codex-workflow-v2 2.0.0-beta.13.8 → 2.0.0-beta.14

package/src/reviewer.ts

@@ -0,0 +1,1879 @@
+import { SUPPORTED_NODE_VERSION, isSupportedNodeVersion } from './runtime.js';
+import { verifiedPendingReviewTransport } from './pending-review-update.js';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  PROTOCOL_VERSION,
+  STATE_SCHEMA_VERSION,
+  type ContextEnvelope,
+  type ReviewInput,
+  type StepEvidence,
+  type TaskState,
+} from './contracts.js';
+import { canonicalJsonStringify } from './alpha6/store-sidecars.js';
+import { changedFiles, headCommit, runGit } from './repository.js';
+import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
+
+export type ReviewMode = 'ordinary' | 'security';
+
+export interface ReviewerRuntimePreflight {
+  protocol: 'codex-workflow-reviewer-runtime-preflight-v1';
+  prepared: boolean;
+  node: { executable: string; version: string; requiredVersion: string; supported: boolean };
+  workflowPackage: {
+    name: string;
+    version: string;
+    runtimeModulePath: string;
+    runtimeModuleSha256: string;
+    installedPackageRoot: string;
+    installedPackageManifestPath: string;
+    installedPackageManifestSha256: string | null;
+    declaredVersion: string | null;
+    lockedVersion: string | null;
+    installedVersion: string | null;
+    exactRepositoryLocal: boolean;
+  };
+  buildReadiness: {
+    state: 'ready' | 'missing' | 'stale';
+    manifestPath: string;
+    manifestSha256: string | null;
+    manifestFingerprint: string | null;
+    verifiedFileCount: number;
+    expectedFileCount: number;
+    cliEntrypointPath: string;
+    cliEntrypointSha256: string | null;
+    runningCliMatchesInstalledBuild: boolean;
+    reviewerModulePath: string;
+    reviewerModuleSha256: string | null;
+    runningModuleMatchesInstalledBuild: boolean;
+    gatewayModulePath: string;
+    gatewayModuleSha256: string | null;
+    runningGatewayMatchesInstalledBuild: boolean;
+    workflowModulePath: string;
+    workflowModuleSha256: string | null;
+    runningWorkflowMatchesInstalledBuild: boolean;
+    evidenceSha256: string;
+  };
+  runtimeDependencyReadiness: {
+    state: 'ready' | 'missing' | 'stale' | 'not-run';
+    expectedPackageCount: number;
+    verifiedPackageCount: number;
+    expectedFileCount: number;
+    verifiedFileCount: number;
+    packages: Array<{
+      name: string;
+      version: string;
+      packageRoot: string;
+      packageManifestPath: string;
+      packageManifestSha256: string | null;
+      expectedFileCount: number;
+      verifiedFileCount: number;
+      state: 'ready' | 'missing' | 'stale';
+    }>;
+    evidenceSha256: string;
+  };
+  runtimeCheck: {
+    kind: 'repository-local-gateway-load';
+    state: 'passed' | 'failed' | 'not-run';
+    loader: 'node:createRequire';
+    executable: string;
+    gatewayEntrypointPath: string;
+    gatewayEntrypointSha256: string | null;
+    reviewerEntrypointPath: string;
+    reviewerEntrypointSha256: string | null;
+    workflowEntrypointPath: string;
+    workflowEntrypointSha256: string | null;
+    dependencyClosureEvidenceSha256: string;
+    observedPackageName: string | null;
+    observedPackageVersion: string | null;
+    observedProtocolVersion: number | null;
+    observedStateSchemaVersion: number | null;
+    resultSha256: string | null;
+    failureKind: 'module-load-failed' | 'contract-mismatch' | null;
+    evidenceSha256: string;
+    sealedCheckoutMutationAllowed: false;
+  };
+  repositoryDependencyReadiness: {
+    packageManifestPath: string | null;
+    packageManifestSha256: string | null;
+    packageLockPath: string | null;
+    packageLockSha256: string | null;
+    nodeModulesPath: string;
+    nodeModulesPresent: boolean;
+    state:
+      | 'ready'
+      | 'not-installed'
+      | 'not-applicable'
+      | 'version-mismatch'
+      | 'build-missing'
+      | 'build-stale'
+      | 'runtime-dependency-missing'
+      | 'runtime-dependency-stale'
+      | 'runtime-check-failed';
+    installAttempted: false;
+    installCommand: null;
+  };
+  ephemeralCache: {
+    path: string;
+    writable: boolean;
+    outsideSealedCheckout: boolean;
+    lifecycle: 'os-temporary';
+  };
+  sealedCheckoutMutationAllowed: false;
+  blockers: string[];
+}
+
+export interface ReviewerProcessResult {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+  timedOut?: boolean;
+}
+
+export type ReviewerCommandRunner = (
+  command: string,
+  args: string[],
+  options: { cwd: string; input: string; timeoutMs: number },
+) => ReviewerProcessResult;
+
+export interface StrictReviewOutput extends ReviewInput {
+  isolationProbe: 'denied' | 'written' | 'not-attempted';
+}
+
+export interface StrictReviewerLaunchResult {
+  review: ReviewInput;
+  verifiedIsolation: boolean;
+  command: string[];
+  processStatus: number | null;
+  timedOut: boolean;
+  stderr: string;
+  before: RepositorySeal;
+  after: RepositorySeal;
+}
+
+export interface StrictStepReviewerLaunchResult extends StrictReviewerLaunchResult {
+  reviewedCommit: string;
+  reviewerOutputHash: string;
+}
+
+interface ParsedStrictReviewResult {
+  output: StrictReviewOutput;
+  outputHash: string;
+}
+
+export interface RepositorySeal {
+  headCommit: string;
+  changedFiles: string[];
+  contentHash: string;
+}
+
+export interface ExternalStrictStepReviewPacket {
+  protocol: 'codex-workflow-external-strict-step-review-v1';
+  taskId: string;
+  stepId: string;
+  reviewedCommit: string;
+  packet: Record<string, unknown>;
+  packetHash: string;
+  repositorySeal: RepositorySeal;
+  repositorySealHash: string;
+  reviewMode: ReviewMode;
+  reviewerRuntime: ReviewerRuntimePreflight;
+}
+
+export interface ExternalStrictStepReviewInput {
+  protocol: 'codex-workflow-external-strict-step-review-v1';
+  packetHash: string;
+  repositorySealHash: string;
+  reviewerThreadId: string;
+  reviewMode: ReviewMode;
+  review: ReviewInput;
+}
+
+export interface ExternalStrictTaskReviewPacket {
+  protocol: 'codex-workflow-external-strict-task-review-v1';
+  taskId: string;
+  reviewedCommit: string;
+  packet: Record<string, unknown>;
+  packetHash: string;
+  repositorySeal: RepositorySeal;
+  repositorySealHash: string;
+  reviewMode: ReviewMode;
+  reviewerRuntime: ReviewerRuntimePreflight;
+}
+
+export interface ExternalStrictTaskReviewInput {
+  protocol: 'codex-workflow-external-strict-task-review-v1';
+  packetHash: string;
+  repositorySealHash: string;
+  reviewerThreadId: string;
+  reviewMode: ReviewMode;
+  review: ReviewInput;
+}
+
+export interface ReviewScopeAugmentation {
+  stepId: string;
+  paths: string[];
+  authority: 'machine-derived-check-support';
+}
+
+const FULL_GIT_SHA_PATTERN = /^[a-f0-9]{40}$/;
+export const STRICT_REVIEWER_TIMEOUT_MS = 180_000;
+
+export const STRICT_REVIEW_OUTPUT_SCHEMA = {
+  type: 'object',
+  additionalProperties: false,
+  required: ['status', 'reviewer', 'summary', 'findings', 'isolationProbe'],
+  properties: {
+    status: { enum: ['passed', 'failed', 'unverified'] },
+    reviewer: { type: 'string', minLength: 1 },
+    summary: { type: 'string', minLength: 1 },
+    isolationProbe: { enum: ['denied', 'written', 'not-attempted'] },
+    findings: {
+      type: 'array',
+      items: {
+        type: 'object',
+        additionalProperties: false,
+        required: [
+          'id',
+          'severity',
+          'requirement',
+          'summary',
+          'evidence',
+          'requiredAction',
+          'causeId',
+          'route',
+          'planConflict',
+        ],
+        properties: {
+          id: { type: 'string', minLength: 1 },
+          severity: { enum: ['critical', 'major', 'minor'] },
+          requirement: { type: ['string', 'null'] },
+          summary: { type: 'string', minLength: 1 },
+          evidence: { type: 'string', minLength: 1 },
+          requiredAction: { type: 'string', minLength: 1 },
+          causeId: {
+            anyOf: [
+              { type: 'string', pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$' },
+              { type: 'null' },
+            ],
+          },
+          route: { enum: ['fix', 'replan'] },
+          planConflict: {
+            anyOf: [
+              { type: 'null' },
+              {
+                type: 'object',
+                additionalProperties: false,
+                required: ['planClause', 'whyFixCannotFit', 'minimalPlanChange'],
+                properties: {
+                  planClause: { type: 'string', minLength: 1 },
+                  whyFixCannotFit: { type: 'string', minLength: 1 },
+                  minimalPlanChange: { type: 'string', minLength: 1 },
+                },
+              },
+            ],
+          },
+        },
+      },
+    },
+  },
+} as const;
+
+/** @deprecated Use STRICT_REVIEW_OUTPUT_SCHEMA. Retained for direct-module compatibility. */
+export const REVIEW_SCHEMA = STRICT_REVIEW_OUTPUT_SCHEMA;
+
+export function launchStrictReviewer(
+  repositoryRoot: string,
+  task: TaskState,
+  taskRoot: string,
+  envelope: ContextEnvelope,
+  runner: ReviewerCommandRunner = spawnReviewer,
+  scopeAugmentations: readonly ReviewScopeAugmentation[] = [],
+): StrictReviewerLaunchResult {
+  const launch = runStrictReviewerLaunch(
+    repositoryRoot,
+    {
+      protocol: 'codex-workflow-strict-review-v1',
+      task,
+      taskRoot,
+      envelope,
+      commandSummary: 'Strict reviewer did not return valid output proving the denied write probe.',
+      packet: {
