halfcycle 0.3.31 → 0.3.33

package/dist/index.js

@@ -1,13 +1,10 @@
 // dist/install.js
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname2, join as join5, posix, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// ../events/dist/result.js
-import { z as z2 } from "zod";
-
 // ../core/dist/guard-record.js
 import { z } from "zod";
 var severitySchema = z.enum(["info", "warn", "block"]);
@@ -113,7 +110,101 @@ ${block}`);
   return result;
 }
 
+// ../core/dist/hook-wiring.js
+var SETTINGS_REL = ".claude/settings.json";
+var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
+var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
+var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
+var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
+var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
+var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
+var HALFCYCLE_HOOK_WIRING = [
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_START_MARKER_REL}`,
+    script: SESSION_START_MARKER_REL
+  },
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 10,
+    command: `bash ./${GUARD_RUNNER_REL} refresh-credential`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${USER_PROMPT_REMINDER_REL}`,
+    script: USER_PROMPT_REMINDER_REL
+  },
+  {
+    event: "PostToolUse",
+    matcher: WRITE_CAPABLE_TOOLS.join("|"),
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook post-tool-use`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "Stop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SubagentStop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook subagent-stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SessionEnd",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_END_MARKER_REL}`,
+    script: SESSION_END_MARKER_REL
+  }
+];
+var RETIRED_HOOK_COMMANDS = [];
+var HALFCYCLE_HOOK_COMMANDS = /* @__PURE__ */ new Set([
+  ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.command),
+  ...RETIRED_HOOK_COMMANDS
+]);
+var HALFCYCLE_HOOK_WIRING_PATHS = [
+  .../* @__PURE__ */ new Set([SETTINGS_REL, ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])
+];
+
+// ../core/dist/secret-shape.js
+var SECRET_SHAPE_PATTERNS = [
+  // Assignment to a credential-named identifier: `apiKey = "..."`, `secret: '...'`,
+  // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
+  /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
+  // Connection strings that embed credentials: `scheme://user:pass@host`.
+  /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/i,
+  // Bearer / authorization header values.
+  /\bauthorization\b\s*[:=]\s*['"]?\s*bearer\s+\S+/i,
+  // PEM / private-key block headers.
+  /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+)?PRIVATE\s+KEY-----/,
+  // JWT shape: three base64url segments separated by dots.
+  /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/,
+  // A long high-entropy hex/base64 run adjacent to a credential-ish word on the
+  // same line — a raw key literal. Kept last (broadest, most likely false-drop).
+  /\b(?:key|token|secret|credential)\b[\s\S]{0,40}[A-Za-z0-9+/_-]{32,}/i
+];
+function looksLikeSecret(text) {
+  for (const pattern of SECRET_SHAPE_PATTERNS) {
+    if (pattern.test(text))
+      return true;
+  }
+  return false;
+}
+
 // ../events/dist/result.js
+import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
   guardId: z2.string(),
   patternRef: z2.string(),
@@ -171,74 +262,28 @@ var wireErrorSchema = z2.object({
   message: z2.string()
 }).strict();
 
-// ../events/dist/telemetry.js
-import { z as z3 } from "zod";
-var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
-var guardEvalOutcomeSchema = z3.enum([
-  "evaluated",
-  "infra-error",
-  "contract-error",
-  "unconfigured"
-]);
-var guardEvalRunSchema = z3.object({
-  // `runId`/`outcome` are the E2 run-observability additions, declared
-  // field-level-OPTIONAL as the FIRST (expand) step of an expand-contract
-  // migration. Every new record populated by the migrated writer (T-07)
-  // carries both; a legacy line predating the amendment carries neither and
-  // must still parse (the mixed-era guard-eval log the Build-Record reader
-  // assembles from, and the runner emit not yet migrated). So the presence
-  // refinement below is skipped for a legacy line (no `outcome`), and the
-  // per-writer guarantee lives with the writer + reader-normalisation (T-07),
-  // where the schema may then be tightened to required. runId is uuid-checked
-  // WHEN present; outcome is enum-checked when present.
-  runId: z3.string().uuid().optional(),
-  engagementId: z3.string().optional(),
-  runType: z3.enum(["hook", "ci"]),
-  occurredAt: utcIso8601,
-  outcome: guardEvalOutcomeSchema.optional(),
-  failureReason: z3.string().optional(),
-  phase: z3.string().optional(),
-  scope: z3.record(z3.string(), z3.unknown()),
-  cost: z3.record(z3.string(), z3.unknown()).optional(),
-  result: resultEnvelopeSchema.optional()
-}).strict().superRefine((run, ctx) => {
-  if (run.outcome === void 0)
-    return;
-  if (run.outcome === "evaluated" && run.result === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is required when outcome is 'evaluated'"
-    });
-  }
-  if (run.outcome !== "evaluated" && run.result !== void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is only present when outcome is 'evaluated'"
-    });
-  }
-  if (run.outcome !== "unconfigured" && run.engagementId === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["engagementId"],
-      message: "engagementId is required unless outcome is 'unconfigured'"
-    });
-  }
-});
+// ../events/dist/lone-surrogates.js
+var LONE_SURROGATE = new RegExp("\\p{Cs}", "u");
+function hasLoneSurrogate(text) {
+  return LONE_SURROGATE.test(text);
+}
+var LONE_SURROGATE_MESSAGE = "must be valid text: it holds half of a character pair with no other half";
 
-// ../events/dist/state.js
+// ../events/dist/build-record.js
 import { z as z4 } from "zod";
-var utcIso86012 = z4.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
+
+// ../events/dist/state.js
+import { z as z3 } from "zod";
+var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var STATE_RECORD_FORMAT = "halfcycle-state-record/v1";
-var stepIdSchema = z4.string().regex(/^(l[0-5](-l[0-5])?|xl)\.[a-z0-9-]+$/);
-var methodVersionSchema = z4.string().regex(/^\d+\.\d+\.\d+$/);
+var stepIdSchema = z3.string().regex(/^(l[0-5](-l[0-5])?|xl)\.[a-z0-9-]+$/);
+var methodVersionSchema = z3.string().regex(/^\d+\.\d+\.\d+$/);
