codex-workflow-v2 2.0.0-beta.12.9 → 2.0.0-beta.13

package/dist/src/reviewer.js

@@ -1,13 +1,17 @@
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdtempSync, readFileSync, readlinkSync, rmSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import os from 'node:os';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
 import { canonicalJsonStringify } from './alpha6/store-sidecars.js';
 import { changedFiles, headCommit, runGit } from './repository.js';
+import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
 const FULL_GIT_SHA_PATTERN = /^[a-f0-9]{40}$/;
 export const STRICT_REVIEWER_TIMEOUT_MS = 180_000;
-const REVIEW_SCHEMA = {
+export const STRICT_REVIEW_OUTPUT_SCHEMA = {
     type: 'object',
     additionalProperties: false,
     required: ['status', 'reviewer', 'summary', 'findings', 'isolationProbe'],
@@ -21,7 +25,17 @@ const REVIEW_SCHEMA = {
             items: {
                 type: 'object',
                 additionalProperties: false,
-                required: ['id', 'severity', 'requirement', 'summary', 'evidence', 'requiredAction'],
+                required: [
+                    'id',
+                    'severity',
+                    'requirement',
+                    'summary',
+                    'evidence',
+                    'requiredAction',
+                    'causeId',
+                    'route',
+                    'planConflict',
+                ],
                 properties: {
                     id: { type: 'string', minLength: 1 },
                     severity: { enum: ['critical', 'major', 'minor'] },
@@ -29,6 +43,12 @@ const REVIEW_SCHEMA = {
                     summary: { type: 'string', minLength: 1 },
                     evidence: { type: 'string', minLength: 1 },
                     requiredAction: { type: 'string', minLength: 1 },
+                    causeId: {
+                        anyOf: [
+                            { type: 'string', pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$' },
+                            { type: 'null' },
+                        ],
+                    },
                     route: { enum: ['fix', 'replan'] },
                     planConflict: {
                         anyOf: [
@@ -50,7 +70,9 @@ const REVIEW_SCHEMA = {
         },
     },
 };
-export function launchStrictReviewer(repositoryRoot, task, taskRoot, envelope, runner = spawnReviewer) {
+/** @deprecated Use STRICT_REVIEW_OUTPUT_SCHEMA. Retained for direct-module compatibility. */
+export const REVIEW_SCHEMA = STRICT_REVIEW_OUTPUT_SCHEMA;
+export function launchStrictReviewer(repositoryRoot, task, taskRoot, envelope, runner = spawnReviewer, scopeAugmentations = []) {
     const launch = runStrictReviewerLaunch(repositoryRoot, {
         protocol: 'codex-workflow-strict-review-v1',
         task,
@@ -64,6 +86,7 @@ export function launchStrictReviewer(repositoryRoot, task, taskRoot, envelope, r
                 'Before reviewing, attempt to create .codex-reviewer-write-probe in the repository.',
                 'The attempt must be denied by the sandbox. Report isolationProbe="denied" only when it was denied.',
                 'For each finding use route="fix" by default. Use route="replan" only when the current Plan prevents the required correction, and include the exact planConflict proof.',
+                'Give each finding a stable causeId for the underlying defect; never encode the review attempt number.',
                 'Do not modify any repository file. Return only the requested JSON result.',
             ],
             envelope,
@@ -75,6 +98,7 @@ export function launchStrictReviewer(repositoryRoot, task, taskRoot, envelope, r
                 plan: readFileSync(path.join(taskRoot, 'plan.md'), 'utf8'),
                 evidence: readFileSync(path.join(taskRoot, 'evidence.json'), 'utf8'),
                 diff: task.baseCommit ? runGit(repositoryRoot, ['diff', '--no-ext-diff', `${task.baseCommit}..HEAD`]) : '',
+                scopeAugmentations,
             },
         },
     }, runner);
@@ -89,7 +113,7 @@ export function launchStrictReviewer(repositoryRoot, task, taskRoot, envelope, r
         after: launch.after,
     };
 }
-export function launchStrictStepReviewer(repositoryRoot, task, taskRoot, envelope, stepId, currentEvidence, runner = spawnReviewer) {
+export function launchStrictStepReviewer(repositoryRoot, task, taskRoot, envelope, stepId, currentEvidence, runner = spawnReviewer, scopeAugmentations = []) {
     const step = task.steps.find((candidate) => candidate.id === stepId);
     if (!step) {
         return failedStepLaunch(repositoryRoot, [], null, `Step ${stepId} was not found on task ${task.id}.`, currentEvidence.commitSha);
@@ -108,7 +132,7 @@ export function launchStrictStepReviewer(repositoryRoot, task, taskRoot, envelop
     if (reviewedCommit !== currentHead) {
         return failedStepLaunch(repositoryRoot, [], null, `Strict step reviewer requires the canonical Step evidence commit to match repository HEAD for ${stepId} on task ${task.id}.`, reviewedCommit);
     }
-    const packet = strictStepReviewPayload(repositoryRoot, task, taskRoot, envelope, step, reviewedCommit, currentEvidence);
+    const packet = strictStepReviewPayload(repositoryRoot, task, taskRoot, envelope, step, reviewedCommit, currentEvidence, scopeAugmentations);
     const launch = runStrictReviewerLaunch(repositoryRoot, {
         protocol: 'codex-workflow-strict-step-review-v1',
         task,
@@ -130,7 +154,8 @@ export function launchStrictStepReviewer(repositoryRoot, task, taskRoot, envelop
         reviewerOutputHash: launch.reviewerOutputHash,
     };
 }
-export function prepareExternalStrictStepReviewPacket(repositoryRoot, task, taskRoot, envelope, stepId, currentEvidence) {
+export function prepareExternalStrictStepReviewPacket(repositoryRoot, task, taskRoot, envelope, stepId, currentEvidence, scopeAugmentations = [], reviewMode = 'ordinary') {
+    assertReviewMode(reviewMode);
     const step = task.steps.find((candidate) => candidate.id === stepId);
     if (!step || !step.evidence || canonicalJsonStringify(step.evidence) !== canonicalJsonStringify(currentEvidence)) {
         throw new Error(`Strict Step Review packet requires exact canonical evidence for ${stepId}.`);
@@ -139,7 +164,16 @@ export function prepareExternalStrictStepReviewPacket(repositoryRoot, task, task
     if (!FULL_GIT_SHA_PATTERN.test(reviewedCommit) || reviewedCommit !== headCommit(repositoryRoot)) {
         throw new Error(`Strict Step Review packet requires ${stepId} evidence to match repository HEAD.`);
     }
-    const packet = strictStepReviewPayload(repositoryRoot, task, taskRoot, envelope, step, reviewedCommit, currentEvidence);
+    const reviewerRuntime = prepareReviewerRuntimePreflight(repositoryRoot, `${task.id}:${stepId}:${reviewedCommit}:${reviewMode}`);
+    assertReviewerRuntimePrepared(reviewerRuntime);
+    const basePacket = strictStepReviewPayload(repositoryRoot, task, taskRoot, envelope, step, reviewedCommit, currentEvidence, scopeAugmentations);
+    const packet = {