+        protocol: 'codex-workflow-strict-review-v1',
+        instruction: [
+          'Act only as the independent reviewer described by the context envelope.',
+          'Before reviewing, attempt to create .codex-reviewer-write-probe in the repository.',
+          'The attempt must be denied by the sandbox. Report isolationProbe="denied" only when it was denied.',
+          'For each finding use route="fix" by default. Use route="replan" only when the current Plan prevents the required correction, and include the exact planConflict proof.',
+          'Give each finding a stable causeId for the underlying defect; never encode the review attempt number.',
+          'Do not modify any repository file. Return only the requested JSON result.',
+        ],
+        envelope,
+        task: {
+          id: task.id,
+          baseCommit: task.baseCommit,
+          headCommit: headCommit(repositoryRoot),
+          brief: readFileSync(path.join(taskRoot, 'brief.md'), 'utf8'),
+          plan: readFileSync(path.join(taskRoot, 'plan.md'), 'utf8'),
+          evidence: readFileSync(path.join(taskRoot, 'evidence.json'), 'utf8'),
+          diff: task.baseCommit ? runGit(repositoryRoot, ['diff', '--no-ext-diff', `${task.baseCommit}..HEAD`]) : '',
+          scopeAugmentations,
+        },
+      },
+    },
+    runner,
+  );
+  return {
+    review: launch.review,
+    verifiedIsolation: launch.verifiedIsolation,
+    command: launch.command,
+    processStatus: launch.processStatus,
+    timedOut: launch.timedOut,
+    stderr: launch.stderr,
+    before: launch.before,
+    after: launch.after,
+  };
+}
+
+export function launchStrictStepReviewer(
+  repositoryRoot: string,
+  task: TaskState,
+  taskRoot: string,
+  envelope: ContextEnvelope,
+  stepId: string,
+  currentEvidence: StepEvidence,
+  runner: ReviewerCommandRunner = spawnReviewer,
+  scopeAugmentations: readonly ReviewScopeAugmentation[] = [],
+): StrictStepReviewerLaunchResult {
+  const step = task.steps.find((candidate) => candidate.id === stepId);
+  if (!step) {
+    return failedStepLaunch(
+      repositoryRoot,
+      [],
+      null,
+      `Step ${stepId} was not found on task ${task.id}.`,
+      currentEvidence.commitSha,
+    );
+  }
+  if (!step.evidence) {
+    return failedStepLaunch(
+      repositoryRoot,
+      [],
+      null,
+      `Step ${stepId} has no canonical evidence to review on task ${task.id}.`,
+      currentEvidence.commitSha,
+    );
+  }
+  if (canonicalJsonStringify(step.evidence) !== canonicalJsonStringify(currentEvidence)) {
+    return failedStepLaunch(
+      repositoryRoot,
+      [],
+      null,
+      `Strict step reviewer requires the exact canonical Step evidence for ${stepId} on task ${task.id}.`,
+      currentEvidence.commitSha,
+    );
+  }
+  const reviewedCommit = currentEvidence.commitSha;
+  if (!FULL_GIT_SHA_PATTERN.test(reviewedCommit)) {
+    return failedStepLaunch(
+      repositoryRoot,
+      [],
+      null,
+      `Strict step reviewer requires a full lowercase Git SHA for ${stepId} on task ${task.id}.`,
+      reviewedCommit,
+    );
+  }
+  const currentHead = headCommit(repositoryRoot);
+  if (reviewedCommit !== currentHead) {
+    return failedStepLaunch(
+      repositoryRoot,
+      [],
+      null,
+      `Strict step reviewer requires the canonical Step evidence commit to match repository HEAD for ${stepId} on task ${task.id}.`,
+      reviewedCommit,
+    );
+  }
+  const packet = strictStepReviewPayload(
+    repositoryRoot,
+    task,
+    taskRoot,
+    envelope,
+    step,
+    reviewedCommit,
+    currentEvidence,
+    scopeAugmentations,
+  );
+  const launch = runStrictReviewerLaunch(
+    repositoryRoot,
+    {
+      protocol: 'codex-workflow-strict-step-review-v1',
+      task,
+      taskRoot,
+      envelope,
+      commandSummary: 'Strict step reviewer did not return valid output proving the denied write probe.',
+      packet,
+    },
+    runner,
+  );
+  return {
+    review: launch.review,
+    verifiedIsolation: launch.verifiedIsolation,
+    command: launch.command,
+    processStatus: launch.processStatus,
+    timedOut: launch.timedOut,
+    stderr: launch.stderr,
+    before: launch.before,
+    after: launch.after,
+    reviewedCommit,
+    reviewerOutputHash: launch.reviewerOutputHash,
+  };
+}
+
+export function prepareExternalStrictStepReviewPacket(
+  repositoryRoot: string,
+  task: TaskState,
+  taskRoot: string,
+  envelope: ContextEnvelope,
+  stepId: string,
+  currentEvidence: StepEvidence,
+  scopeAugmentations: readonly ReviewScopeAugmentation[] = [],
+  reviewMode: ReviewMode = 'ordinary',
+): ExternalStrictStepReviewPacket {
+  assertReviewMode(reviewMode);
+  const step = task.steps.find((candidate) => candidate.id === stepId);
+  if (!step || !step.evidence || canonicalJsonStringify(step.evidence) !== canonicalJsonStringify(currentEvidence)) {
+    throw new Error(`Strict Step Review packet requires exact canonical evidence for ${stepId}.`);
+  }
+  const reviewedCommit = currentEvidence.commitSha;
+  const pendingReviewUpdate = verifiedPendingReviewTransport(repositoryRoot, task, stepId, taskRoot);
+  if (!FULL_GIT_SHA_PATTERN.test(reviewedCommit) || (reviewedCommit !== headCommit(repositoryRoot) && !pendingReviewUpdate)) {
+    throw new Error(`Strict Step Review packet requires ${stepId} evidence to match repository HEAD.`);
+  }
+  const reviewerRuntime = prepareReviewerRuntimePreflight(
+    repositoryRoot,
+    `${task.id}:${stepId}:${reviewedCommit}:${reviewMode}`,
+  );
+  assertReviewerRuntimePrepared(reviewerRuntime);
+  const basePacket = strictStepReviewPayload(
+    repositoryRoot,
+    task,
+    taskRoot,
+    envelope,
+    step,
+    reviewedCommit,
+    currentEvidence,
+    scopeAugmentations,
+  );
+  const packet = {
+    ...basePacket,
+    ...(pendingReviewUpdate ? { pendingReviewUpdate } : {}),
+    instruction: [...(basePacket.instruction as string[]), reviewInstruction(reviewMode)],
+    reviewMode,
+    reviewPolicy: reviewPolicy(reviewMode),
+    reviewerRuntime,
+  };
+  const repositorySeal = sealRepository(repositoryRoot);
+  return {
+    protocol: 'codex-workflow-external-strict-step-review-v1',
+    taskId: task.id,
+    stepId,
+    reviewedCommit,
+    packet,
+    packetHash: canonicalHash(packet),
+    repositorySeal,
+    repositorySealHash: canonicalHash(repositorySeal),
+    reviewMode,
+    reviewerRuntime,
+  };
+}
+
+export function prepareExternalStrictTaskReviewPacket(
+  repositoryRoot: string,
+  task: TaskState,
+  taskRoot: string,
+  envelope: ContextEnvelope,
+  scopeAugmentations: readonly ReviewScopeAugmentation[] = [],
+  reviewMode: ReviewMode = 'ordinary',
+): ExternalStrictTaskReviewPacket {
+  assertReviewMode(reviewMode);
+  const reviewedCommit = headCommit(repositoryRoot);
+  if (!FULL_GIT_SHA_PATTERN.test(reviewedCommit)) {
+    throw new Error(`Strict Task Review packet requires a full lowercase Git SHA for ${task.id}.`);
+  }
+  const reviewerRuntime = prepareReviewerRuntimePreflight(
+    repositoryRoot,
+    `${task.id}:task:${reviewedCommit}:${reviewMode}`,
+  );
+  assertReviewerRuntimePrepared(reviewerRuntime);
+  const packet = {
+    protocol: 'codex-workflow-strict-review-v1',
+    instruction: [
+      'Act only as the independent reviewer described by the context envelope.',
+      'Review the supplied Task result and bind every finding to reviewedCommit.',
+      'For each finding use route="fix" by default. Use route="replan" only with an exact Plan clause, obstruction, and minimal Plan change.',
+      'Do not modify any repository or Workflow state. Return one ReviewInput JSON object.',
+      reviewInstruction(reviewMode),
+    ],
+    reviewMode,
+    reviewPolicy: reviewPolicy(reviewMode),
+    reviewerRuntime,
+    envelope,
+    task: { ...strictTaskReviewSubject(repositoryRoot, task, taskRoot), scopeAugmentations },
+  };
+  const repositorySeal = sealRepository(repositoryRoot);
+  return {
+    protocol: 'codex-workflow-external-strict-task-review-v1',
+    taskId: task.id,
+    reviewedCommit,
+    packet,
+    packetHash: canonicalHash(packet),
+    repositorySeal,
+    repositorySealHash: canonicalHash(repositorySeal),
+    reviewMode,
+    reviewerRuntime,
+  };
+}
+
+export function validateExternalStrictStepReviewInput(
+  value: unknown,
+  expected: ExternalStrictStepReviewPacket,
+): ReviewInput {
+  return validateExternalReviewEnvelope(value, expected);
+}
+
+export function validateExternalStrictTaskReviewInput(
+  value: unknown,
+  expected: ExternalStrictTaskReviewPacket,
+): ReviewInput {
+  return validateExternalReviewEnvelope(value, expected);
+}
+
+export function strictReviewInputHash(review: ReviewInput): string {
+  return hashReviewInput(review);
+}
+
+function strictStepReviewPayload(
+  repositoryRoot: string,
+  task: TaskState,
+  taskRoot: string,
+  envelope: ContextEnvelope,
+  step: TaskState['steps'][number],
+  reviewedCommit: string,
+  currentEvidence: StepEvidence,
+  scopeAugmentations: readonly ReviewScopeAugmentation[],
+): Record<string, unknown> {
+  return {
+    protocol: 'codex-workflow-strict-step-review-v1',
+    instruction: [
+      'Act only as the independent reviewer described by the context envelope.',
+      'Review only the supplied Task Step and bind findings to reviewedCommit.',
+      'For each finding set route="fix" unless the required correction cannot fit the current Plan. Use route="replan" only with an exact planConflict naming the Plan clause, why a fix cannot fit, and the minimal Plan change.',