 var anchorPathRegex = /^(?!\/)(?!.*#)(?!method\/)(?!(.*\/)?docs\/method\/).+$/;
-var recordKindSchema = z4.enum(["artefact", "step-run", "gate", "intervention"]);
-var methodLayerSchema = z4.enum(["l0", "l1", "l2", "l3", "l3-l4", "l4", "l5", "xl"]);
-var evidenceKindSchema = z4.enum(["anchor", "diff", "repro", "question-answer", "no-op"]);
-var declarableEvidenceKindSchema = z4.enum(["anchor", "diff", "repro", "question-answer"]);
-var dispositionSchema = z4.enum([
+var recordKindSchema = z3.enum(["artefact", "step-run", "gate", "intervention"]);
+var methodLayerSchema = z3.enum(["l0", "l1", "l2", "l3", "l3-l4", "l4", "l5", "xl"]);
+var evidenceKindSchema = z3.enum(["anchor", "diff", "repro", "question-answer", "no-op"]);
+var declarableEvidenceKindSchema = z3.enum(["anchor", "diff", "repro", "question-answer"]);
+var dispositionSchema = z3.enum([
   "prevented",
   "corrected-in-spec",
   "corrected-in-scope",
@@ -248,20 +293,20 @@ var dispositionSchema = z4.enum([
   "surfaced",
   "filed-forward"
 ]);
-var mechanismSchema = z4.enum(["guard", "verdict", "served-step", "method-step"]);
-var artefactStateSchema = z4.enum(["created", "updated"]);
+var mechanismSchema = z3.enum(["guard", "verdict", "served-step", "method-step"]);
+var artefactStateSchema = z3.enum(["created", "updated"]);
 var QUALIFIED_OUTCOMES = ["declined", "parked"];
-var qualifiedOutcomeSchema = z4.enum(QUALIFIED_OUTCOMES);
+var qualifiedOutcomeSchema = z3.enum(QUALIFIED_OUTCOMES);
 function isQualifiedOutcome(outcome) {
   return QUALIFIED_OUTCOMES.includes(outcome);
 }
-var runOutcomeSchema = z4.enum([
+var runOutcomeSchema = z3.enum([
   "completed",
   "attempted-failed",
   ...QUALIFIED_OUTCOMES
 ]);
-var gateKindSchema = z4.enum(["approval", "mechanical"]);
-var gateVerdictSchema = z4.enum(["pass", "fail", ...QUALIFIED_OUTCOMES]);
+var gateKindSchema = z3.enum(["approval", "mechanical"]);
+var gateVerdictSchema = z3.enum(["pass", "fail", ...QUALIFIED_OUTCOMES]);
 function outcomeReasonIssue(outcome, reason) {
   if (isQualifiedOutcome(outcome) && reason === void 0) {
     return { message: `outcomeReason is required when the outcome is '${outcome}'` };
@@ -273,142 +318,383 @@ function outcomeReasonIssue(outcome, reason) {
   }
   return null;
 }
-var anchorEvidenceSchema = z4.object({
-  kind: z4.literal("anchor"),
-  path: z4.string().regex(anchorPathRegex),
+var anchorEvidenceSchema = z3.object({
+  kind: z3.literal("anchor"),
+  path: z3.string().regex(anchorPathRegex),
   // Optional 1-based line number within the file at `path`. Present when the
   // writer knows the exact line; omitted — never `0`, never `null` — when it
   // does not, because a line number is not always obtainable. Absence is a
   // valid, permanent state here, not a gap meant to be filled in later.
-  line: z4.number().optional()
+  line: z3.number().optional()
 }).strict();
-var diffEvidenceSchema = z4.object({
-  kind: z4.literal("diff"),
-  ref: z4.string()
+var diffEvidenceSchema = z3.object({
+  kind: z3.literal("diff"),
+  ref: z3.string()
 }).strict();
-var reproEvidenceSchema = z4.object({
-  kind: z4.literal("repro"),
-  steps: z4.string().max(2e3)
+var reproEvidenceSchema = z3.object({
+  kind: z3.literal("repro"),
+  steps: z3.string().max(2e3)
 }).strict();
-var questionAnswerEvidenceSchema = z4.object({
-  kind: z4.literal("question-answer"),
-  question: z4.string().max(2e3),
-  before: z4.string().max(2e3),
-  after: z4.string().max(2e3)
+var questionAnswerEvidenceSchema = z3.object({
+  kind: z3.literal("question-answer"),
+  question: z3.string().max(2e3),
+  before: z3.string().max(2e3),
+  after: z3.string().max(2e3)
 }).strict();
-var noOpEvidenceSchema = z4.object({
-  kind: z4.literal("no-op"),
-  inspected: z4.string().max(2e3),
-  unchangedBecause: z4.string().max(2e3)
+var noOpEvidenceSchema = z3.object({
+  kind: z3.literal("no-op"),
+  inspected: z3.string().max(2e3),
+  unchangedBecause: z3.string().max(2e3)
 }).strict();
-var evidenceSchema = z4.discriminatedUnion("kind", [
+var evidenceSchema = z3.discriminatedUnion("kind", [
   anchorEvidenceSchema,
   diffEvidenceSchema,
   reproEvidenceSchema,
   questionAnswerEvidenceSchema,
   noOpEvidenceSchema
 ]);
-var stateRecordEnvelopeSchema = z4.object({
-  format: z4.literal(STATE_RECORD_FORMAT),
+var stateRecordEnvelopeSchema = z3.object({
+  format: z3.literal(STATE_RECORD_FORMAT),
   recordKind: recordKindSchema,
-  recordId: z4.string().uuid(),
+  recordId: z3.string().uuid(),
   methodVersion: methodVersionSchema,
-  engagementId: z4.string(),
+  engagementId: z3.string(),
   stepId: stepIdSchema,
   // Immutable: names when the thing happened, never when a later disposition
   // moved.
-  occurredAt: utcIso86012,
+  occurredAt: utcIso8601,
   // Equal to `occurredAt` on first write; advances on each re-emit OF A FINDING.
   // Carried on the shared envelope so a "when did this last change" query is
   // kind-agnostic. Kept rather than generalised to `updatedAt` because
   // `disposition` is the only field any re-emit may change (§5.3).
-  dispositionAt: utcIso86012,
+  dispositionAt: utcIso8601,
   evidence: evidenceSchema,
   // Which phase of the project this record belongs to, if any. Present on
   // records written during phase-scoped work; absent on records that run once
   // for the whole project rather than per phase. Absence is meaningful on its
   // own — it is never replaced with a placeholder value, and it is read as
   // "satisfies any phase", not as "unknown".
-  phase: z4.string().optional()
+  phase: z3.string().optional()
 });
-var artefactRefSchema = z4.object({
-  name: z4.string(),
-  parent: z4.string()
+var artefactRefSchema = z3.object({
+  name: z3.string(),
+  parent: z3.string()
 }).strict();
-var coverageSchema = z4.object({
-  asked: z4.number().int().nonnegative(),
-  answered: z4.number().int().nonnegative()
+var coverageSchema = z3.object({
+  asked: z3.number().int().nonnegative(),
+  answered: z3.number().int().nonnegative()
 }).strict().superRefine((coverage, ctx) => {
   if (coverage.answered > coverage.asked) {
     ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["answered"],
       message: "answered cannot be more than asked"
     });
   }
 });
 var artefactRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z4.literal("artefact"),
+  recordKind: z3.literal("artefact"),
   artefactRef: artefactRefSchema,
   // Some layer wrote it, by construction — an empty array is not a legitimate
   // state, so the schema says so.