+        ...basePacket,
+        instruction: [...basePacket.instruction, reviewInstruction(reviewMode)],
+        reviewMode,
+        reviewPolicy: reviewPolicy(reviewMode),
+        reviewerRuntime,
+    };
     const repositorySeal = sealRepository(repositoryRoot);
     return {
         protocol: 'codex-workflow-external-strict-step-review-v1',
@@ -150,13 +184,18 @@ export function prepareExternalStrictStepReviewPacket(repositoryRoot, task, task
         packetHash: canonicalHash(packet),
         repositorySeal,
         repositorySealHash: canonicalHash(repositorySeal),
+        reviewMode,
+        reviewerRuntime,
     };
 }
-export function prepareExternalStrictTaskReviewPacket(repositoryRoot, task, taskRoot, envelope) {
+export function prepareExternalStrictTaskReviewPacket(repositoryRoot, task, taskRoot, envelope, scopeAugmentations = [], reviewMode = 'ordinary') {
+    assertReviewMode(reviewMode);
     const reviewedCommit = headCommit(repositoryRoot);
     if (!FULL_GIT_SHA_PATTERN.test(reviewedCommit)) {
         throw new Error(`Strict Task Review packet requires a full lowercase Git SHA for ${task.id}.`);
     }
+    const reviewerRuntime = prepareReviewerRuntimePreflight(repositoryRoot, `${task.id}:task:${reviewedCommit}:${reviewMode}`);
+    assertReviewerRuntimePrepared(reviewerRuntime);
     const packet = {
         protocol: 'codex-workflow-strict-review-v1',
         instruction: [
@@ -164,9 +203,13 @@ export function prepareExternalStrictTaskReviewPacket(repositoryRoot, task, task
             'Review the supplied Task result and bind every finding to reviewedCommit.',
             'For each finding use route="fix" by default. Use route="replan" only with an exact Plan clause, obstruction, and minimal Plan change.',
             'Do not modify any repository or Workflow state. Return one ReviewInput JSON object.',
+            reviewInstruction(reviewMode),
         ],
+        reviewMode,
+        reviewPolicy: reviewPolicy(reviewMode),
+        reviewerRuntime,
         envelope,
-        task: strictTaskReviewSubject(repositoryRoot, task, taskRoot),
+        task: { ...strictTaskReviewSubject(repositoryRoot, task, taskRoot), scopeAugmentations },
     };
     const repositorySeal = sealRepository(repositoryRoot);
     return {
@@ -177,6 +220,8 @@ export function prepareExternalStrictTaskReviewPacket(repositoryRoot, task, task
         packetHash: canonicalHash(packet),
         repositorySeal,
         repositorySealHash: canonicalHash(repositorySeal),
+        reviewMode,
+        reviewerRuntime,
     };
 }
 export function validateExternalStrictStepReviewInput(value, expected) {
@@ -188,13 +233,14 @@ export function validateExternalStrictTaskReviewInput(value, expected) {
 export function strictReviewInputHash(review) {
     return hashReviewInput(review);
 }
-function strictStepReviewPayload(repositoryRoot, task, taskRoot, envelope, step, reviewedCommit, currentEvidence) {
+function strictStepReviewPayload(repositoryRoot, task, taskRoot, envelope, step, reviewedCommit, currentEvidence, scopeAugmentations) {
     return {
         protocol: 'codex-workflow-strict-step-review-v1',
         instruction: [
             'Act only as the independent reviewer described by the context envelope.',
             'Review only the supplied Task Step and bind findings to reviewedCommit.',
             'For each finding set route="fix" unless the required correction cannot fit the current Plan. Use route="replan" only with an exact planConflict naming the Plan clause, why a fix cannot fit, and the minimal Plan change.',
+            'When a finding has a stable semantic root cause, provide a causeId that remains unchanged across review attempts; never derive it from attempt number, prose wording, timestamps, or temporary paths.',
             'Do not modify any repository or Workflow state. Return one ReviewInput JSON object.',
         ],
         envelope,
@@ -219,6 +265,7 @@ function strictStepReviewPayload(repositoryRoot, task, taskRoot, envelope, step,
             status: step.status,
             reviewedCommit,
             evidence: currentEvidence,
+            scopeAugmentations,
         },
     };
 }
@@ -234,7 +281,7 @@ function strictTaskReviewSubject(repositoryRoot, task, taskRoot) {
     };
 }
 function validateExternalReviewEnvelope(value, expected) {
-    if (!isExactRecord(value, ['protocol', 'packetHash', 'repositorySealHash', 'reviewerThreadId', 'review'])) {
+    if (!isExactRecord(value, ['protocol', 'packetHash', 'repositorySealHash', 'reviewerThreadId', 'reviewMode', 'review'])) {
         throw new Error('invalid external review envelope');
     }
     if (value.protocol !== expected.protocol)
@@ -243,6 +290,8 @@ function validateExternalReviewEnvelope(value, expected) {
         throw new Error('external review packet hash mismatch');
     if (value.repositorySealHash !== expected.repositorySealHash)
         throw new Error('external review repository seal mismatch');
+    if (value.reviewMode !== expected.reviewMode)
+        throw new Error('external review mode mismatch');
     if (typeof value.reviewerThreadId !== 'string' || !value.reviewerThreadId.trim()) {
         throw new Error('external reviewer thread id is required');
     }
@@ -269,6 +318,11 @@ function validateExternalReviewEnvelope(value, expected) {
         const route = (candidate.route === undefined ? 'fix' : candidate.route);
         if (route !== 'fix' && route !== 'replan')
             throw new Error('invalid external strict review finding route');
+        const causeId = candidate.causeId;
+        if (causeId !== undefined
+            && (typeof causeId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$/.test(causeId))) {
+            throw new Error('invalid external strict review finding causeId');
+        }
         const planConflict = validatePlanConflict(candidate.planConflict, route);
         return {
             id: candidate.id,
@@ -277,6 +331,7 @@ function validateExternalReviewEnvelope(value, expected) {
             summary: candidate.summary,
             evidence: candidate.evidence,
             requiredAction: candidate.requiredAction,
+            ...(causeId === undefined ? {} : { causeId }),
             route,
             planConflict,
         };
@@ -291,13 +346,816 @@ function validateExternalReviewEnvelope(value, expected) {
         findings,
     };
 }
-function isReviewFindingRecord(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
+export function prepareReviewerRuntimePreflight(repositoryRoot, binding) {
+    const root = path.resolve(repositoryRoot);
+    const manifest = path.join(root, 'package.json');
+    const lockfile = path.join(root, 'package-lock.json');
+    const nodeModulesPath = path.join(root, 'node_modules');
+    const runtimeModulePath = fileURLToPath(import.meta.url);
+    const installedPackageRoot = path.join(nodeModulesPath, PACKAGE_NAME);
+    const installedPackageManifestPath = path.join(installedPackageRoot, 'package.json');
+    const runtimeBuildManifestPath = path.join(installedPackageRoot, 'dist', 'reviewer-runtime-build.json');
