dev-loops 0.6.0 → 0.7.2

package/scripts/github/tick-verified-checkboxes.mjs

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+// Mirror the issue-body AC/DoD tick procedure onto the PR body: after a clean
+// pre_approval_gate verification, flip each verified item's `- [ ]` to `- [x]`
+// in the PR body via a single `gh pr edit --body-file` update. Matches labels by
+// EXACT (trimmed) text and fails closed — never blanket-checks, never unchecks.
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { buildParseError, formatCliError, isDirectCliRun } from "../_core-helpers.mjs";
+import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
+import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
+import { editPr } from "./edit-pr.mjs";
+import { viewPr } from "./view-pr.mjs";
+
+const USAGE = `Usage: tick-verified-checkboxes.mjs --repo <owner/name> --pr <number> --verified <label> [--verified <label>...] [--dry-run]
+Tick verified acceptance-criteria checkboxes in a PR body. Mirrors the issue-body
+tick from skills/docs/acceptance-criteria-verification.md onto the PR body so the
+merged PR shows checked AC/DoD. Flips \`- [ ] <label>\` to \`- [x] <label>\` ONLY when
+<label> exactly equals a --verified label (exact-match, fail-closed: never blanket-
+checks, never unchecks). Applies a single \`gh pr edit --body-file\` update.
+Required:
+  --repo <owner/name>           Repository slug (e.g. owner/repo)
+  --pr <number>                 Pull request number
+  --verified <label>            An exact (trimmed) checklist label that was verified
+                                (repeatable; at least one is required)
+Options:
+  --dry-run                     Compute + report the flips but never edit the PR
+Output (stdout, JSON):
+  { "ok": true, "pr": 17, "flipped": [...], "unmatched": [...], "edited": true|false }
+Error output (stderr, JSON):
+  { "ok": false, "error": "...", "usage"?: "..." }
+${JQ_OUTPUT_USAGE}
+Exit codes:
+  0  Success
+  1  Argument error or gh failure
+  2  Invalid --jq filter`.trim();
+const parseError = buildParseError(USAGE);
+
+// GFM checklist line: optional indentation, a `-`/`*`/`+` bullet, a `[ ]`/`[x]`
+// box, then the label. Capture indent + bullet so we preserve them on flip, and
+// an optional trailing `\r` so CRLF bodies (as returned by `gh pr view`) round-
+// trip byte-for-byte instead of silently failing to match.
+const CHECKBOX_RE = /^(\s*)([-*+])\s+\[([ xX])\]\s+(.*?)(\r?)$/;
+
+// PURE: flip only unchecked checklist lines whose trimmed label EXACTLY equals a
+// verified label. Never unchecks. Never touches non-checkbox text. Idempotent:
+// an already-`[x]` verified label is neither flipped nor reported as unmatched.
+// Returns { body, flipped, unmatched } where flipped = labels changed this call
+// and unmatched = verified labels absent from the body's checklist.
