gentle-pi 1.0.2 → 1.0.4

package/extensions/gentle-ai.ts

@@ -1,4 +1,5 @@
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import {
 	existsSync,
 	lstatSync,
@@ -20,6 +21,7 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
 import type {
 	ExtensionAPI,
 	ExtensionContext,
@@ -49,7 +51,7 @@ import {
 } from "../lib/sdd-status.ts";
 import type { TriggerEvent } from "../lib/review-triggers.ts";
 import { ReviewBundleExporter, ReviewBundleImporter } from "../lib/review-bundle.ts";
-import { domainHashV1 } from "../lib/review-canonical.ts";
+import { canonicalJsonV1, domainHashV1 } from "../lib/review-canonical.ts";
 import { inspectLegacyReviewAuthorityV1, type LegacyInspectionV1 } from "../lib/review-legacy-detector.ts";
 import { compactResetRequestV1, destructiveResetReviewAuthorityV1 } from "../lib/review-reset.ts";
 import { ReviewMutationLockV1 } from "../lib/review-lock.ts";
@@ -57,14 +59,31 @@ import {
 	COMPACT_START_BLOCK_ACTION,
 	GRAPH_V1_ORDINARY_READ_ONLY,
 	CompactReviewStartBlockedError,
+	CompactReviewTerminalAmbiguityError,
+	inspectCompactTerminalApplicability,
 	discoverCompactReview,
 	finalizeCompactReview,
 	startCompactReview,
 } from "../lib/review-facade.ts";
+import { parseCompactFinalizeInput, parseNativeCompactFinalizeInput, toNativeReviewerDocument, toNativeValidatorDocument } from "../lib/review-compact-contract.ts";
+import { toNativeRefuterDocument } from "../lib/review-refuter-adapter.ts";
 import { validateCompactReviewGate } from "../lib/review-compact-gate.ts";
+import {
+	assertLiveRecoveredSourceBindingV1,
+	assertLiveRecoveredSuccessorBindingV1,
+	createSupersessionEnvelopeV1,
+	hasEligibleGraphV1RecoveryAuthorityV1,
+	inspectApprovedCompactSuccessorV1,
+	inspectRecoverableGraphSourceV1,
+	prepareSupersessionV1,
+	resolveReviewAuthorityForChange,
+	SupersessionStoreV1,
+	type PrepareSupersessionInputV1,
+} from "../lib/review-authority-supersession.ts";
 import {
 	COMPACT_AUTHORITY_OUTCOME,
 	compactV2LineageExists,
+	discoverCompactReviewStores,
 	graphV1LineageExists,
 	hasGraphV1Authority,
 	inspectCompactReviewAuthorityV2,
@@ -72,8 +91,11 @@ import {
 } from "../lib/review-compact-store.ts";
 import {
 	inheritedUnsafeGitEnvironmentKeys,
+	publicationProbeGitEnvironment,
+	ReviewRepositoryError,
 	resolveRepositoryAuthorityV1,
 } from "../lib/review-repository.ts";
+import { captureLiveReviewCandidateBinding } from "../lib/review-snapshot.ts";
 import {
 	EXTERNAL_RELEASE_EVIDENCE,
 	GATE_RESULT,
@@ -87,10 +109,12 @@ import {
 	createReviewState,
 	evaluateReleaseFastPathV1,
 	recheckReleaseFastPathRemoteHeadV1,
+	resolveConfiguredPushDestinationV1,
 	resolvePushDestinationRefV1,
 	resolvePushRemoteRefV1,
 	validateAuthoritativeReviewGate,
 	type GateTargetV1,
+	type PushGateTargetV1,
 	type ReleaseFastPathEvidenceV1,
 	type ReviewBudgetV1,
 	type ReviewReducerInput,
@@ -106,6 +130,17 @@ import {
 	type ReviewProjectionV1,
 } from "../lib/review-snapshot.ts";
 import { sanitizeTerminalText, stripAnsi } from "../lib/terminal-theme.ts";
+import { CandidateViewError, CandidateViewRegistry, injectReviewCandidateView } from "../lib/review-candidate-view.ts";
+import {
+	createNativeReviewCli,
+	isCanonicalProcessString,
+	type NativeReviewCli,
+	type NativeFinalizeResult,
+	type NativeStartResult,
+	type NativeValidateResult,
+} from "../lib/native-review-cli.ts";
+
+const execFileAsync = promisify(execFile);
 
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const ASSETS_DIR = join(PACKAGE_ROOT, "assets");
@@ -2086,12 +2121,17 @@ const REVIEW_CONTROLLER_OPERATION = {
 	RESET: "reset",
 	RECOVER: "recover",
 	RECOVER_LOCK: "recover-lock",
+	PREPARE_SUPERSESSION: "prepare-supersession",
+	SUPERSEDE: "supersede",
 	REPAIR: "repair",
+	BIND_SDD: "bind-sdd",
 } as const;
 
 type ReviewControllerOperation =
 	(typeof REVIEW_CONTROLLER_OPERATION)[keyof typeof REVIEW_CONTROLLER_OPERATION];
 
+const NATIVE_BIND_TOKEN_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+
 const REVIEW_CONTROLLER_PARAMETERS = {
 	type: "object",
 	additionalProperties: false,
@@ -2106,6 +2146,10 @@ const REVIEW_CONTROLLER_PARAMETERS = {
 			type: "string",
 			description: "Bounded review lineage identifier. A failed start creates no lineage; do not use it with status or advance.",
 		},
+		changeName: {
+			type: "string",
+			description: "Canonical OpenSpec change name required to resolve a recovered authority during lifecycle validate.",
+		},
 		idempotencyKey: {
 			type: "string",
 			description: "Required for graph-v1 start/advance and lifecycle validate operations.",
@@ -2120,7 +2164,7 @@ const REVIEW_CONTROLLER_PARAMETERS = {
 		},
 		input: {
 			type: "string",
-			description: "A JSON-serialized object string, not a nested object. Ordinary START uses {\"mode\":\"ordinary\",\"policyHash\":\"<hash>\"}; FINALIZE supplies reviewer results, correction forecast, targeted validation, final evidence, and an explicit final_verification_passed boolean. Judgment Day retains graph-v1 input.",
+			description: "A JSON-serialized object string, not a nested object. New native ordinary START uses {\"mode\":\"ordinary\"} with optional baseRef and repository-local policyPath; legacy compact START retains policyHash. FINALIZE supplies reviewer results, correction forecast, targeted validation, final evidence, and an explicit final_verification_passed boolean. Judgment Day retains graph-v1 input.",
 		},
 		outputPath: { type: "string", description: "Destination path for deterministic bundle export." },
 		inputPath: { type: "string", description: "Source path for staged bundle import." },
@@ -2132,6 +2176,7 @@ const REVIEW_CONTROLLER_PARAMETERS = {
 interface ReviewControllerParameters {
 	operation: ReviewControllerOperation;
 	lineageId?: string;
+	changeName?: string;
 	idempotencyKey?: string;
 	transition?: string;
 	command?: string;
@@ -2143,6 +2188,16 @@ interface ReviewControllerParameters {
 	acknowledgeUntrustedBundleSource?: string;
 }
 
+interface SupersessionControllerInput {
+	changeName: string;
+	sourceLineageId: string;
+	successorLineageId: string;
+	operationId: string;
+	prepared: PrepareSupersessionInputV1;
+	challenge?: string;
+	request_hash?: string;
+}
+
 interface ReviewControllerStartInput {
 	mode: ReviewMode;
 	projection: ReviewProjectionV1;
@@ -2181,18 +2236,199 @@ interface DerivedReviewGateTarget {
 	command: ReviewLifecycleCommand;
 	target: GateTargetV1;
 	actualIntendedCommitTree?: string;
+	nativePublication?: NativePublicationBinding;
+}
+
+interface NativePrePrBoundaryBinding {
+	source: "explicit";
+	selector: string;
+	commit: string;
+	remote: string;
+	remoteRef: string;
+	remoteIdentity: string;
+}
+
+const GH_REPOSITORY_SOURCE = {
+	EXPLICIT: "explicit",
+	ENVIRONMENT: "environment",
+	LOCAL: "local",
+} as const;
+
+type GhRepositorySource = (typeof GH_REPOSITORY_SOURCE)[keyof typeof GH_REPOSITORY_SOURCE];
+
+interface GhRepositoryBinding {
+	source: GhRepositorySource;
+	value: string;
+	remote: string;
+	remoteIdentity: string;
+}
+
+interface NativePrePrHeadBinding {
+	selector: string;
+	commit: string;
+	remote: string;
+	remoteRef: string;
+	remoteIdentity: string;
+}
+
+interface NativePrePushRangeBinding {
+	remote: string;
+	destinationRef: string;
+	oldObject: string;
+	newObject: string;
+	baseSelector: string;
+	advertisedBaseCommit: string;
+}
+
+interface NativePublicationBinding {
+	flags: readonly string[];
+	pushRemote: string;
+	pushIdentity: string;
+	prePushRange?: NativePrePushRangeBinding;
+	prePrBoundary?: NativePrePrBoundaryBinding;
+	prePrHead?: NativePrePrHeadBinding;
+	repository?: GhRepositoryBinding;
+}
+
+interface AdvertisedBranch {
+	selector: string;
+	remote: string;
+	remoteRef: string;
+	commit: string;
+	remoteIdentity: string;
+	localRef: string;
+}
+
+interface AdvertisedRemoteBranch {
+	remote: string;
+	remoteRef: string;
+	commit: string;
+	remoteIdentity: string;
+}
+
+const ADVERTISED_BRANCH_KIND = {
+	BASE: "base",
+	HEAD: "head",
+} as const;
+
+type AdvertisedBranchKind = (typeof ADVERTISED_BRANCH_KIND)[keyof typeof ADVERTISED_BRANCH_KIND];
+
+const PUBLICATION_PROBE_ERROR_CODE = {
+	CANCELLED: "cancelled",
+	TIMEOUT: "timeout",
+	UNAVAILABLE: "unavailable",
+	NON_ZERO: "non-zero",
+	SIGNAL: "signal",
+	OUTPUT_LIMIT: "output-limit",
+} as const;
+
+type PublicationProbeErrorCode = (typeof PUBLICATION_PROBE_ERROR_CODE)[keyof typeof PUBLICATION_PROBE_ERROR_CODE];
+
+interface PublicationProbeRequest {
+	file: "git";
+	arguments: readonly string[];
+	cwd: string;
+	timeoutMs: number;
+	maxBufferBytes: number;
+	shell: false;
+	signal?: AbortSignal;
+	environment: NodeJS.ProcessEnv;
+}
+
+interface PublicationProbeResult {
+	stdout: string;
+	stderr: string;
+	exitCode: number;
+	signal: NodeJS.Signals | null;
+	timedOut: boolean;
+	outputLimitExceeded: boolean;
+}
+
+type PublicationProbe = (request: PublicationProbeRequest) => Promise<PublicationProbeResult>;
+
+class PublicationProbeError extends Error {
+	readonly code: PublicationProbeErrorCode;
+
+	constructor(code: PublicationProbeErrorCode, message: string) {
+		super(message);
+		this.name = "PublicationProbeError";
+		this.code = code;
+	}
 }
 
+const NATIVE_PUBLICATION_BASE_NEXT_ACTION = {
+	UNSUPPORTED_UNTIL_PERSISTED_BASE: "native-first-push-unsupported-until-persisted-advertised-base-exists",
+} as const;
+
+const NATIVE_SPLIT_FETCH_PUSH_NEXT_ACTION = "native-split-fetch-push-unsupported-until-upstream-supports-explicit-push-base";
+
+class NativePublicationBaseRequiredError extends Error {
+	readonly nextAction = NATIVE_PUBLICATION_BASE_NEXT_ACTION.UNSUPPORTED_UNTIL_PERSISTED_BASE;
+
+	constructor() {
+		super("Native first-push authorization is unsupported until Pi has a persisted explicit advertised-base source");
+		this.name = "NativePublicationBaseRequiredError";
+	}
+}
+
+class NativeSplitFetchPushUnsupportedError extends Error {
+	readonly nextAction = NATIVE_SPLIT_FETCH_PUSH_NEXT_ACTION;
+
+	constructor() {
+		super("Native split fetch/push pre-push is unsupported by the upstream base-ref contract because <remote>/<branch> resolves through fetch-side remote-tracking state");
+		this.name = "NativeSplitFetchPushUnsupportedError";
+	}
+}
+
+const PUBLICATION_PROBE_TIMEOUT_MS = 2_000;
+const PUBLICATION_PROBE_MAX_BUFFER_BYTES = 64 * 1024;
+const BASH_TIME_REVALIDATION_TIMEOUT_MS = 30_000;
+
+const nodePublicationProbe: PublicationProbe = async (request) => {
+	try {
+		const output = await execFileAsync(request.file, [...request.arguments], {
+			cwd: request.cwd,
+			encoding: "utf8",
+			env: request.environment,
+			maxBuffer: request.maxBufferBytes,
+			shell: request.shell,
+			signal: request.signal,
+			timeout: request.timeoutMs,
+			windowsHide: true,
+		});
+		return { stdout: output.stdout, stderr: output.stderr, exitCode: 0, signal: null, timedOut: false, outputLimitExceeded: false };
+	} catch (error) {
+		const detail = error as NodeJS.ErrnoException & { stdout?: string; stderr?: string; code?: string | number; signal?: NodeJS.Signals; killed?: boolean };
+		if (detail.code === "ENOENT" || detail.code === "EACCES" || detail.name === "AbortError") throw error;
+		return {
+			stdout: detail.stdout ?? "",
+			stderr: detail.stderr ?? "",
+			exitCode: typeof detail.code === "number" ? detail.code : 1,
+			signal: detail.signal ?? null,
+			timedOut: detail.killed === true,
+			outputLimitExceeded: detail.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER",
+		};
+	}
+};
+
 interface ReleaseFastPathAuthorizationV1 {
 	remote: string;
 	protected_ref: string;
 	expected_remote_head: string;
 }
 
+interface NativeReviewAuthorizationContext {
+	lineage_id: string;
+	store_revision: string;
+	fingerprint: string;
+	intended_tree?: string;
+}
+
 interface PendingReviewAuthorization {
 	command_hash: string;
 	target_hash: string;
 	receipt_hash: string | null;
+	native_gate?: NativeReviewAuthorizationContext;
 	release_fast_path?: ReleaseFastPathAuthorizationV1;
 }
 