+      'When a finding has a stable semantic root cause, provide a causeId that remains unchanged across review attempts; never derive it from attempt number, prose wording, timestamps, or temporary paths.',
+      'Do not modify any repository or Workflow state. Return one ReviewInput JSON object.',
+    ],
+    envelope,
+    task: {
+      id: task.id,
+      baseCommit: task.baseCommit,
+      headCommit: headCommit(repositoryRoot),
+      brief: readFileSync(path.join(taskRoot, 'brief.md'), 'utf8'),
+      plan: readFileSync(path.join(taskRoot, 'plan.md'), 'utf8'),
+      diff: task.baseCommit ? runGit(repositoryRoot, ['diff', '--no-ext-diff', `${task.baseCommit}..HEAD`]) : '',
+    },
+    step: {
+      id: step.id,
+      title: step.title,
+      objective: step.objective,
+      requirements: step.requirements,
+      dependencies: step.dependencies,
+      expectedOutputs: step.expectedOutputs,
+      allowedWrites: step.allowedWrites,
+      forbiddenScope: step.forbiddenScope,
+      checks: step.checks,
+      status: step.status,
+      reviewedCommit,
+      evidence: currentEvidence,
+      scopeAugmentations,
+    },
+  };
+}
+
+function strictTaskReviewSubject(
+  repositoryRoot: string,
+  task: TaskState,
+  taskRoot: string,
+): Record<string, unknown> {
+  return {
+    id: task.id,
+    baseCommit: task.baseCommit,
+    headCommit: headCommit(repositoryRoot),
+    brief: readFileSync(path.join(taskRoot, 'brief.md'), 'utf8'),
+    plan: readFileSync(path.join(taskRoot, 'plan.md'), 'utf8'),
+    evidence: readFileSync(path.join(taskRoot, 'evidence.json'), 'utf8'),
+    diff: task.baseCommit ? runGit(repositoryRoot, ['diff', '--no-ext-diff', `${task.baseCommit}..HEAD`]) : '',
+  };
+}
+
+function validateExternalReviewEnvelope(
+  value: unknown,
+  expected: ExternalStrictStepReviewPacket | ExternalStrictTaskReviewPacket,
+): ReviewInput {
+  if (!isExactRecord(value, ['protocol', 'packetHash', 'repositorySealHash', 'reviewerThreadId', 'reviewMode', 'review'])) {
+    throw new Error('invalid external review envelope');
+  }
+  if (value.protocol !== expected.protocol) throw new Error('invalid external review protocol');
+  if (value.packetHash !== expected.packetHash) throw new Error('external review packet hash mismatch');
+  if (value.repositorySealHash !== expected.repositorySealHash) throw new Error('external review repository seal mismatch');
+  if (value.reviewMode !== expected.reviewMode) throw new Error('external review mode mismatch');
+  if (typeof value.reviewerThreadId !== 'string' || !value.reviewerThreadId.trim()) {
+    throw new Error('external reviewer thread id is required');
+  }
+  if (!isExactRecord(value.review, ['status', 'reviewer', 'summary', 'findings'])) {
+    throw new Error('invalid external strict review');
+  }
+  const review = value.review;
+  if (!['passed', 'failed'].includes(String(review.status))
+    || typeof review.reviewer !== 'string' || !review.reviewer.trim()
+    || typeof review.summary !== 'string' || !review.summary.trim()
+    || !Array.isArray(review.findings)) {
+    throw new Error('invalid external strict review');
+  }
+  const findings = review.findings.map((candidate) => {
+    if (!isReviewFindingRecord(candidate)
+      || typeof candidate.id !== 'string' || !candidate.id.trim()
+      || !['critical', 'major', 'minor'].includes(String(candidate.severity))
+      || (candidate.requirement !== null && typeof candidate.requirement !== 'string')
+      || typeof candidate.summary !== 'string' || !candidate.summary.trim()
+      || typeof candidate.evidence !== 'string' || !candidate.evidence.trim()
+      || typeof candidate.requiredAction !== 'string' || !candidate.requiredAction.trim()) {
+      throw new Error('invalid external strict review finding');
+    }
+    const route = (candidate.route === undefined ? 'fix' : candidate.route) as 'fix' | 'replan';
+    if (route !== 'fix' && route !== 'replan') throw new Error('invalid external strict review finding route');
+    const causeId = candidate.causeId;
+    if (causeId !== undefined
+      && (typeof causeId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$/.test(causeId))) {
+      throw new Error('invalid external strict review finding causeId');
+    }
+    const planConflict = validatePlanConflict(candidate.planConflict, route);
+    return {
+      id: candidate.id,
+      severity: candidate.severity as 'critical' | 'major' | 'minor',
+      requirement: candidate.requirement as string | null,
+      summary: candidate.summary,
+      evidence: candidate.evidence,
+      requiredAction: candidate.requiredAction,
+      ...(causeId === undefined ? {} : { causeId }),
+      route,
+      planConflict,
+    };
+  });
+  if ((review.status === 'passed' && findings.length > 0) || (review.status === 'failed' && findings.length === 0)) {
+    throw new Error('invalid external strict review finding cardinality');
+  }
+  return {
+    status: review.status as 'passed' | 'failed',
+    reviewer: review.reviewer,
+    summary: review.summary,
+    findings,
+  };
+}
+
+export function prepareReviewerRuntimePreflight(
+  repositoryRoot: string,
+  binding: string,
+): ReviewerRuntimePreflight {
+  const root = path.resolve(repositoryRoot);
+  const manifest = path.join(root, 'package.json');
+  const lockfile = path.join(root, 'package-lock.json');
+  const nodeModulesPath = path.join(root, 'node_modules');
+  const runtimeModulePath = fileURLToPath(import.meta.url);
+  const installedPackageRoot = path.join(nodeModulesPath, PACKAGE_NAME);
+  const installedPackageManifestPath = path.join(installedPackageRoot, 'package.json');
+  const runtimeBuildManifestPath = path.join(installedPackageRoot, 'dist', 'reviewer-runtime-build.json');
+  const installedReviewerModulePath = path.join(installedPackageRoot, 'dist', 'src', 'reviewer.js');
+  const installedCliPath = path.join(installedPackageRoot, 'dist', 'src', 'cli.js');
+  const installedGatewayModulePath = path.join(installedPackageRoot, 'dist', 'src', 'gateway-handshake.js');
+  const installedWorkflowModulePath = path.join(installedPackageRoot, 'dist', 'src', 'workflow.js');
+  const cachePath = path.join(
+    os.tmpdir(),
+    'codex-workflow-review-runtime',
+    canonicalHash({ repositoryRoot: root, binding }),
+  );
+  const nodeSupported = isSupportedNodeVersion(process.versions.node);
+  let cacheWritable = false;
+  if (nodeSupported) {
+    mkdirSync(cachePath, { recursive: true, mode: 0o700 });
+    chmodSync(cachePath, 0o700);
+    const cacheProbe = path.join(cachePath, '.write-probe');
+    try {
+      writeFileSync(cacheProbe, 'ok\n', { mode: 0o600 });
+      rmSync(cacheProbe, { force: true });
+      cacheWritable = true;
+    } catch {
+      rmSync(cacheProbe, { force: true });
+    }
+  }
+  const outsideSealedCheckout = isOutside(root, cachePath);
+  const packageManifestPath = existsSync(manifest) ? manifest : null;
+  const packageLockPath = existsSync(lockfile) ? lockfile : null;
+  const nodeModulesPresent = existsSync(nodeModulesPath) && statSync(nodeModulesPath).isDirectory();
+  const repositoryManifest = readJsonRecord(packageManifestPath);
+  const repositoryLock = readJsonRecord(packageLockPath);
+  const installedPackageDirectory = isPlainDirectory(installedPackageRoot);
+  const installedManifest = readJsonRecord(
+    installedPackageDirectory && isPlainFileInside(installedPackageRoot, installedPackageManifestPath)
+      ? installedPackageManifestPath
+      : null,
+  );
+  const declaredVersion = nestedString(repositoryManifest, ['devDependencies', PACKAGE_NAME]);
+  const lockedVersion = nestedString(repositoryLock, ['packages', `node_modules/${PACKAGE_NAME}`, 'version']);
+  const lockDeclaredVersion = nestedString(repositoryLock, ['packages', '', 'devDependencies', PACKAGE_NAME]);
+  const installedVersion = stringField(installedManifest, 'version');
+  const installedName = stringField(installedManifest, 'name');
+  const exactRepositoryLocal = declaredVersion === PACKAGE_VERSION
+    && lockedVersion === PACKAGE_VERSION
+    && lockDeclaredVersion === PACKAGE_VERSION
+    && installedName === PACKAGE_NAME
+    && installedVersion === PACKAGE_VERSION;
+  const runtimeModuleSha256 = sha256File(runtimeModulePath);
+  const runtimeCliModulePath = fileURLToPath(new URL('./cli.js', import.meta.url));
+  const runtimeGatewayModulePath = fileURLToPath(new URL('./gateway-handshake.js', import.meta.url));
+  const runtimeWorkflowModulePath = fileURLToPath(new URL('./workflow.js', import.meta.url));
+  const buildReadiness = inspectReviewerBuild(
+    installedPackageRoot,
+    runtimeBuildManifestPath,
+    installedPackageManifestPath,
+    installedCliPath,
+    sha256File(runtimeCliModulePath),
+    installedReviewerModulePath,
+    runtimeModuleSha256,
+    installedGatewayModulePath,
+    sha256File(runtimeGatewayModulePath),
+    installedWorkflowModulePath,
+    sha256File(runtimeWorkflowModulePath),
+  );
+  const runtimeBuildManifest = buildReadiness.state === 'ready'
+    ? parseRuntimeBuildManifest(readJsonRecord(runtimeBuildManifestPath))
+    : null;
+  const runtimeDependencyReadiness = inspectRuntimeDependencyClosure(
+    nodeModulesPath,
+    installedPackageRoot,
+    runtimeBuildManifest,
+    exactRepositoryLocal && buildReadiness.state === 'ready',
+  );
+  const runtimeCheck = inspectReviewerRuntimeCheck(
+    installedPackageManifestPath,