-  writtenByLayers: z4.array(methodLayerSchema).min(1),
+  writtenByLayers: z3.array(methodLayerSchema).min(1),
   state: artefactStateSchema
 }).strict();
 var stepRunRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z4.literal("step-run"),
+  recordKind: z3.literal("step-run"),
   runOutcome: runOutcomeSchema,
-  failureReason: z4.string().optional(),
-  outcomeReason: z4.string().max(2e3).optional()
+  failureReason: z3.string().optional(),
+  outcomeReason: z3.string().max(2e3).optional()
 }).strict().superRefine((rec, ctx) => {
   if (rec.runOutcome === "attempted-failed" && rec.failureReason === void 0) {
     ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["failureReason"],
       message: "failureReason is required when runOutcome is 'attempted-failed'"
     });
   }
   if (rec.runOutcome !== "attempted-failed" && rec.failureReason !== void 0) {
     ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["failureReason"],
       message: "failureReason is only present when runOutcome is 'attempted-failed'"
     });
   }
   const issue = outcomeReasonIssue(rec.runOutcome, rec.outcomeReason);
   if (issue) {
-    ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
+    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
   }
 });
 var gateRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z4.literal("gate"),
+  recordKind: z3.literal("gate"),
   gateKind: gateKindSchema,
   verdict: gateVerdictSchema,
-  actor: z4.string(),
-  outcomeReason: z4.string().max(2e3).optional(),
+  actor: z3.string(),
+  outcomeReason: z3.string().max(2e3).optional(),
   coverage: coverageSchema.optional()
 }).strict().superRefine((rec, ctx) => {
   const issue = outcomeReasonIssue(rec.verdict, rec.outcomeReason);
   if (issue) {
-    ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
+    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
   }
 });
 var interventionRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z4.literal("intervention"),
+  recordKind: z3.literal("intervention"),
   layer: methodLayerSchema,
   mechanism: mechanismSchema,
   severity: severitySchema,
   disposition: dispositionSchema,
-  summary: z4.string().max(2e3),
+  summary: z3.string().max(2e3),
   coverage: coverageSchema.optional()
 }).strict();
-var stateRecordSchema = z4.discriminatedUnion("recordKind", [
+var stateRecordSchema = z3.discriminatedUnion("recordKind", [
   artefactRecordSchema,
   stepRunRecordSchema,
   gateRecordSchema,
   interventionRecordSchema
 ]);
 
+// ../events/dist/control-characters.js
+var CONTROL_CHARACTER_CLASS = "\\p{Cc}";
+var CONTROL_CHARACTER = new RegExp(CONTROL_CHARACTER_CLASS, "u");
+function hasControlCharacter(text) {
+  return CONTROL_CHARACTER.test(text);
+}
+
+// ../events/dist/phase-identity.js
+var PHASE_SEGMENT_PREFIX = "phase-";
+var PHASE_NAME_MAX_BYTES = 200;
+function isValidPhaseIdentity(identity) {
+  if (typeof identity === "number")
+    return Number.isInteger(identity) && identity >= 0;
+  if (typeof identity !== "string")
+    return false;
+  if (identity === "")
+    return false;
+  if (identity.includes("/"))
+    return false;
+  if (identity.includes("\\"))
+    return false;
+  if (identity.startsWith("."))
+    return false;
+  if (hasControlCharacter(identity))
+    return false;
+  if (utf8ByteLength(identity) > PHASE_NAME_MAX_BYTES)
+    return false;
+  return true;
+}
+function utf8ByteLength(text) {
+  let bytes = 0;
+  for (const ch of text) {
+    const cp = ch.codePointAt(0);
+    bytes += cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+  }
+  return bytes;
+}
+var InvalidPhaseIdentityError = class extends Error {
+  /** The value that was refused, exactly as supplied. */
+  identity;
+  constructor(identity, allowedLocation) {
+    const subject = allowedLocation === void 0 ? "a file" : "a Build Record";
+    const where = allowedLocation === void 0 ? "" : `
+  Records are written only into ${allowedLocation.replace(/\\/g, "/")}/. Nothing was written.`;
+    super(`that phase identity cannot name ${subject}.
+  identity: ${describeIdentity(identity)}` + where);
+    this.name = "InvalidPhaseIdentityError";
+    this.identity = identity;
+  }
+};
+function assertValidPhaseIdentity(identity, allowedLocation) {
+  if (!isValidPhaseIdentity(identity)) {
+    throw new InvalidPhaseIdentityError(identity, allowedLocation);
+  }
+}
+function renderPhaseSegment(identity) {
+  if (!isValidPhaseIdentity(identity)) {
+    throw new InvalidPhaseIdentityError(identity);
+  }
+  return `${PHASE_SEGMENT_PREFIX}${identity}`;
+}
+function describeIdentity(identity) {
+  if (identity === "")
+    return "(empty)";
+  if (typeof identity === "string")
+    return identity;
+  if (identity === null)
+    return "null";
+  if (identity === void 0)
+    return "none supplied";
+  if (typeof identity === "number" || typeof identity === "boolean")
+    return String(identity);
+  if (Array.isArray(identity))
+    return "(a list)";
+  if (typeof identity === "object")
+    return "(an object)";
+  return `(a ${typeof identity})`;
+}
+
+// ../events/dist/build-record.js
+var BUILD_RECORD_V2_FORMAT = "halfcycle-build-record/v2";
+var STATEMENT_MAX = 2e3;
+var DEVIATION_MAX = 500;
+var DEVIATIONS_MAX = 20;
+var ACTOR_MAX = 200;
+var FINDING_MAX = 500;
+var FINDINGS_SHOWN_MAX = 50;
+var PHASE_CLOSE_REASON_MAX = 1900;
+var closeCommitSchema = z4.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/, "must be a full commit hash: 40 or 64 lowercase hex characters");
+var walkVerdictSchema = z4.enum(["clean", "defects"]);
+var closeDecisionSchema = z4.enum(["done-when-met", "override"]);
+function plainText(max) {
+  const base = max === void 0 ? z4.string() : z4.string().max(max);
+  return base.refine((v) => !hasControlCharacter(v), {
+    message: "must be one line with no control characters (no line breaks, tabs or NUL)"
+  }).refine((v) => !hasLoneSurrogate(v), { message: LONE_SURROGATE_MESSAGE });
+}
+function statementText(max) {
+  return plainText(max).refine((v) => !looksLikeSecret(v), {
+    message: "looks like a password or key \u2014 rephrase it"
+  });
+}
+var closeActorSchema = plainText(ACTOR_MAX);
+var phaseNameSchema = z4.string().refine((v) => isValidPhaseIdentity(v), {
+  message: `must be a phase name: not empty, no slash or backslash, not starting with a dot, no control characters, at most ${PHASE_NAME_MAX_BYTES} bytes`
+});
+var closeStatementsSchema = z4.object({
+  thesis: statementText(STATEMENT_MAX).nullable(),
+  outcome: statementText(STATEMENT_MAX).nullable(),
+  deviations: z4.array(statementText(DEVIATION_MAX)).max(DEVIATIONS_MAX),
+  closeCommit: closeCommitSchema.nullable()
+}).strict();