+export function tickVerifiedCheckboxes(body, verifiedLabels) {
+  const verified = new Set(
+    (verifiedLabels ?? []).map((l) => String(l).trim()).filter((l) => l.length > 0),
+  );
+  const flipped = [];
+  const found = new Set();
+  const lines = String(body).split("\n");
+  const nextLines = lines.map((line) => {
+    const m = line.match(CHECKBOX_RE);
+    if (!m) return line;
+    const [, indent, bullet, mark, rest, cr] = m;
+    const label = rest.trim();
+    if (!verified.has(label)) return line;
+    found.add(label);
+    if (mark !== " ") return line; // already checked — leave it, idempotent
+    if (!flipped.includes(label)) flipped.push(label); // duplicate lines: report once
+    return `${indent}${bullet} [x] ${rest}${cr}`;
+  });
+  const unmatched = [...verified].filter((label) => !found.has(label));
+  return { body: nextLines.join("\n"), flipped, unmatched };
+}
+
+export function parseTickVerifiedCliArgs(argv) {
+  const { tokens } = parseArgs({
+    args: [...argv],
+    options: {
+      help: { type: "boolean", short: "h" },
+      repo: { type: "string" },
+      pr: { type: "string" },
+      verified: { type: "string", multiple: true },
+      "dry-run": { type: "boolean" },
+      ...JQ_OUTPUT_PARSE_OPTIONS,
+    },
+    allowPositionals: true,
+    strict: false,
+    tokens: true,
+  });
+  const options = {
+    help: false,
+    repo: undefined,
+    pr: undefined,
+    verified: [],
+    dryRun: false,
+    jq: undefined,
+    silent: false,
+  };
+  for (const token of tokens) {
+    if (token.kind === "positional") {
+      throw parseError(`Unknown argument: ${token.value}`);
+    }
+    if (token.kind !== "option") continue;
+    if (token.name === "help") {
+      options.help = true;
+      return options;
+    }
+    if (token.name === "repo") {
+      options.repo = requireTokenValue(token, parseError).trim();
+      continue;
+    }
+    if (token.name === "pr") {
+      options.pr = parsePrNumber(requireTokenValue(token, parseError), parseError);
+      continue;
+    }
+    if (token.name === "verified") {
+      const label = requireTokenValue(token, parseError).trim();
+      if (label.length === 0) throw parseError("--verified must be a non-empty label");
+      options.verified.push(label);
+      continue;
+    }
+    if (token.name === "dry-run") {
+      options.dryRun = true;
+      continue;
+    }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
+    throw parseError(`Unknown argument: ${token.rawName}`);
+  }
+  if (options.repo === undefined || options.pr === undefined) {
+    throw parseError("Ticking PR checkboxes requires both --repo <owner/name> and --pr <number>");
+  }
+  if (options.verified.length === 0) {
+    throw parseError("at least one --verified is required");
+  }
+  try {
+    parseRepoSlug(options.repo);
+  } catch (error) {
+    throw parseError(error instanceof Error ? error.message : String(error));
+  }
+  return options;
+}
+
+export async function tickCheckboxes(
+  options,
+  { env = process.env, ghCommand = "gh", run = runChild, editPr: edit = editPr } = {},
+) {
+  // Reuse view-pr.mjs rather than re-implementing `gh pr view --json body`.
+  const { pr } = await viewPr(
+    { repo: options.repo, pr: options.pr, fields: "body" },
+    { env, ghCommand, run },
+  );
+  const currentBody = typeof pr.body === "string" ? pr.body : "";
+  const { body: nextBody, flipped, unmatched } = tickVerifiedCheckboxes(currentBody, options.verified);
+  if (flipped.length === 0 || options.dryRun) {
+    return { ok: true, pr: options.pr, flipped, unmatched, edited: false };
+  }
+  const dir = await mkdtemp(join(tmpdir(), "tick-verified-"));
+  try {
+    const bodyFile = join(dir, "body.md");
+    await writeFile(bodyFile, nextBody, "utf8");
+    await edit(
+      { repo: options.repo, pr: options.pr, bodyFile, addAssignees: [], removeAssignees: [] },
+      { env, ghCommand, run },
+    );
+    return { ok: true, pr: options.pr, flipped, unmatched, edited: true };
+  } finally {
+    // Clean up the temp dir on success or failure; never let cleanup mask the result/error.