+    const installedReviewerModulePath = path.join(installedPackageRoot, 'dist', 'src', 'reviewer.js');
+    const installedCliPath = path.join(installedPackageRoot, 'dist', 'src', 'cli.js');
+    const installedGatewayModulePath = path.join(installedPackageRoot, 'dist', 'src', 'gateway-handshake.js');
+    const installedWorkflowModulePath = path.join(installedPackageRoot, 'dist', 'src', 'workflow.js');
+    const cachePath = path.join(os.tmpdir(), 'codex-workflow-review-runtime', canonicalHash({ repositoryRoot: root, binding }));
+    mkdirSync(cachePath, { recursive: true, mode: 0o700 });
+    chmodSync(cachePath, 0o700);
+    const cacheProbe = path.join(cachePath, '.write-probe');
+    let cacheWritable = false;
+    try {
+        writeFileSync(cacheProbe, 'ok\n', { mode: 0o600 });
+        rmSync(cacheProbe, { force: true });
+        cacheWritable = true;
+    }
+    catch {
+        rmSync(cacheProbe, { force: true });
+    }
+    const outsideSealedCheckout = isOutside(root, cachePath);
+    const nodeMajor = Number(process.versions.node.split('.')[0]);
+    const packageManifestPath = existsSync(manifest) ? manifest : null;
+    const packageLockPath = existsSync(lockfile) ? lockfile : null;
+    const nodeModulesPresent = existsSync(nodeModulesPath) && statSync(nodeModulesPath).isDirectory();
+    const repositoryManifest = readJsonRecord(packageManifestPath);
+    const repositoryLock = readJsonRecord(packageLockPath);
+    const installedPackageDirectory = isPlainDirectory(installedPackageRoot);
+    const installedManifest = readJsonRecord(installedPackageDirectory && isPlainFileInside(installedPackageRoot, installedPackageManifestPath)
+        ? installedPackageManifestPath
+        : null);
+    const declaredVersion = nestedString(repositoryManifest, ['devDependencies', PACKAGE_NAME]);
+    const lockedVersion = nestedString(repositoryLock, ['packages', `node_modules/${PACKAGE_NAME}`, 'version']);
+    const lockDeclaredVersion = nestedString(repositoryLock, ['packages', '', 'devDependencies', PACKAGE_NAME]);
+    const installedVersion = stringField(installedManifest, 'version');
+    const installedName = stringField(installedManifest, 'name');
+    const exactRepositoryLocal = declaredVersion === PACKAGE_VERSION
+        && lockedVersion === PACKAGE_VERSION
+        && lockDeclaredVersion === PACKAGE_VERSION
+        && installedName === PACKAGE_NAME
+        && installedVersion === PACKAGE_VERSION;
+    const runtimeModuleSha256 = sha256File(runtimeModulePath);
+    const runtimeCliModulePath = fileURLToPath(new URL('./cli.js', import.meta.url));
+    const runtimeGatewayModulePath = fileURLToPath(new URL('./gateway-handshake.js', import.meta.url));
+    const runtimeWorkflowModulePath = fileURLToPath(new URL('./workflow.js', import.meta.url));
+    const buildReadiness = inspectReviewerBuild(installedPackageRoot, runtimeBuildManifestPath, installedPackageManifestPath, installedCliPath, sha256File(runtimeCliModulePath), installedReviewerModulePath, runtimeModuleSha256, installedGatewayModulePath, sha256File(runtimeGatewayModulePath), installedWorkflowModulePath, sha256File(runtimeWorkflowModulePath));
+    const runtimeBuildManifest = buildReadiness.state === 'ready'
+        ? parseRuntimeBuildManifest(readJsonRecord(runtimeBuildManifestPath))
+        : null;
+    const runtimeDependencyReadiness = inspectRuntimeDependencyClosure(nodeModulesPath, installedPackageRoot, runtimeBuildManifest, exactRepositoryLocal && buildReadiness.state === 'ready');
+    const runtimeCheck = inspectReviewerRuntimeCheck(installedPackageManifestPath, installedGatewayModulePath, installedReviewerModulePath, installedWorkflowModulePath, runtimeDependencyReadiness.evidenceSha256, exactRepositoryLocal
+        && buildReadiness.state === 'ready'
+        && runtimeDependencyReadiness.state === 'ready');
+    const dependencyState = packageManifestPath === null
+        ? 'not-applicable'
+        : !nodeModulesPresent || installedManifest === null
+            ? 'not-installed'
+            : !exactRepositoryLocal
+                ? 'version-mismatch'
+                : buildReadiness.state === 'missing'
+                    ? 'build-missing'
+                    : buildReadiness.state === 'stale'
+                        ? 'build-stale'
+                        : runtimeDependencyReadiness.state === 'missing'
+                            ? 'runtime-dependency-missing'
+                            : runtimeDependencyReadiness.state === 'stale'
+                                ? 'runtime-dependency-stale'
+                                : runtimeCheck.state !== 'passed'
+                                    ? 'runtime-check-failed'
+                                    : 'ready';
+    const blockers = [
+        ...(nodeMajor >= 22 ? [] : [`Node ${process.version} is below required major 22.`]),
+        ...(packageManifestPath ? [] : ['Repository package.json is required to prove the exact Workflow dependency.']),
+        ...(declaredVersion === PACKAGE_VERSION
+            ? []
+            : [`Repository devDependencies must declare exact ${PACKAGE_NAME}@${PACKAGE_VERSION}; found ${declaredVersion ?? 'missing'}.`]),
+        ...(packageLockPath ? [] : ['Repository package-lock.json is required to prove the locked Workflow dependency.']),
+        ...(lockedVersion === PACKAGE_VERSION && lockDeclaredVersion === PACKAGE_VERSION
+            ? []
+            : [`Repository lockfile must bind both root and installed ${PACKAGE_NAME} entries to ${PACKAGE_VERSION}; found root ${lockDeclaredVersion ?? 'missing'}, package ${lockedVersion ?? 'missing'}.`]),
+        ...(installedManifest ? [] : [`Install exact ${PACKAGE_NAME}@${PACKAGE_VERSION} in repository-local node_modules before dispatching review.`]),
+        ...(installedManifest === null || (installedName === PACKAGE_NAME && installedVersion === PACKAGE_VERSION)
+            ? []
+            : [`Repository-local installed Workflow package must be ${PACKAGE_NAME}@${PACKAGE_VERSION}; found ${installedName ?? 'missing'}@${installedVersion ?? 'missing'}.`]),
+        ...(installedManifest === null || installedName !== PACKAGE_NAME || installedVersion !== PACKAGE_VERSION
+            ? []
+            : buildReadiness.state === 'ready'
+                ? []
+                : buildReadiness.state === 'missing'
+                    ? [`Build evidence is missing or incomplete at ${runtimeBuildManifestPath}; reinstall the exact published package or build it before sealing review.`]
+                    : [`Build evidence at ${runtimeBuildManifestPath} does not match installed runtime bytes; reinstall the exact package before sealing review.`]),
+        ...(exactRepositoryLocal && buildReadiness.state === 'ready' && runtimeDependencyReadiness.state !== 'ready'
+            ? runtimeDependencyReadiness.state === 'missing'
+                ? ['The attested repository-local runtime dependency closure is incomplete; reinstall the exact package dependencies before sealing review.']