+var closedBySchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("account"), email: plainText().nullable() }).strict(),
+  z4.object({ kind: z4.literal("no-account") }).strict(),
+  z4.object({ kind: z4.literal("account-removed") }).strict(),
+  z4.object({ kind: z4.literal("not-recorded") }).strict()
+]);
+var unfinishedStepSchema = z4.object({
+  stepId: plainText(),
+  state: z4.enum(["parked", "failed"])
+}).strict();
+var crossedSchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("none") }).strict(),
+  z4.object({ kind: z4.literal("unfinished-steps"), steps: z4.array(unfinishedStepSchema).min(1) }).strict(),
+  z4.object({ kind: z4.literal("clean-over-findings"), findings: z4.number().int().min(1) }).strict(),
+  z4.object({ kind: z4.literal("not-recorded") }).strict()
+]);
+var seatCoverageSchema = z4.object({
+  enrolled: z4.number().int().nonnegative(),
+  conformant: z4.number().int().nonnegative()
+}).strict().refine((c) => c.conformant <= c.enrolled, {
+  message: "conformant cannot exceed enrolled",
+  path: ["conformant"]
+});
+var observedCloseSchema = z4.object({
+  sequence: z4.number().int().min(1),
+  closedAt: utcIso8601,
+  closedBy: closedBySchema,
+  crossed: crossedSchema,
+  seatCoverage: seatCoverageSchema.nullable()
+}).strict();
+var couldNotRunCheckSchema = z4.object({
+  check: plainText(),
+  description: plainText().nullable(),
+  reason: plainText()
+}).strict();
+var firedCheckSchema = z4.object({
+  check: plainText(),
+  description: plainText().nullable(),
+  severity: severitySchema,
+  explanation: plainText().nullable(),
+  occurrences: z4.number().int().min(1)
+}).strict();
+var phaseChecksSchema = z4.discriminatedUnion("state", [
+  z4.object({ state: z4.literal("not-observed") }).strict(),
+  z4.object({
+    state: z4.literal("nothing-fired"),
+    runs: z4.number().int().min(1),
+    couldNotRun: z4.array(couldNotRunCheckSchema)
+  }).strict(),
+  z4.object({
+    state: z4.literal("fired"),
+    runs: z4.number().int().min(1),
+    couldNotRun: z4.array(couldNotRunCheckSchema),
+    fired: z4.array(firedCheckSchema).min(1)
+  }).strict()
+]);
+var observedSchema = z4.object({
+  engagementId: plainText(),
+  methodVersion: methodVersionSchema,
+  closes: z4.array(observedCloseSchema).min(1),
+  checks: phaseChecksSchema
+}).strict().superRefine((o, ctx) => {
+  o.closes.forEach((close, i) => {
+    if (close.sequence !== i + 1) {
+      ctx.addIssue({
+        code: "custom",
+        message: "closes must be numbered 1, 2, 3 \u2026 in order with no gap",
+        path: ["closes", i, "sequence"]
+      });
+    }
+  });
+});
+var attestedWalkSchema = z4.object({
+  verdict: walkVerdictSchema,
+  findings: z4.array(plainText(FINDING_MAX)).max(FINDINGS_SHOWN_MAX),
+  findingsNotShown: z4.number().int().nonnegative()
+}).strict();
+var attestedStatementsSchema = z4.object({
+  thesis: plainText(STATEMENT_MAX).nullable(),
+  outcome: plainText(STATEMENT_MAX).nullable(),
+  deviations: z4.array(plainText(DEVIATION_MAX)).max(DEVIATIONS_MAX)
+}).strict();
+var attestedCloseSchema = z4.object({
+  sequence: z4.number().int().min(1),
+  decision: closeDecisionSchema,
+  actor: plainText(ACTOR_MAX).nullable(),
+  reason: plainText(PHASE_CLOSE_REASON_MAX).nullable(),
+  walk: attestedWalkSchema.nullable(),
+  closeCommit: closeCommitSchema.nullable(),
+  statements: attestedStatementsSchema
+}).strict();
+var attestedSchema = z4.object({
+  closes: z4.array(attestedCloseSchema)
+}).strict();
+var buildRecordV2Schema = z4.object({
+  format: z4.literal(BUILD_RECORD_V2_FORMAT),
+  phase: phaseNameSchema,
+  observed: observedSchema,
+  attested: attestedSchema
+}).strict().superRefine((record2, ctx) => {
+  const observedBySequence = new Map(record2.observed.closes.map((c) => [c.sequence, c]));
+  const attestedSequences = record2.attested.closes.map((c) => c.sequence);
+  const sameSet = attestedSequences.length === observedBySequence.size && new Set(attestedSequences).size === attestedSequences.length && attestedSequences.every((s) => observedBySequence.has(s));
+  if (!sameSet) {
+    ctx.addIssue({
+      code: "custom",
+      message: "attested closes must match the observed closes one for one, by sequence",
+      path: ["attested", "closes"]
+    });
+  }
+  record2.attested.closes.forEach((close, i) => {
+    if (close.decision === "override" !== (close.reason !== null)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "reason is given exactly when the decision is override",
+        path: ["attested", "closes", i, "reason"]
+      });
+    }
+    const observed = observedBySequence.get(close.sequence);
+    if (observed !== void 0 && observed.closedBy.kind === "account-removed" !== (close.actor === null)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "actor is empty exactly when the closing account was removed",
+        path: ["attested", "closes", i, "actor"]
+      });
+    }
+  });
+});
+
 // ../events/dist/crew.js
 import { z as z5 } from "zod";
 var crewGroupSchema = z5.enum(["builder", "reviewer", "always-on"]);
@@ -605,7 +891,7 @@ var CREW_CALLSIGNS = CREW_ROSTER.map((member) => member.callsign);
 
 // ../events/dist/device-auth.js
 import { z as z6 } from "zod";
-var utcIso86013 = z6.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
+var utcIso86012 = z6.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var DEVICE_AUTH_STATUS = {
   /** The poll: minted, nobody has acted yet. Keep polling. 200. */
   PENDING: "pending",
@@ -650,7 +936,7 @@ var deviceAuthStartResponseSchema = z6.object({
   deviceCode: z6.string().min(1),
   userCode: z6.string().min(1),
   verificationUrl: z6.string().min(1),
-  expiresAt: utcIso86013,
+  expiresAt: utcIso86012,
   pollIntervalMs: z6.number().int().positive()
 }).strict();
 var devicePollPendingSchema = z6.object({
@@ -661,7 +947,7 @@ var devicePollApprovedSchema = z6.object({
   status: z6.literal(DEVICE_AUTH_STATUS.APPROVED),
   accountId: z6.string().min(1),
   credential: z6.string().min(1),
-  expiresAt: utcIso86013
+  expiresAt: utcIso86012
 }).strict();
 var deviceAuthRefusalSchema = z6.object({
   status: z6.enum([
@@ -699,67 +985,6 @@ var deviceConfirmResponseSchema = z6.union([
 ]);
 var DASHBOARD_URL = "https://app.halfcycle.ai";
 
-// ../events/dist/phase-identity.js
-var PHASE_SEGMENT_PREFIX = "phase-";
-function isValidPhaseIdentity(identity) {
-  if (typeof identity === "number")
-    return Number.isInteger(identity) && identity >= 0;
-  if (typeof identity !== "string")
-    return false;
-  if (identity === "")
-    return false;
-  if (identity.includes("/"))
-    return false;
-  if (identity.includes("\\"))
-    return false;
-  if (identity.includes("\0"))
-    return false;
-  if (identity.startsWith("."))