+    installedGatewayModulePath,
+    installedReviewerModulePath,
+    installedWorkflowModulePath,
+    runtimeDependencyReadiness.evidenceSha256,
+    nodeSupported && exactRepositoryLocal
+      && buildReadiness.state === 'ready'
+      && runtimeDependencyReadiness.state === 'ready',
+  );
+  const dependencyState = packageManifestPath === null
+    ? 'not-applicable'
+    : !nodeModulesPresent || installedManifest === null
+      ? 'not-installed'
+      : !exactRepositoryLocal
+        ? 'version-mismatch'
+        : buildReadiness.state === 'missing'
+          ? 'build-missing'
+          : buildReadiness.state === 'stale'
+            ? 'build-stale'
+            : runtimeDependencyReadiness.state === 'missing'
+              ? 'runtime-dependency-missing'
+              : runtimeDependencyReadiness.state === 'stale'
+                ? 'runtime-dependency-stale'
+                : runtimeCheck.state !== 'passed'
+                  ? 'runtime-check-failed'
+                  : 'ready';
+  const blockers = [
+    ...(nodeSupported ? [] : [`Node ${process.version} is unsupported; required exact version ${SUPPORTED_NODE_VERSION}.`]),
+    ...(packageManifestPath ? [] : ['Repository package.json is required to prove the exact Workflow dependency.']),
+    ...(declaredVersion === PACKAGE_VERSION
+      ? []
+      : [`Repository devDependencies must declare exact ${PACKAGE_NAME}@${PACKAGE_VERSION}; found ${declaredVersion ?? 'missing'}.`]),
+    ...(packageLockPath ? [] : ['Repository package-lock.json is required to prove the locked Workflow dependency.']),
+    ...(lockedVersion === PACKAGE_VERSION && lockDeclaredVersion === PACKAGE_VERSION
+      ? []
+      : [`Repository lockfile must bind both root and installed ${PACKAGE_NAME} entries to ${PACKAGE_VERSION}; found root ${lockDeclaredVersion ?? 'missing'}, package ${lockedVersion ?? 'missing'}.`]),
+    ...(installedManifest ? [] : [`Install exact ${PACKAGE_NAME}@${PACKAGE_VERSION} in repository-local node_modules before dispatching review.`]),
+    ...(installedManifest === null || (installedName === PACKAGE_NAME && installedVersion === PACKAGE_VERSION)
+      ? []
+      : [`Repository-local installed Workflow package must be ${PACKAGE_NAME}@${PACKAGE_VERSION}; found ${installedName ?? 'missing'}@${installedVersion ?? 'missing'}.`]),
+    ...(installedManifest === null || installedName !== PACKAGE_NAME || installedVersion !== PACKAGE_VERSION
+      ? []
+      : buildReadiness.state === 'ready'
+        ? []
+        : buildReadiness.state === 'missing'
+          ? [`Build evidence is missing or incomplete at ${runtimeBuildManifestPath}; reinstall the exact published package or build it before sealing review.`]
+          : [`Build evidence at ${runtimeBuildManifestPath} does not match installed runtime bytes; reinstall the exact package before sealing review.`]),
+    ...(exactRepositoryLocal && buildReadiness.state === 'ready' && runtimeDependencyReadiness.state !== 'ready'
+      ? runtimeDependencyReadiness.state === 'missing'
+        ? ['The attested repository-local runtime dependency closure is incomplete; reinstall the exact package dependencies before sealing review.']
+        : ['The attested repository-local runtime dependency closure has version, path, symlink, or content drift; reinstall the exact package dependencies before sealing review.']
+      : []),
+    ...(nodeSupported && exactRepositoryLocal
+      && buildReadiness.state === 'ready'
+      && runtimeDependencyReadiness.state === 'ready'
+      && runtimeCheck.state !== 'passed'
+      ? runtimeCheck.failureKind === 'contract-mismatch'
+        ? [`Repository-local gateway handshake did not report exact package/protocol/schema authority from ${installedGatewayModulePath}; reinstall the exact package before sealing review.`]
+        : [`Repository-local reviewer runtime could not load its exact gateway/reviewer/workflow graph from ${installedPackageRoot}; verify package dependencies and reinstall the exact package before sealing review.`]
+      : []),
+    ...(nodeSupported && !cacheWritable ? ['Ephemeral reviewer cache is not writable.'] : []),
+    ...(outsideSealedCheckout ? [] : ['Ephemeral reviewer cache is inside the sealed checkout.']),
+  ];
+  return {
+    protocol: 'codex-workflow-reviewer-runtime-preflight-v1',
+    prepared: blockers.length === 0,
+    node: {
+      executable: process.execPath,
+      version: process.version,
+      requiredVersion: SUPPORTED_NODE_VERSION,
+      supported: nodeSupported,
+    },
+    workflowPackage: {
+      name: PACKAGE_NAME,
+      version: PACKAGE_VERSION,
+      runtimeModulePath,
+      runtimeModuleSha256,
+      installedPackageRoot,
+      installedPackageManifestPath,
+      installedPackageManifestSha256: installedManifest ? sha256File(installedPackageManifestPath) : null,
+      declaredVersion,
+      lockedVersion,
+      installedVersion,
+      exactRepositoryLocal,
+    },
+    buildReadiness,
+    runtimeDependencyReadiness,
+    runtimeCheck,
+    repositoryDependencyReadiness: {
+      packageManifestPath,
+      packageManifestSha256: packageManifestPath ? sha256File(packageManifestPath) : null,
+      packageLockPath,
+      packageLockSha256: packageLockPath ? sha256File(packageLockPath) : null,
+      nodeModulesPath,
+      nodeModulesPresent,
+      state: dependencyState,
+      installAttempted: false,
+      installCommand: null,
+    },
+    ephemeralCache: {
+      path: cachePath,
+      writable: cacheWritable,
+      outsideSealedCheckout,
+      lifecycle: 'os-temporary',
+    },
+    sealedCheckoutMutationAllowed: false,
+    blockers,
+  };
+}
+
+function inspectReviewerRuntimeCheck(
+  installedPackageManifestPath: string,
+  gatewayEntrypointPath: string,
+  reviewerEntrypointPath: string,
+  workflowEntrypointPath: string,
+  dependencyClosureEvidenceSha256: string,
+  eligible: boolean,
+): ReviewerRuntimePreflight['runtimeCheck'] {
+  const gatewayEntrypointSha256 = eligible ? sha256File(gatewayEntrypointPath) : null;
+  const reviewerEntrypointSha256 = eligible ? sha256File(reviewerEntrypointPath) : null;
+  const workflowEntrypointSha256 = eligible ? sha256File(workflowEntrypointPath) : null;
+  if (!eligible) {
+    return runtimeCheckEvidence({
+      state: 'not-run',
+      gatewayEntrypointPath,
+      gatewayEntrypointSha256,
+      reviewerEntrypointPath,
+      reviewerEntrypointSha256,
+      workflowEntrypointPath,
+      workflowEntrypointSha256,
+      dependencyClosureEvidenceSha256,
+      observedPackageName: null,
+      observedPackageVersion: null,
+      observedProtocolVersion: null,
+      observedStateSchemaVersion: null,
+      resultSha256: null,
+      failureKind: null,
+    });
+  }
+  let observedPackageName: string | null = null;
+  let observedPackageVersion: string | null = null;
+  let observedProtocolVersion: number | null = null;
+  let observedStateSchemaVersion: number | null = null;
+  let resultSha256: string | null = null;
+  try {
+    const requireInstalled = createRequire(installedPackageManifestPath);
+    const gatewayModule = runtimeModuleRecord(requireInstalled(gatewayEntrypointPath));
+    const reviewerModule = runtimeModuleRecord(requireInstalled(reviewerEntrypointPath));
+    const workflowModule = runtimeModuleRecord(requireInstalled(workflowEntrypointPath));
+    const handshake = gatewayModule && typeof gatewayModule.gatewayHandshake === 'function'
+      ? runtimeModuleRecord(gatewayModule.gatewayHandshake())
+      : null;
+    if (handshake) {
+      observedPackageName = typeof handshake.packageName === 'string' ? handshake.packageName : null;
+      observedPackageVersion = typeof handshake.packageVersion === 'string' ? handshake.packageVersion : null;
+      observedProtocolVersion = typeof handshake.protocolVersion === 'number' ? handshake.protocolVersion : null;
+      observedStateSchemaVersion = typeof handshake.stateSchemaVersion === 'number' ? handshake.stateSchemaVersion : null;
+      resultSha256 = canonicalHash(handshake);
+    }
+    const passed = handshake !== null
+      && reviewerModule !== null
+      && typeof reviewerModule.prepareReviewerRuntimePreflight === 'function'
+      && workflowModule !== null
+      && typeof workflowModule.WorkflowService === 'function'
+      && observedPackageName === PACKAGE_NAME
+      && observedPackageVersion === PACKAGE_VERSION
+      && observedProtocolVersion === PROTOCOL_VERSION
+      && observedStateSchemaVersion === STATE_SCHEMA_VERSION;
+    return runtimeCheckEvidence({
+      state: passed ? 'passed' : 'failed',
+      gatewayEntrypointPath,
+      gatewayEntrypointSha256,
+      reviewerEntrypointPath,
+      reviewerEntrypointSha256,
+      workflowEntrypointPath,
+      workflowEntrypointSha256,
+      dependencyClosureEvidenceSha256,
+      observedPackageName,
+      observedPackageVersion,
+      observedProtocolVersion,
+      observedStateSchemaVersion,
+      resultSha256,
+      failureKind: passed ? null : 'contract-mismatch',
+    });
+  } catch {
+    return runtimeCheckEvidence({
+      state: 'failed',
+      gatewayEntrypointPath,
+      gatewayEntrypointSha256,
+      reviewerEntrypointPath,
+      reviewerEntrypointSha256,
+      workflowEntrypointPath,
+      workflowEntrypointSha256,
+      dependencyClosureEvidenceSha256,
+      observedPackageName,
+      observedPackageVersion,
+      observedProtocolVersion,
+      observedStateSchemaVersion,
+      resultSha256,
