runnerBlocker(key, reason, source, repair) {
+    return { key, reason, source, repair };
+}
 function applicableSkippedChecks(input, report, changedFiles) {
     if (shouldApplyVisualProofGate({ config: input.config, issue: input.issue, changedFiles })) {
         return report.skippedChecks;
@@ -352,15 +969,31 @@ function localSessionBlockReasons(phaseResults) {
         ];
     });
 }
-function blocked(reasons) {
-    return {
+function blocked(reasons, options = {}) {
+    const result = {
         status: 'blocked',
         reasons,
-        changedFiles: [],
-        skippedChecks: [],
-        residualRisks: [],
-        commits: [],
+        changedFiles: options.changedFiles ?? [],
+        skippedChecks: options.skippedChecks ?? [],
+        residualRisks: options.residualRisks ?? [],
+        commits: options.commits ?? [],
     };
+    if (options.validation) {
+        result.validation = options.validation;
+    }
+    if (options.blockers && options.blockers.length > 0) {
+        result.blockers = options.blockers;
+    }
+    if (options.repairAttempts && options.repairAttempts.length > 0) {
+        result.repairAttempts = options.repairAttempts;
+    }
+    if (options.acceptanceProofAttempt) {
+        result.acceptanceProofAttempt = options.acceptanceProofAttempt;
+    }
+    return result;
+}
+function repairAttemptsField(repairAttempts) {
+    return repairAttempts.length > 0 ? { repairAttempts } : {};
 }
 function formatCodexExitReason(result) {
     const figmaReason = formatFigmaMcpFailureReason(result);
@@ -381,6 +1014,15 @@ function formatCodexExitReason(result) {
         ? `Codex exited with code ${result.exitCode}: ${truncate(detail, 600)}`
         : `Codex exited with code ${result.exitCode}`;
 }
+function isIdleTimeoutResult(result) {
+    if (result.exitCode !== 124) {
+        return false;
+    }
+    return `${result.stderr}\n${result.stdout}`
+        .split(/\r?\n/u)
+        .map((line) => line.trim())
+        .some((line) => /^Command idle timed out after [1-9][0-9]*ms\.$/u.test(line));
+}
 function formatFigmaMcpFailureReason(result) {
     if (result.exitCode === 0 || result.figmaMcp?.enabled !== true) {
         return undefined;