-    return false;
-  return true;
-}
-var InvalidPhaseIdentityError = class extends Error {
-  /** The value that was refused, exactly as supplied. */
-  identity;
-  constructor(identity, allowedLocation) {
-    const subject = allowedLocation === void 0 ? "a file" : "a Build Record";
-    const where = allowedLocation === void 0 ? "" : `
-  Records are written only into ${allowedLocation.replace(/\\/g, "/")}/. Nothing was written.`;
-    super(`that phase identity cannot name ${subject}.
-  identity: ${describeIdentity(identity)}` + where);
-    this.name = "InvalidPhaseIdentityError";
-    this.identity = identity;
-  }
-};
-function assertValidPhaseIdentity(identity, allowedLocation) {
-  if (!isValidPhaseIdentity(identity)) {
-    throw new InvalidPhaseIdentityError(identity, allowedLocation);
-  }
-}
-function renderPhaseSegment(identity) {
-  if (!isValidPhaseIdentity(identity)) {
-    throw new InvalidPhaseIdentityError(identity);
-  }
-  return `${PHASE_SEGMENT_PREFIX}${identity}`;
-}
-function describeIdentity(identity) {
-  if (identity === "")
-    return "(empty)";
-  if (typeof identity === "string")
-    return identity;
-  if (identity === null)
-    return "null";
-  if (identity === void 0)
-    return "none supplied";
-  if (typeof identity === "number" || typeof identity === "boolean")
-    return String(identity);
-  if (Array.isArray(identity))
-    return "(a list)";
-  if (typeof identity === "object")
-    return "(an object)";
-  return `(a ${typeof identity})`;
-}
-
 // ../events/dist/credential-wire.js
 import { z as z7 } from "zod";
 var engagementCredentialResponseSchema = z7.object({
@@ -771,10 +996,47 @@ var engagementCredentialResponseSchema = z7.object({
 }).strict();
 var ciTokenExchangeResponseSchema = z7.object({
   token: z7.string(),
-  expiresAt: utcIso86012,
+  expiresAt: utcIso8601,
   engagementId: z7.string()
 }).strict();
 
+// ../events/dist/phase-record.js
+import { z as z8 } from "zod";
+var phaseRecordRefusalReasonSchema = z8.enum([
+  "still-open",
+  "reopened",
+  "never-opened",
+  "never-closed",
+  "closed-before-records"
+]);
+var phaseRecordRecordSchema = z8.object({
+  outcome: z8.literal("record"),
+  phase: phaseNameSchema,
+  record: buildRecordV2Schema
+}).strict().refine((body) => body.record.phase === body.phase, {
+  message: "the record is for a different phase than the one asked for",
+  path: ["record", "phase"]
+});
+var phaseRecordWithheldSchema = z8.object({
+  outcome: z8.literal("withheld"),
+  phase: phaseNameSchema,
+  sequence: z8.number().int().min(1),
+  closedAt: utcIso8601,
+  message: z8.string()
+}).strict();
+var phaseRecordRefusedSchema = wireErrorSchema.extend({
+  outcome: z8.literal("refused"),
+  phase: phaseNameSchema,
+  statusCode: z8.literal(409),
+  error: z8.literal("PhaseRecordRefused"),
+  reason: phaseRecordRefusalReasonSchema
+}).strict();
+var phaseRecordResponseSchema = z8.discriminatedUnion("outcome", [
+  phaseRecordRecordSchema,
+  phaseRecordWithheldSchema,
+  phaseRecordRefusedSchema
+]);
+
 // dist/engagement-credential.js
 import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { platform as platform2 } from "node:os";
@@ -925,14 +1187,36 @@ halfcycle_env_file() {
 // dist/identity.js
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { isAbsolute, join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
-function git(targetRepoRoot, args) {
+var REPOSITORY_LOCATING_GIT_VARS = [
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR",
+  "GIT_DIR",
+  "GIT_GRAFT_FILE",
+  "GIT_IMPLICIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_NO_REPLACE_OBJECTS",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_PREFIX",
+  "GIT_REPLACE_REF_BASE",
+  "GIT_SHALLOW_FILE",
+  "GIT_WORK_TREE"
+];
+function gitEnvForNamedRepo() {
+  const env = { ...process.env };
+  for (const name of REPOSITORY_LOCATING_GIT_VARS)
+    delete env[name];
+  return env;
+}
+function git(targetRepoRoot, args, stdin) {
   try {
     const out = execFileSync("git", ["-C", targetRepoRoot, ...args], {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      env: gitEnvForNamedRepo(),
+      ...stdin === void 0 ? {} : { input: stdin },
+      stdio: [stdin === void 0 ? "ignore" : "pipe", "pipe", "ignore"]
     });
     const trimmed = out.trim();
     return trimmed.length > 0 ? trimmed : null;
@@ -950,6 +1234,38 @@ function readRootCommit(targetRepoRoot) {
 function readRemote(targetRepoRoot) {
   return git(targetRepoRoot, ["remote", "get-url", "origin"]);
 }
+function readIgnoredPaths(targetRepoRoot, paths) {
+  if (paths.length === 0)
+    return null;
+  const out = git(targetRepoRoot, ["check-ignore", "-v", "-z", "--stdin"], paths.map((p) => `${p}\0`).join(""));
+  if (out === null)
+    return null;
+  const fields = out.split("\0");
+  if (fields[fields.length - 1] === "")
+    fields.pop();
+  if (fields.length % 4 !== 0)
+    return null;
+  const ignored = [];
+  for (let i = 0; i < fields.length; i += 4) {
+    const [source, line, pattern, path] = fields.slice(i, i + 4);
+    if (pattern.startsWith("!"))