+      failureKind: 'module-load-failed',
+    });
+  }
+}
+
+function assertReviewerRuntimePrepared(preflight: ReviewerRuntimePreflight): void {
+  if (!preflight.prepared) {
+    throw new Error(`External sealed review packet requires a prepared reviewer runtime: ${preflight.blockers.join(' ')}`);
+  }
+}
+
+function runtimeCheckEvidence(
+  value: Omit<ReviewerRuntimePreflight['runtimeCheck'],
+    'kind' | 'loader' | 'executable' | 'evidenceSha256' | 'sealedCheckoutMutationAllowed'>,
+): ReviewerRuntimePreflight['runtimeCheck'] {
+  const evidence = {
+    kind: 'repository-local-gateway-load' as const,
+    loader: 'node:createRequire' as const,
+    executable: process.execPath,
+    ...value,
+    sealedCheckoutMutationAllowed: false as const,
+  };
+  return { ...evidence, evidenceSha256: canonicalHash(evidence) };
+}
+
+function runtimeModuleRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
+
+interface RuntimeBuildManifest {
+  protocol: 'codex-workflow-runtime-build-manifest-v1';
+  packageName: string;
+  packageVersion: string;
+  packageManifestSha256: string;
+  requiredEntrypoints: string[];
+  files: Array<{ path: string; sha256: string }>;
+  runtimeDependencies: Array<{
+    name: string;
+    version: string;
+    packageManifestSha256: string;
+    files: Array<{ path: string; sha256: string }>;
+  }>;
+  fingerprint: string;
+}
+
+function inspectRuntimeDependencyClosure(
+  nodeModulesPath: string,
+  installedPackageRoot: string,
+  manifest: RuntimeBuildManifest | null,
+  eligible: boolean,
+): ReviewerRuntimePreflight['runtimeDependencyReadiness'] {
+  const expected = manifest?.runtimeDependencies ?? [];
+  const expectedFileCount = expected.reduce((total, dependency) => total + dependency.files.length, 0);
+  if (!eligible || !manifest) {
+    const evidence = {
+      state: 'not-run' as const,
+      expectedPackageCount: expected.length,
+      verifiedPackageCount: 0,
+      expectedFileCount,
+      verifiedFileCount: 0,
+      packages: [],
+    };
+    return { ...evidence, evidenceSha256: canonicalHash(evidence) };
+  }
+  const nodeModulesReady = (() => {
+    try {
+      return lstatSync(nodeModulesPath).isDirectory()
+        && isUnredirectedPathInside(path.dirname(nodeModulesPath), nodeModulesPath);
+    } catch {
+      return false;
+    }
+  })();
+  const repositoryRoot = path.dirname(nodeModulesPath);
+  const expectedByName = new Map(expected.map((dependency) => [dependency.name, dependency]));
+  const installedWorkflowManifest = readJsonRecord(path.join(installedPackageRoot, 'package.json'));
+  const rootDependencyNames = runtimeDependencyNames(installedWorkflowManifest);
+  let graphDrift = rootDependencyNames === null;
+  const queue: Array<{ name: string; parentPackageRoot: string }> = (rootDependencyNames ?? [])
+    .map((name) => ({ name, parentPackageRoot: installedPackageRoot }));
+  const queuedEdges = new Set(queue.map(({ name, parentPackageRoot }) => `${parentPackageRoot}\0${name}`));
+  const inspectedInstances = new Map<string, ReviewerRuntimePreflight['runtimeDependencyReadiness']['packages'][number]>();
+  while (queue.length > 0) {
+    const edge = queue.shift()!;
+    const expectedDependency = expectedByName.get(edge.name);
+    if (!expectedDependency) {
+      graphDrift = true;
+      continue;
+    }
+    const resolution = resolveRuntimeDependencyPackageRoot(repositoryRoot, edge.parentPackageRoot, edge.name);
+    const packageRoot = resolution ?? runtimeDependencySearchPaths(
+      repositoryRoot,
+      edge.parentPackageRoot,
+      edge.name,
+    )[0] ?? path.join(nodeModulesPath, ...edge.name.split('/'));
+    const instanceKey = `${edge.name}\0${packageRoot}`;
+    let inspected = inspectedInstances.get(instanceKey);
+    if (!inspected) {
+      inspected = inspectRuntimeDependencyPackage(
+        repositoryRoot,
+        packageRoot,
+        expectedDependency,
+        nodeModulesReady,
+      );
+      inspectedInstances.set(instanceKey, inspected);
+    }
+    if (inspected.state !== 'ready') continue;
+    const installedDependencyManifest = readJsonRecord(inspected.packageManifestPath);
+    const childNames = runtimeDependencyNames(installedDependencyManifest);
+    if (childNames === null) {
+      graphDrift = true;
+      continue;
+    }
+    for (const childName of childNames) {
+      if (!expectedByName.has(childName)) {
+        graphDrift = true;
+        continue;
+      }
+      const edgeKey = `${packageRoot}\0${childName}`;
+      if (queuedEdges.has(edgeKey)) continue;
+      queuedEdges.add(edgeKey);
+      queue.push({ name: childName, parentPackageRoot: packageRoot });
+    }
+  }
+  const packages = [...inspectedInstances.values()].sort((left, right) => (
+    left.name.localeCompare(right.name) || left.packageRoot.localeCompare(right.packageRoot)
+  ));
+  const packageInstancesByName = new Map<string, typeof packages>();
+  for (const dependency of packages) {
+    const instances = packageInstancesByName.get(dependency.name) ?? [];
+    instances.push(dependency);
+    packageInstancesByName.set(dependency.name, instances);
+  }
+  const verifiedNames = expected.filter((dependency) => {
+    const instances = packageInstancesByName.get(dependency.name) ?? [];
+    return instances.length > 0 && instances.every((instance) => instance.state === 'ready');
+  });
+  const expectedNamesReached = verifiedNames.length === expected.length;
+  const state: 'ready' | 'missing' | 'stale' = graphDrift
+    || packages.some((dependency) => dependency.state === 'stale')
+    || (packages.length === 0 && expected.length > 0 && nodeModulesReady)
+    ? 'stale'
+    : packages.some((dependency) => dependency.state === 'missing')
+      || !nodeModulesReady
+      ? 'missing'
+      : expectedNamesReached
+        ? 'ready'
+        : 'stale';
+  const evidence = {
+    state,
+    expectedPackageCount: expected.length,
+    verifiedPackageCount: verifiedNames.length,
+    expectedFileCount,
+    verifiedFileCount: verifiedNames.reduce((total, dependency) => total + dependency.files.length, 0),
+    packages,
+  };
+  return { ...evidence, evidenceSha256: canonicalHash(evidence) };
+}
+
+function inspectRuntimeDependencyPackage(
+  repositoryRoot: string,
+  packageRoot: string,
+  expected: RuntimeBuildManifest['runtimeDependencies'][number],
+  nodeModulesReady: boolean,
+): ReviewerRuntimePreflight['runtimeDependencyReadiness']['packages'][number] {
+  const packageManifestPath = path.join(packageRoot, 'package.json');
+  const base = {
+    name: expected.name,
+    version: expected.version,
+    packageRoot,
+    packageManifestPath,
+    expectedFileCount: expected.files.length,
+  };
+  if (!nodeModulesReady || !existsSync(packageRoot)) {
+    return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'missing' };
+  }
+  try {
+    if (!isPackageName(expected.name) || !lstatSync(packageRoot).isDirectory()) {
+      return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'stale' };
+    }
+    const realRepositoryRoot = realpathSync(repositoryRoot);
+    const realPackageRoot = realpathSync(packageRoot);
+    if (!isUnredirectedPathInside(repositoryRoot, packageRoot)
+      || isOutside(realRepositoryRoot, realPackageRoot)) {
+      return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'stale' };
+    }
+    const manifestFile = inspectRuntimeFile(packageRoot, packageManifestPath);
+    if (manifestFile.state === 'missing') {
+      return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'missing' };
+    }
+    const installedManifest = readJsonRecord(manifestFile.state === 'ready' ? packageManifestPath : null);
+    if (manifestFile.state !== 'ready'
+      || manifestFile.sha256 !== expected.packageManifestSha256
+      || stringField(installedManifest, 'name') !== expected.name
+      || stringField(installedManifest, 'version') !== expected.version) {
+      return { ...base, packageManifestSha256: manifestFile.sha256, verifiedFileCount: 0, state: 'stale' };
+    }
+    const collected = collectRuntimeDependencyFiles(packageRoot);
+    if (collected.unsafe) {
+      return { ...base, packageManifestSha256: manifestFile.sha256, verifiedFileCount: 0, state: 'stale' };
+    }
+    const observed = new Map(collected.files.map((file) => [file.path, file.sha256]));
+    let missing = false;
+    let drift = collected.files.length !== expected.files.length;
+    let verifiedFileCount = 0;
+    for (const file of expected.files) {
+      if (safeRuntimeDependencyPath(file.path) === null) {
+        drift = true;
+        continue;
+      }
+      const hash = observed.get(file.path);
+      if (hash === undefined) missing = true;
+      else if (hash !== file.sha256) drift = true;
+      else verifiedFileCount += 1;
+    }
+    return {
+      ...base,
+      packageManifestSha256: manifestFile.sha256,
+      verifiedFileCount,
+      state: missing ? 'missing' : drift ? 'stale' : 'ready',
+    };
+  } catch {
+    return { ...base, packageManifestSha256: null, verifiedFileCount: 0, state: 'stale' };
+  }
+}
+
+function resolveRuntimeDependencyPackageRoot(
+  repositoryRoot: string,
+  parentPackageRoot: string,
+  dependencyName: string,
+): string | null {
+  for (const candidate of runtimeDependencySearchPaths(repositoryRoot, parentPackageRoot, dependencyName)) {
+    try {
+      lstatSync(candidate);
+      return candidate;
+    } catch {
+      // Continue through Node's parent-aware node_modules search order.