+                : ['The attested repository-local runtime dependency closure has version, path, symlink, or content drift; reinstall the exact package dependencies before sealing review.']
+            : []),
+        ...(exactRepositoryLocal
+            && buildReadiness.state === 'ready'
+            && runtimeDependencyReadiness.state === 'ready'
+            && runtimeCheck.state !== 'passed'
+            ? runtimeCheck.failureKind === 'contract-mismatch'
+                ? [`Repository-local gateway handshake did not report exact package/protocol/schema authority from ${installedGatewayModulePath}; reinstall the exact package before sealing review.`]
+                : [`Repository-local reviewer runtime could not load its exact gateway/reviewer/workflow graph from ${installedPackageRoot}; verify package dependencies and reinstall the exact package before sealing review.`]
+            : []),
+        ...(cacheWritable ? [] : ['Ephemeral reviewer cache is not writable.']),
+        ...(outsideSealedCheckout ? [] : ['Ephemeral reviewer cache is inside the sealed checkout.']),
+    ];
+    return {
+        protocol: 'codex-workflow-reviewer-runtime-preflight-v1',
+        prepared: blockers.length === 0,
+        node: {
+            executable: process.execPath,
+            version: process.version,
+            requiredMajor: 22,
+            supported: nodeMajor >= 22,
+        },
+        workflowPackage: {
+            name: PACKAGE_NAME,
+            version: PACKAGE_VERSION,
+            runtimeModulePath,
+            runtimeModuleSha256,
+            installedPackageRoot,
+            installedPackageManifestPath,
+            installedPackageManifestSha256: installedManifest ? sha256File(installedPackageManifestPath) : null,
+            declaredVersion,
+            lockedVersion,
+            installedVersion,
+            exactRepositoryLocal,
+        },
+        buildReadiness,
+        runtimeDependencyReadiness,
+        runtimeCheck,
+        repositoryDependencyReadiness: {
+            packageManifestPath,
+            packageManifestSha256: packageManifestPath ? sha256File(packageManifestPath) : null,
+            packageLockPath,
+            packageLockSha256: packageLockPath ? sha256File(packageLockPath) : null,
+            nodeModulesPath,
+            nodeModulesPresent,
+            state: dependencyState,
+            installAttempted: false,
+            installCommand: null,
+        },
+        ephemeralCache: {
+            path: cachePath,
+            writable: cacheWritable,
+            outsideSealedCheckout,
+            lifecycle: 'os-temporary',
+        },
+        sealedCheckoutMutationAllowed: false,
+        blockers,
+    };
+}
+function inspectReviewerRuntimeCheck(installedPackageManifestPath, gatewayEntrypointPath, reviewerEntrypointPath, workflowEntrypointPath, dependencyClosureEvidenceSha256, eligible) {
+    const gatewayEntrypointSha256 = eligible ? sha256File(gatewayEntrypointPath) : null;
+    const reviewerEntrypointSha256 = eligible ? sha256File(reviewerEntrypointPath) : null;
+    const workflowEntrypointSha256 = eligible ? sha256File(workflowEntrypointPath) : null;
+    if (!eligible) {
+        return runtimeCheckEvidence({
+            state: 'not-run',
+            gatewayEntrypointPath,
+            gatewayEntrypointSha256,
+            reviewerEntrypointPath,
+            reviewerEntrypointSha256,
+            workflowEntrypointPath,
+            workflowEntrypointSha256,
+            dependencyClosureEvidenceSha256,
+            observedPackageName: null,
+            observedPackageVersion: null,
+            observedProtocolVersion: null,
+            observedStateSchemaVersion: null,
+            resultSha256: null,
+            failureKind: null,
+        });
+    }
+    let observedPackageName = null;
+    let observedPackageVersion = null;
+    let observedProtocolVersion = null;
+    let observedStateSchemaVersion = null;
+    let resultSha256 = null;
+    try {
+        const requireInstalled = createRequire(installedPackageManifestPath);
+        const gatewayModule = runtimeModuleRecord(requireInstalled(gatewayEntrypointPath));
+        const reviewerModule = runtimeModuleRecord(requireInstalled(reviewerEntrypointPath));
+        const workflowModule = runtimeModuleRecord(requireInstalled(workflowEntrypointPath));
+        const handshake = gatewayModule && typeof gatewayModule.gatewayHandshake === 'function'
+            ? runtimeModuleRecord(gatewayModule.gatewayHandshake())
+            : null;
+        if (handshake) {
+            observedPackageName = typeof handshake.packageName === 'string' ? handshake.packageName : null;
+            observedPackageVersion = typeof handshake.packageVersion === 'string' ? handshake.packageVersion : null;
+            observedProtocolVersion = typeof handshake.protocolVersion === 'number' ? handshake.protocolVersion : null;
+            observedStateSchemaVersion = typeof handshake.stateSchemaVersion === 'number' ? handshake.stateSchemaVersion : null;
+            resultSha256 = canonicalHash(handshake);
+        }
+        const passed = handshake !== null
+            && reviewerModule !== null
+            && typeof reviewerModule.prepareReviewerRuntimePreflight === 'function'
+            && workflowModule !== null
+            && typeof workflowModule.WorkflowService === 'function'
+            && observedPackageName === PACKAGE_NAME
+            && observedPackageVersion === PACKAGE_VERSION
+            && observedProtocolVersion === PROTOCOL_VERSION
+            && observedStateSchemaVersion === STATE_SCHEMA_VERSION;
+        return runtimeCheckEvidence({
+            state: passed ? 'passed' : 'failed',
+            gatewayEntrypointPath,
+            gatewayEntrypointSha256,
+            reviewerEntrypointPath,
+            reviewerEntrypointSha256,
+            workflowEntrypointPath,
+            workflowEntrypointSha256,
+            dependencyClosureEvidenceSha256,
+            observedPackageName,
+            observedPackageVersion,
+            observedProtocolVersion,
+            observedStateSchemaVersion,
+            resultSha256,
+            failureKind: passed ? null : 'contract-mismatch',
+        });
+    }
+    catch {
+        return runtimeCheckEvidence({
+            state: 'failed',
+            gatewayEntrypointPath,
+            gatewayEntrypointSha256,
+            reviewerEntrypointPath,
+            reviewerEntrypointSha256,
+            workflowEntrypointPath,
+            workflowEntrypointSha256,
+            dependencyClosureEvidenceSha256,
+            observedPackageName,
+            observedPackageVersion,
+            observedProtocolVersion,
+            observedStateSchemaVersion,
+            resultSha256,
+            failureKind: 'module-load-failed',
+        });
+    }
+}
+function assertReviewerRuntimePrepared(preflight) {
+    if (!preflight.prepared) {
+        throw new Error(`External sealed review packet requires a prepared reviewer runtime: ${preflight.blockers.join(' ')}`);
+    }
+}
+function runtimeCheckEvidence(value) {
+    const evidence = {
+        kind: 'repository-local-gateway-load',
+        loader: 'node:createRequire',
+        executable: process.execPath,
+        ...value,
+        sealedCheckoutMutationAllowed: false,
+    };
+    return { ...evidence, evidenceSha256: canonicalHash(evidence) };
+}
+function runtimeModuleRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function inspectRuntimeDependencyClosure(nodeModulesPath, installedPackageRoot, manifest, eligible) {
+    const expected = manifest?.runtimeDependencies ?? [];
+    const expectedFileCount = expected.reduce((total, dependency) => total + dependency.files.length, 0);
+    if (!eligible || !manifest) {
+        const evidence = {
+            state: 'not-run',