@@ -2208,7 +2444,7 @@ function parseReviewControllerParameters(value: unknown): ReviewControllerParame
 	// VALIDATE defers its lineage requirement to execution time: the proven
 	// release-from-protected-main fast path needs no receipt lineage, while
 	// every other validation still requires one before receipt validation.
-	const needsLineage = ![REVIEW_CONTROLLER_OPERATION.START, REVIEW_CONTROLLER_OPERATION.FINALIZE, REVIEW_CONTROLLER_OPERATION.EXPORT, REVIEW_CONTROLLER_OPERATION.IMPORT, REVIEW_CONTROLLER_OPERATION.INSPECT, REVIEW_CONTROLLER_OPERATION.RESET, REVIEW_CONTROLLER_OPERATION.RECOVER, REVIEW_CONTROLLER_OPERATION.RECOVER_LOCK, REVIEW_CONTROLLER_OPERATION.REPAIR, REVIEW_CONTROLLER_OPERATION.VALIDATE].includes(value.operation as ReviewControllerOperation);
+	const needsLineage = ![REVIEW_CONTROLLER_OPERATION.START, REVIEW_CONTROLLER_OPERATION.FINALIZE, REVIEW_CONTROLLER_OPERATION.STATUS, REVIEW_CONTROLLER_OPERATION.EXPORT, REVIEW_CONTROLLER_OPERATION.IMPORT, REVIEW_CONTROLLER_OPERATION.INSPECT, REVIEW_CONTROLLER_OPERATION.RESET, REVIEW_CONTROLLER_OPERATION.RECOVER, REVIEW_CONTROLLER_OPERATION.RECOVER_LOCK, REVIEW_CONTROLLER_OPERATION.PREPARE_SUPERSESSION, REVIEW_CONTROLLER_OPERATION.SUPERSEDE, REVIEW_CONTROLLER_OPERATION.REPAIR, REVIEW_CONTROLLER_OPERATION.VALIDATE, REVIEW_CONTROLLER_OPERATION.BIND_SDD].includes(value.operation as ReviewControllerOperation);
 	if (needsLineage && (typeof value.lineageId !== "string" || value.lineageId.trim().length === 0)) {
 		throw new Error("Review controller requires a lineageId");
 	}
@@ -2216,7 +2452,7 @@ function parseReviewControllerParameters(value: unknown): ReviewControllerParame
 		operation: value.operation,
 		...(typeof value.lineageId === "string" ? { lineageId: value.lineageId } : {}),
 	};
-	for (const key of ["idempotencyKey", "transition", "command", "input", "outputPath", "inputPath", "operationId", "lineageIds", "acknowledgeUntrustedBundleSource"] as const) {
+	for (const key of ["changeName", "idempotencyKey", "transition", "command", "input", "outputPath", "inputPath", "operationId", "lineageIds", "acknowledgeUntrustedBundleSource"] as const) {
 		const optional = value[key];
 		if (optional !== undefined && typeof optional !== "string") {
 			if (value.operation === REVIEW_CONTROLLER_OPERATION.START && key === "input") {
@@ -2272,9 +2508,67 @@ function parseControllerJson(input: string, operation: ReviewControllerOperation
 	return value;
 }
 
+function parseSupersessionControllerInput(value: Record<string, unknown>): SupersessionControllerInput {
+	for (const key of ["changeName", "sourceLineageId", "successorLineageId", "operationId"] as const) {
+		if (typeof value[key] !== "string" || value[key].trim().length === 0) throw new Error(`Review controller supersession requires ${key}`);
+	}
+	if (!isRecord(value.prepared)) throw new Error("Review controller supersession requires the exact prepared request input");
+	return {
+		changeName: value.changeName as string,
+		sourceLineageId: value.sourceLineageId as string,
+		successorLineageId: value.successorLineageId as string,
+		operationId: value.operationId as string,
+		prepared: value.prepared as unknown as PrepareSupersessionInputV1,
+		...(typeof value.challenge === "string" ? { challenge: value.challenge } : {}),
+		...(typeof value.request_hash === "string" ? { request_hash: value.request_hash } : {}),
+	};
+}
+
+function assertSupersessionControllerIdentity(
+	input: SupersessionControllerInput,
+	prepared: ReturnType<typeof prepareSupersessionV1>,
+): void {
+	if (
+		input.operationId !== prepared.body.operation_id ||
+		input.changeName !== prepared.body.change.change_name ||
+		input.sourceLineageId !== prepared.body.source.lineage_id ||
+		input.successorLineageId !== prepared.body.successor.lineage_id ||
+		canonicalJsonV1(input.prepared) !== canonicalJsonV1({
+			operation_id: prepared.body.operation_id,
+			eligibility: input.prepared.eligibility,
+			equivalence: input.prepared.equivalence,
+			...(input.prepared.predecessor_recovery_id === undefined ? {} : { predecessor_recovery_id: input.prepared.predecessor_recovery_id }),
+			...(input.prepared.sequence === undefined ? {} : { sequence: input.prepared.sequence }),
+		})
+	) throw new Error("Review controller supersession identity does not exactly match the prepared request");
+}
+
+const REVIEW_CONTROLLER_OUTCOME = {
+	RESET_STATE_UNAVAILABLE: "reset-state-unavailable",
+} as const;
+
+class ReviewResetStateUnavailableError extends Error {
+	readonly code = REVIEW_CONTROLLER_OUTCOME.RESET_STATE_UNAVAILABLE;
+	readonly statePath: string;
+
+	constructor(statePath: string) {
+		super("Review reset recovery state is unavailable");
+		this.name = "ReviewResetStateUnavailableError";
+		this.statePath = statePath;
+	}
+}
+
 function durableResetRecoveryRequest(cwd: string): LegacyInspectionV1["reset_request"] {
 	const authority = resolveRepositoryAuthorityV1(cwd);
-	const value = JSON.parse(readFileSync(join(authority.store_root, "control", "reset-state.json"), "utf8")) as unknown;
+	const statePath = join(authority.store_root, "control", "reset-state.json");
+	let serialized: string;
+	try {
+		serialized = readFileSync(statePath, "utf8");
+	} catch (error) {
+		if (isRecord(error) && error.code === "ENOENT") throw new ReviewResetStateUnavailableError(statePath);
+		throw error;
+	}
+	const value = JSON.parse(serialized) as unknown;
 	if (!isRecord(value) || !isRecord(value.body)) throw new Error("Review reset recovery state is malformed");
 	const envelope = value as unknown as ReviewResetStateEnvelope;
 	const body = envelope.body;
@@ -2344,7 +2638,16 @@ function inspectReviewAuthorityForController(cwd: string): ControllerReviewAutho
 	const legacy = inspectLegacyReviewAuthorityV1(cwd);
 	const compact = inspectCompactReviewAuthorityV2(cwd);
 	const inspection = legacy.outcome === "reset-in-progress"
-		? { ...legacy, reset_request: durableResetRecoveryRequest(cwd) }
+		? (() => {
+			try {
+				return { ...legacy, reset_request: durableResetRecoveryRequest(cwd) };
+			} catch (error) {
+				if (error instanceof ReviewResetStateUnavailableError) {
+					return { ...legacy, reset_state_outcome: REVIEW_CONTROLLER_OUTCOME.RESET_STATE_UNAVAILABLE };
+				}
+				throw error;
+			}
+		})()
 		: compact.outcome === COMPACT_AUTHORITY_OUTCOME.INVALID
 			? { ...legacy, reset_request: compactResetRequestV1(cwd, legacy) }
 			: legacy;
@@ -2375,31 +2678,29 @@ async function authorizeDestructiveReviewOperation(
 	ctx: ExtensionContext,
 ): Promise<void> {
 	const parameters = parseReviewControllerParameters(parametersValue);
-	if (
-		parameters.operation !== REVIEW_CONTROLLER_OPERATION.RESET &&
-		parameters.operation !== REVIEW_CONTROLLER_OPERATION.RECOVER
-	) return;
+	const isReset = parameters.operation === REVIEW_CONTROLLER_OPERATION.RESET || parameters.operation === REVIEW_CONTROLLER_OPERATION.RECOVER;
+	const isSupersession = parameters.operation === REVIEW_CONTROLLER_OPERATION.SUPERSEDE;
+	if (!isReset && !isSupersession) return;
 	const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);
-	for (const key of ["repositoryId", "commonDirHash", "inventoryHash", "confirmation"] as const) {
-		if (typeof input[key] !== "string" || input[key].length === 0) {
-			throw new Error(`Review controller ${parameters.operation} requires an exact string ${key}`);
+	const challengeKey = isSupersession ? "challenge" : "confirmation";
+	if (isReset) {
+		for (const key of ["repositoryId", "commonDirHash", "inventoryHash"] as const) {
+			if (typeof input[key] !== "string" || input[key].length === 0) throw new Error(`Review controller ${parameters.operation} requires an exact string ${key}`);
 		}
 	}
+	if (typeof input[challengeKey] !== "string" || input[challengeKey].length === 0) {
+		throw new Error(`Review controller ${parameters.operation} requires an exact string ${challengeKey}`);
+	}
 	if (!ctx.hasUI) {
 		throw new Error(`Review controller ${parameters.operation.toUpperCase()} requires fresh explicit authorization through the interactive Pi UI; headless execution fails closed`);
 	}
 	const approved = await ctx.ui.confirm(
-		`Authorize destructive review authority ${parameters.operation.toUpperCase()}?`,
-		[
-			`Operation: ${parameters.operation.toUpperCase()}`,
-			`Repository: ${input.repositoryId}`,
-			`Exact challenge: ${input.confirmation}`,
-			"This invalidates all prior review authority for this repository.",
-		].join("\n"),
+		isSupersession ? "Authorize review authority SUPERSESSION?" : `Authorize destructive review authority ${parameters.operation.toUpperCase()}?`,
+		isSupersession
+			? ["Operation: SUPERSEDE", `Exact challenge: ${input.challenge}`, "This preserves graph-v1 history and activates only the exact compact-v2 successor."].join("\n")
+			: [`Operation: ${parameters.operation.toUpperCase()}`, `Repository: ${input.repositoryId}`, `Exact challenge: ${input.confirmation}`, "This invalidates all prior review authority for this repository."].join("\n"),
 	);
-	if (!approved) {
-		throw new Error(`Review controller ${parameters.operation.toUpperCase()} was not explicitly authorized`);
-	}
+	if (!approved) throw new Error(`Review controller ${parameters.operation.toUpperCase()} was not explicitly authorized`);
 }
 
 function parseReviewBudget(value: unknown, label: string): ReviewBudgetV1 {
@@ -2735,6 +3036,401 @@ function runReviewGit(
 	}).trim();
 }
 