+      continue;
+    const lineNumber = Number.parseInt(line, 10);
+    if (!Number.isFinite(lineNumber))
+      return null;
+    ignored.push({ path, pattern, source, line: lineNumber });
+  }
+  if (ignored.length === 0)
+    return null;
+  if (ignored.every((entry) => isAbsolute(entry.source)))
+    return ignored;
+  if (git(targetRepoRoot, ["rev-parse", "--show-prefix"]) === null)
+    return ignored;
+  const toplevel = git(targetRepoRoot, ["rev-parse", "--show-toplevel"]);
+  if (toplevel === null)
+    return null;
+  return ignored.map((entry) => isAbsolute(entry.source) ? entry : { ...entry, source: join3(toplevel, entry.source) });
+}
 function mintOrReadIdentity(targetRepoRoot) {
   const path = join3(targetRepoRoot, ".halfcycle", "project.json");
   if (existsSync(path)) {
@@ -1399,18 +1715,12 @@ var BUNDLE_PIN_REL = ".halfcycle/bundle.json";
 var PROJECT_IDENTITY_REL = ".halfcycle/project.json";
 var CREW_ROSTER_REL = ".halfcycle/crew.json";
 var CAPTURED_INDEX_REL = "test/fixtures/captured/manifest.json";
-var SETTINGS_REL = ".claude/settings.json";
 var GITIGNORE_REL = ".gitignore";
 function commandStubRel(name) {
   return `.claude/commands/${name}.md`;
 }
 var RETIRED_WRITE_SET_FILES = [];
-var RETIRED_HOOK_COMMANDS = [];
 var RETIRED_DENY_PATTERNS = [];
-function installerHookCommands() {
-  const settings = JSON.parse(generateSettingsJson());
-  return Object.values(settings.hooks ?? {}).flatMap((entries) => entries.flatMap((entry) => entry.hooks.map((h) => h.command)));
-}
 function closedWriteSet() {
   const files = /* @__PURE__ */ new Set([
     ...(readPluginManifest().commands ?? []).map((cmd) => commandStubRel(cmd.name)),
@@ -1436,7 +1746,7 @@ function closedWriteSet() {
     merged,
     dirs,
     ownedDirs,
-    hookCommands: /* @__PURE__ */ new Set([...installerHookCommands(), ...RETIRED_HOOK_COMMANDS]),
+    hookCommands: new Set(HALFCYCLE_HOOK_COMMANDS),
     denyRuleSha256: new Set([...DENY_PATTERNS, ...RETIRED_DENY_PATTERNS].map((rule) => sha256Hex(rule))),
     gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL])
   };
@@ -1521,6 +1831,54 @@ function assertManifestInWriteSet(manifest, writeSet) {
     throw new Error(`[bundle install] the install record names paths outside the write set: ${strays.join(", ")}`);
   }
 }
+function findNotShared(targetRepo, manifest, collidedPaths) {
+  const merged = [
+    SETTINGS_REL,
+    ...manifest.mcp !== void 0 ? [MCP_REGISTRATION_REL] : [],
+    ...manifest.gitignore.created || manifest.gitignore.appended.length > 0 ? [GITIGNORE_REL] : []
+  ];
+  const collided = new Set(collidedPaths);
+  const dirVerdicts = /* @__PURE__ */ new Map();
+  const travelsThroughPlainDirs = (rel) => {
+    for (let dir = posix.dirname(rel); dir !== "."; dir = posix.dirname(dir)) {
+      let plain = dirVerdicts.get(dir);
+      if (plain === void 0) {
+        const abs = join5(targetRepo, dir);
+        plain = !lstatOrNull(abs)?.isSymbolicLink() && lstatOrNull(join5(abs, ".git")) === null;
+        dirVerdicts.set(dir, plain);
+      }
+      if (!plain)
+        return false;
+    }
+    return true;
+  };
+  const paths = [
+    .../* @__PURE__ */ new Set([
+      ...manifest.files.filter((f) => !("perMachine" in f)).map((f) => f.path),
+      ...merged,
+      INSTALL_MANIFEST_REL
+    ])
+  ].filter((rel) => !collided.has(rel)).filter((rel) => lstatOrNull(join5(targetRepo, rel)) !== null).filter(travelsThroughPlainDirs).sort();
+  const ignored = readIgnoredPaths(targetRepo, paths);
+  if (ignored === null)
+    return null;
+  const sorted = [...ignored].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const named = sorted.find((entry) => entry.path === SETTINGS_REL) ?? sorted[0];
+  return {
+    path: named.path,
+    pattern: named.pattern,
+    source: named.source,
+    line: named.line,
+    others: sorted.length - 1
+  };
+}
+function lstatOrNull(path) {
+  try {
+    return lstatSync(path);
+  } catch {
+    return null;
+  }
+}
 function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1635,9 +1993,15 @@ var DENY_PATTERNS = [
   "Bash(git push --no-verify:*)",
   "Bash(git commit --no-verify:*)"
 ];
-var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
 var USER_PROMPT_REMINDER_SENTENCE = "Where this project stands, and what order to work in, is recorded in the Halfcycle service and nowhere in this repository \u2014 call halfcycle_resolve before you answer or plan, because the files here will look complete and current and still be wrong about position.";
 function generateSettingsJson() {
+  const hooks = {};
+  for (const { event, matcher, timeout, command } of HALFCYCLE_HOOK_WIRING) {
+    (hooks[event] ??= []).push({
+      ...matcher === null ? {} : { matcher },
+      hooks: [{ type: "command", command, timeout }]
+    });
+  }
   const settings = {
     $schema: "https://json.schemastore.org/claude-code-settings.json",
     permissions: {
@@ -1645,88 +2009,10 @@ function generateSettingsJson() {
       // and is the machine owner's grant to make, not ours.