+    try {
+      await rm(dir, { recursive: true, force: true });
+    } catch {
+      // ignore cleanup failures
+    }
+  }
+}
+
+export async function runCli(
+  argv = process.argv.slice(2),
+  { stdout = process.stdout, stderr = process.stderr, env = process.env, ghCommand = "gh", run = runChild, editPr: edit = editPr } = {},
+) {
+  let options;
+  try {
+    options = parseTickVerifiedCliArgs(argv);
+  } catch (error) {
+    stderr.write(`${formatCliError(error)}\n`);
+    return 1;
+  }
+  if (options.help) {
+    stdout.write(`${USAGE}\n`);
+    return 0;
+  }
+  let result;
+  try {
+    result = await tickCheckboxes(options, { env, ghCommand, run, editPr: edit });
+  } catch (error) {
+    stderr.write(`${JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) })}\n`);
+    return 1;
+  }
+  return emitResult(result, { jq: options.jq, silent: options.silent, stdout, stderr });
+}
+
+if (isDirectCliRun(import.meta.url)) {
+  runCli().then((code) => { process.exitCode = code; });
+}

package/scripts/github/upsert-checkpoint-verdict.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { readFile } from "node:fs/promises";
-import { buildParseError, formatCliError, isDirectCliRun, parseJsonText } from "../_core-helpers.mjs";
-import { loadDevLoopConfig, resolveGateConfig, resolveRefinementConfig } from "@dev-loops/core/config";
+import { buildParseError, formatCliError, isDirectCliRun, parseJsonText, sanitizeCopilotSummonTokens } from "../_core-helpers.mjs";
+import { loadDevLoopConfig, resolveEffectiveCopilotRoundCap, resolveGateAngleContract, resolveGateConfig, resolveRefinementConfig, resolveRejectForeignAngles } from "@dev-loops/core/config";
+import { checkFanoutAngleCoverage } from "@dev-loops/core/loop/gate-fanin";
 import { parseArgs } from "node:util";
-import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult } from "../lib/jq-output.mjs";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
 import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
 import { truncateText } from "@dev-loops/core/bash-exit-one";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
@@ -72,6 +73,11 @@ Optional:
   --gate <draft_gate|pre_approval_gate>     Auto-resolved from coordination state
                                             when omitted. Explicit gate is validated
                                             against allowed coordination actions.
+  --lightweight                             This PR is light-dispatched (#1210):
+                                            resolve the Copilot round cap as
+                                            min(lightMode.maxCopilotRounds ?? 1,
+                                            refinement.maxCopilotRounds) instead of
+                                            refinement.maxCopilotRounds alone.
   --findings-severity-counts <json>         JSON object mapping severity to count
                                              (e.g. '{"must-fix":0,"worth-fixing-now":0}').
                                              Required for --verdict clean when
@@ -261,6 +267,7 @@ export function parseUpsertCheckpointVerdictCliArgs(argv) {
       "findings-severity-counts": { type: "string" },
       "execution-mode": { type: "string" },
       "inline-reason": { type: "string" },
+      lightweight: { type: "boolean" },
       ...JQ_OUTPUT_PARSE_OPTIONS,
     },
     allowPositionals: true,
@@ -281,6 +288,7 @@ export function parseUpsertCheckpointVerdictCliArgs(argv) {
     findingsSeverityCounts: undefined,
     executionMode: undefined,
     inlineReason: undefined,
+    lightweight: false,
     jq: undefined,
     silent: false,
   };
@@ -306,6 +314,10 @@ export function parseUpsertCheckpointVerdictCliArgs(argv) {
       options.pr = parsePrNumber(requireTokenValue(token, parseError), parseError);
       continue;
     }
+    if (token.name === "lightweight") {
+      options.lightweight = true;
+      continue;
+    }
     if (token.name === "gate") {
       const gate = normalizeGateName(requireTokenValue(token, parseError));
       if (!gate) {
@@ -391,14 +403,7 @@ export function parseUpsertCheckpointVerdictCliArgs(argv) {
       options.inlineReason = smartTruncate(reason, MAX_GATE_COMMENT_EXCERPT_LENGTH);
       continue;
     }
-    if (token.name === "jq") {
-      options.jq = requireTokenValue(token, parseError);
-      continue;
-    }
-    if (token.name === "silent") {
-      options.silent = true;
-      continue;
-    }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
     throw parseError(`Unknown argument: ${token.rawName}`);
   }
   // Default execution mode to inline_single_agent when omitted. inlineReason is
@@ -749,7 +754,11 @@ export function renderGateReviewCommentBody({ gate, headSha, verdict, findingsSu
     "",
     `**Next action:** ${nextAction}`,
   );
-  return lines.join("\n");
+  // Neutralize any bare @copilot/`/copilot`* tokens in the rendered body (gate
+  // evidence legitimately quotes the anti-summon rule, e.g. from a findings
+  // excerpt) so posting this comment can never arm request-copilot-review.mjs's
+  // anti-summon guard on a later request.