+function runPublicationGit(cwd: string, args: readonly string[]): string {
+	return execFileSync("git", args, {
+		cwd,
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+		env: publicationProbeGitEnvironment(),
+	}).trim();
+}
+
+async function runPublicationProbeGit(
+	cwd: string,
+	args: readonly string[],
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+): Promise<string> {
+	const timeoutSignal = AbortSignal.timeout(timeoutMs);
+	const boundedSignal = signal === undefined ? timeoutSignal : AbortSignal.any([signal, timeoutSignal]);
+	let result: PublicationProbeResult;
+	try {
+		result = await probe({
+			file: "git",
+			arguments: args,
+			cwd,
+			timeoutMs,
+			maxBufferBytes: PUBLICATION_PROBE_MAX_BUFFER_BYTES,
+			shell: false,
+			signal: boundedSignal,
+			environment: publicationProbeGitEnvironment(),
+		});
+	} catch (error) {
+		if (error instanceof PublicationProbeError) throw error;
+		if (error instanceof Error && error.name === "AbortError") {
+			throw new PublicationProbeError(
+				signal?.aborted ? PUBLICATION_PROBE_ERROR_CODE.CANCELLED : PUBLICATION_PROBE_ERROR_CODE.TIMEOUT,
+				signal?.aborted ? "Publication probe was cancelled" : "Publication probe timed out",
+			);
+		}
+		throw new PublicationProbeError(PUBLICATION_PROBE_ERROR_CODE.UNAVAILABLE, "Publication probe could not start");
+	}
+	if (result.timedOut) throw new PublicationProbeError(PUBLICATION_PROBE_ERROR_CODE.TIMEOUT, "Publication probe timed out");
+	if (result.outputLimitExceeded) throw new PublicationProbeError(PUBLICATION_PROBE_ERROR_CODE.OUTPUT_LIMIT, "Publication probe output exceeded its limit");
+	if (result.signal) throw new PublicationProbeError(PUBLICATION_PROBE_ERROR_CODE.SIGNAL, "Publication probe was signalled");
+	if (result.exitCode !== 0) throw new PublicationProbeError(PUBLICATION_PROBE_ERROR_CODE.NON_ZERO, "Publication probe failed");
+	return result.stdout.trim();
+}
+
+function configuredGitValues(cwd: string, key: string): string[] {
+	try {
+		return runPublicationGit(cwd, ["config", "--get-all", key]).split(/\r?\n/).filter(Boolean);
+	} catch {
+		return [];
+	}
+}
+
+function configuredRemotes(cwd: string): string[] {
+	const remotes = runPublicationGit(cwd, ["remote"]).split(/\r?\n/).filter(Boolean);
+	if (new Set(remotes).size !== remotes.length) throw new Error("Configured Git remotes are ambiguous");
+	return remotes;
+}
+
+function singleConfiguredValue(cwd: string, key: string): string | undefined {
+	const values = configuredGitValues(cwd, key);
+	if (values.length > 1) throw new Error(`Git configuration ${key} is ambiguous`);
+	return values[0];
+}
+
+function currentBranch(cwd: string): string {
+	try {
+		return runPublicationGit(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"]);
+	} catch {
+		throw new Error("Publication requires an attached current branch");
+	}
+}
+
+function resolveNativePushRemote(cwd: string): string {
+	const branch = currentBranch(cwd);
+	const keys = [`branch.${branch}.pushRemote`, "remote.pushDefault", `branch.${branch}.remote`];
+	for (const key of keys) {
+		const remote = singleConfiguredValue(cwd, key);
+		if (remote !== undefined) {
+			resolveConfiguredPushDestinationV1(cwd, remote);
+			return remote;
+		}
+	}
+	if (configuredRemotes(cwd).includes("origin")) {
+		resolveConfiguredPushDestinationV1(cwd, "origin");
+		return "origin";
+	}
+	throw new Error("Native publication push remote is not configured");
+}
+
+function repositoryLocationIdentity(cwd: string, location: string): string {
+	let normalized = location;
+	try {
+		const parsed = new URL(location);
+		if (parsed.protocol && !parsed.pathname.startsWith("//")) {
+			normalized = `${parsed.host.toLowerCase()}/${parsed.pathname.replace(/^\/+|\/+$/g, "")}`;
+		} else throw new Error("not an absolute URL");
+	} catch {
+		const colon = location.indexOf(":");
+		const slash = location.indexOf("/");
+		if (colon > 0 && (slash < 0 || colon < slash)) {
+			const host = location.slice(0, colon).split("@").at(-1)!.toLowerCase();
+			normalized = `${host}/${location.slice(colon + 1)}`;
+		} else if (!isAbsolute(location)) {
+			normalized = resolve(runPublicationGit(cwd, ["rev-parse", "--show-toplevel"]), location);
+		}
+	}
+	normalized = normalized.replace(/\/+$/, "").replace(/\.git$/, "");
+	return `sha256:${createHash("sha256").update(normalized).digest("hex")}`;
+}
+
+function repositoryCoordinates(location: string): { host: string; owner: string; repository: string } | undefined {
+	let host: string;
+	let path: string;
+	try {
+		const parsed = new URL(location);
+		if (!parsed.host) throw new Error("not an absolute URL");
+		host = parsed.host.toLowerCase();
+		path = parsed.pathname;
+	} catch {
+		const colon = location.indexOf(":");
+		const slash = location.indexOf("/");
+		if (colon <= 0 || (slash >= 0 && colon > slash)) return undefined;
+		host = location.slice(0, colon).split("@").at(-1)!.toLowerCase();
+		path = location.slice(colon + 1);
+	}
+	const segments = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "").split("/");
+	if (segments.length !== 2 || !segments[0] || !segments[1]) return undefined;
+	return { host, owner: segments[0], repository: segments[1] };
+}
+
+function remoteFetchUrl(cwd: string, remote: string): string {
+	const value = singleConfiguredValue(cwd, `remote.${remote}.url`);
+	if (value === undefined) throw new Error(`Publication remote ${remote} has no unambiguous fetch URL`);
+	return value;
+}
+
+function pushRemoteIdentity(cwd: string, remote: string): string {
+	return repositoryLocationIdentity(cwd, resolveConfiguredPushDestinationV1(cwd, remote).url);
+}
+
+function localRefAtCommit(cwd: string, remote: string, branch: string, commit: string): string {
+	for (const ref of [`refs/heads/${branch}`, `refs/remotes/${remote}/${branch}`]) {
+		try {
+			if (runPublicationGit(cwd, ["rev-parse", "--verify", `${ref}^{commit}`]) === commit) return ref;
+		} catch {
+			// Continue to the other exact local evidence source.
+		}
+	}
+	throw new Error(`Advertised base ${remote}/${branch} is not available at the same local commit`);
+}
+
+async function advertisedRemoteBranch(
+	cwd: string,
+	remote: string,
+	branch: string,
+	label: AdvertisedBranchKind,
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+	location = remoteFetchUrl(cwd, remote),
+): Promise<AdvertisedRemoteBranch> {
+	runPublicationGit(cwd, ["check-ref-format", "--branch", branch]);
+	const remoteRef = `refs/heads/${branch}`;
+	const output = await runPublicationProbeGit(cwd, ["ls-remote", "--heads", location, remoteRef], probe, timeoutMs, signal);
+	const rows = output.split(/\r?\n/).filter(Boolean);
+	if (rows.length !== 1) throw new Error(`Advertised ${label} ${remote}/${branch} is missing or ambiguous`);
+	const [commit, ref, extra] = rows[0]!.split(/\s+/);
+	if (extra !== undefined || ref !== remoteRef || !/^[0-9a-f]{40,64}$/.test(commit ?? "")) throw new Error(`Advertised ${label} ${remote}/${branch} is malformed`);
+	return {
+		remote,
+		remoteRef,
+		commit: commit!,
+		remoteIdentity: repositoryLocationIdentity(cwd, location),
+	};
+}
+
+async function advertisedBranch(
+	cwd: string,
+	remote: string,
+	branch: string,
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+	location = remoteFetchUrl(cwd, remote),
+): Promise<AdvertisedBranch> {
+	const advertised = await advertisedRemoteBranch(cwd, remote, branch, ADVERTISED_BRANCH_KIND.BASE, probe, timeoutMs, signal, location);
+	return {
+		...advertised,
+		selector: `${remote}/${branch}`,
+		localRef: localRefAtCommit(cwd, remote, branch, advertised.commit),
+	};
+}
+
+function optionalCommandOptionValue(arguments_: readonly string[], names: readonly string[]): string | undefined {
+	const matches: string[] = [];
+	for (let index = 0; index < arguments_.length; index += 1) {
+		const argument = arguments_[index]!;
+		const exact = names.find((name) => argument === name);
+		if (exact) {
+			const value = arguments_[index + 1];
+			if (!value) throw new Error(`${exact} is missing its value`);
+			matches.push(value);
+			index += 1;
+			continue;
+		}
+		const equals = names.find((name) => argument.startsWith(`${name}=`));
+		if (equals) matches.push(argument.slice(equals.length + 1));
+	}
+	if (matches.length > 1) throw new Error(`Command option ${names.join("/")} is ambiguous`);
+	return matches[0];
+}
+
+interface ParsedGhRepository {
+	host?: string;
+	owner: string;
+	repository: string;
+	value: string;
+}
+
+function parseGhRepository(value: string, label: string): ParsedGhRepository {
+	if (value.length === 0 || value.trim() !== value || /[\u0000-\u001f\u007f\\?#@]/.test(value) || value.includes("://")) {
+		throw new Error(`${label} is malformed`);
+	}
+	const segments = value.split("/");
+	if (segments.length !== 2 && segments.length !== 3) throw new Error(`${label} must use [HOST/]OWNER/REPO`);
+	const [host, owner, repository] = segments.length === 3
+		? [segments[0], segments[1], segments[2]]
+		: [undefined, segments[0], segments[1]];
+	if (!owner || !repository || !/^[A-Za-z0-9_.-]+$/.test(owner) || !/^[A-Za-z0-9_.-]+$/.test(repository)) {
+		throw new Error(`${label} is malformed`);
+	}
+	if (host !== undefined) {
+		const match = /^([A-Za-z0-9.-]+)(?::([0-9]+))?$/.exec(host);
+		const port = match?.[2] === undefined ? undefined : Number(match[2]);
+		if (!match || (port !== undefined && (!Number.isSafeInteger(port) || port < 1 || port > 65_535))) {
+			throw new Error(`${label} host is malformed`);
+		}
+	}
+	const normalizedHost = host?.toLowerCase();
+	return {
+		...(normalizedHost === undefined ? {} : { host: normalizedHost }),
+		owner,
+		repository,
+		value: normalizedHost === undefined ? `${owner}/${repository}` : `${normalizedHost}/${owner}/${repository}`,
+	};
+}
+
+function repositoryRemoteMatches(cwd: string, remote: string, repository: ParsedGhRepository): boolean {
+	const coordinates = repositoryCoordinates(remoteFetchUrl(cwd, remote));
+	return coordinates !== undefined &&
+		(repository.host === undefined || coordinates.host === repository.host) &&
+		coordinates.owner.toLowerCase() === repository.owner.toLowerCase() &&
+		coordinates.repository.toLowerCase() === repository.repository.toLowerCase();
+}
+
+function effectiveGhRepository(command: ReviewLifecycleCommand): GhRepositoryBinding {
+	if (command.arguments.some((argument) => /^-R.+/.test(argument))) {
+		throw new Error("Pull request -R must pass its repository as a separate value");
+	}
+	const explicit = optionalCommandOptionValue(command.arguments, ["--repo", "-R"]);
+	const inherited = explicit === undefined && process.env.GH_REPO !== undefined && process.env.GH_REPO.length > 0
+		? process.env.GH_REPO
+		: undefined;
+	const selected = explicit ?? inherited;
+	const remotes = configuredRemotes(command.cwd);
+	if (remotes.length === 0) throw new Error("Pull request repository has no configured remote");
+	let source: GhRepositorySource;
+	let value: string;
+	let remote: string;
+	if (selected !== undefined) {
+		const repository = parseGhRepository(selected, explicit === undefined ? "GH_REPO" : "Pull request --repo");
+		const matches = remotes.filter((candidate) => repositoryRemoteMatches(command.cwd, candidate, repository));
+		if (matches.length !== 1) throw new Error("Pull request repository does not map to one configured remote");
+		source = explicit === undefined ? GH_REPOSITORY_SOURCE.ENVIRONMENT : GH_REPOSITORY_SOURCE.EXPLICIT;
+		value = repository.value;
+		remote = matches[0]!;
+	} else {
+		const resolved = remotes.filter((candidate) => singleConfiguredValue(command.cwd, `remote.${candidate}.gh-resolved`) !== undefined);
+		if (resolved.length > 1) throw new Error("GitHub CLI default repository context is ambiguous");
+		if (resolved.length === 0 && remotes.length !== 1) throw new Error("GitHub CLI local repository inference is ambiguous");
+		remote = resolved[0] ?? remotes[0]!;
+		const location = remoteFetchUrl(command.cwd, remote);
+		const coordinates = repositoryCoordinates(location);
+		source = GH_REPOSITORY_SOURCE.LOCAL;
+		value = coordinates === undefined
+			? location
+			: `${coordinates.host}/${coordinates.owner}/${coordinates.repository}`;
+	}
+	return {
+		source,
+		value,
+		remote,
+		remoteIdentity: repositoryLocationIdentity(command.cwd, remoteFetchUrl(command.cwd, remote)),
+	};
+}
+
+async function deriveAdvertisedPrePrBase(
+	command: ReviewLifecycleCommand,
+	base: string,
+	repository: GhRepositoryBinding,
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+): Promise<AdvertisedBranch> {
+	if (base.startsWith("refs/") || /^[0-9a-f]{40,64}$/.test(base)) throw new Error("Pull request base must be an advertised branch name");
+	runPublicationGit(command.cwd, ["check-ref-format", "--branch", base]);
+	return advertisedBranch(command.cwd, repository.remote, base, probe, timeoutMs, signal);
+}
+
+function parsePullRequestHead(head: string): { owner?: string; branch: string; remoteRef: string } {
+	const separator = head.indexOf(":");
+	if (separator !== head.lastIndexOf(":")) throw new Error("Pull request head is malformed");
+	const owner = separator < 0 ? undefined : head.slice(0, separator);
+	const branch = separator < 0 ? head : head.slice(separator + 1);
+	if (
+		!branch ||
+		branch.startsWith("refs/") ||
+		/^[0-9a-f]{40,64}$/.test(branch) ||
+		(owner !== undefined && !owner) ||
+		!/^[A-Za-z0-9_.-]+$/.test(owner ?? "owner")
+	) throw new Error("Pull request head must use branch or owner:branch syntax");
+	return { ...(owner === undefined ? {} : { owner }), branch, remoteRef: `refs/heads/${branch}` };
+}
+
+async function deriveAdvertisedPrePrHead(
+	command: ReviewLifecycleCommand,
+	head: string,
+	repository: GhRepositoryBinding,
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+): Promise<NativePrePrHeadBinding> {
+	const parsed = parsePullRequestHead(head);
+	runPublicationGit(command.cwd, ["check-ref-format", "--branch", parsed.branch]);
+	let remote = repository.remote;
+	if (parsed.owner !== undefined) {
+		const baseCoordinates = repositoryCoordinates(remoteFetchUrl(command.cwd, repository.remote));
+		if (baseCoordinates === undefined) throw new Error("Pull request base repository coordinates are unavailable for an owner-qualified head");
+		const matches = configuredRemotes(command.cwd).filter((candidate) => {
+			const coordinates = repositoryCoordinates(remoteFetchUrl(command.cwd, candidate));
+			return coordinates !== undefined &&
+				coordinates.owner.toLowerCase() === parsed.owner!.toLowerCase() &&
+				coordinates.host === baseCoordinates.host &&
+				coordinates.repository.toLowerCase() === baseCoordinates.repository.toLowerCase();
+		});
+		if (matches.length !== 1) throw new Error("Pull request head repository does not map to one configured remote");
+		remote = matches[0]!;
+	}
+	const advertised = await advertisedRemoteBranch(command.cwd, remote, parsed.branch, ADVERTISED_BRANCH_KIND.HEAD, probe, timeoutMs, signal);
+	const localHead = runPublicationGit(command.cwd, ["rev-parse", "--verify", "HEAD^{commit}"]);
+	if (advertised.commit !== localHead) throw new Error("Advertised pull request head does not match reviewed local HEAD");
+	return { selector: head, ...advertised };
+}
+
+async function deriveNativePrePushBinding(
+	command: ReviewLifecycleCommand,
+	target: PushGateTargetV1,
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+): Promise<NativePublicationBinding> {
+	const pushRemote = resolveNativePushRemote(command.cwd);
+	if (pushRemote !== target.remote) throw new Error(`Push command remote ${target.remote} does not match native publication remote ${pushRemote}`);
+	if (target.updates.length !== 1) throw new Error("Native pre-push requires one exact destination update");
+	const update = target.updates[0]!;
+	if (update.kind === PUSH_UPDATE_KIND.CREATE) throw new NativePublicationBaseRequiredError();
+	if (!update.destination_ref.startsWith("refs/heads/")) throw new Error("Native pre-push destination must be an advertised branch");
+	const branch = update.destination_ref.slice("refs/heads/".length);
+	const destination = resolveConfiguredPushDestinationV1(command.cwd, target.remote);
+	if (destination.destination_id !== target.destination_id) throw new Error("Push publication destination changed after exact command target derivation");
+	const fetchUrl = remoteFetchUrl(command.cwd, target.remote);
+	const pushIdentity = repositoryLocationIdentity(command.cwd, destination.url);
+	if (destination.url !== fetchUrl || pushIdentity !== repositoryLocationIdentity(command.cwd, fetchUrl)) {
+		throw new NativeSplitFetchPushUnsupportedError();
+	}
+	const base = await advertisedBranch(command.cwd, target.remote, branch, probe, timeoutMs, signal, destination.url);
+	if (base.commit !== update.old_object) throw new Error("Advertised push destination changed after exact command target derivation");
+	return {
+		flags: ["--base-ref", base.selector],
+		pushRemote,
+		pushIdentity,
+		prePushRange: {
+			remote: target.remote,
+			destinationRef: update.destination_ref,
+			oldObject: update.old_object,
+			newObject: update.new_object,
+			baseSelector: base.selector,
+			advertisedBaseCommit: base.commit,
+		},
+	};
+}
+
 function commitIncludesAllTracked(arguments_: readonly string[]): boolean {
 	let includesAllTracked = false;
 	const booleanOptions = new Set([
@@ -2785,15 +3481,14 @@ function commitIncludesAllTracked(arguments_: readonly string[]): boolean {
 			throw new Error(`Unsupported commit tree semantics: ${argument}`);
 		}
 		if (argument === "-a" || argument === "--all") {
-			includesAllTracked = true;
-			continue;
+			throw new Error("Commit --all cannot be exactly proven against the frozen reviewed projection");
 		}
 		if (/^-[^-]+$/.test(argument) && argument.length > 2) {
 			const flags = argument.slice(1);
 			if (/[^aemnsqv]/.test(flags)) {
 				throw new Error(`Unsupported combined commit option: ${argument}`);
 			}
-			if (flags.includes("a")) includesAllTracked = true;
+			if (flags.includes("a")) throw new Error("Commit --all cannot be exactly proven against the frozen reviewed projection");
 			if (flags.includes("m")) {
 				index += 1;
 				if (arguments_[index] === undefined) throw new Error("Commit message option is missing its value");
@@ -2816,19 +3511,8 @@ function commitIncludesAllTracked(arguments_: readonly string[]): boolean {
 }
 
 function deriveCommitTree(command: ReviewLifecycleCommand): string {
-	const includesAllTracked = commitIncludesAllTracked(command.arguments);
-	if (!includesAllTracked) return runReviewGit(command.cwd, ["write-tree"]);
-	const temporaryDirectory = mkdtempSync(join(tmpdir(), "gentle-pi-commit-tree-"));
-	const temporaryIndex = join(temporaryDirectory, "index");
-	try {
-		const environment = { ...process.env, GIT_INDEX_FILE: temporaryIndex };
-		const stagedTree = runReviewGit(command.cwd, ["write-tree"]);
-		runReviewGit(command.cwd, ["read-tree", stagedTree], environment);
-		runReviewGit(command.cwd, ["add", "-u", "--", "."], environment);
-		return runReviewGit(command.cwd, ["write-tree"], environment);
-	} finally {
-		rmSync(temporaryDirectory, { recursive: true, force: true });
-	}
+	commitIncludesAllTracked(command.arguments);
+	return runReviewGit(command.cwd, ["write-tree"]);
 }
 
 function resolveLocalFullRef(cwd: string, value: string, label: string): string {
@@ -2912,7 +3596,7 @@ function pushRemoteAndRefspec(arguments_: readonly string[]): { remote: string;
 	return { remote, refspec: refspecs[0]! };
 }
 