+    }
+  }
+  return null;
+}
+
+function runtimeDependencySearchPaths(
+  repositoryRoot: string,
+  parentPackageRoot: string,
+  dependencyName: string,
+): string[] {
+  if (!isPackageName(dependencyName)) return [];
+  const root = path.resolve(repositoryRoot);
+  let cursor = path.resolve(parentPackageRoot);
+  if (isOutside(root, cursor)) return [];
+  const candidates: string[] = [];
+  while (true) {
+    if (path.basename(cursor) !== 'node_modules') {
+      candidates.push(path.join(cursor, 'node_modules', ...dependencyName.split('/')));
+    }
+    if (cursor === root) break;
+    const parent = path.dirname(cursor);
+    if (parent === cursor || isOutside(root, parent)) break;
+    cursor = parent;
+  }
+  return candidates;
+}
+
+function runtimeDependencyNames(manifest: Record<string, unknown> | null): string[] | null {
+  const dependencies = manifest?.dependencies;
+  if (dependencies === undefined) return [];
+  if (!dependencies || typeof dependencies !== 'object' || Array.isArray(dependencies)) return null;
+  const names = Object.keys(dependencies);
+  return names.every(isPackageName) ? names.sort((left, right) => left.localeCompare(right)) : null;
+}
+
+function collectRuntimeDependencyFiles(
+  packageRoot: string,
+  directory: string = packageRoot,
+): { unsafe: boolean; files: Array<{ path: string; sha256: string }> } {
+  try {
+    const files: Array<{ path: string; sha256: string }> = [];
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const absolutePath = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) return { unsafe: true, files: [] };
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules') return { unsafe: true, files: [] };
+        const nested = collectRuntimeDependencyFiles(packageRoot, absolutePath);
+        if (nested.unsafe) return nested;
+        files.push(...nested.files);
+        continue;
+      }
+      if (!entry.isFile() || entry.name === 'package.json' || !/\.(?:cjs|js|json|mjs|node)$/.test(entry.name)) continue;
+      const relativePath = path.relative(packageRoot, absolutePath).split(path.sep).join('/');
+      if (safeRuntimeDependencyPath(relativePath) === null
+        || !lstatSync(absolutePath).isFile()
+        || isOutside(realpathSync(packageRoot), realpathSync(absolutePath))) {
+        return { unsafe: true, files: [] };
+      }
+      files.push({ path: relativePath, sha256: sha256File(absolutePath) });
+    }
+    return { unsafe: false, files: files.sort((left, right) => left.path.localeCompare(right.path)) };
+  } catch {
+    return { unsafe: true, files: [] };
+  }
+}
+
+function inspectReviewerBuild(
+  installedPackageRoot: string,
+  manifestPath: string,
+  installedPackageManifestPath: string,
+  cliPath: string,
+  runningCliSha256: string,
+  reviewerPath: string,
+  runningRuntimeSha256: string,
+  gatewayPath: string,
+  runningGatewaySha256: string,
+  workflowPath: string,
+  runningWorkflowSha256: string,
+): ReviewerRuntimePreflight['buildReadiness'] {
+  const manifestFile = inspectRuntimeFile(installedPackageRoot, manifestPath);
+  const rawManifest = readJsonRecord(manifestFile.state === 'ready' ? manifestPath : null);
+  const parsed = parseRuntimeBuildManifest(rawManifest);
+  const installedPackageManifestSha256 = inspectRuntimeFile(
+    installedPackageRoot,
+    installedPackageManifestPath,
+  ).sha256;
+  let state: 'ready' | 'missing' | 'stale' = manifestFile.state === 'unsafe'
+    ? 'stale'
+    : parsed
+      ? 'ready'
+      : 'missing';
+  let verifiedFileCount = 0;
+  if (parsed) {
+    const expectedFingerprint = runtimeBuildFingerprint(parsed);
+    const filePaths = new Set(parsed.files.map((file) => file.path));
+    if (
+      parsed.packageName !== PACKAGE_NAME
+      || parsed.packageVersion !== PACKAGE_VERSION
+      || parsed.packageManifestSha256 !== installedPackageManifestSha256
+      || parsed.fingerprint !== expectedFingerprint
+      || canonicalJsonStringify(parsed.requiredEntrypoints) !== canonicalJsonStringify([
+        'dist/src/cli.js',
+        'dist/src/gateway-handshake.js',
+        'dist/src/reviewer.js',
+        'dist/src/workflow.js',
+      ])
+      || !parsed.requiredEntrypoints.every((entry) => filePaths.has(entry))
+    ) {
+      state = 'stale';
+    }
+    for (const file of parsed.files) {
+      const safeRelative = safeRuntimeBuildPath(file.path);
+      if (safeRelative === null) {
+        state = 'stale';
+        continue;
+      }
+      const absolutePath = path.join(installedPackageRoot, safeRelative);
+      const observed = inspectRuntimeFile(installedPackageRoot, absolutePath);
+      if (observed.state === 'missing') {
+        state = 'missing';
+        continue;
+      }
+      if (observed.state === 'unsafe' || observed.sha256 !== file.sha256) {
+        state = 'stale';
+        continue;
+      }
+      verifiedFileCount += 1;
+    }
+  }
+  const cliFile = inspectRuntimeFile(installedPackageRoot, cliPath);
+  const reviewerFile = inspectRuntimeFile(installedPackageRoot, reviewerPath);
+  const gatewayFile = inspectRuntimeFile(installedPackageRoot, gatewayPath);
+  const workflowFile = inspectRuntimeFile(installedPackageRoot, workflowPath);
+  const cliSha256 = cliFile.sha256;
+  const reviewerSha256 = reviewerFile.sha256;
+  const gatewaySha256 = gatewayFile.sha256;
+  const workflowSha256 = workflowFile.sha256;
+  if (parsed && [cliFile, reviewerFile, gatewayFile, workflowFile].some((file) => file.state === 'unsafe')) {
+    state = 'stale';
+  } else if (parsed && [cliSha256, reviewerSha256, gatewaySha256, workflowSha256].some((hash) => hash === null)) {
+    state = 'missing';
+  }
+  const runningCliMatchesInstalledBuild = cliSha256 !== null && cliSha256 === runningCliSha256;
+  const runningModuleMatchesInstalledBuild = reviewerSha256 !== null && reviewerSha256 === runningRuntimeSha256;
+  const runningGatewayMatchesInstalledBuild = gatewaySha256 !== null && gatewaySha256 === runningGatewaySha256;
+  const runningWorkflowMatchesInstalledBuild = workflowSha256 !== null && workflowSha256 === runningWorkflowSha256;
+  if (parsed && (!runningCliMatchesInstalledBuild
+    || !runningModuleMatchesInstalledBuild
+    || !runningGatewayMatchesInstalledBuild
+    || !runningWorkflowMatchesInstalledBuild)) state = 'stale';
+  const manifestSha256 = manifestFile.sha256;
+  const manifestFingerprint = parsed?.fingerprint ?? null;
+  const expectedFileCount = parsed?.files.length ?? 0;
+  return {
+    state,
+    manifestPath,
+    manifestSha256,
+    manifestFingerprint,
+    verifiedFileCount,
+    expectedFileCount,
+    cliEntrypointPath: cliPath,
+    cliEntrypointSha256: cliSha256,
+    runningCliMatchesInstalledBuild,
+    reviewerModulePath: reviewerPath,
+    reviewerModuleSha256: reviewerSha256,
+    runningModuleMatchesInstalledBuild,
+    gatewayModulePath: gatewayPath,
+    gatewayModuleSha256: gatewaySha256,
+    runningGatewayMatchesInstalledBuild,
+    workflowModulePath: workflowPath,
+    workflowModuleSha256: workflowSha256,
+    runningWorkflowMatchesInstalledBuild,
+    evidenceSha256: canonicalHash({
+      installedPackageRoot,
+      manifestSha256,
+      manifestFingerprint,
+      installedPackageManifestSha256,