+  return sanitizeCopilotSummonTokens(lines.join("\n"));
 }
 function resolveRequestedHeadSha(requestedHeadSha, currentHeadSha) {
   if (requestedHeadSha === currentHeadSha) {
@@ -897,7 +906,14 @@ async function postDraftGateViaDraftTransition(options, { env, ghCommand, repoRo
   try {
     // The PR is now a draft, so RUN_DRAFT_GATE is the legal action. Re-enter with
     // the caller's full options; prIsDraft is now true so this branch is skipped.
-    result = await upsertCheckpointVerdict(options, { env, ghCommand, repoRoot });
+    // `_draftTransitionInProgress` guards against unbounded recursion: if GitHub's
+    // draft-state read still lags the conversion mutation on re-entry (isDraft reads
+    // false again), the reconcile branch must NOT fire a second time — it fails closed
+    // with a clear error instead of recursing indefinitely (exit 13). (#1020)
+    result = await upsertCheckpointVerdict(
+      { ...options, _draftTransitionInProgress: true },
+      { env, ghCommand, repoRoot },
+    );
   } catch (error) {
     if (conversion.alreadyDraft !== true) {
       try {
@@ -949,13 +965,18 @@ export async function upsertCheckpointVerdict(options, { env = process.env, ghCo
       // loadPrGateCoordinationContext call will surface the real error.
     }
   }
-  const coordinationContext = await loadPrGateCoordinationContext({ repo: options.repo, pr: options.pr }, { env, ghCommand });
+  // Thread the light-dispatch signal (#1210) so the context interpreter and the
+  // maxCopilotRounds resolution below both use the composed lightweight cap —
+  // the two must never disagree at the cap boundary (#1126).
+  const coordinationContext = await loadPrGateCoordinationContext({ repo: options.repo, pr: options.pr, lightweight: options.lightweight === true }, { env, ghCommand });
   const evidence = coordinationContext.gateEvidence;
   const canonicalHeadSha = resolveRequestedHeadSha(options.headSha, evidence.currentHeadSha);
   const { config } = await loadDevLoopConfig({ repoRoot });
   const draftGateConfig = resolveGateConfig(config, "draft");
   const preApprovalGateConfig = resolveGateConfig(config, "preApproval");
-  const maxCopilotRounds = resolveRefinementConfig(config, "maxCopilotRounds");
+  const maxCopilotRounds = options.lightweight === true
+    ? resolveEffectiveCopilotRoundCap(config, { lightweight: true })
+    : resolveRefinementConfig(config, "maxCopilotRounds");
   // Root cause 2: detect internal-only PRs so the Copilot convergence requirement
   // is suppressed. Docs-only / tooling-only PRs should go straight to pre_approval_gate
   // without requiring an external Copilot review cycle.
@@ -982,6 +1003,10 @@ export async function upsertCheckpointVerdict(options, { env = process.env, ghCo
     copilotReviewRoundCount: coordinationContext.snapshot?.copilotReviewRoundCount ?? 0,
     maxCopilotRounds,
     sameHeadCleanConverged: coordinationContext.interpretation.sameHeadCleanConverged,
+    // Independent gate-ENTRY re-check (#1190): fed alongside (not derived from)
+    // sameHeadCleanConverged, so an outstanding request on the current head refuses
+    // RUN_PRE_APPROVAL_GATE even if sameHeadCleanConverged were somehow stale/wrong.