-function derivePushTarget(command: ReviewLifecycleCommand): GateTargetV1 {
+function derivePushTarget(command: ReviewLifecycleCommand, pinnedTarget?: PushGateTargetV1): GateTargetV1 {
 	const { remote, refspec } = pushRemoteAndRefspec(command.arguments);
 	if (refspec.startsWith(":")) throw new Error("Push deletion is unsupported");
 	if (refspec.startsWith("+")) throw new Error("Force push refspecs are unsupported");
@@ -2925,15 +3609,28 @@ function derivePushTarget(command: ReviewLifecycleCommand): GateTargetV1 {
 	const newObject = runReviewGit(command.cwd, ["rev-parse", "--verify", sourceRef]);
 	const newPeeledCommit = runReviewGit(command.cwd, ["rev-parse", "--verify", `${sourceRef}^{commit}`]);
 	const newTree = runReviewGit(command.cwd, ["rev-parse", "--verify", `${newPeeledCommit}^{tree}`]);
-	const remoteResolution = separator < 0
-		? { ...resolvePushRemoteRefV1(command.cwd, remote, sourceRef, "push remote destination ref"), ref: sourceRef }
-		: resolvePushDestinationRefV1(
+	const pinnedUpdate = pinnedTarget?.updates.length === 1 ? pinnedTarget.updates[0] : undefined;
+	const pinnedDestinationMatches = pinnedUpdate === undefined || (separator < 0
+		? pinnedUpdate.destination_ref === sourceRef
+		: destinationValue.startsWith("refs/")
+			? pinnedUpdate.destination_ref === destinationValue
+			: pinnedUpdate.destination_ref.endsWith(`/${destinationValue}`));
+	if (!pinnedDestinationMatches) throw new Error("Push destination changed after authorization");
+	const remoteResolution = pinnedUpdate === undefined
+		? separator < 0
+			? { ...resolvePushRemoteRefV1(command.cwd, remote, sourceRef, "push remote destination ref"), ref: sourceRef }
+			: resolvePushDestinationRefV1(
 				command.cwd,
 				remote,
 				destinationValue,
 				sourceRef,
 				"push remote destination ref",
-			);
+				)
+		: {
+				destination: resolveConfiguredPushDestinationV1(command.cwd, remote),
+				ref: pinnedUpdate.destination_ref,
+				object_id: pinnedUpdate.old_object,
+			};
 	const destinationRef = remoteResolution.ref;
 	const oldObject = remoteResolution.object_id;
 	const update = oldObject === null
@@ -2967,36 +3664,19 @@ function derivePushTarget(command: ReviewLifecycleCommand): GateTargetV1 {
 	};
 }
 
-function commandOptionValue(arguments_: readonly string[], name: string): string {
-	const matches: string[] = [];
-	for (let index = 0; index < arguments_.length; index += 1) {
-		const argument = arguments_[index]!;
-		if (argument === name) {
-			const value = arguments_[index + 1];
-			if (!value) throw new Error(`${name} is missing its value`);
-			matches.push(value);
-			index += 1;
-		} else if (argument.startsWith(`${name}=`)) {
-			matches.push(argument.slice(name.length + 1));
-		}
-	}
-	if (matches.length !== 1) throw new Error(`Command requires exactly one ${name} value`);
-	return matches[0]!;
+function commandOptionValue(arguments_: readonly string[], names: readonly string[]): string {
+	const value = optionalCommandOptionValue(arguments_, names);
+	if (value === undefined) throw new Error(`Command requires exactly one ${names.join("/")} value`);
+	return value;
 }
 
+
 function derivePullRequestTarget(command: ReviewLifecycleCommand): GateTargetV1 {
-	const baseRef = resolveLocalFullRef(
-		command.cwd,
-		commandOptionValue(command.arguments, "--base"),
-		"Pull request base",
-	);
-	const headRef = resolveLocalFullRef(
-		command.cwd,
-		commandOptionValue(command.arguments, "--head"),
-		"Pull request head",
-	);
+	const baseRef = resolveLocalFullRef(command.cwd, commandOptionValue(command.arguments, ["--base", "-B"]), "Pull request base");
+	const headOption = commandOptionValue(command.arguments, ["--head", "-H"]);
+	const headRef = parsePullRequestHead(headOption).remoteRef;
 	const baseCommit = runReviewGit(command.cwd, ["rev-parse", "--verify", `${baseRef}^{commit}`]);
-	const headCommit = runReviewGit(command.cwd, ["rev-parse", "--verify", `${headRef}^{commit}`]);
+	const headCommit = runReviewGit(command.cwd, ["rev-parse", "--verify", "HEAD^{commit}"]);
 	return {
 		kind: GATE_TARGET_KIND.PULL_REQUEST,
 		base_ref: baseRef,
@@ -3008,6 +3688,61 @@ function derivePullRequestTarget(command: ReviewLifecycleCommand): GateTargetV1
 	};
 }
 
+async function deriveNativePublicationTarget(
+	derived: DerivedReviewGateTarget,
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+): Promise<DerivedReviewGateTarget> {
+	if (derived.command.event === "pre-push") {
+		if (derived.target.kind !== GATE_TARGET_KIND.PUSH) throw new Error("Push target derivation returned the wrong kind");
+		return { ...derived, nativePublication: await deriveNativePrePushBinding(derived.command, derived.target, probe, timeoutMs, signal) };
+	}
+	if (derived.command.event !== "pre-pr") return derived;
+	if (derived.target.kind !== GATE_TARGET_KIND.PULL_REQUEST) throw new Error("Pull request target derivation returned the wrong kind");
+	const repository = effectiveGhRepository(derived.command);
+	const advertised = await deriveAdvertisedPrePrBase(
+		derived.command,
+		commandOptionValue(derived.command.arguments, ["--base", "-B"]),
+		repository,
+		probe,
+		timeoutMs,
+		signal,
+	);
+	const head = await deriveAdvertisedPrePrHead(
+		derived.command,
+		commandOptionValue(derived.command.arguments, ["--head", "-H"]),
+		repository,
+		probe,
+		timeoutMs,
+		signal,
+	);
+	const pushRemote = resolveNativePushRemote(derived.command.cwd);
+	if (
+		advertised.commit !== derived.target.base_commit ||
+		head.remoteRef !== derived.target.head_ref ||
+		head.commit !== derived.target.head_commit
+	) throw new Error("Advertised PR topology does not match the exact local command target");
+	return {
+		...derived,
+		nativePublication: {
+			flags: ["--base-ref", advertised.selector],
+			pushRemote,
+			pushIdentity: pushRemoteIdentity(derived.command.cwd, pushRemote),
+			repository,
+			prePrBoundary: {
+				source: "explicit",
+				selector: advertised.selector,
+				commit: advertised.commit,
+				remote: advertised.remote,
+				remoteRef: advertised.remoteRef,
+				remoteIdentity: advertised.remoteIdentity,
+			},
+			prePrHead: head,
+		},
+	};
+}
+
 function deriveReleaseTarget(command: ReviewLifecycleCommand): GateTargetV1 {
 	const tag = command.arguments[0];
 	if (!tag || tag.startsWith("-")) {
@@ -3041,6 +3776,7 @@ function deriveReleaseTarget(command: ReviewLifecycleCommand): GateTargetV1 {
 function deriveReviewGateTarget(
 	command: string,
 	defaultCwd: string,
+	pinnedPushTarget?: PushGateTargetV1,
 ): DerivedReviewGateTarget {
 	const inspection = inspectReviewLifecycleCommand(command, defaultCwd);
 	if (!inspection.event || !inspection.command) {
@@ -3068,13 +3804,10 @@ function deriveReviewGateTarget(
 		};
 	}
 	if (inspection.command.event === "pre-push") {
-		return { command: inspection.command, target: derivePushTarget(inspection.command) };
+		return { command: inspection.command, target: derivePushTarget(inspection.command, pinnedPushTarget) };
 	}
 	if (inspection.command.event === "pre-pr") {
-		return {
-			command: inspection.command,
-			target: derivePullRequestTarget(inspection.command),
-		};
+		return { command: inspection.command, target: derivePullRequestTarget(inspection.command) };
 	}
 	if (inspection.command.event === "pre-release") {
 		return { command: inspection.command, target: deriveReleaseTarget(inspection.command) };
@@ -3086,7 +3819,9 @@ function reviewAuthorizationKey(command: string, cwd: string): string {
 	return canonicalHash({ command, cwd: resolve(cwd) });
 }
 
-type ReviewGateEvaluator = (command: string) => ToolCallEventResult | undefined;
+type ReviewGateEvaluator = (
+	command: string,
+) => Promise<ToolCallEventResult | undefined>;
 type CommandSafetyEvaluator = (
 	command: string,
 ) => Promise<ToolCallEventResult | undefined>;
@@ -3095,55 +3830,490 @@ function isReviewTransition(value: string): value is ReviewTransition {
 	return Object.values(REVIEW_TRANSITION).some((transition) => transition === value);
 }
 