       deny: [...DENY_PATTERNS]
     },
-    hooks: {
-      SessionStart: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/session-start-marker.sh",
-              timeout: 5
-            }
-          ]
-        },
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh refresh-credential",
-              timeout: 10
-            }
-          ]
-        }
-      ],
-      UserPromptSubmit: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/user-prompt-reminder.sh",
-              timeout: 5
-            }
-          ]
-        }
-      ],
-      PostToolUse: [
-        {
-          matcher: WRITE_CAPABLE_TOOLS.join("|"),
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook post-tool-use",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      Stop: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook stop",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      SubagentStop: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook subagent-stop",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      SessionEnd: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/session-end-marker.sh",
-              timeout: 5
-            }
-          ]
-        }
-      ]
-    }
+    hooks
   };
   return JSON.stringify(settings, null, 2) + "\n";
 }
-var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
 var GENERATED_GUARD_RUNNER_HEADER = "# Governance hook wrapper \u2014 generated by";
 function generateGuardRunnerWrapper() {
   return `#!/usr/bin/env bash
@@ -1948,14 +2234,16 @@ var CI_STANZA_KNOWN_HEADER_HASHES = [
 function isTrackedAndClean(targetRepo, relPath) {
   try {
     execFileSync2("git", ["-C", targetRepo, "ls-files", "--error-unmatch", "--", relPath], {
-      stdio: "ignore"
+      stdio: "ignore",
+      env: gitEnvForNamedRepo()
     });
   } catch {
     return false;
   }
   try {
     execFileSync2("git", ["-C", targetRepo, "diff", "--quiet", "HEAD", "--", relPath], {
-      stdio: "ignore"
+      stdio: "ignore",
+      env: gitEnvForNamedRepo()
     });
   } catch {
     return false;
@@ -2533,6 +2821,7 @@ async function install(options) {
   const installManifest = finishManifest(draft);
   assertManifestInWriteSet(installManifest, writeSet);
   recordOwned(report, join5(targetRepo, INSTALL_MANIFEST_REL), targetRepo, serializeManifest(installManifest), INSTALL_MANIFEST_REL);
+  const notShared = findNotShared(targetRepo, installManifest, report.collidedPaths);
   return {
     version: manifest.version,
     writtenPaths: report.writtenPaths,
@@ -2541,7 +2830,8 @@ async function install(options) {
     collidedPaths: report.collidedPaths,
     replacedPaths: report.replacedPaths,
     bootstrapScanRan: scanResult.ran,
-    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null
+    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null,
+    notShared
   };
 }
 
@@ -2722,7 +3012,7 @@ async function mintBoardEnterCode(baseUrl, sessionToken) {
 }
 
 // dist/setup/manifest.js
-import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname3, join as join6, posix as posix2 } from "node:path";
 var DECLARED_ROOT_FILES = ["CLAUDE.md", "AGENTS.md", "ENGAGEMENT.md"];
 var DECLARED_DIR_PREFIX = "docs";
@@ -2810,7 +3100,7 @@ function firstSymlinkOnPath(targetRepo, path) {
   for (let i = 0; i < segments.length; i++) {
     walked = join6(walked, segments[i]);
     try {
-      if (lstatSync(walked).isSymbolicLink())
+      if (lstatSync2(walked).isSymbolicLink())
         return segments.slice(0, i + 1).join("/");
     } catch {
       return null;
@@ -3170,446 +3460,485 @@ function buildEngagementRecord(input) {
   return { ok: true, document, rows };
 }
 
-// dist/build-record/types.js
-var BUILD_RECORD_FORMAT = "halfcycle-build-record/v1";
-function projectSeedGuard(fired, includeExplanation) {
-  const seed = {
-    patternRef: fired.patternRef,
-    severity: fired.severity
-  };
-  if (includeExplanation && fired.explanation)
-    seed.explanation = fired.explanation;
-  return seed;
-}
-
-// dist/build-record/sources.js
-import { readFileSync as readFileSync7, existsSync as existsSync6 } from "node:fs";
-import { createHash as createHash3 } from "node:crypto";
-import { join as join10 } from "node:path";
-
-// dist/build-record/close-record.js
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
-var CLOSE_RECORD_FORMAT = "halfcycle-phase-close/v1";
-var BUILD_RECORD_ZONE_B_DIR = join8(ZONE_B_DIR, "build-record");
-var InvalidCloseRecordError = class extends Error {
-  constructor(path, detail) {
-    super(`[build-record] the phase close record at ${path} cannot be read \u2014 ${detail}`);
-    this.name = "InvalidCloseRecordError";
+// dist/build-record/render-v2.js
+var HIDDEN = /[\p{Cc}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/u;
+var MARKDOWN_SPECIAL = /* @__PURE__ */ new Set(["\\", "`", "*", "_", "[", "]", "<", "|", "~", "#", "&", "$"]);
+function printRecordText(text) {
+  if (text === "")
+    return "(blank)";
+  let out = "";
+  for (const ch of text) {
+    if (HIDDEN.test(ch)) {
+      out += `U+${ch.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")}`;
+    } else if (MARKDOWN_SPECIAL.has(ch)) {
+      out += `\\${ch}`;
+    } else {
+      out += ch;
+    }
   }
-};
-function closeRecordPath(repoRoot, phase) {
-  assertValidPhaseIdentity(phase, BUILD_RECORD_ZONE_B_DIR);
-  return join8(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phase)}.close.json`);
+  return out;
 }
-function resolveCloseAtHead(repoRoot) {
-  try {
-    const closeCommit = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--short", "HEAD"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    const closedDate = execFileSync3("git", ["-C", repoRoot, "show", "-s", "--format=%cs", "HEAD"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (closeCommit === "" || closedDate === "")
-      return null;
-    return { closeCommit, closedDate };
-  } catch {
-    return null;
-  }
+function makePrinter() {
+  let hidden = false;
+  return {
+    text(value) {
+      if (!hidden && HIDDEN.test(value))
+        hidden = true;
+      return printRecordText(value);
+    },
+    sawHidden() {
+      return hidden;
+    }
+  };
 }
-function writeCloseRecord(repoRoot, phase) {
-  let path;
-  try {
-    path = closeRecordPath(repoRoot, phase);
-  } catch (err) {
-    return { recorded: false, path: null, reason: err instanceof Error ? err.message : String(err) };
-  }
-  const at = resolveCloseAtHead(repoRoot);
-  if (at === null) {
-    return {
-      recorded: false,
-      path,
-      reason: `the commit could not be read from ${repoRoot} \u2014 there is no git available, no repository there, or no commit in it yet`
-    };
+function counted(n, one, many) {
+  return `${String(n)} ${n === 1 ? one : many}`;
+}
+var TITLE_PREFIX = "# Build Record: ";
+var HEADER_WHAT = "This is the Build Record for one phase of a software project run with the Halfcycle method. A phase is a stage of the work with an agreed finish line; this record says how this one ended.";
+var HEADER_REGISTERS = "Two kinds of content are kept apart here. Lines under **Observed by Halfcycle** come from Halfcycle's own records, made as the work happened. Lines under **Stated by the client** are quoted, and are the client's own word: Halfcycle did not check them. Halfcycle witnessed the method being run. The client attests the code.";
+var HEADER_KEPT = "Halfcycle derived this record and kept it when the phase closed, and changes it afterwards in one way only: if an account that closed this phase is later deleted, its email is removed, and so is the name given at any close Halfcycle recorded as made by that account. The client's Halfcycle command-line tool wrote this file from that kept copy when the phase closed or when it was fetched again, so a later deletion changes the kept copy and reaches this file at the next fetch; the same record, as data, is in the .json file of the same name beside this one. If the phase is closed again, this file is replaced by a new record that describes every close, this one included.";
+var HEADER_HIDDEN = "Some text in this record contains characters that do not print. Each is shown as U+ and its code of four or more hex digits; the .json file holds the text exactly.";