+    copilotReviewRequestStatus: coordinationContext.snapshot?.copilotReviewRequestStatus ?? "none",
     draftGateRequireCi: draftGateConfig.requireCi,
     draftGate: coordinationContext.gateEvidence.draftGate,
     draftGateMarker: coordinationContext.gateEvidence.draftGateMarker,
@@ -1060,11 +1085,32 @@ export async function upsertCheckpointVerdict(options, { env = process.env, ghCo
   if (
     options.gate === "draft_gate"
     && !prIsDraft
+    && !options._draftTransitionInProgress
     && !coordination.draftGateAlreadySatisfied
     && coordination.allowedNextActions.includes(PR_CHECKPOINT_ACTION.RECONCILE_DRAFT_GATE)
   ) {
     return await postDraftGateViaDraftTransition(options, { env, ghCommand, repoRoot });
   }
+  // Fail closed on a lagged draft-state read: we are re-entering FROM
+  // postDraftGateViaDraftTransition (which just converted the PR to draft) yet the
+  // coordination context still reports the PR as non-draft. Recursing would loop
+  // indefinitely (the original #1020 hang → exit 13, error swallowed). Surface a
+  // clear, actionable error instead so the operator knows the draft conversion did
+  // not take (or GitHub's read lags the mutation) and can retry. (#1020)
+  if (
+    options.gate === "draft_gate"
+    && !prIsDraft
+    && options._draftTransitionInProgress
+  ) {
+    throw new Error(
+      `draft_gate self-heal for ${options.repo}#${options.pr} failed: the PR was converted to draft ` +
+      `to post the verdict, but GitHub still reports it as non-draft on re-entry (draft-state read lagged ` +
+      `the conversion mutation, or the conversion did not take). Not recursing. Re-run the draft_gate post ` +
+      `once the PR reflects the draft state, or reconcile manually with ` +
+      `\`gh pr ready ${options.pr} --repo ${options.repo}\` / ` +
+      `\`node scripts/github/reconcile-draft-gate.mjs --repo ${options.repo} --pr ${options.pr}\`.`,
+    );
+  }
   if (gateActionForbidden) {
     throw new Error(buildGateEntryRefusalError({ options, coordination }));
   }
@@ -1101,6 +1147,7 @@ export async function upsertCheckpointVerdict(options, { env = process.env, ghCo
   // multi-line per-angle breakdown and the `**Findings summary:**` line carries a
   // single-line digest (so the marker/parse contract still round-trips).
   let structuredFindings = null;
+  let rawFindingsInput = null;
   if (options.findingsJson) {
     let raw;
     try {
@@ -1119,6 +1166,7 @@ export async function upsertCheckpointVerdict(options, { env = process.env, ghCo
     const candidate = Array.isArray(parsed)
       ? parsed
       : (Array.isArray(parsed?.angles) ? parsed.angles : (Array.isArray(parsed?.findings) ? parsed.findings : null));
+    rawFindingsInput = candidate;
     try {
       structuredFindings = normalizeStructuredFindings(candidate);
     } catch (err) {
@@ -1128,6 +1176,48 @@ export async function upsertCheckpointVerdict(options, { env = process.env, ghCo
       throw new Error(`--findings-json "${options.findingsJson}" did not contain any renderable findings (expected a non-empty per-angle array of { angle, findings } entries, or a flat per-finding array of { severity, summary, angle? } entries)`);
     }
   }
+  // Fan-out angle-coverage enforcement (fail closed): a fanout_fanin verdict's
+  // structured per-angle results must cover every configured mandatory angle,
+  // and (default) must not name an angle outside the gate's configured pool.
+  // Only applies when structured per-angle results were actually supplied —
+  // a free-text --findings-summary fanout_fanin verdict carries no per-angle
+  // data to validate.
+  if (structuredFindings && (options.executionMode ?? DEFAULT_EXECUTION_MODE) === "fanout_fanin") {
+    // Angle-less entries would be bucketed under the synthetic `general` label
+    // by normalization and then surface as a CONFUSING foreign-angle error.
+    // Fail first with a dedicated message naming the real problem instead.