-function executeReviewControllerOperation(
-	parametersValue: unknown,
-	defaultCwd: string,
-	pendingAuthorizations: Map<string, PendingReviewAuthorization>,
-): Record<string, unknown> {
-	const parameters = parseReviewControllerParameters(parametersValue);
-	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.EXPORT) {
-		const outputPath = requiredControllerString(parameters, "outputPath");
-		const operationId = requiredControllerString(parameters, "operationId");
-		const lineageIds = parameters.lineageIds === undefined ? undefined : JSON.parse(parameters.lineageIds) as unknown;
-		if (lineageIds !== undefined && (!Array.isArray(lineageIds) || lineageIds.some((id) => typeof id !== "string"))) throw new Error("Export lineageIds must be a JSON string array");
-		return { operation: parameters.operation, result: new ReviewBundleExporter(defaultCwd).export({ outputPath, operationId, lineageIds }) };
-	}
-	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.IMPORT) {
-		// RISK2-001: adopting a brand-new lineage from a bundle is an experimental,
-		// operator-attested trust decision (see lib/review-bundle.ts import gate).
-		return { operation: parameters.operation, result: new ReviewBundleImporter(defaultCwd).import({ inputPath: requiredControllerString(parameters, "inputPath"), operationId: requiredControllerString(parameters, "operationId"), acknowledgeUntrustedBundleSource: parameters.acknowledgeUntrustedBundleSource === "true" }) };
+function isKnownPiLegacyLineage(cwd: string, lineageId: string): boolean {
+	try {
+		return compactV2LineageExists(cwd, lineageId) || graphV1LineageExists(cwd, lineageId);
+	} catch (error) {
+		if (error instanceof ReviewRepositoryError) return false;
+		throw error;
+	}
+}
+
+const COMPACT_NATIVE_START_APPLICABILITY = {
+	UNRELATED_HISTORY: "unrelated-history",
+	COMPATIBLE_RECEIPT: "compatible-receipt",
+	NONTERMINAL: "nonterminal",
+	ESCALATED: "escalated",
+	AMBIGUOUS: "ambiguous",
+	INVALID: "invalid",
+} as const;
+
+type CompactNativeStartApplicability =
+	(typeof COMPACT_NATIVE_START_APPLICABILITY)[keyof typeof COMPACT_NATIVE_START_APPLICABILITY];
+
+interface CompactNativeStartClassification {
+	applicability: CompactNativeStartApplicability;
+	lineageIds: string[];
+}
+
+function isBrokenRepositoryIdentity(error: unknown): error is ReviewRepositoryError {
+	return error instanceof ReviewRepositoryError && /pinned repository identity|root commit authority/i.test(error.message);
+}
+
+function classifyCompactAuthorityApplicability(cwd: string): CompactNativeStartClassification {
+	try {
+		const authority = resolveRepositoryAuthorityV1(cwd);
+		const live = captureLiveReviewCandidateBinding({ cwd, repositoryId: authority.repository_id });
+		const matching = discoverCompactReviewStores(cwd).flatMap((store) => {
+			const record = store.load();
+			const state = record.state;
+			const stateMatches = state.initial_snapshot.base_tree === live.base_tree &&
+				state.initial_snapshot.complete_snapshot_tree === live.complete_snapshot_tree &&
+				state.initial_snapshot.initial_review_tree === live.initial_review_tree &&
+				canonicalJsonV1(state.genesis_paths) === canonicalJsonV1(live.genesis_paths) &&
+				canonicalJsonV1(state.intended_untracked) === canonicalJsonV1(live.intended_untracked);
+			if (state.state !== "approved" && state.state !== "escalated") {
+				return stateMatches ? [{ lineageId: state.lineage_id, state: state.state }] : [];
+			}
+			const { body } = store.loadTerminalReceipt().receipt;
+			const receiptMatches = body.base_tree === live.base_tree &&
+				body.final_candidate_tree === live.complete_snapshot_tree &&
+				body.genesis_paths_hash === domainHashV1("compact-paths", live.genesis_paths) &&
+				body.intended_untracked_hash === domainHashV1("compact-untracked", live.intended_untracked);
+			if (stateMatches && !receiptMatches) throw new CompactReviewStoreError("Compact terminal receipt is incomplete or mismatched for its candidate");
+			return receiptMatches ? [{ lineageId: state.lineage_id, state: state.state }] : [];
+		}).toSorted((left, right) => left.lineageId.localeCompare(right.lineageId));
+		if (matching.length === 0) return { applicability: COMPACT_NATIVE_START_APPLICABILITY.UNRELATED_HISTORY, lineageIds: [] };
+		if (matching.length > 1) return { applicability: COMPACT_NATIVE_START_APPLICABILITY.AMBIGUOUS, lineageIds: matching.map(({ lineageId }) => lineageId) };
+		const match = matching[0]!;
+		return {
+			applicability: match.state === "approved"
+				? COMPACT_NATIVE_START_APPLICABILITY.COMPATIBLE_RECEIPT
+				: match.state === "escalated"
+					? COMPACT_NATIVE_START_APPLICABILITY.ESCALATED
+					: COMPACT_NATIVE_START_APPLICABILITY.NONTERMINAL,
+			lineageIds: [match.lineageId],
+		};
+	} catch {
+		return { applicability: COMPACT_NATIVE_START_APPLICABILITY.INVALID, lineageIds: [] };
+	}
+}
+
+function compactApplicabilityNextAction(applicability: CompactNativeStartClassification): string {
+	switch (applicability.applicability) {
+		case COMPACT_NATIVE_START_APPLICABILITY.COMPATIBLE_RECEIPT:
+			return "use-compatible-read-or-gate-route";
+		case COMPACT_NATIVE_START_APPLICABILITY.NONTERMINAL:
+			return "stop-and-resolve-existing-compact-authority";
+		case COMPACT_NATIVE_START_APPLICABILITY.ESCALATED:
+			return "stop-and-report-escalated-compact-authority";
+		case COMPACT_NATIVE_START_APPLICABILITY.AMBIGUOUS:
+			return "stop-and-report-ambiguous-compact-authority";
+		case COMPACT_NATIVE_START_APPLICABILITY.INVALID:
+			return "stop-and-report-invalid-compact-authority";
+		case COMPACT_NATIVE_START_APPLICABILITY.UNRELATED_HISTORY:
+			return "start-native-authoritative";
+	}
+}
+
+function compactNativeStartBlockedResult(applicability: CompactNativeStartClassification): Record<string, unknown> {
+	return {
+		operation: REVIEW_CONTROLLER_OPERATION.START,
+		status: "blocked",
+		outcome: `compact-authority-${applicability.applicability}`,
+		mutation_performed: false,
+		next_action: compactApplicabilityNextAction(applicability),
+		...(applicability.lineageIds.length === 0 ? {} : { lineage_ids: applicability.lineageIds }),
+	};
+}
+
+function nativeStatusUnsupported(operation: ReviewControllerOperation): Record<string, unknown> {
+	return {
+		operation,
+		status: "blocked",
+		outcome: "native-status-unsupported",
+		mutation_performed: false,
+		inventory_complete: false,
+		next_action: "require-upstream-read-only-native-status-inventory",
+		evidence: {
+			native_contract: "gentle-ai/2.1.4",
+			general_status: "unsupported",
+			claimant_inventory: "unsupported",
+		},
+	};
+}
+
+function mapNativeStartResult(result: NativeStartResult): Record<string, unknown> {
+	return {
+		lineage_id: result.lineageId,
+		state: result.state,
+		risk_tier: result.riskLevel,
+		selected_lenses: result.selectedLenses,
+		changed_files: result.changedFiles,
+		original_changed_lines: result.changedLines,
+		correction_budget: result.correctionBudget,
+		action: result.action,
+		lenses_required: result.lensesRequired,
+	};
+}
+
+function mapNativeFinalizeResult(result: NativeFinalizeResult): Record<string, unknown> {
+	return {
+		lineage_id: result.lineageId,
+		state: result.state,
+		action: result.action,
+		store_revision: result.storeRevision,
+		...(result.receiptPath === undefined ? {} : { receipt_path: result.receiptPath }),
+	};
+}
+
+function mapNativeValidateResult(result: NativeValidateResult): Record<string, unknown> {
+	return {
+		allowed: result.allowed,
+		result: result.result,
+		action: result.action,
+		reason: result.reason,
+		context: result.gateContext.raw,
+	};
+}
+
+function nativeGateFingerprint(result: NativeValidateResult, derived: DerivedReviewGateTarget): string {
+	return canonicalHash({
+		gate_context: result.gateContext.raw,
+		publication_target: {
+			target: derived.target,
+			native_publication: derived.nativePublication ?? null,
+		},
+	});
+}
+
+function requestedNativeGate(command: ReviewLifecycleCommand): string {
+	return command.event === "pre-release" ? "release" : command.event;
+}
+
+function nativeGateFlags(derived: DerivedReviewGateTarget): readonly string[] {
+	return derived.nativePublication?.flags ?? [];
+}
+
+function assertFrozenPreCommitProjection(
+	derived: DerivedReviewGateTarget,
+	lineageId: string,
+	candidateViews: CandidateViewRegistry | null,
+): string | undefined {
+	if (derived.command.event !== "pre-commit" || candidateViews === null || !candidateViews.hasProjection(lineageId)) return undefined;
+	const projection = candidateViews.resolveProjection(lineageId, derived.command.cwd);
+	if (derived.actualIntendedCommitTree !== projection.candidateTree) {
+		throw new CandidateViewError("staged commit tree does not exactly match the frozen reviewed candidate projection");
+	}
+	return projection.candidateTree;
+}
+
+function authorizationTargetHash(derived: DerivedReviewGateTarget): string {
+	return derived.nativePublication === undefined
+		? canonicalHash(derived.target)
+		: canonicalHash({ target: derived.target, native_publication: derived.nativePublication });
+}
+
+function assertNativePublicationBinding(result: NativeValidateResult, derived: DerivedReviewGateTarget): void {
+	const returnedGate = result.gateContext.raw.gate;
+	if (returnedGate !== requestedNativeGate(derived.command) && (result.allowed || returnedGate !== "")) {
+		throw new Error("Native validation returned a gate context for a different gate");
+	}
+	const expected = derived.nativePublication?.prePrBoundary;
+	if (expected === undefined || !result.allowed || result.result !== "allow") return;
+	const value = result.gateContext.raw.pre_pr_boundary;
+	if (!isRecord(value)) throw new Error("Native pre-PR result omitted its publication boundary");
+	if (
+		value.source !== expected.source ||
+		value.selector !== expected.selector ||
+		value.commit !== expected.commit ||
+		value.remote !== expected.remote ||
+		value.remote_ref !== expected.remoteRef ||
+		value.remote_identity !== expected.remoteIdentity
+	) throw new Error("Native pre-PR publication boundary does not match the exact PR command target");
+}
+
+function assertNativePublicationUnchanged(before: DerivedReviewGateTarget, after: DerivedReviewGateTarget): void {
+	if (authorizationTargetHash(before) !== authorizationTargetHash(after)) {
+		throw new Error("Native publication target changed during native validation");
+	}
+	if (before.target.kind === GATE_TARGET_KIND.PULL_REQUEST) {
+		if (
+			after.target.kind !== GATE_TARGET_KIND.PULL_REQUEST ||
+			after.target.head_commit !== before.target.head_commit ||
+			after.nativePublication?.prePrHead?.commit !== before.target.head_commit
+		) throw new Error("Advertised pull request head changed during native validation");
+	}
+}
+
+async function rederiveNativePublicationTarget(
+	expected: DerivedReviewGateTarget,
+	command: string,
+	defaultCwd: string,
+	probe: PublicationProbe,
+	timeoutMs: number,
+	signal?: AbortSignal,
+): Promise<DerivedReviewGateTarget> {
+	const rederived = deriveReviewGateTarget(
+		command,
+		defaultCwd,
+		expected.target.kind === GATE_TARGET_KIND.PUSH ? expected.target : undefined,
+	);
+	if (rederived.command.cwd !== expected.command.cwd) throw new Error("Lifecycle command repository changed during native validation");
+	const fresh = await deriveNativePublicationTarget(rederived, probe, timeoutMs, signal);
+	assertNativePublicationUnchanged(expected, fresh);
+	return fresh;
+}
+
+interface NativeStartPolicyValidation {
+	policyPath?: string;
+	reason?: string;
+}
+
+function isStrictDescendantPath(parent: string, candidate: string): boolean {
+	const pathFromParent = relative(parent, candidate);
+	return pathFromParent.length > 0 && pathFromParent !== ".." && !pathFromParent.startsWith(`..${sep}`) && !isAbsolute(pathFromParent);
+}
+
+function validateNativeStartPolicyPath(cwd: string, value: unknown): NativeStartPolicyValidation {
+	if (typeof value !== "string" || value.trim().length === 0) return { reason: "policy-path-not-regular" };
+	let repository: string;
+	try {
+		repository = realpathSync(cwd);
+	} catch {
+		return { reason: "policy-path-outside-scope" };
+	}
+	const policyRoot = join(repository, ".gentle-ai", "policies");
+	const candidate = resolve(repository, value);
+	if (!isStrictDescendantPath(policyRoot, candidate)) return { reason: "policy-path-outside-scope" };
+	const gentleDirectory = join(repository, ".gentle-ai");
+	for (const directory of [gentleDirectory, policyRoot]) {
+		try {
+			const metadata = lstatSync(directory);
+			if (metadata.isSymbolicLink()) return { reason: "policy-path-symlink" };
+			if (!metadata.isDirectory()) return { reason: "policy-path-not-regular" };
+		} catch {
+			return { reason: "policy-path-not-regular" };
+		}
+	}
+	const segments = relative(policyRoot, candidate).split(sep);
+	let current = policyRoot;
+	for (const [index, segment] of segments.entries()) {
+		current = join(current, segment);
+		try {
+			const metadata = lstatSync(current);
+			if (metadata.isSymbolicLink()) return { reason: "policy-path-symlink" };
+			if (index === segments.length - 1) {
+				if (!metadata.isFile()) return { reason: "policy-path-not-regular" };
+			} else if (!metadata.isDirectory()) {
+				return { reason: "policy-path-not-regular" };
+			}
+		} catch {
+			return { reason: "policy-path-not-regular" };
+		}
+	}
+	try {
+		const canonicalPath = realpathSync(candidate);
+		if (canonicalPath !== candidate || !isStrictDescendantPath(policyRoot, canonicalPath)) return { reason: "policy-path-symlink" };
+		return { policyPath: canonicalPath };
+	} catch {
+		return { reason: "policy-path-not-regular" };
+	}
+}
+
+function nativeStartRejection(reason: string, field?: string): Record<string, unknown> {
+	return {
+		operation: REVIEW_CONTROLLER_OPERATION.START,
+		status: "blocked",
+		outcome: reason === "legacy-policy-hash-unsupported"
+			? "native-start-legacy-policy-hash-unsupported"
+			: reason === "base-ref-invalid"
+				? "native-start-base-ref-invalid"
+				: reason === "unknown-field"
+					? "native-start-input-invalid"
+					: "native-start-policy-path-invalid",
+		reason,
+		...(field === undefined ? {} : { field }),
+		mutation_performed: false,
+		mutation_outcome: "none",
+	};
+}
+
+function nativeOperationFailure(operation: ReviewControllerOperation, error: unknown): Record<string, unknown> {
+	const value = error as { mutationOutcome?: unknown; nextAction?: unknown };
+	const mutationOutcome = value.mutationOutcome === "unknown" ? "unknown" : "none";
+	return {
+		operation,
+		status: "blocked",
+		outcome: "native-operation-failed",
+		mutation_performed: false,
+		mutation_outcome: mutationOutcome,
+		...(mutationOutcome === "unknown" || value.nextAction === "replay-exact-native-operation"
+			? { next_action: "replay-exact-native-operation" }
+			: { next_action: "resolve-native-operation-failure" }),
+	};
+}
+
+function nativePublicationFailure(operation: ReviewControllerOperation, error: unknown): Record<string, unknown> {
+	if (error instanceof NativeSplitFetchPushUnsupportedError) {
+		return {
+			operation,
+			status: "blocked",
+			outcome: "native-split-fetch-push-unsupported",
+			reason: error.message,
+			mutation_performed: false,
+			mutation_outcome: "none",
+			next_action: error.nextAction,
+		};
+	}
+	if (!(error instanceof NativePublicationBaseRequiredError)) return nativeOperationFailure(operation, error);
+	return {
+		operation,
+		status: "blocked",
+		outcome: "native-publication-base-required",
+		reason: error.message,
+		mutation_performed: false,
+		mutation_outcome: "none",
+		next_action: error.nextAction,
+	};
+}
+
+async function executeReviewControllerOperation(
+	parametersValue: unknown,
+	defaultCwd: string,
+	pendingAuthorizations: Map<string, PendingReviewAuthorization>,
+	nativeReviewCli: NativeReviewCli | null,
+	signal?: AbortSignal,
+	publicationProbe: PublicationProbe = nodePublicationProbe,
+	publicationProbeTimeoutMs = PUBLICATION_PROBE_TIMEOUT_MS,
+	candidateViews: CandidateViewRegistry | null = new CandidateViewRegistry(),
+): Promise<Record<string, unknown>> {
+	const parameters = parseReviewControllerParameters(parametersValue);
+	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.EXPORT) {
+		const outputPath = requiredControllerString(parameters, "outputPath");
+		const operationId = requiredControllerString(parameters, "operationId");
+		const lineageIds = parameters.lineageIds === undefined ? undefined : JSON.parse(parameters.lineageIds) as unknown;
+		if (lineageIds !== undefined && (!Array.isArray(lineageIds) || lineageIds.some((id) => typeof id !== "string"))) throw new Error("Export lineageIds must be a JSON string array");
+		return { operation: parameters.operation, result: new ReviewBundleExporter(defaultCwd).export({ outputPath, operationId, lineageIds }) };
+	}
+	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.IMPORT) {
+		// RISK2-001: adopting a brand-new lineage from a bundle is an experimental,
+		// operator-attested trust decision (see lib/review-bundle.ts import gate).
+		return { operation: parameters.operation, result: new ReviewBundleImporter(defaultCwd).import({ inputPath: requiredControllerString(parameters, "inputPath"), operationId: requiredControllerString(parameters, "operationId"), acknowledgeUntrustedBundleSource: parameters.acknowledgeUntrustedBundleSource === "true" }) };
+	}
+	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.PREPARE_SUPERSESSION) {
+		const input = parseSupersessionControllerInput(parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation));
+		const prepared = prepareSupersessionV1(input.prepared);
+		assertSupersessionControllerIdentity(input, prepared);
+		return { operation: parameters.operation, change_name: input.changeName, request_hash: prepared.request_hash, challenge: prepared.challenge, body: prepared.body };
+	}
+	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.SUPERSEDE) {
+		const input = parseSupersessionControllerInput(parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation));
+		if (typeof input.challenge !== "string" || typeof input.request_hash !== "string") throw new Error("Review controller SUPERSEDE requires the exact prepared request_hash and challenge");
+		const prepared = prepareSupersessionV1(input.prepared);
+		assertSupersessionControllerIdentity(input, prepared);
+		if (input.request_hash !== prepared.request_hash || input.challenge !== prepared.challenge) throw new Error("Review controller SUPERSEDE prepared request and challenge must exactly match the fresh authorization");
+		const body = { ...prepared.body, authorization_hash: domainHashV1("review-authority-supersession-authorization", { challenge: prepared.challenge, request_hash: prepared.request_hash }) };
+		const envelope = createSupersessionEnvelopeV1(body);
+		const installed = SupersessionStoreV1.forRepository(defaultCwd).install(input.changeName, envelope, {
+			casChecks: [
+				{
+					label: "graph source",
+					expected: canonicalJsonV1(prepared.body.source),
+					observe: () => {
+						assertLiveRecoveredSourceBindingV1(defaultCwd, envelope);
+						return canonicalJsonV1(inspectRecoverableGraphSourceV1(defaultCwd, input.changeName, input.sourceLineageId).source);
+					},
+				},
+				{
+					label: "compact successor",
+					expected: canonicalJsonV1(prepared.body.successor),
+					observe: () => {
+						const successor = inspectApprovedCompactSuccessorV1(defaultCwd, input.successorLineageId);
+						assertLiveRecoveredSuccessorBindingV1(defaultCwd, envelope, discoverCompactReview(defaultCwd, input.successorLineageId, true).record.state);
+						return canonicalJsonV1(successor);
+					},
+				},
+			],
+		});
+		const active = resolveReviewAuthorityForChange(defaultCwd, input.changeName);
+		if (!active || active.recovery.recovery_id !== installed.recovery_id) throw new Error("Review controller SUPERSEDE did not produce one validated active authority");
+		return { operation: parameters.operation, change_name: input.changeName, recovery_id: installed.recovery_id, active_authority_id: active.record.state.lineage_id, next_action: "validate-recovered-authority" };
+	}
+	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.INSPECT && nativeReviewCli !== null) {
+		try {
+			const inspection = inspectReviewAuthorityForController(defaultCwd);
+			if (inspection.outcome !== "clean") return { operation: parameters.operation, status: "blocked", inspection, inventory_complete: false, next_action: "resolve-pi-owned-preflight" };
+			const compact = classifyCompactAuthorityApplicability(defaultCwd);
+			const diagnostic = {
+				compact_authority_applicability: compact.applicability,
+				...(compact.lineageIds.length === 0 ? {} : { compact_authority_lineage_ids: compact.lineageIds }),
+			};
+			if (compact.applicability === COMPACT_NATIVE_START_APPLICABILITY.UNRELATED_HISTORY) {
+				return { operation: parameters.operation, status: "ready", inspection, ...diagnostic, inventory_complete: false, next_action: compactApplicabilityNextAction(compact), evidence: { native_contract: "gentle-ai/2.1.4", general_status: "unsupported", claimant_inventory: "unsupported", start_routing: "authoritative" } };
+			}
+			return {
+				operation: parameters.operation,
+				inspection,
+				...diagnostic,
+				inventory_complete: false,
+				status: compact.applicability === COMPACT_NATIVE_START_APPLICABILITY.NONTERMINAL ? "in-progress" : "blocked",
+				next_action: compactApplicabilityNextAction(compact),
+			};
+		} catch (error) {
+			if (isBrokenRepositoryIdentity(error)) {
+				return {
+					operation: parameters.operation,
+					status: "blocked",
+					outcome: "compact-authority-invalid",
+					compact_authority_applicability: COMPACT_NATIVE_START_APPLICABILITY.INVALID,