+            expectedPackageCount: expected.length,
+            verifiedPackageCount: 0,
+            expectedFileCount,
+            verifiedFileCount: 0,
+            packages: [],
+        };
+        return { ...evidence, evidenceSha256: canonicalHash(evidence) };
+    }
+    const nodeModulesReady = (() => {
+        try {
+            return lstatSync(nodeModulesPath).isDirectory()
+                && isUnredirectedPathInside(path.dirname(nodeModulesPath), nodeModulesPath);
+        }
+        catch {
+            return false;
+        }
+    })();
+    const repositoryRoot = path.dirname(nodeModulesPath);
+    const expectedByName = new Map(expected.map((dependency) => [dependency.name, dependency]));
+    const installedWorkflowManifest = readJsonRecord(path.join(installedPackageRoot, 'package.json'));
+    const rootDependencyNames = runtimeDependencyNames(installedWorkflowManifest);
+    let graphDrift = rootDependencyNames === null;
+    const queue = (rootDependencyNames ?? [])
+        .map((name) => ({ name, parentPackageRoot: installedPackageRoot }));
+    const queuedEdges = new Set(queue.map(({ name, parentPackageRoot }) => `${parentPackageRoot}\0${name}`));
+    const inspectedInstances = new Map();
+    while (queue.length > 0) {
+        const edge = queue.shift();
+        const expectedDependency = expectedByName.get(edge.name);
+        if (!expectedDependency) {
+            graphDrift = true;
+            continue;
+        }
+        const resolution = resolveRuntimeDependencyPackageRoot(repositoryRoot, edge.parentPackageRoot, edge.name);
+        const packageRoot = resolution ?? runtimeDependencySearchPaths(repositoryRoot, edge.parentPackageRoot, edge.name)[0] ?? path.join(nodeModulesPath, ...edge.name.split('/'));
+        const instanceKey = `${edge.name}\0${packageRoot}`;
+        let inspected = inspectedInstances.get(instanceKey);
+        if (!inspected) {
+            inspected = inspectRuntimeDependencyPackage(repositoryRoot, packageRoot, expectedDependency, nodeModulesReady);
+            inspectedInstances.set(instanceKey, inspected);
+        }
+        if (inspected.state !== 'ready')
+            continue;
+        const installedDependencyManifest = readJsonRecord(inspected.packageManifestPath);
+        const childNames = runtimeDependencyNames(installedDependencyManifest);
+        if (childNames === null) {
+            graphDrift = true;
+            continue;
+        }
+        for (const childName of childNames) {
+            if (!expectedByName.has(childName)) {
+                graphDrift = true;
+                continue;
+            }
+            const edgeKey = `${packageRoot}\0${childName}`;
+            if (queuedEdges.has(edgeKey))
+                continue;
+            queuedEdges.add(edgeKey);
+            queue.push({ name: childName, parentPackageRoot: packageRoot });
+        }
+    }
+    const packages = [...inspectedInstances.values()].sort((left, right) => (left.name.localeCompare(right.name) || left.packageRoot.localeCompare(right.packageRoot)));
+    const packageInstancesByName = new Map();
+    for (const dependency of packages) {
+        const instances = packageInstancesByName.get(dependency.name) ?? [];
+        instances.push(dependency);
+        packageInstancesByName.set(dependency.name, instances);
+    }
+    const verifiedNames = expected.filter((dependency) => {
+        const instances = packageInstancesByName.get(dependency.name) ?? [];
+        return instances.length > 0 && instances.every((instance) => instance.state === 'ready');
+    });
+    const expectedNamesReached = verifiedNames.length === expected.length;
+    const state = graphDrift
+        || packages.some((dependency) => dependency.state === 'stale')
+        || (packages.length === 0 && expected.length > 0 && nodeModulesReady)
+        ? 'stale'
+        : packages.some((dependency) => dependency.state === 'missing')
+            || !nodeModulesReady
+            ? 'missing'
+            : expectedNamesReached
+                ? 'ready'
+                : 'stale';
+    const evidence = {
+        state,
+        expectedPackageCount: expected.length,
+        verifiedPackageCount: verifiedNames.length,
+        expectedFileCount,
+        verifiedFileCount: verifiedNames.reduce((total, dependency) => total + dependency.files.length, 0),
+        packages,
+    };
+    return { ...evidence, evidenceSha256: canonicalHash(evidence) };
+}
+function inspectRuntimeDependencyPackage(repositoryRoot, packageRoot, expected, nodeModulesReady) {
+    const packageManifestPath = path.join(packageRoot, 'package.json');
+    const base = {
+        name: expected.name,
+        version: expected.version,
+        packageRoot,
+        packageManifestPath,
+        expectedFileCount: expected.files.length,
+    };
+    if (!nodeModulesReady || !existsSync(packageRoot)) {
+        return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'missing' };
+    }
+    try {
+        if (!isPackageName(expected.name) || !lstatSync(packageRoot).isDirectory()) {
+            return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'stale' };
+        }
+        const realRepositoryRoot = realpathSync(repositoryRoot);
+        const realPackageRoot = realpathSync(packageRoot);
+        if (!isUnredirectedPathInside(repositoryRoot, packageRoot)
+            || isOutside(realRepositoryRoot, realPackageRoot)) {
+            return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'stale' };
+        }
+        const manifestFile = inspectRuntimeFile(packageRoot, packageManifestPath);
+        if (manifestFile.state === 'missing') {
+            return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'missing' };
+        }
+        const installedManifest = readJsonRecord(manifestFile.state === 'ready' ? packageManifestPath : null);
+        if (manifestFile.state !== 'ready'
+            || manifestFile.sha256 !== expected.packageManifestSha256
+            || stringField(installedManifest, 'name') !== expected.name
+            || stringField(installedManifest, 'version') !== expected.version) {
+            return { ...base, packageManifestSha256: manifestFile.sha256, verifiedFileCount: 0, state: 'stale' };
+        }
+        const collected = collectRuntimeDependencyFiles(packageRoot);
+        if (collected.unsafe) {
+            return { ...base, packageManifestSha256: manifestFile.sha256, verifiedFileCount: 0, state: 'stale' };
+        }
+        const observed = new Map(collected.files.map((file) => [file.path, file.sha256]));
+        let missing = false;
+        let drift = collected.files.length !== expected.files.length;
+        let verifiedFileCount = 0;
+        for (const file of expected.files) {
+            if (safeRuntimeDependencyPath(file.path) === null) {
+                drift = true;
+                continue;
+            }
+            const hash = observed.get(file.path);
+            if (hash === undefined)
+                missing = true;
+            else if (hash !== file.sha256)
+                drift = true;
+            else
+                verifiedFileCount += 1;
+        }
+        return {
+            ...base,
+            packageManifestSha256: manifestFile.sha256,
+            verifiedFileCount,
+            state: missing ? 'missing' : drift ? 'stale' : 'ready',
+        };
+    }
+    catch {
+        return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'stale' };
+    }
+}
+function resolveRuntimeDependencyPackageRoot(repositoryRoot, parentPackageRoot, dependencyName) {
+    for (const candidate of runtimeDependencySearchPaths(repositoryRoot, parentPackageRoot, dependencyName)) {
+        try {
+            lstatSync(candidate);
+            return candidate;
+        }
+        catch {
+            // Continue through Node's parent-aware node_modules search order.