+    const angleless = (rawFindingsInput ?? []).filter(
+      (e) => !e || typeof e !== "object" || typeof e.angle !== "string" || e.angle.trim().length === 0,
+    ).length;
+    if (angleless > 0) {
+      throw new Error(
+        `--findings-json for ${options.gate}: ${angleless} entr${angleless === 1 ? "y" : "ies"} lack a non-empty .angle — a fanout_fanin verdict must attribute every per-angle entry/finding to its review angle (use the nested [{ angle, verdict, findings }] shape, or add .angle to each flat finding)`,
+      );
+    }
+    const gateKey = options.gate === "draft_gate" ? "draft" : "preApproval";
+    const { mandatoryAngles, pool } = resolveGateAngleContract(config, gateKey);
+    const { missingMandatory, foreignAngles } = checkFanoutAngleCoverage(structuredFindings, {
+      mandatoryAngles,
+      pool,
+    });
+    if (missingMandatory.length > 0) {
+      throw new Error(
+        `--findings-json for ${options.gate} is missing mandatory angle(s): ${missingMandatory.join(", ")} (configured in gates.${gateKey}.mandatoryAngles; add a per-angle entry for each before posting a fanout_fanin verdict)`,
+      );
+    }
+    if (foreignAngles.length > 0) {
+      const message = `--findings-json for ${options.gate} names angle(s) outside the configured pool: ${foreignAngles.join(", ")}`;
+      if (resolveRejectForeignAngles(config)) {
+        throw new Error(
+          `${message} (add them to gates.${gateKey}.angles, or set gates.rejectForeignAngles: false to warn instead of fail)`,
+        );
+      }
+      // rejectForeignAngles: false is WARNING mode, not silence — one line per call.
+      if (!options.silent) {
+        process.stderr.write(`WARNING: ${message} (gates.rejectForeignAngles is false; recorded as a warning)\n`);
+      }
+    }
+  }
   // --findings-json takes precedence; when structured findings are present, do not
   // read --findings-file at all (avoids a spurious hard failure if a caller passes
   // both and the file is missing/invalid even though it would be ignored anyway).

package/scripts/github/verify-briefing-prefixes.mjs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { buildParseError, formatCliError, isDirectCliRun } from "../_core-helpers.mjs";
+import { JQ_OUTPUT_USAGE, emitResult } from "../lib/jq-output.mjs";
+
+const USAGE = `Usage: verify-briefing-prefixes.mjs --head-sha <sha> [--help]
+Fan-in enforcement for GATE-EXEC-BRIEFING-PREFIX (docs/gate-review-sub-loop-contract.md):
+fails closed when this gate-review round's per-scope reviewer sentinels (written by
+verify-fresh-review-context.mjs --prefix-hash/--prefix-file) do not all record the SAME
+invariant-briefing prefix hash. Deterministic and offline: reads only the sentinel files
+already on disk under tmp/, keyed by the given head SHA.
+
+Required:
+  --head-sha <sha>  The FULL 40-char reviewed head SHA (git rev-parse HEAD); sentinels are read from
+                     tmp/checkpoint-context-sentinel-<scope>-<headSha>.json.
+
+Output (stdout, JSON):
+  { "ok": true, "verified": true, "headSha": "...", "reviewerCount": <n>, "prefixHash": "..." }
+  { "ok": true, "verified": true, "headSha": "...", "reviewerCount": 0, "reason": "no sentinels found for this round" }
+  { "ok": true, "verified": false, "headSha": "...", "reviewerCount": <n>, "reason": "...", "missing": [...], "mismatched": [...] }
+  On error (stderr, JSON):
+  { "ok": false, "error": "...", "usage": "..." }
+${JQ_OUTPUT_USAGE}
+Exit codes:
+  0  Verified: no sentinels found for this round (nothing to check), or every
+     sentinel records a hash and all hashes are identical (a single hashed
+     sentinel verifies — nothing to mismatch)
+  1  Fail closed: two or more sentinels record DIFFERENT prefix hashes, or ANY
+     sentinel for the round (even a lone one) records no prefix hash — a missing
+     hash is treated as a mismatch, never grandfathered
+  2  Usage or internal error, or invalid --jq filter
+
+Caveat: rounds are keyed by head SHA only. Two different gates reviewed at the
+SAME head share one sentinel namespace, so run this check per gate pass (the head
+advances between gate passes per GATE-EXEC-REGATE-MANDATORY; never manually clear sentinels); legitimately different per-gate prefixes at an identical
+head would otherwise flag as a mismatch (conservative fail-closed, never
+fail-open).`.trim();
+
+// Full 40-char SHA required: sentinel filenames embed the full `git rev-parse
+// HEAD` value, so a short prefix would glob zero sentinels and read as a
+// vacuous pass — fail closed on anything shorter instead.