+					inventory_complete: false,
+					next_action: "stop-and-report-invalid-compact-authority",
+				};
+			}
+			if (error instanceof ReviewRepositoryError) return nativeStatusUnsupported(parameters.operation);
+			throw error;
+		}
 	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.INSPECT) {
 		const authority = resolveRepositoryAuthorityV1(defaultCwd);
 		const lock = new ReviewMutationLockV1(join(authority.store_root, "control"), authority.repository_id, authority.authority_id);
 		const inspection = inspectReviewAuthorityForController(defaultCwd);
+		const input = parameters.input === undefined ? undefined : parseControllerJson(parameters.input, parameters.operation);
+		const policyHash = input?.mode === REVIEW_MODE.ORDINARY && isRecord(input.projection) && input.projection.kind === REVIEW_PROJECTION.COMPLETE && typeof input.policyHash === "string" ? input.policyHash : undefined;
+		const applicability = inspection.outcome === "clean" && (
+			inspection.compact_authority?.outcome === COMPACT_AUTHORITY_OUTCOME.APPROVED ||
+			inspection.compact_authority?.outcome === COMPACT_AUTHORITY_OUTCOME.ESCALATED
+		) ? inspectCompactTerminalApplicability(defaultCwd, policyHash) : undefined;
+		const candidateInspection = applicability === undefined ? inspection : {
+			...inspection,
+			terminal_applicability: applicability.applicability,
+			terminal_lineage_ids: applicability.lineageIds,
+		};
+		const terminal = applicability?.applicability === "applicable";
+		const terminalAmbiguous = applicability?.applicability === "ambiguous";
 		return {
 			operation: parameters.operation,
-			inspection,
+			inspection: candidateInspection,
 			lock: lock.inspect(),
 			...(inspection.outcome === "clean" && inspection.compact_authority !== undefined
-				? {
-					status: inspection.compact_authority.outcome === COMPACT_AUTHORITY_OUTCOME.ESCALATED
-						? "escalated"
-						: inspection.compact_authority.outcome === COMPACT_AUTHORITY_OUTCOME.APPROVED
-							? "terminal"
-							: inspection.compact_authority.outcome === COMPACT_AUTHORITY_OUTCOME.ACTIVE
-								? "in-progress"
-								: "blocked",
-					next_action: compactAuthorityAction(inspection),
-				}
+				? inspection.compact_authority.outcome === COMPACT_AUTHORITY_OUTCOME.INVALID
+					? { status: "blocked", next_action: "request-explicit-reset-authorization" }
+					: inspection.compact_authority.outcome === COMPACT_AUTHORITY_OUTCOME.ACTIVE
+					? { status: "in-progress", next_action: "finalize-existing-ordinary-review" }
+					: terminalAmbiguous
+						? { status: "blocked", next_action: "stop-and-report-ambiguous-compact-terminal-authority" }
+						: terminal
+							? { status: "terminal", next_action: compactAuthorityAction(inspection) }
+						: { status: "ready", next_action: "start-ordinary-review" }
 				: inspection.outcome === "clean"
 					? { status: "ready", next_action: "start-ordinary-review" }
 					: inspection.outcome === "blocked-ambiguous"
-					? { status: "blocked", next_action: "stop-and-report-ambiguous-authority" }
-					: {
-						status: "blocked",
-						next_action: inspection.outcome === "reset-in-progress"
-							? "request-explicit-reset-recovery-authorization"
-							: "request-explicit-reset-authorization",
-					}),
+						? { status: "blocked", next_action: "stop-and-report-ambiguous-authority" }
+						: { status: "blocked", next_action: inspection.outcome === "reset-in-progress" ? "request-explicit-reset-recovery-authorization" : "request-explicit-reset-authorization" }),
 		};
 	}
+
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.RECOVER_LOCK) {
 		const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);
 		if (typeof input.ownerHash !== "string") throw new Error("Lock recovery requires an exact ownerHash");
@@ -3154,7 +4324,20 @@ function executeReviewControllerOperation(
 	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.RECOVER) {
 		const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);
-		durableResetRecoveryRequest(defaultCwd);
+		try {
+			durableResetRecoveryRequest(defaultCwd);
+		} catch (error) {
+			if (error instanceof ReviewResetStateUnavailableError) {
+				return {
+					operation: parameters.operation,
+					status: "blocked",
+					outcome: REVIEW_CONTROLLER_OUTCOME.RESET_STATE_UNAVAILABLE,
+					mutation_performed: false,
+					next_action: "stop-and-restore-durable-reset-state",
+				};
+			}
+			throw error;
+		}
 		pendingAuthorizations.clear();
 		const result = destructiveResetReviewAuthorityV1({ cwd: defaultCwd, repositoryId: String(input.repositoryId), commonDirHash: String(input.commonDirHash), inventoryHash: String(input.inventoryHash), confirmation: String(input.confirmation), resume: true });
 		const inspection = inspectReviewAuthorityForController(defaultCwd);
@@ -3186,11 +4369,114 @@ function executeReviewControllerOperation(
 		store.repairCurrentAuthority();
 		return { operation: parameters.operation, repaired: true };
 	}
+	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.BIND_SDD) {
+		if (nativeReviewCli === null) return nativeStatusUnsupported(parameters.operation);
+		const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);
+		if (
+			typeof input.change !== "string" ||
+			typeof input.lineageId !== "string" ||
+			typeof input.expectedBindingRevision !== "string"
+		) throw new Error("Native bind-sdd requires change, lineageId, and expected binding revision");
+		if (!/^[a-z0-9][a-z0-9-]*$/.test(input.change)) throw new Error("Native bind-sdd change name is invalid");
+		if (!NATIVE_BIND_TOKEN_RE.test(input.lineageId)) throw new Error("Native bind-sdd lineageId is invalid");
+		if (input.expectedBindingRevision !== "" && !NATIVE_BIND_TOKEN_RE.test(input.expectedBindingRevision)) throw new Error("Native bind-sdd expected binding revision is invalid");
+		const expectedPath = join("openspec", "changes", input.change);
+		const canonicalCwd = realpathSync(defaultCwd);
+		const absolutePath = resolve(canonicalCwd, expectedPath);
+		if (!existsSync(absolutePath) || !lstatSync(absolutePath).isDirectory()) throw new Error("Native bind-sdd change path is outside or missing from the repository");
+		const canonicalPath = realpathSync(absolutePath);
+		const pathFromRepository = relative(canonicalCwd, canonicalPath);
+		if (pathFromRepository === ".." || pathFromRepository.startsWith(`..${sep}`) || isAbsolute(pathFromRepository)) throw new Error("Native bind-sdd change path is outside or missing from the repository");
+		try {
+			const bound = await nativeReviewCli.bindSdd({
+				cwd: canonicalCwd,
+				change: input.change,
+				lineage: input.lineageId,
+				expectedBindingRevision: input.expectedBindingRevision,
+				...(signal === undefined ? {} : { signal }),
+			});
+			if (
+				bound.change !== input.change ||
+				bound.lineage !== input.lineageId ||
+				typeof bound.revision !== "string" || bound.revision.length === 0 ||
+				typeof bound.authorityRevision !== "string" || bound.authorityRevision.length === 0 ||
+				typeof bound.receiptHash !== "string" || bound.receiptHash.length === 0 ||
+				bound.gateContext.lineageId !== input.lineageId ||
+				bound.gateContext.storeRevision !== bound.authorityRevision
+			) throw Object.assign(
+				new Error("Native bind-sdd returned malformed or inconsistent binding evidence"),
+				{ mutationOutcome: "unknown", nextAction: "replay-exact-native-operation" },
+			);
+			return { operation: parameters.operation, binding: {
+				revision: bound.revision,
+				change: bound.change,
+				lineage: bound.lineage,
+				authority_revision: bound.authorityRevision,
+				receipt_hash: bound.receiptHash,
+				gate_context: bound.gateContext.raw,
+			} };
+		} catch (error) {
+			return nativeOperationFailure(parameters.operation, error);
+		}
+	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.START) {
 		const rawStart = parseControllerJson(
 			requiredControllerString(parameters, "input"),
 			REVIEW_CONTROLLER_OPERATION.START,
 		);
+		if (rawStart.mode === REVIEW_MODE.ORDINARY && nativeReviewCli !== null) {
+			const selectorFree = !("policyPath" in rawStart) && !("baseRef" in rawStart);
+			if (selectorFree) {
+				let compact: CompactNativeStartClassification | undefined;
+				try {
+					const inspection = inspectReviewAuthorityForController(defaultCwd);
+					if (inspection.outcome !== "clean") {
+						return { operation: parameters.operation, status: "blocked", outcome: "legacy-read-only", mutation_performed: false, next_action: "use-compatible-read-or-gate-route" };
+					}
+					compact = classifyCompactAuthorityApplicability(defaultCwd);
+				} catch (error) {
+					if (isBrokenRepositoryIdentity(error)) {
+						return compactNativeStartBlockedResult({ applicability: COMPACT_NATIVE_START_APPLICABILITY.INVALID, lineageIds: [] });
+					}
+					if (!(error instanceof ReviewRepositoryError)) throw error;
+				}
+				if (compact !== undefined && compact.applicability !== COMPACT_NATIVE_START_APPLICABILITY.UNRELATED_HISTORY) {
+					return compactNativeStartBlockedResult(compact);
+				}
+			}
+			if (typeof parameters.lineageId === "string" && isKnownPiLegacyLineage(defaultCwd, parameters.lineageId)) {
+				return { operation: parameters.operation, status: "blocked", outcome: "legacy-read-only", mutation_performed: false, next_action: "use-compatible-read-or-gate-route" };
+			}
+			if ("policyHash" in rawStart) return nativeStartRejection("legacy-policy-hash-unsupported");
+			const unknownField = Object.keys(rawStart).find((field) => !["mode", "baseRef", "policyPath"].includes(field));
+			if (unknownField !== undefined) return nativeStartRejection("unknown-field", unknownField);
+			const policy: NativeStartPolicyValidation = rawStart.policyPath === undefined
+				? {}
+				: validateNativeStartPolicyPath(defaultCwd, rawStart.policyPath);
+			if (policy.reason !== undefined) return nativeStartRejection(policy.reason);
+			const baseRef = rawStart.baseRef;
+			if (baseRef !== undefined && !isCanonicalProcessString(baseRef)) return nativeStartRejection("base-ref-invalid");
+			const replayKey = JSON.stringify({ cwd: defaultCwd, lineageId: parameters.lineageId ?? null, input: parameters.input ?? null, inputPath: parameters.inputPath ?? null });
+			let candidateView: ReturnType<CandidateViewRegistry["create"]> | undefined;
+			try {
+				candidateView = candidateViews?.createOrReuse({ contributorRoot: defaultCwd, replayKey });
+				const result = await nativeReviewCli.start({
+					cwd: candidateView?.root ?? defaultCwd,
+					...(baseRef === undefined ? {} : { baseRef }),
+					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
+					...(policy.policyPath === undefined ? {} : { policyPath: policy.policyPath }),
+					...(signal === undefined ? {} : { signal }),
+				});
+				if (candidateView && candidateViews && result.lensesRequired) candidateViews.bind({ token: candidateView.token, lineageId: result.lineageId, selectedLenses: result.selectedLenses });
+				else if (candidateView && candidateViews && ((result.action === "created" && result.state === "reviewing") || result.action === "resumed" || result.action === "reuse-receipt")) candidateViews.retain(candidateView.token, result.lineageId);
+				else if (candidateView && candidateViews) candidateViews.cleanup(candidateView.token);
+				return { operation: parameters.operation, result: mapNativeStartResult(result) };
+			} catch (error) {
+				const value = error as { mutationOutcome?: unknown; nextAction?: unknown };
+				if (candidateView && candidateViews && value.mutationOutcome !== "unknown" && value.nextAction !== "replay-exact-native-operation") candidateViews.cleanup(candidateView.token);
+				return nativeOperationFailure(parameters.operation, error);
+			}
+		}
 		const inspection = inspectReviewAuthorityForController(defaultCwd);
 		if (inspection.outcome !== "clean") {
 			return {
@@ -3225,6 +4511,16 @@ function executeReviewControllerOperation(
 				const state = discoverCompactReview(defaultCwd, result.lineage_id).record.state;
 				return { operation: parameters.operation, result, state };
 			} catch (error) {
+				if (error instanceof CompactReviewTerminalAmbiguityError) {
+					return {
+						operation: parameters.operation,
+						status: "blocked",
+						lineage_created: false,
+						lineage_ids: error.lineageIds,
+						next_action: "stop-and-report-ambiguous-compact-terminal-authority",
+						inspection: inspectReviewAuthorityForController(defaultCwd),
+					};
+				}
 				if (error instanceof CompactReviewStartBlockedError) {
 					return {
 						operation: parameters.operation,
@@ -3297,6 +4593,47 @@ function executeReviewControllerOperation(
 		if (raw.final_evidence !== undefined && typeof raw.final_evidence !== "string") throw new Error("Review controller finalize final_evidence must be a string");
 		if (raw.final_verification_passed !== undefined && typeof raw.final_verification_passed !== "boolean") throw new Error("Review controller finalize final_verification_passed must be boolean");
 		if (raw.final_evidence !== undefined && raw.final_verification_passed === undefined) throw new Error("Review controller finalize with final_evidence requires an explicit final_verification_passed boolean");
+		if (
+			nativeReviewCli !== null &&
+			typeof parameters.lineageId === "string" &&
+			isKnownPiLegacyLineage(defaultCwd, parameters.lineageId)
+		) {
+			return { operation: parameters.operation, status: "blocked", outcome: "legacy-read-only", mutation_performed: false, next_action: "use-compatible-read-or-gate-route" };
+		}
+		if (nativeReviewCli !== null) {
+			const input = parseNativeCompactFinalizeInput({
+				cwd: defaultCwd,
+				...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
+				...raw,
+			});
+			let correctionCompletion = false;
+			let candidateView: ReturnType<CandidateViewRegistry["create"]> | undefined;
+			try {
+				if (candidateViews && parameters.lineageId === undefined) throw new CandidateViewError("Native FINALIZE requires an explicit candidate-view lineage");
+				correctionCompletion = input.review_result === undefined && (input.validation !== undefined || input.validation_proof !== undefined) && input.final_evidence !== undefined;
+				const replayKey = JSON.stringify({ cwd: defaultCwd, lineageId: parameters.lineageId ?? null, input: parameters.input ?? null, inputPath: parameters.inputPath ?? null });
+				candidateView = candidateViews && parameters.lineageId ? correctionCompletion ? candidateViews.createCorrected(parameters.lineageId, defaultCwd, replayKey) : candidateViews.resolveForFinalize(parameters.lineageId) : undefined;
+				const result = await nativeReviewCli.finalize({
+					cwd: candidateView?.root ?? defaultCwd,
+					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
+					...(input.review_result === undefined ? {} : { lensResults: input.review_result.lens_results.map((document, index) => ({ lens: document.lens ?? `lens-${index}`, document: toNativeReviewerDocument(document) })) }),
+					...(input.refuter_batch === undefined ? {} : { refuterDocument: toNativeRefuterDocument(input.refuter_batch) }),
+					...(input.correction_line_forecast === undefined ? {} : { correctionLines: input.correction_line_forecast }),
+					...(input.validation === undefined && input.validation_proof === undefined ? {} : { validationDocument: toNativeValidatorDocument(input.validation ?? input.validation_proof!) }),
+					...(input.final_evidence === undefined ? {} : { evidenceDocument: input.final_evidence, failed: input.final_verification_passed === false }),
+					...(signal === undefined ? {} : { signal }),
+				});
+				try {
+					if (correctionCompletion && candidateViews && parameters.lineageId) candidateViews.promoteCorrected(parameters.lineageId, candidateView!.token);
+					candidateViews?.cleanupTerminal(result.lineageId, result.state);
+				} catch {}
+				return { operation: parameters.operation, result: mapNativeFinalizeResult(result) };
+			} catch (error) {
+				const value = error as { mutationOutcome?: unknown; nextAction?: unknown };
+				if (correctionCompletion && candidateView && candidateViews && value.mutationOutcome !== "unknown" && value.nextAction !== "replay-exact-native-operation") candidateViews.cleanup(candidateView.token);
+				return nativeOperationFailure(parameters.operation, error);
+			}
+		}
 		return {
 			operation: parameters.operation,
 			result: finalizeCompactReview({
@@ -3372,6 +4709,7 @@ function executeReviewControllerOperation(
 		};
 	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.STATUS) {
+		if (parameters.lineageId === undefined) return nativeStatusUnsupported(parameters.operation);
 		const compactExists = compactV2LineageExists(defaultCwd, parameters.lineageId!);
 		const graphExists = graphV1LineageExists(defaultCwd, parameters.lineageId!);
 		if (compactExists && graphExists) throw new Error("Review authority is ambiguous across graph-v1 and compact-v2");
@@ -3403,6 +4741,65 @@ function executeReviewControllerOperation(
 		),
 	);
 	const derived = deriveReviewGateTarget(commandValue, defaultCwd);
+	if (
+		nativeReviewCli !== null &&
+		typeof parameters.lineageId === "string" &&
+		!compactV2LineageExists(derived.command.cwd, parameters.lineageId) &&
+		!graphV1LineageExists(derived.command.cwd, parameters.lineageId)
+	) {
+		try {
+			const nativeDerived = await deriveNativePublicationTarget(
+				derived,
+				publicationProbe,
+				publicationProbeTimeoutMs,
+				signal,
+			);
+			const intendedTree = assertFrozenPreCommitProjection(nativeDerived, parameters.lineageId, candidateViews);
+			const result = await nativeReviewCli.validate({
+				cwd: nativeDerived.command.cwd,
+				gate: requestedNativeGate(nativeDerived.command),
+				lineageId: parameters.lineageId,
+				flags: nativeGateFlags(nativeDerived),
+				...(signal === undefined ? {} : { signal }),
+			});
+			assertNativePublicationBinding(result, nativeDerived);
+			const authorizedDerived = result.allowed && result.result === "allow"
+				? await rederiveNativePublicationTarget(
+					nativeDerived,
+					commandValue,
+					defaultCwd,
+					publicationProbe,
+					publicationProbeTimeoutMs,
+					signal,
+				)
+				: nativeDerived;
+			if (result.allowed && result.result === "allow") assertFrozenPreCommitProjection(authorizedDerived, parameters.lineageId, candidateViews);
+			const response: Record<string, unknown> = {
+				operation: parameters.operation,
+				result: mapNativeValidateResult(result),
+				derived_target: nativeDerived.target,
+			};
+			if (result.allowed && result.result === "allow") {
+				const commandHash = reviewAuthorizationKey(commandValue, authorizedDerived.command.cwd);
+				const authorization: PendingReviewAuthorization = {
+					command_hash: commandHash,
+					target_hash: authorizationTargetHash(authorizedDerived),
+					receipt_hash: null,
+					native_gate: {
+						lineage_id: result.gateContext.lineageId,
+						store_revision: result.gateContext.storeRevision,
+						fingerprint: nativeGateFingerprint(result, authorizedDerived),
+						...(intendedTree === undefined ? {} : { intended_tree: intendedTree }),
+					},
+				};
+				pendingAuthorizations.set(commandHash, authorization);
+				response.authorization = authorization;
+			}
+			return response;
+		} catch (error) {
+			return nativePublicationFailure(parameters.operation, error);
+		}
+	}
 	let releaseFastPath: Record<string, unknown> | undefined;
 	if (input.release !== undefined) {
 		if (derived.command.event !== "pre-release") {
@@ -3450,13 +4847,30 @@ function executeReviewControllerOperation(
 			};
 		}
 	}
-	let compact = false;
-	if (typeof parameters.lineageId === "string" && parameters.lineageId.trim().length > 0) {
+	if (
+		parameters.changeName === undefined &&
+		(parameters.lineageId === undefined || !graphV1LineageExists(derived.command.cwd, parameters.lineageId)) &&
+		hasEligibleGraphV1RecoveryAuthorityV1(derived.command.cwd)
+	) {
+		throw new Error("Review controller validate requires changeName and a valid supersession for eligible graph-v1 recovery authority");
+	}
+	const recoveredAuthority = parameters.changeName === undefined
+		? undefined
+		: resolveReviewAuthorityForChange(derived.command.cwd, parameters.changeName);
+	if (
+		recoveredAuthority !== undefined &&
+		parameters.lineageId !== undefined &&
+		parameters.lineageId !== recoveredAuthority.record.state.lineage_id
+	) {
+		throw new Error("Review controller validate lineageId does not match the change-scoped recovered authority");
+	}
+	let compact = recoveredAuthority !== undefined;
+	if (!compact && typeof parameters.lineageId === "string" && parameters.lineageId.trim().length > 0) {
 		const compactExists = compactV2LineageExists(derived.command.cwd, parameters.lineageId);
 		const graphExists = graphV1LineageExists(derived.command.cwd, parameters.lineageId);
 		if (compactExists && graphExists) throw new Error("Review authority is ambiguous across graph-v1 and compact-v2");
 		compact = compactExists;
-	} else {
+	} else if (!compact) {
 		try {
 			discoverCompactReview(derived.command.cwd, undefined, true);
 			compact = true;
@@ -3468,6 +4882,7 @@ function executeReviewControllerOperation(
 		const result = validateCompactReviewGate({
 			cwd: derived.command.cwd,
 			...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
+			...(parameters.changeName === undefined ? {} : { changeName: parameters.changeName }),
 			deriveTarget: () => {
 				const rederived = deriveReviewGateTarget(commandValue, defaultCwd);
 				if (rederived.command.cwd !== derived.command.cwd) throw new Error("Lifecycle command repository changed during compact validation");
@@ -3529,11 +4944,16 @@ function executeReviewControllerOperation(
 	return response;
 }
 