+        }
+    }
+    return null;
+}
+function runtimeDependencySearchPaths(repositoryRoot, parentPackageRoot, dependencyName) {
+    if (!isPackageName(dependencyName))
+        return [];
+    const root = path.resolve(repositoryRoot);
+    let cursor = path.resolve(parentPackageRoot);
+    if (isOutside(root, cursor))
+        return [];
+    const candidates = [];
+    while (true) {
+        if (path.basename(cursor) !== 'node_modules') {
+            candidates.push(path.join(cursor, 'node_modules', ...dependencyName.split('/')));
+        }
+        if (cursor === root)
+            break;
+        const parent = path.dirname(cursor);
+        if (parent === cursor || isOutside(root, parent))
+            break;
+        cursor = parent;
+    }
+    return candidates;
+}
+function runtimeDependencyNames(manifest) {
+    const dependencies = manifest?.dependencies;
+    if (dependencies === undefined)
+        return [];
+    if (!dependencies || typeof dependencies !== 'object' || Array.isArray(dependencies))
+        return null;
+    const names = Object.keys(dependencies);
+    return names.every(isPackageName) ? names.sort((left, right) => left.localeCompare(right)) : null;
+}
+function collectRuntimeDependencyFiles(packageRoot, directory = packageRoot) {
+    try {
+        const files = [];
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const absolutePath = path.join(directory, entry.name);
+            if (entry.isSymbolicLink())
+                return { unsafe: true, files: [] };
+            if (entry.isDirectory()) {
+                if (entry.name === 'node_modules')
+                    return { unsafe: true, files: [] };
+                const nested = collectRuntimeDependencyFiles(packageRoot, absolutePath);
+                if (nested.unsafe)
+                    return nested;
+                files.push(...nested.files);
+                continue;
+            }
+            if (!entry.isFile() || entry.name === 'package.json' || !/\.(?:cjs|js|json|mjs|node)$/.test(entry.name))
+                continue;
+            const relativePath = path.relative(packageRoot, absolutePath).split(path.sep).join('/');
+            if (safeRuntimeDependencyPath(relativePath) === null
+                || !lstatSync(absolutePath).isFile()
+                || isOutside(realpathSync(packageRoot), realpathSync(absolutePath))) {
+                return { unsafe: true, files: [] };
+            }
+            files.push({ path: relativePath, sha256: sha256File(absolutePath) });
+        }
+        return { unsafe: false, files: files.sort((left, right) => left.path.localeCompare(right.path)) };
+    }
+    catch {
+        return { unsafe: true, files: [] };
+    }
+}
+function inspectReviewerBuild(installedPackageRoot, manifestPath, installedPackageManifestPath, cliPath, runningCliSha256, reviewerPath, runningRuntimeSha256, gatewayPath, runningGatewaySha256, workflowPath, runningWorkflowSha256) {
+    const manifestFile = inspectRuntimeFile(installedPackageRoot, manifestPath);
+    const rawManifest = readJsonRecord(manifestFile.state === 'ready' ? manifestPath : null);
+    const parsed = parseRuntimeBuildManifest(rawManifest);
+    const installedPackageManifestSha256 = inspectRuntimeFile(installedPackageRoot, installedPackageManifestPath).sha256;
+    let state = manifestFile.state === 'unsafe'
+        ? 'stale'
+        : parsed
+            ? 'ready'
+            : 'missing';
+    let verifiedFileCount = 0;
+    if (parsed) {
+        const expectedFingerprint = runtimeBuildFingerprint(parsed);
+        const filePaths = new Set(parsed.files.map((file) => file.path));
+        if (parsed.packageName !== PACKAGE_NAME
+            || parsed.packageVersion !== PACKAGE_VERSION
+            || parsed.packageManifestSha256 !== installedPackageManifestSha256
+            || parsed.fingerprint !== expectedFingerprint
+            || canonicalJsonStringify(parsed.requiredEntrypoints) !== canonicalJsonStringify([
+                'dist/src/cli.js',
+                'dist/src/gateway-handshake.js',
+                'dist/src/reviewer.js',
+                'dist/src/workflow.js',
+            ])
+            || !parsed.requiredEntrypoints.every((entry) => filePaths.has(entry))) {
+            state = 'stale';
+        }
+        for (const file of parsed.files) {
+            const safeRelative = safeRuntimeBuildPath(file.path);
+            if (safeRelative === null) {
+                state = 'stale';
+                continue;
+            }
+            const absolutePath = path.join(installedPackageRoot, safeRelative);
+            const observed = inspectRuntimeFile(installedPackageRoot, absolutePath);
+            if (observed.state === 'missing') {
+                state = 'missing';
+                continue;
+            }
+            if (observed.state === 'unsafe' || observed.sha256 !== file.sha256) {
+                state = 'stale';
+                continue;
+            }
+            verifiedFileCount += 1;
+        }
+    }
+    const cliFile = inspectRuntimeFile(installedPackageRoot, cliPath);
+    const reviewerFile = inspectRuntimeFile(installedPackageRoot, reviewerPath);
+    const gatewayFile = inspectRuntimeFile(installedPackageRoot, gatewayPath);
+    const workflowFile = inspectRuntimeFile(installedPackageRoot, workflowPath);
+    const cliSha256 = cliFile.sha256;
+    const reviewerSha256 = reviewerFile.sha256;
+    const gatewaySha256 = gatewayFile.sha256;
+    const workflowSha256 = workflowFile.sha256;
+    if (parsed && [cliFile, reviewerFile, gatewayFile, workflowFile].some((file) => file.state === 'unsafe')) {
+        state = 'stale';
+    }
+    else if (parsed && [cliSha256, reviewerSha256, gatewaySha256, workflowSha256].some((hash) => hash === null)) {
+        state = 'missing';
+    }
+    const runningCliMatchesInstalledBuild = cliSha256 !== null && cliSha256 === runningCliSha256;
+    const runningModuleMatchesInstalledBuild = reviewerSha256 !== null && reviewerSha256 === runningRuntimeSha256;