+const HEAD_SHA_RE = /^[0-9a-f]{40}$/i;
+const SHA256_RE = /^[0-9a-f]{64}$/;
+const SENTINEL_PREFIX = "checkpoint-context-sentinel-";
+const parseError = buildParseError(USAGE);
+
+function resolveFlagValue(argv, flag) {
+  const idx = argv.indexOf(flag);
+  if (idx === -1) return null;
+  const val = argv[idx + 1];
+  if (val === undefined || val === "" || (val.length > 0 && val[0] === "-")) {
+    return ""; // provided but missing/empty/flag-like
+  }
+  return val;
+}
+
+/**
+ * Read every sentinel for the given round (head SHA) from `<tmpRoot>/`, extracting
+ * the reviewer scope (from the filename) and recorded `prefixHash` (from the JSON
+ * body, when present). A malformed/unreadable sentinel is still COUNTED, with
+ * `prefixHash: null` — downstream that reads as a missing hash and FAILS CLOSED,
+ * deliberately: a corrupt sentinel means the invariant-prefix proof cannot be
+ * verified for that reviewer, and silently dropping it would fail open.
+ * @param {string} tmpRoot
+ * @param {string} headSha — lowercase hex, already validated
+ * @returns {Promise<Array<{ scope: string, prefixHash: string|null }>>}
+ */
+async function readRoundSentinels(tmpRoot, headSha) {
+  const suffix = `-${headSha}.json`;
+  let entries;
+  try {
+    entries = await readdir(tmpRoot, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  const matches = entries
+    .filter((e) => e.isFile() && e.name.startsWith(SENTINEL_PREFIX) && e.name.endsWith(suffix))
+    .map((e) => ({
+      file: e.name,
+      scope: e.name.slice(SENTINEL_PREFIX.length, -suffix.length),
+    }))
+    .filter((m) => m.scope.length > 0) // exclude the round-only (no-scope) sentinel name shape
+    // readdir order is filesystem-dependent; sort by scope so missing/mismatched
+    // output is deterministic across runs (this is a deterministic fan-in check).
+    .sort((a, b) => a.scope.localeCompare(b.scope));
+  const results = [];
+  for (const { file, scope } of matches) {
+    let prefixHash = null;
+    try {
+      const raw = await readFile(path.join(tmpRoot, file), "utf8");
+      const parsed = JSON.parse(raw);
+      // Only a well-formed sha256 counts as a recorded hash; anything else
+      // (corrupted/hand-edited value) is treated as missing so the round
+      // fails closed rather than comparing garbage.
+      if (parsed && typeof parsed.prefixHash === "string" && SHA256_RE.test(parsed.prefixHash.toLowerCase().trim())) {
+        prefixHash = parsed.prefixHash.toLowerCase().trim();
+      }
+    } catch {
+      // Malformed/unreadable sentinel: counted with prefixHash null so the
+      // evaluation fails closed on it (see the function doc comment).
+    }
+    results.push({ scope, prefixHash });
+  }
+  return results;
+}
+
+/**
+ * Pure comparison: given the round's sentinels, decide verified/reason/missing/mismatched.
+ * Exported for direct unit testing without touching the filesystem.