-function gateLifecycleCommand(
+async function gateLifecycleCommand(
 	command: string,
 	defaultCwd: string,
 	pendingAuthorizations: Map<string, PendingReviewAuthorization>,
-): ToolCallEventResult | undefined {
+	nativeReviewCli: NativeReviewCli | null = null,
+	publicationProbe: PublicationProbe = nodePublicationProbe,
+	publicationProbeTimeoutMs = PUBLICATION_PROBE_TIMEOUT_MS,
+	signal?: AbortSignal,
+	candidateViews: CandidateViewRegistry | null = null,
+): Promise<ToolCallEventResult | undefined> {
 	const inspection = inspectReviewLifecycleCommand(command, defaultCwd);
 	if (!inspection.event) return undefined;
 	if (!inspection.command) {
@@ -3557,9 +4977,40 @@ function gateLifecycleCommand(
 		};
 	}
 	pendingAuthorizations.delete(commandHash);
+	if (authorization.native_gate) {
+		try {
+			derived = await deriveNativePublicationTarget(
+				derived,
+				publicationProbe,
+				publicationProbeTimeoutMs,
+				signal,
+			);
+		} catch (error) {
+			return {
+				block: true,
+				reason: `Gentle AI ${inspection.event} gate native publication target changed after authorization and failed closed: ${error instanceof Error ? error.message : String(error)}`,
+			};
+		}
+	}
+	try {
+		const intendedTree = authorization.native_gate === undefined
+			? undefined
+			: assertFrozenPreCommitProjection(derived, authorization.native_gate.lineage_id, candidateViews);
+		if (authorization.native_gate?.intended_tree !== undefined && intendedTree !== authorization.native_gate.intended_tree) {
+			return {
+				block: true,
+				reason: `Gentle AI ${inspection.event} gate staged projection changed after authorization and failed closed.`,
+			};
+		}
+	} catch (error) {
+		return {
+			block: true,
+			reason: `Gentle AI ${inspection.event} gate could not re-prove the staged projection and failed closed: ${error instanceof Error ? error.message : String(error)}`,
+		};
+	}
 	if (
 		authorization.command_hash !== commandHash ||
-		authorization.target_hash !== canonicalHash(derived.target)
+		authorization.target_hash !== authorizationTargetHash(derived)
 	) {
 		const mismatch = authorization.command_hash !== commandHash ? "command identity" : "typed target";
 		return {
@@ -3567,6 +5018,56 @@ function gateLifecycleCommand(
 			reason: `Gentle AI ${inspection.event} gate ${mismatch} changed after authorization and failed closed.`,
 		};
 	}
+	if (authorization.native_gate) {
+		if (nativeReviewCli === null) {
+			return {
+				block: true,
+				reason: `Gentle AI ${inspection.event} gate native validation dependency is unavailable and failed closed.`,
+			};
+		}
+		try {
+			const fresh = await nativeReviewCli.validate({
+				cwd: derived.command.cwd,
+				gate: requestedNativeGate(derived.command),
+				lineageId: authorization.native_gate.lineage_id,
+				flags: nativeGateFlags(derived),
+				...(signal === undefined ? {} : { signal }),
+			});
+			assertNativePublicationBinding(fresh, derived);
+			if (
+				!fresh.allowed ||
+				fresh.result !== "allow"
+			) {
+				return {
+					block: true,
+					reason: `Gentle AI ${inspection.event} gate native authority, receipt, revision, or target changed after authorization and failed closed.`,
+				};
+			}
+			const postNativeDerived = await rederiveNativePublicationTarget(
+				derived,
+				command,
+				defaultCwd,
+				publicationProbe,
+				publicationProbeTimeoutMs,
+				signal,
+			);
+			const postNativeIntendedTree = assertFrozenPreCommitProjection(postNativeDerived, authorization.native_gate.lineage_id, candidateViews);
+			if (authorization.native_gate.intended_tree !== undefined && postNativeIntendedTree !== authorization.native_gate.intended_tree) throw new CandidateViewError("staged projection changed during native validation");
+			assertNativePublicationBinding(fresh, postNativeDerived);
+			if (nativeGateFingerprint(fresh, postNativeDerived) !== authorization.native_gate.fingerprint) {
+				return {
+					block: true,
+					reason: `Gentle AI ${inspection.event} gate native authority, receipt, revision, or target changed after authorization and failed closed.`,
+				};
+			}
+			derived = postNativeDerived;
+		} catch {
+			return {
+				block: true,
+				reason: `Gentle AI ${inspection.event} gate native bash-time validation failed closed.`,
+			};
+		}
+	}
 	if (authorization.release_fast_path) {
 		// The remote protected main head is rechecked immediately before the tag
 		// push; an advanced or unprovable head fails closed.
@@ -3592,7 +5093,7 @@ export async function enforceReviewGateAndCommandSafety(
 ): Promise<ToolCallEventResult | undefined> {
 	const safetyResult = await evaluateSafety(command);
 	if (safetyResult) return safetyResult;
-	return evaluateGate(command);
+	return await evaluateGate(command);
 }
 