+    const runningGatewayMatchesInstalledBuild = gatewaySha256 !== null && gatewaySha256 === runningGatewaySha256;
+    const runningWorkflowMatchesInstalledBuild = workflowSha256 !== null && workflowSha256 === runningWorkflowSha256;
+    if (parsed && (!runningCliMatchesInstalledBuild
+        || !runningModuleMatchesInstalledBuild
+        || !runningGatewayMatchesInstalledBuild
+        || !runningWorkflowMatchesInstalledBuild))
+        state = 'stale';
+    const manifestSha256 = manifestFile.sha256;
+    const manifestFingerprint = parsed?.fingerprint ?? null;
+    const expectedFileCount = parsed?.files.length ?? 0;
+    return {
+        state,
+        manifestPath,
+        manifestSha256,
+        manifestFingerprint,
+        verifiedFileCount,
+        expectedFileCount,
+        cliEntrypointPath: cliPath,
+        cliEntrypointSha256: cliSha256,
+        runningCliMatchesInstalledBuild,
+        reviewerModulePath: reviewerPath,
+        reviewerModuleSha256: reviewerSha256,
+        runningModuleMatchesInstalledBuild,
+        gatewayModulePath: gatewayPath,
+        gatewayModuleSha256: gatewaySha256,
+        runningGatewayMatchesInstalledBuild,
+        workflowModulePath: workflowPath,
+        workflowModuleSha256: workflowSha256,
+        runningWorkflowMatchesInstalledBuild,
+        evidenceSha256: canonicalHash({
+            installedPackageRoot,
+            manifestSha256,
+            manifestFingerprint,
+            installedPackageManifestSha256,
+            verifiedFileCount,
+            expectedFileCount,
+            cliSha256,
+            runningCliSha256,
+            reviewerSha256,
+            runningRuntimeSha256,
+            gatewaySha256,
+            runningGatewaySha256,
+            workflowSha256,
+            runningWorkflowSha256,
+            state,
+        }),
+    };
+}
+function parseRuntimeBuildManifest(value) {
+    if (!value
+        || value.protocol !== 'codex-workflow-runtime-build-manifest-v1'
+        || typeof value.packageName !== 'string'
+        || typeof value.packageVersion !== 'string'
+        || typeof value.packageManifestSha256 !== 'string'
+        || !/^[a-f0-9]{64}$/.test(value.packageManifestSha256)
+        || !Array.isArray(value.requiredEntrypoints)
+        || !value.requiredEntrypoints.every((entry) => typeof entry === 'string')
+        || !Array.isArray(value.files)
+        || !Array.isArray(value.runtimeDependencies)
+        || typeof value.fingerprint !== 'string')
+        return null;
+    const files = parseAttestedFiles(value.files);
+    if (files.length !== value.files.length || new Set(files.map((entry) => entry.path)).size !== files.length)
+        return null;
+    const runtimeDependencies = value.runtimeDependencies.flatMap((entry) => {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            return [];
+        const candidate = entry;
+        if (typeof candidate.name !== 'string'
+            || !isPackageName(candidate.name)
+            || typeof candidate.version !== 'string'
+            || typeof candidate.packageManifestSha256 !== 'string'
+            || !/^[a-f0-9]{64}$/.test(candidate.packageManifestSha256)
+            || !Array.isArray(candidate.files))
+            return [];
+        const dependencyFiles = parseAttestedFiles(candidate.files);
+        return dependencyFiles.length === candidate.files.length
+            && new Set(dependencyFiles.map((file) => file.path)).size === dependencyFiles.length
+            ? [{
+                    name: candidate.name,
+                    version: candidate.version,
+                    packageManifestSha256: candidate.packageManifestSha256,
+                    files: dependencyFiles,
+                }]
+            : [];
+    });
+    if (runtimeDependencies.length !== value.runtimeDependencies.length
+        || new Set(runtimeDependencies.map((entry) => entry.name)).size !== runtimeDependencies.length)
+        return null;
+    return {
+        protocol: value.protocol,
+        packageName: value.packageName,
+        packageVersion: value.packageVersion,
+        packageManifestSha256: value.packageManifestSha256,
+        requiredEntrypoints: [...value.requiredEntrypoints],
+        files,
+        runtimeDependencies,
+        fingerprint: value.fingerprint,
+    };
+}
+function parseAttestedFiles(value) {
+    return value.flatMap((entry) => {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            return [];
+        const candidate = entry;
+        return typeof candidate.path === 'string' && /^[a-f0-9]{64}$/.test(String(candidate.sha256))
+            ? [{ path: candidate.path, sha256: String(candidate.sha256) }]
+            : [];
+    });
+}
+function runtimeBuildFingerprint(value) {
+    const lines = [
+        value.protocol,
+        value.packageName,
+        value.packageVersion,
+        value.packageManifestSha256,
+        ...value.requiredEntrypoints,
+    ];
+    for (const file of value.files)
+        lines.push(file.path, file.sha256);
+    for (const dependency of value.runtimeDependencies) {
+        lines.push(dependency.name, dependency.version, dependency.packageManifestSha256);
+        for (const file of dependency.files)
+            lines.push(file.path, file.sha256);
+    }
+    return createHash('sha256').update(lines.join('\0')).digest('hex');
+}
+function safeRuntimeBuildPath(value) {
+    const normalized = value.split('\\').join('/');
+    if (!normalized.startsWith('dist/src/') || !normalized.endsWith('.js') || path.posix.normalize(normalized) !== normalized)
+        return null;
+    if (path.posix.isAbsolute(normalized) || normalized.split('/').includes('..'))
+        return null;
+    return normalized;
+}
+function safeRuntimeDependencyPath(value) {
+    const normalized = value.split('\\').join('/');
+    if (!/\.(?:cjs|js|json|mjs|node)$/.test(normalized)
+        || path.posix.normalize(normalized) !== normalized
+        || path.posix.isAbsolute(normalized)
+        || normalized.split('/').includes('..')