+      verifiedFileCount,
+      expectedFileCount,
+      cliSha256,
+      runningCliSha256,
+      reviewerSha256,
+      runningRuntimeSha256,
+      gatewaySha256,
+      runningGatewaySha256,
+      workflowSha256,
+      runningWorkflowSha256,
+      state,
+    }),
+  };
+}
+
+function parseRuntimeBuildManifest(value: Record<string, unknown> | null): RuntimeBuildManifest | null {
+  if (!value
+    || value.protocol !== 'codex-workflow-runtime-build-manifest-v1'
+    || typeof value.packageName !== 'string'
+    || typeof value.packageVersion !== 'string'
+    || typeof value.packageManifestSha256 !== 'string'
+    || !/^[a-f0-9]{64}$/.test(value.packageManifestSha256)
+    || !Array.isArray(value.requiredEntrypoints)
+    || !value.requiredEntrypoints.every((entry) => typeof entry === 'string')
+    || !Array.isArray(value.files)
+    || !Array.isArray(value.runtimeDependencies)
+    || typeof value.fingerprint !== 'string') return null;
+  const files = parseAttestedFiles(value.files);
+  if (files.length !== value.files.length || new Set(files.map((entry) => entry.path)).size !== files.length) return null;
+  const runtimeDependencies = value.runtimeDependencies.flatMap((entry) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return [];
+    const candidate = entry as Record<string, unknown>;
+    if (typeof candidate.name !== 'string'
+      || !isPackageName(candidate.name)
+      || typeof candidate.version !== 'string'
+      || typeof candidate.packageManifestSha256 !== 'string'
+      || !/^[a-f0-9]{64}$/.test(candidate.packageManifestSha256)
+      || !Array.isArray(candidate.files)) return [];
+    const dependencyFiles = parseAttestedFiles(candidate.files);
+    return dependencyFiles.length === candidate.files.length
+      && new Set(dependencyFiles.map((file) => file.path)).size === dependencyFiles.length
+      ? [{
+        name: candidate.name,
+        version: candidate.version,
+        packageManifestSha256: candidate.packageManifestSha256,
+        files: dependencyFiles,
+      }]
+      : [];
+  });
+  if (runtimeDependencies.length !== value.runtimeDependencies.length
+    || new Set(runtimeDependencies.map((entry) => entry.name)).size !== runtimeDependencies.length) return null;
+  return {
+    protocol: value.protocol,
+    packageName: value.packageName,
+    packageVersion: value.packageVersion,
+    packageManifestSha256: value.packageManifestSha256,
+    requiredEntrypoints: [...value.requiredEntrypoints] as string[],
+    files,
+    runtimeDependencies,
+    fingerprint: value.fingerprint,
+  };
+}
+
+function parseAttestedFiles(value: unknown[]): Array<{ path: string; sha256: string }> {
+  return value.flatMap((entry) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return [];
+    const candidate = entry as Record<string, unknown>;
+    return typeof candidate.path === 'string' && /^[a-f0-9]{64}$/.test(String(candidate.sha256))
+      ? [{ path: candidate.path, sha256: String(candidate.sha256) }]
+      : [];
+  });
+}
+
+function runtimeBuildFingerprint(value: Omit<RuntimeBuildManifest, 'fingerprint'> | RuntimeBuildManifest): string {
+  const lines = [
+    value.protocol,
+    value.packageName,
+    value.packageVersion,
+    value.packageManifestSha256,
+    ...value.requiredEntrypoints,
+  ];
+  for (const file of value.files) lines.push(file.path, file.sha256);
+  for (const dependency of value.runtimeDependencies) {
+    lines.push(dependency.name, dependency.version, dependency.packageManifestSha256);
+    for (const file of dependency.files) lines.push(file.path, file.sha256);
+  }
+  return createHash('sha256').update(lines.join('\0')).digest('hex');
+}
+
+function safeRuntimeBuildPath(value: string): string | null {
+  const normalized = value.split('\\').join('/');
+  if (!normalized.startsWith('dist/src/') || !normalized.endsWith('.js') || path.posix.normalize(normalized) !== normalized) return null;
+  if (path.posix.isAbsolute(normalized) || normalized.split('/').includes('..')) return null;
+  return normalized;
+}
+
+function safeRuntimeDependencyPath(value: string): string | null {
+  const normalized = value.split('\\').join('/');
+  if (!/\.(?:cjs|js|json|mjs|node)$/.test(normalized)
+    || path.posix.normalize(normalized) !== normalized
+    || path.posix.isAbsolute(normalized)
+    || normalized.split('/').includes('..')
+    || normalized.split('/').includes('node_modules')) return null;
+  return normalized;
+}
+
+function isPackageName(value: string): boolean {
+  return /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i.test(value);
+}
+
+function readJsonRecord(filePath: string | null): Record<string, unknown> | null {
+  if (!filePath) return null;
+  try {
+    const value: unknown = JSON.parse(readFileSync(filePath, 'utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : null;
+  } catch {
+    return null;
+  }
+}
+
+function nestedString(value: Record<string, unknown> | null, keys: string[]): string | null {
+  let cursor: unknown = value;
+  for (const key of keys) {
+    if (!cursor || typeof cursor !== 'object' || Array.isArray(cursor)) return null;
+    cursor = (cursor as Record<string, unknown>)[key];
+  }
+  return typeof cursor === 'string' ? cursor : null;
+}
+
+function stringField(value: Record<string, unknown> | null, key: string): string | null {
+  const candidate = value?.[key];
+  return typeof candidate === 'string' ? candidate : null;
+}
+
+function isPlainDirectory(directoryPath: string): boolean {
+  try {
+    return existsSync(directoryPath) && lstatSync(directoryPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+function isUnredirectedPathInside(root: string, candidate: string): boolean {
+  try {
+    const logicalRoot = path.resolve(root);
+    const logicalCandidate = path.resolve(candidate);
+    if (isOutside(logicalRoot, logicalCandidate)) return false;
+    const expectedRealPath = path.join(realpathSync(logicalRoot), path.relative(logicalRoot, logicalCandidate));
+    return realpathSync(logicalCandidate) === expectedRealPath;
+  } catch {
+    return false;
+  }
+}
+
+function isPlainFileInside(root: string, filePath: string): boolean {
+  return inspectRuntimeFile(root, filePath).state === 'ready';
+}
+
+function inspectRuntimeFile(
+  root: string,
+  filePath: string,
+): { state: 'ready' | 'missing' | 'unsafe'; sha256: string | null } {
+  try {
+    if (!existsSync(filePath)) return { state: 'missing', sha256: null };
+    if (!lstatSync(filePath).isFile()) return { state: 'unsafe', sha256: null };
+    const realRoot = realpathSync(root);
+    const realFile = realpathSync(filePath);
+    if (isOutside(realRoot, realFile)) return { state: 'unsafe', sha256: null };
+    return { state: 'ready', sha256: sha256File(realFile) };
+  } catch {
+    return { state: 'unsafe', sha256: null };
+  }
+}
+
+function assertReviewMode(value: string): asserts value is ReviewMode {
+  if (value !== 'ordinary' && value !== 'security') {
+    throw new Error('review mode must be ordinary or security');
+  }
+}
+
+function reviewInstruction(mode: ReviewMode): string {
+  return mode === 'security'
+    ? 'Perform the requested security-focused review within the supplied sealed scope.'