 /** @internal */
@@ -3609,25 +5110,119 @@ export const __testing = {
 	inspectReviewLifecycleCommand,
 	deriveReviewGateTarget,
 	gateLifecycleCommand,
+	nativeStatusUnsupported,
 	executeReviewControllerOperation,
 	enforceReviewGateAndCommandSafety,
 	renderSddModelPanel: renderSddModelPanelForTesting,
 	getOrchestratorPrompt,
 	renderOrchestratorPrompt,
+	resolveControllerSddStatus,
+	resolveStartupControllerSddStatus,
+	repositoryLocationIdentity,
+	runPublicationProbeGit,
+	publicationProbeErrorCode: PUBLICATION_PROBE_ERROR_CODE,
 };
 
-export default function gentleAi(pi: ExtensionAPI): void {
+const NATIVE_SDD_STATUS_STARTUP_TIMEOUT_MS = 1_000;
+
+async function resolveControllerSddStatus(
+	cwd: string,
+	changeName: string | undefined,
+	includeInstructions: boolean,
+	artifactStore: SddPreflightPreferences["artifactStore"] | undefined,
+	nativeReviewCli: NativeReviewCli | null = null,
+	signal?: AbortSignal,
+) {
+	const base = resolveSddStatus({ cwd, changeName, includeInstructions, artifactStore });
+	if (!base.changeName || base.isNonAuthoritative) return base;
+	if (hasRecoveryObligationForChange(cwd, base.changeName)) {
+		return resolveSddStatus({
+			cwd,
+			changeName: base.changeName,
+			includeInstructions,
+			artifactStore,
+			reviewAuthority: {
+				expected: true,
+				resolve: () => {
+					const active = resolveReviewAuthorityForChange(cwd, base.changeName!);
+					if (!active) throw new Error("validated recovered review authority is missing");
+					return { activeAuthorityId: active.record.state.lineage_id };
+				},
+			},
+		});
+	}
+	if (base.applyState !== "all_done" || nativeReviewCli === null) return base;
+	try {
+		const native = await nativeReviewCli.sddStatus({ cwd, change: base.changeName, ...(signal === undefined ? {} : { signal }) });
+		return resolveSddStatus({
+			cwd,
+			changeName: base.changeName,
+			includeInstructions,
+			artifactStore,
+			nativeReviewReadiness: { expected: true, ready: native.ready },
+		});
+	} catch (error) {
+		return resolveSddStatus({
+			cwd,
+			changeName: base.changeName,
+			includeInstructions,
+			artifactStore,
+			nativeReviewReadiness: { expected: true, ready: false, reason: error instanceof Error ? error.message : "native bound status failed" },
+		});
+	}
+}
+
+async function resolveStartupControllerSddStatus(
+	cwd: string,
+	changeName: string | undefined,
+	includeInstructions: boolean,
+	artifactStore: SddPreflightPreferences["artifactStore"] | undefined,
+	nativeReviewCli: NativeReviewCli | null,
+	timeoutMs = NATIVE_SDD_STATUS_STARTUP_TIMEOUT_MS,
+) {
+	return resolveControllerSddStatus(cwd, changeName, includeInstructions, artifactStore, nativeReviewCli, AbortSignal.timeout(timeoutMs));
+}
+
+function hasRecoveryObligationForChange(cwd: string, changeName: string): boolean {
+	try {
+		return SupersessionStoreV1.forRepository(cwd).hasRecoveryRequiredMarker(changeName) || hasEligibleGraphV1RecoveryAuthorityV1(cwd);
+	} catch (error) {
+		// A non-repository cannot have repository-anchored recovery authority.
+		if (error instanceof Error && error.message === "Unable to resolve Git repository authority") return false;
+		// An unreadable marker, store, or Git authority is recovery-required, never absent.
+		return true;
+	}
+}
+
+export interface GentleAiRuntimeDependencies {
+	nativeReviewCli?: NativeReviewCli | null;
+	candidateViews?: CandidateViewRegistry | null;
+	publicationProbe?: PublicationProbe;
+	publicationProbeTimeoutMs?: number;
+	bashTimeRevalidationTimeoutMs?: number;
+}
+
+export function createGentleAiExtension(dependencies: GentleAiRuntimeDependencies = {}): (pi: ExtensionAPI) => void {
+	const nativeReviewCli = dependencies.nativeReviewCli === undefined ? createNativeReviewCli() : dependencies.nativeReviewCli;
+	const publicationProbe = dependencies.publicationProbe ?? nodePublicationProbe;
+	const publicationProbeTimeoutMs = dependencies.publicationProbeTimeoutMs ?? PUBLICATION_PROBE_TIMEOUT_MS;
+	const bashTimeRevalidationTimeoutMs = dependencies.bashTimeRevalidationTimeoutMs ?? BASH_TIME_REVALIDATION_TIMEOUT_MS;
+	if (!Number.isSafeInteger(publicationProbeTimeoutMs) || publicationProbeTimeoutMs <= 0) throw new TypeError("Publication probe timeout must be a positive safe integer");
+	if (!Number.isSafeInteger(bashTimeRevalidationTimeoutMs) || bashTimeRevalidationTimeoutMs <= 0) throw new TypeError("Bash-time revalidation timeout must be a positive safe integer");
+	return function gentleAi(pi: ExtensionAPI): void {
 	const pendingReviewAuthorizations = new Map<string, PendingReviewAuthorization>();
+	const candidateViews = dependencies.candidateViews === undefined ? new CandidateViewRegistry() : dependencies.candidateViews;
 
 	pi.registerTool({
 		name: "gentle_review",
 		label: "Gentle Review Controller",
 		description:
-			"Inspect and recover review authority, run new ordinary review through compact start/finalize/validate, preserve graph-v1 Judgment Day and compatibility reads, and authorize one exact lifecycle command. RESET and RECOVER require fresh interactive authorization and fail closed headlessly.",
-		promptSnippet: "Inspect authority, then use compact start/finalize/validate for ordinary review; use graph-v1 only for explicit Judgment Day",
+			"Inspect and recover review authority, run new native ordinary review through start/finalize/validate, preserve legacy compact compatibility reads and graph-v1 Judgment Day, and authorize one exact lifecycle command. FINALIZE input is a JSON string: review_result.lens_results[] entries contain lens, findings, and non-empty evidence exactly once for every lens selected by START; final_evidence and final_verification_passed are paired. This is the Pi wrapper contract, distinct from native CLI --result, --refuter, --validation, and --evidence files. RESET/RECOVER remain destructive; prepare-supersession/supersede require fresh interactive authorization and fail closed headlessly.",
+		promptSnippet: "Inspect authority, then use native start/finalize/validate for a new ordinary review; use graph-v1 only for explicit Judgment Day",
 		promptGuidelines: [
-			'Call {"operation":"inspect"} before START. Ordinary START uses a JSON string such as "{\\"mode\\":\\"ordinary\\",\\"policyHash\\":\\"<hash>\\"}"; the controller derives lineage, Git/untracked scope, tier, lenses, authored lines, and budget.',
-			"Run selected lenses once, then call FINALIZE with causal result JSON. FINALIZE alone records correction forecast, Git-derived correction evidence, targeted validation, and final evidence. Use ADVANCE only for explicit graph-v1 Judgment Day.",
+			'Call {"operation":"inspect"} before START. New native ordinary START uses a JSON string such as "{\\"mode\\":\\"ordinary\\"}", with optional baseRef or repository-local policyPath; policyHash is legacy compact-only. The controller derives lineage, Git/untracked scope, tier, lenses, authored lines, and budget.',
+			"For non-destructive legacy recovery, call prepare-supersession with one exact change, source, successor, operation, and prepared evidence input. Call supersede only with the returned request hash and exact English challenge after fresh UI approval; it never falls back to RESET or RECOVER. Headless, stale, conflicting, malformed, or unsupported recovery remains resolve-review blocked; exact retries are idempotent, but semantic retries require a new operation.",
+			"Run selected lenses once, then call FINALIZE with a JSON string containing review_result.lens_results entries for every START-selected lens. Each entry has lens, findings, and non-empty evidence; clean lenses use findings: []. Pair final_evidence with final_verification_passed. This Pi wrapper shape differs from native CLI --result, --refuter, --validation, and --evidence files. FINALIZE alone records correction forecast, Git-derived correction evidence, targeted validation, and final evidence. Use ADVANCE only for explicit graph-v1 Judgment Day.",
 			"For blocked-legacy or blocked-mixed, do not call START repeatedly. Explain invalidation, request explicit user authorization for the exact reset_request challenge, then call RESET or RECOVER only after authorization. RESET and RECOVER internally INSPECT authority; require their verified clean result and next_action start-fresh-ordinary-review-after-verified-clean before continuing directly to a fresh ordinary START.",
 			"A reported lineage_created false or pre-authority validation error proves no lineage was created. After ambiguous START or FINALIZE output, replay the exact operation so compact CAS returns the committed revision or rejects a stale/semantic retry.",
 			"Use gentle_review for bounded review transaction operations and exact lifecycle validation; never fabricate bash tool metadata or a separate gate target.",
@@ -3637,10 +5232,15 @@ export default function gentleAi(pi: ExtensionAPI): void {
 		async execute(_toolCallId, parameters, signal, _onUpdate, ctx) {
 			if (signal?.aborted) throw new Error("Review controller operation was cancelled");
 			await authorizeDestructiveReviewOperation(parameters, ctx);
-			const details = executeReviewControllerOperation(
+			const details = await executeReviewControllerOperation(
 				parameters,
 				ctx.cwd,
 				pendingReviewAuthorizations,
+				nativeReviewCli,
+				signal,
+				publicationProbe,
+				publicationProbeTimeoutMs,
+				candidateViews,
 			);
 			return {
 				content: [{ type: "text", text: JSON.stringify(details) }],
@@ -3708,11 +5308,13 @@ export default function gentleAi(pi: ExtensionAPI): void {
 				: "";
 		const phase = isSddAgent ? sddPhaseFromAgentStartEvent(event) : undefined;
 		const nativeStatusPrompt = phase
-			? `\n\n${renderNativeSddPhasePrompt(resolveSddStatus({
-				cwd: ctx.cwd,
-				includeInstructions: true,
-				artifactStore: prefs?.artifactStore,
-			}), phase)}`
+			? `\n\n${renderNativeSddPhasePrompt(await resolveStartupControllerSddStatus(
+				ctx.cwd,
+				undefined,
+				true,
+				prefs?.artifactStore,
+				nativeReviewCli,
+			), phase)}`
 			: "";
 		const gentlePrompt = isNamedAgent || isSddAgent
 			? ""
@@ -3728,12 +5330,27 @@ export default function gentleAi(pi: ExtensionAPI): void {
 			event.input,
 		);
 		if (sensitivePathDenied) return sensitivePathDenied;
+		if (event.toolName === "subagent_run") {
+			try {
+				injectReviewCandidateView(event.input, candidateViews);
+				return undefined;
+			} catch (error) {
+				return {
+					block: true,
+					reason: error instanceof Error ? error.message : "review subagent dispatch is invalid",
+				};
+			}
+		}
 		if (event.toolName !== "bash") return undefined;
 		if (!isRecord(event.input) || typeof event.input.command !== "string")
 			return undefined;
 		return enforceReviewGateAndCommandSafety(
 			event.input.command,
-			(command) => gateLifecycleCommand(command, ctx.cwd, pendingReviewAuthorizations),
+			(command) => {
+				const deadline = AbortSignal.timeout(bashTimeRevalidationTimeoutMs);
+				const signal = ctx.signal === undefined ? deadline : AbortSignal.any([ctx.signal, deadline]);
+				return gateLifecycleCommand(command, ctx.cwd, pendingReviewAuthorizations, nativeReviewCli, publicationProbe, publicationProbeTimeoutMs, signal, candidateViews);
+			},
 			(command) => confirmCommand(command, ctx),
 		);
 	});
@@ -3759,14 +5376,15 @@ export default function gentleAi(pi: ExtensionAPI): void {
 		},
 	});
 
-	const handleSddStatusCommand = (args: string, ctx: ExtensionContext) => {
+	const handleSddStatusCommand = async (args: string, ctx: ExtensionContext) => {
 		const parsed = parseSddStatusCommandArgs(args);
-		const status = resolveSddStatus({
-			cwd: ctx.cwd,
-			changeName: parsed.changeName,
-			includeInstructions: true,
-			artifactStore: getSddPreflightPreferences(ctx)?.artifactStore,
-		});
+		const status = await resolveControllerSddStatus(
+			ctx.cwd,
+			parsed.changeName,
+			true,
+			getSddPreflightPreferences(ctx)?.artifactStore,
+			nativeReviewCli,
+		);
 		ctx.ui.notify(
 			parsed.json ? JSON.stringify(status, null, 2) : renderSddStatusMarkdown(status),
 			sddStatusSeverity(status),
@@ -3776,18 +5394,19 @@ export default function gentleAi(pi: ExtensionAPI): void {
 	pi.registerCommand("sdd-status", {
 		description: "Show deterministic SDD change status and instructions.",
 		handler: async (args, ctx) => {
-			handleSddStatusCommand(args, ctx);
+			await handleSddStatusCommand(args, ctx);
 		},
 	});
 
-	const handleSddContinueCommand = (args: string, ctx: ExtensionContext) => {
+	const handleSddContinueCommand = async (args: string, ctx: ExtensionContext) => {
 		const parsed = parseSddStatusCommandArgs(args);
-		const status = resolveSddStatus({
-			cwd: ctx.cwd,
-			changeName: parsed.changeName,
-			includeInstructions: true,
-			artifactStore: getSddPreflightPreferences(ctx)?.artifactStore,
-		});
+		const status = await resolveControllerSddStatus(
+			ctx.cwd,
+			parsed.changeName,
+			true,
+			getSddPreflightPreferences(ctx)?.artifactStore,
+			nativeReviewCli,
+		);
 		ctx.ui.notify(
 			parsed.json ? JSON.stringify(status, null, 2) : renderSddDispatcherMarkdown(status),
 			sddStatusSeverity(status),
@@ -3797,7 +5416,7 @@ export default function gentleAi(pi: ExtensionAPI): void {
 	pi.registerCommand("sdd-continue", {
 		description: "Resolve SDD status and route the next phase deterministically.",
 		handler: async (args, ctx) => {
-			handleSddContinueCommand(args, ctx);
+			await handleSddContinueCommand(args, ctx);
 		},
 	});
 
@@ -3901,4 +5520,9 @@ export default function gentleAi(pi: ExtensionAPI): void {
 			);
 		},
 	});
+	};
+}
+
+export default function gentleAi(pi: ExtensionAPI): void {
+	return createGentleAiExtension()(pi);
 }