+        || normalized.split('/').includes('node_modules'))
+        return null;
+    return normalized;
+}
+function isPackageName(value) {
+    return /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i.test(value);
+}
+function readJsonRecord(filePath) {
+    if (!filePath)
+        return null;
+    try {
+        const value = JSON.parse(readFileSync(filePath, 'utf8'));
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function nestedString(value, keys) {
+    let cursor = value;
+    for (const key of keys) {
+        if (!cursor || typeof cursor !== 'object' || Array.isArray(cursor))
+            return null;
+        cursor = cursor[key];
+    }
+    return typeof cursor === 'string' ? cursor : null;
+}
+function stringField(value, key) {
+    const candidate = value?.[key];
+    return typeof candidate === 'string' ? candidate : null;
+}
+function isPlainDirectory(directoryPath) {
+    try {
+        return existsSync(directoryPath) && lstatSync(directoryPath).isDirectory();
+    }
+    catch {
         return false;
-    const required = ['id', 'severity', 'requirement', 'summary', 'evidence', 'requiredAction'];
-    const allowed = new Set([...required, 'route', 'planConflict']);
-    return required.every((key) => key in value)
-        && Object.keys(value).every((key) => allowed.has(key));
+    }
+}
+function isUnredirectedPathInside(root, candidate) {
+    try {
+        const logicalRoot = path.resolve(root);
+        const logicalCandidate = path.resolve(candidate);
+        if (isOutside(logicalRoot, logicalCandidate))
+            return false;
+        const expectedRealPath = path.join(realpathSync(logicalRoot), path.relative(logicalRoot, logicalCandidate));
+        return realpathSync(logicalCandidate) === expectedRealPath;
+    }
+    catch {
+        return false;
+    }
+}
+function isPlainFileInside(root, filePath) {
+    return inspectRuntimeFile(root, filePath).state === 'ready';
+}
+function inspectRuntimeFile(root, filePath) {
+    try {
+        if (!existsSync(filePath))
+            return { state: 'missing', sha256: null };
+        if (!lstatSync(filePath).isFile())
+            return { state: 'unsafe', sha256: null };
+        const realRoot = realpathSync(root);
+        const realFile = realpathSync(filePath);
+        if (isOutside(realRoot, realFile))
+            return { state: 'unsafe', sha256: null };
+        return { state: 'ready', sha256: sha256File(realFile) };
+    }
+    catch {
+        return { state: 'unsafe', sha256: null };
+    }
+}
+function assertReviewMode(value) {
+    if (value !== 'ordinary' && value !== 'security') {
+        throw new Error('review mode must be ordinary or security');
+    }
+}
+function reviewInstruction(mode) {
+    return mode === 'security'
+        ? 'Perform the requested security-focused review within the supplied sealed scope.'
+        : 'Perform an ordinary correctness and acceptance review. Do not initiate or substitute an implicit security scan; report security-relevant defects only when encountered in the supplied scope.';
+}
+function reviewPolicy(mode) {
+    return { mode, implicitSecurityScan: false, securityFocusRequested: mode === 'security' };
+}
+function isOutside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative.startsWith('..') && !path.isAbsolute(relative);
+}
+function sha256File(filePath) {
+    return createHash('sha256').update(readFileSync(filePath)).digest('hex');
+}
+function isReviewFindingRecord(value) {
+    return isExactRecord(value, [
+        'id',
+        'severity',
+        'requirement',
+        'summary',
+        'evidence',
+        'requiredAction',
+        'causeId',
+        'route',
+        'planConflict',
+    ]);
 }
 function validatePlanConflict(value, route) {
     if (route === 'fix') {
@@ -349,7 +1207,7 @@ function runStrictReviewerLaunch(repositoryRoot, options, runner) {
     const temporary = mkdtempSync(path.join(os.tmpdir(), 'codex-workflow-review-'));
     const schemaFile = path.join(temporary, 'review-result.schema.json');
     const outputFile = path.join(temporary, 'last-message.json');
-    writeFileSync(schemaFile, `${JSON.stringify(REVIEW_SCHEMA, null, 2)}\n`, { mode: 0o600 });
+    writeFileSync(schemaFile, `${JSON.stringify(STRICT_REVIEW_OUTPUT_SCHEMA, null, 2)}\n`, { mode: 0o600 });
     const probe = path.join(repositoryRoot, '.codex-reviewer-write-probe');
     if (existsSync(probe)) {
         rmSync(temporary, { recursive: true, force: true });
@@ -449,13 +1307,58 @@ function sealsEqual(left, right) {
 }
 function parseStrictReview(value) {
     const parsed = JSON.parse(value);
-    if (!['passed', 'failed', 'unverified'].includes(parsed.status ?? ''))
+    if (!isExactRecord(parsed, ['status', 'reviewer', 'summary', 'findings', 'isolationProbe'])) {
+        throw new Error('invalid review');
+    }
+    if (!['passed', 'failed', 'unverified'].includes(String(parsed.status)))
         throw new Error('invalid status');
-    if (!parsed.reviewer?.trim() || !parsed.summary?.trim() || !Array.isArray(parsed.findings))
+    if (typeof parsed.reviewer !== 'string' || !parsed.reviewer.trim()
+        || typeof parsed.summary !== 'string' || !parsed.summary.trim()
+        || !Array.isArray(parsed.findings))
         throw new Error('invalid review');
-    if (!['denied', 'written', 'not-attempted'].includes(parsed.isolationProbe ?? ''))
+    if (!['denied', 'written', 'not-attempted'].includes(String(parsed.isolationProbe)))
         throw new Error('invalid probe');
-    return parsed;
+    const findings = parsed.findings.map((candidate) => {
+        if (!isReviewFindingRecord(candidate)
+            || typeof candidate.id !== 'string' || !candidate.id.trim()
+            || !['critical', 'major', 'minor'].includes(String(candidate.severity))
+            || (candidate.requirement !== null && typeof candidate.requirement !== 'string')
+            || typeof candidate.summary !== 'string' || !candidate.summary.trim()
+            || typeof candidate.evidence !== 'string' || !candidate.evidence.trim()
+            || typeof candidate.requiredAction !== 'string' || !candidate.requiredAction.trim()) {
+            throw new Error('invalid review finding');
+        }
+        if (candidate.route !== 'fix' && candidate.route !== 'replan')
+            throw new Error('invalid review finding route');
+        const route = candidate.route;
+        const causeId = candidate.causeId;
+        if (causeId !== null
+            && (typeof causeId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$/.test(causeId))) {
+            throw new Error('invalid review finding causeId');
+        }
+        const planConflict = validatePlanConflict(candidate.planConflict, route);
+        return {
+            id: candidate.id,
+            severity: candidate.severity,
+            requirement: candidate.requirement,
+            summary: candidate.summary,
+            evidence: candidate.evidence,
+            requiredAction: candidate.requiredAction,
+            ...(causeId === null ? {} : { causeId }),
+            route,
+            planConflict,
+        };
+    });
+    if ((parsed.status === 'passed' && findings.length > 0)
+        || (parsed.status === 'failed' && findings.length === 0))
+        throw new Error('invalid finding cardinality');
+    return {
+        status: parsed.status,
+        reviewer: parsed.reviewer,
+        summary: parsed.summary,
+        findings,
+        isolationProbe: parsed.isolationProbe,
+    };
 }
 function parseStrictReviewWithHash(value) {
     const output = parseStrictReview(value);
@@ -499,5 +1402,4 @@ function failedStepLaunch(repositoryRoot, command, processStatus, summary, revie
         reviewerOutputHash: hashReviewInput(base.review),
     };
 }
-export { REVIEW_SCHEMA };
 //# sourceMappingURL=reviewer.js.map