+ * @param {Array<{ scope: string, prefixHash: string|null }>} sentinels
+ * @returns {{ verified: boolean, reason?: string, missing?: string[], mismatched?: Array<{scope:string, prefixHash:string}> }}
+ */
+export function evaluateBriefingPrefixes(sentinels) {
+  if (sentinels.length === 0) {
+    return { verified: true, reason: "no sentinels found for this round" };
+  }
+  // A hashless sentinel fails closed even when it is the ONLY sentinel (a
+  // one-angle Phase-5 retry round is a real case): "never grandfathered" means
+  // the invariant-prefix proof must exist for every reviewer, not just when a
+  // sibling exists to compare against. A single HASHED sentinel stays verified —
+  // with one recorded hash there is nothing to mismatch.
+  const missing = sentinels.filter((s) => s.prefixHash === null).map((s) => s.scope);
+  if (missing.length > 0) {
+    return {
+      verified: false,
+      reason: `${missing.length} of ${sentinels.length} reviewer sentinel(s) for this round have no recorded prefix hash — the invariant-briefing-prefix proof (GATE-EXEC-BRIEFING-PREFIX) was never established for them. Missing hashes are treated as a mismatch, not grandfathered in.`,
+      missing,
+    };
+  }
+  const distinct = new Map();
+  for (const { scope, prefixHash } of sentinels) {
+    if (!distinct.has(prefixHash)) distinct.set(prefixHash, []);
+    distinct.get(prefixHash).push(scope);
+  }
+  if (distinct.size > 1) {
+    const mismatched = sentinels.map(({ scope, prefixHash }) => ({ scope, prefixHash }));
+    return {
+      verified: false,
+      reason: `Reviewer sentinels for this round recorded ${distinct.size} DIFFERENT invariant-briefing prefix hashes — the seeded briefings were not byte-identical (GATE-EXEC-BRIEFING-PREFIX).`,
+      mismatched,
+    };
+  }
+  return { verified: true, prefixHash: sentinels[0].prefixHash };
+}
+
+export async function main(argv = process.argv.slice(2), { tmpRoot = path.join(process.cwd(), "tmp") } = {}) {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(`${USAGE}\n`);
+    return 0;
+  }
+  const headShaArg = resolveFlagValue(argv, "--head-sha");
+  if (headShaArg === null || headShaArg === "" || !HEAD_SHA_RE.test(headShaArg)) {
+    process.stderr.write(`${formatCliError(
+      parseError(`--head-sha is required and must be the FULL 40-character hex head SHA (short prefixes would match zero sentinels and pass vacuously)${headShaArg ? ` (got ${JSON.stringify(headShaArg)})` : ""}.`)
+    )}\n`);
+    return 2;
+  }
+  const headSha = headShaArg.toLowerCase();
+  const jqArg = resolveFlagValue(argv, "--jq");
+  if (jqArg === "") {
+    process.stderr.write(`${formatCliError(parseError("Invalid --jq value: must be non-empty."))}\n`);
+    return 2;
+  }
+  const jq = jqArg === null ? undefined : jqArg;
+  const silent = argv.includes("--silent") || argv.includes("-s");
+
+  const sentinels = await readRoundSentinels(tmpRoot, headSha);
+  const verdict = evaluateBriefingPrefixes(sentinels);
+  const payload = {
+    ok: true,
+    verified: verdict.verified,
+    headSha,
+    reviewerCount: sentinels.length,
+    ...(verdict.reason ? { reason: verdict.reason } : {}),
+    ...(verdict.missing ? { missing: verdict.missing } : {}),
+    ...(verdict.mismatched ? { mismatched: verdict.mismatched } : {}),
+    ...(verdict.prefixHash ? { prefixHash: verdict.prefixHash } : {}),
+  };
+  return emitResult(payload, { jq, silent, ok: verdict.verified });
+}
+
+if (isDirectCliRun(import.meta.url)) {
+  try {
+    process.exitCode = await main();
+  } catch (err) {
+    process.stderr.write(`${formatCliError(err)}\n`);
+    process.exitCode = 2;
+  }
+}