+    : 'Perform an ordinary correctness and acceptance review. Do not initiate or substitute an implicit security scan; report security-relevant defects only when encountered in the supplied scope.';
+}
+
+function reviewPolicy(mode: ReviewMode): Record<string, unknown> {
+  return { mode, implicitSecurityScan: false, securityFocusRequested: mode === 'security' };
+}
+
+function isOutside(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative.startsWith('..') && !path.isAbsolute(relative);
+}
+
+function sha256File(filePath: string): string {
+  return createHash('sha256').update(readFileSync(filePath)).digest('hex');
+}
+
+function isReviewFindingRecord(value: unknown): value is Record<string, unknown> {
+  return isExactRecord(value, [
+    'id',
+    'severity',
+    'requirement',
+    'summary',
+    'evidence',
+    'requiredAction',
+    'causeId',
+    'route',
+    'planConflict',
+  ]);
+}
+
+function validatePlanConflict(
+  value: unknown,
+  route: 'fix' | 'replan',
+): NonNullable<ReviewInput['findings'][number]['planConflict']> | null {
+  if (route === 'fix') {
+    if (value !== undefined && value !== null) throw new Error('fix findings cannot carry planConflict');
+    return null;
+  }
+  if (!isExactRecord(value, ['planClause', 'whyFixCannotFit', 'minimalPlanChange'])) {
+    throw new Error('replan findings require an exact planConflict');
+  }
+  for (const key of ['planClause', 'whyFixCannotFit', 'minimalPlanChange'] as const) {
+    if (typeof value[key] !== 'string' || !value[key].trim()) {
+      throw new Error('replan findings require non-empty planConflict fields');
+    }
+  }
+  return {
+    planClause: value.planClause as string,
+    whyFixCannotFit: value.whyFixCannotFit as string,
+    minimalPlanChange: value.minimalPlanChange as string,
+  };
+}
+
+function isExactRecord(value: unknown, keys: readonly string[]): value is Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const actual = Object.keys(value).sort();
+  return actual.length === keys.length && actual.every((key, index) => key === [...keys].sort()[index]);
+}
+
+function canonicalHash(value: unknown): string {
+  return createHash('sha256').update(canonicalJsonStringify(value)).digest('hex');
+}
+
+function spawnReviewer(
+  command: string,
+  args: string[],
+  options: { cwd: string; input: string; timeoutMs: number },
+): ReviewerProcessResult {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd,
+    input: options.input,
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+    timeout: options.timeoutMs,
+    killSignal: 'SIGKILL',
+  });
+  const timedOut = result.error !== undefined && 'code' in result.error && result.error.code === 'ETIMEDOUT';
+  return {
+    status: result.status,
+    stdout: result.stdout ?? '',
+    stderr: [result.stderr ?? '', result.error?.message ?? ''].filter(Boolean).join('\n'),
+    timedOut,
+  };
+}
+
+function runStrictReviewerLaunch(
+  repositoryRoot: string,
+  options: {
+    protocol: string;
+    task: TaskState;
+    taskRoot: string;
+    envelope: ContextEnvelope;
+    commandSummary: string;
+    packet: Record<string, unknown>;
+  },
+  runner: ReviewerCommandRunner,
+): StrictReviewerLaunchResult & { reviewerOutputHash: string } {
+  const temporary = mkdtempSync(path.join(os.tmpdir(), 'codex-workflow-review-'));
+  const schemaFile = path.join(temporary, 'review-result.schema.json');
+  const outputFile = path.join(temporary, 'last-message.json');
+  writeFileSync(schemaFile, `${JSON.stringify(STRICT_REVIEW_OUTPUT_SCHEMA, null, 2)}\n`, { mode: 0o600 });
+  const probe = path.join(repositoryRoot, '.codex-reviewer-write-probe');
+  if (existsSync(probe)) {
+    rmSync(temporary, { recursive: true, force: true });
+    const failed = failedLaunch(repositoryRoot, [], null, 'Reviewer probe path already exists; isolation cannot be tested.');
+    return { ...failed, reviewerOutputHash: hashReviewInput(failed.review) };
+  }
+  const before = sealRepository(repositoryRoot);
+  const command = [
+    'codex', '--ask-for-approval', 'never', 'exec',
+    '--ephemeral', '--ignore-user-config', '--ignore-rules', '--sandbox', 'read-only',
+    '--output-schema', schemaFile, '--output-last-message', outputFile, '--json', '-C', repositoryRoot, '-',
+  ];
+  let processResult: ReviewerProcessResult;
+  try {
+    processResult = runner(command[0]!, command.slice(1), {
+      cwd: repositoryRoot,
+      input: `${JSON.stringify(options.packet)}\n`,
+      timeoutMs: STRICT_REVIEWER_TIMEOUT_MS,
+    });
+  } catch (error) {
+    processResult = { status: null, stdout: '', stderr: error instanceof Error ? error.message : String(error) };
+  }
+  const probeWritten = existsSync(probe);
+  const after = sealRepository(repositoryRoot);
+  if (probeWritten) rmSync(probe, { force: true });
+  let output: StrictReviewOutput | null = null;
+  if (processResult.status === 0 && existsSync(outputFile)) {
+    try {
+      const parsed = parseStrictReviewWithHash(readFileSync(outputFile, 'utf8'));
+      output = parsed.output;
+    } catch {
+      output = null;
+    }
+  }
+  rmSync(temporary, { recursive: true, force: true });
+  const unchanged = sealsEqual(before, after) && !probeWritten;
+  const verifiedIsolation = unchanged && output?.isolationProbe === 'denied' && processResult.status === 0;
+  const review = verifiedIsolation && output
+    ? stripProbe(output)
+    : unverifiedReview(
+        processResult.timedOut
+          ? `Strict reviewer exceeded the ${STRICT_REVIEWER_TIMEOUT_MS}ms execution deadline.`
+          : processResult.status !== 0
+          ? `Strict reviewer process failed with status ${String(processResult.status)}.`
+          : probeWritten || !unchanged
+            ? 'Strict reviewer modified repository state; review discarded.'
+            : options.commandSummary,
+      );
+  const reviewerOutputHash = hashReviewInput(review);
+  return {
+    review,
+    verifiedIsolation,
+    command,
+    processStatus: processResult.status,
+    timedOut: processResult.timedOut === true,
+    stderr: processResult.stderr,
+    before,
+    after,
+    reviewerOutputHash,
+  };
+}
+
+function sealRepository(repositoryRoot: string): RepositorySeal {
+  return {
+    headCommit: headCommit(repositoryRoot),
+    changedFiles: changedFiles(repositoryRoot),
+    contentHash: hashReviewableTree(repositoryRoot),
+  };
+}
+
+function hashReviewableTree(repositoryRoot: string): string {
+  const listed = spawnSync(
+    'git',
+    ['-C', repositoryRoot, 'ls-files', '--cached', '--others', '--exclude-standard', '-z'],
+    { encoding: 'utf8' },
+  );
+  if (listed.status !== 0) {
+    throw new Error('Unable to enumerate reviewable repository files.');
+  }
+  const hash = createHash('sha256');
+  const paths = listed.stdout.split('\0').filter(Boolean).sort();
+  for (const relative of paths) {
+    const absolute = path.join(repositoryRoot, relative);
+    hash.update(`${relative}\0`);
+    if (!existsSync(absolute)) {
+      hash.update('missing');
+      continue;
+    }
+    const stat = lstatSync(absolute);
+    hash.update(`${stat.mode & 0o777}\0`);
+    if (stat.isSymbolicLink()) hash.update(`link:${readlinkSync(absolute)}`);
+    else if (stat.isFile()) hash.update(readFileSync(absolute));
+  }
+  return hash.digest('hex');
+}
+
+function sealsEqual(left: RepositorySeal, right: RepositorySeal): boolean {
+  return left.headCommit === right.headCommit
+    && left.contentHash === right.contentHash
+    && JSON.stringify(left.changedFiles) === JSON.stringify(right.changedFiles);
+}
+
+function parseStrictReview(value: string): StrictReviewOutput {
+  const parsed: unknown = JSON.parse(value);
+  if (!isExactRecord(parsed, ['status', 'reviewer', 'summary', 'findings', 'isolationProbe'])) {
+    throw new Error('invalid review');
+  }
+  if (!['passed', 'failed', 'unverified'].includes(String(parsed.status))) throw new Error('invalid status');
+  if (typeof parsed.reviewer !== 'string' || !parsed.reviewer.trim()
+    || typeof parsed.summary !== 'string' || !parsed.summary.trim()
+    || !Array.isArray(parsed.findings)) throw new Error('invalid review');
+  if (!['denied', 'written', 'not-attempted'].includes(String(parsed.isolationProbe))) throw new Error('invalid probe');
+  const findings = parsed.findings.map((candidate) => {
+    if (!isReviewFindingRecord(candidate)
+      || typeof candidate.id !== 'string' || !candidate.id.trim()
+      || !['critical', 'major', 'minor'].includes(String(candidate.severity))
+      || (candidate.requirement !== null && typeof candidate.requirement !== 'string')
+      || typeof candidate.summary !== 'string' || !candidate.summary.trim()
+      || typeof candidate.evidence !== 'string' || !candidate.evidence.trim()
+      || typeof candidate.requiredAction !== 'string' || !candidate.requiredAction.trim()) {
+      throw new Error('invalid review finding');
+    }
+    if (candidate.route !== 'fix' && candidate.route !== 'replan') throw new Error('invalid review finding route');
+    const route: 'fix' | 'replan' = candidate.route;
+    const causeId = candidate.causeId;
+    if (causeId !== null
+      && (typeof causeId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$/.test(causeId))) {
+      throw new Error('invalid review finding causeId');
+    }
+    const planConflict = validatePlanConflict(candidate.planConflict, route);
+    return {
+      id: candidate.id,
+      severity: candidate.severity as 'critical' | 'major' | 'minor',
+      requirement: candidate.requirement as string | null,
+      summary: candidate.summary,
+      evidence: candidate.evidence,
+      requiredAction: candidate.requiredAction,
+      ...(causeId === null ? {} : { causeId }),
+      route,
+      planConflict,
+    };
+  });
+  if ((parsed.status === 'passed' && findings.length > 0)
+    || (parsed.status === 'failed' && findings.length === 0)) throw new Error('invalid finding cardinality');
+  return {
+    status: parsed.status as StrictReviewOutput['status'],
+    reviewer: parsed.reviewer,
+    summary: parsed.summary,
+    findings,
+    isolationProbe: parsed.isolationProbe as StrictReviewOutput['isolationProbe'],
+  };
+}
+
+function parseStrictReviewWithHash(value: string): ParsedStrictReviewResult {
+  const output = parseStrictReview(value);
+  return {
+    output,
+    outputHash: hashReviewInput(stripProbe(output)),
+  };
+}
+
+function hashReviewInput(review: ReviewInput): string {
+  return createHash('sha256').update(canonicalJsonStringify(review)).digest('hex');
+}
+
+function stripProbe(output: StrictReviewOutput): ReviewInput {
+  return {
+    status: output.status,
+    reviewer: output.reviewer,
+    summary: output.summary,
+    findings: output.findings,
+  };
+}
+
+function unverifiedReview(summary: string): ReviewInput {
+  return { status: 'unverified', reviewer: 'strict-codex-reviewer', summary, findings: [] };
+}
+
+function failedLaunch(
+  repositoryRoot: string,
+  command: string[],
+  processStatus: number | null,
+  summary: string,
+): StrictReviewerLaunchResult {
+  const seal = sealRepository(repositoryRoot);
+  return {
+    review: unverifiedReview(summary),
+    verifiedIsolation: false,
+    command,
+    processStatus,
+    timedOut: false,
+    stderr: summary,
+    before: seal,
+    after: seal,
+  };
+}
+
+function failedStepLaunch(
+  repositoryRoot: string,
+  command: string[],
+  processStatus: number | null,
+  summary: string,
+  reviewedCommit: string,
+): StrictStepReviewerLaunchResult {
+  const base = failedLaunch(repositoryRoot, command, processStatus, summary);
+  return {
+    ...base,
+    reviewedCommit,
+    reviewerOutputHash: hashReviewInput(base.review),
+  };
+}