+var OBSERVED_LABEL = "**Observed by Halfcycle**";
+var STATED_LABEL = "**Stated by the client** \u2014 Halfcycle did not check these.";
+var MISMATCHED_HALVES = "This Build Record could not be written: its two parts describe different closes.";
+function renderChecks(checks, p) {
+  const blocks = ["## Checks during this phase", OBSERVED_LABEL];
+  if (checks.state === "not-observed") {
+    blocks.push("**Nothing was observed.** Halfcycle has no record of any check running during this phase, so this record cannot say whether the work had problems. This is not a clean result.");
+    return blocks;
+  }
+  const runs = counted(checks.runs, "check run", "check runs");
+  if (checks.state === "nothing-fired") {
+    blocks.push(`**Checks ran and found nothing.** Halfcycle recorded ${runs} during this phase, and no check found a problem.`);
+  } else {
+    blocks.push(`**Checks found problems.** Halfcycle recorded ${runs} during this phase. Each check that found something is listed by what it checks, in plain words, then how serious it is, what it found, and the name your terminal prints for it.`);
+    blocks.push(renderFired(checks.fired, p));
   }
-  const record2 = {
-    format: CLOSE_RECORD_FORMAT,
-    phase,
-    closeCommit: at.closeCommit,
-    closedDate: at.closedDate
-  };
-  try {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(record2, null, 2) + "\n", "utf-8");
-  } catch (err) {
-    return { recorded: false, path, reason: err instanceof Error ? err.message : String(err) };
+  if (checks.couldNotRun.length === 0) {
+    blocks.push("No check reported that it could not run.");
+  } else {
+    blocks.push("**Some checks could not run.** They neither passed nor failed during this phase:");
+    blocks.push(renderCouldNotRun(checks.couldNotRun, p));
   }
-  return { recorded: true, path, closeCommit: at.closeCommit, closedDate: at.closedDate };
+  return blocks;
 }
-function parseCloseRecord(path, parsed) {
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new InvalidCloseRecordError(path, "it does not hold a record");
+function renderFired(fired, p) {
+  const lines = [];
+  for (const entry of fired) {
+    lines.push(entry.description === null ? "- Check: A check found something here, and no plain-language description of it is on record." : `- Check: ${p.text(entry.description)}`);
+    lines.push(`  - Seriousness: ${seriousness(entry.severity)}`);
+    lines.push(`  - Found: ${counted(entry.occurrences, "time", "times")} during this phase.`);
+    lines.push(`  - What it found: ${entry.explanation === null ? "Not included in this record." : p.text(entry.explanation)}`);
+    lines.push(`  - The name your terminal prints for this check: ${p.text(entry.check)}`);
   }
-  const record2 = parsed;
-  if (record2.format !== CLOSE_RECORD_FORMAT) {
-    throw new InvalidCloseRecordError(path, `it is not a ${CLOSE_RECORD_FORMAT} record (it says ${JSON.stringify(record2.format)})`);
+  return lines.join("\n");
+}
+function seriousness(severity) {
+  switch (severity) {
+    case "block":
+      return "serious, it blocks the work.";
+    case "warn":
+      return "a warning.";
+    case "info":
+      return "for information only.";
   }
-  const commit = record2.closeCommit;
-  const date = record2.closedDate;
-  const missing = [];
-  if (typeof commit !== "string" || commit.trim() === "")
-    missing.push("closeCommit");
-  if (typeof date !== "string" || date.trim() === "")
-    missing.push("closedDate");
-  if (missing.length > 0) {
-    throw new InvalidCloseRecordError(path, `${missing.join(" and ")} ${missing.length === 1 ? "is" : "are"} not recorded in it. A close records the commit and its date together or records neither, so a file carrying one of them was edited by hand.`);
+}
+function renderCouldNotRun(entries, p) {
+  const lines = [];
+  for (const entry of entries) {
+    lines.push(entry.description === null ? "- Check: A check could not run here, and no plain-language description of it is on record." : `- Check: ${p.text(entry.description)}`);
+    lines.push(`  - Why it could not run: ${p.text(entry.reason)}`);
+    lines.push(`  - The name your terminal prints for this check: ${p.text(entry.check)}`);
   }
-  if (typeof record2.phase !== "string" && typeof record2.phase !== "number") {
-    throw new InvalidCloseRecordError(path, "it does not say which phase closed");
+  return lines.join("\n");
+}
+function headline(observed, attested) {
+  const met = attested.decision === "done-when-met";
+  switch (observed.crossed.kind) {
+    case "none":
+      return met ? "**Closed cleanly.** Halfcycle saw nothing outstanding, and the person closing the phase stated its finish conditions were met." : "**Closed by override.** Halfcycle saw nothing outstanding, and the person closing the phase chose to override rather than state its finish conditions were met.";
+    case "unfinished-steps":
+    case "clean-over-findings":
+      return met ? "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase stated its finish conditions were met anyway." : "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase chose to override it.";
+    case "not-recorded":
+      return met ? "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase stated its finish conditions were met." : "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase chose to override.";
+  }
+}
+function closedAtText(closedAt, p) {
+  const m = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})(?:\.\d+)?Z$/.exec(closedAt);
+  return m === null ? p.text(closedAt) : `${m[1]} ${m[2]} UTC`;
+}
+function signedInAs(closedBy, p) {
+  switch (closedBy.kind) {
+    case "account":
+      return closedBy.email === null ? "an account with no email address on file" : `the account ${p.text(closedBy.email)}`;
+    case "no-account":
+      return "a credential not linked to any person's account";
+    case "account-removed":
+      return "an account that has since been deleted";
+    case "not-recorded":
+      return "not recorded for this close";
+  }
+}
+function outstanding(crossed, p) {
+  switch (crossed.kind) {
+    case "none":
+      return ["- Outstanding work Halfcycle could see: none."];
+    case "not-recorded":
+      return ["- Outstanding work Halfcycle could see: not recorded for this close."];
+    case "clean-over-findings":
+      return [
+        `- Outstanding work Halfcycle could see: ${counted(crossed.findings, "problem", "problems")} recorded against this phase.`
+      ];
+    case "unfinished-steps":
+      return [
+        `- Outstanding work Halfcycle could see: ${counted(crossed.steps.length, "step", "steps")} of the method left unfinished. Each is shown by the method's own label for it:`,
+        ...crossed.steps.map((step) => `  - Step: ${p.text(step.stepId)} \u2014 ${step.state === "failed" ? "failed" : "set aside unfinished"}`)
+      ];
+  }
+}
+function machines(coverage) {
+  const label = "- Machines signed in on this project at the close: ";
+  if (coverage === null)
+    return `${label}not recorded.`;
+  if (coverage.enrolled === 0)
+    return `${label}none.`;
+  return `${label}${String(coverage.enrolled)}, of which ${String(coverage.conformant)} had Halfcycle's checks working as set up.`;
+}
+function walkLines(walk, p) {
+  const label = "> - Acceptance walk (the finished work tried as a user would, by someone other than its builder): ";
+  if (walk === null)
+    return [`${label}none reported.`];
+  const lines = [
+    `${label}${walk.verdict === "clean" ? "reported as finding no problems." : "reported as finding problems."}`
+  ];
+  walk.findings.forEach((finding, i) => {
+    lines.push(`>   - Finding ${String(i + 1)}: ${p.text(finding)}`);
+  });
+  if (walk.findingsNotShown > 0) {
+    lines.push(`>   - And ${counted(walk.findingsNotShown, "more finding", "more findings")} not shown here.`);
   }
-  return {
-    format: CLOSE_RECORD_FORMAT,
-    phase: record2.phase,
-    closeCommit: commit,
-    closedDate: date
-  };
+  return lines;
 }
-
-// dist/build-record/write.js
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename, join as join9, resolve, relative as relative2, isAbsolute } from "node:path";
-
-// dist/build-record/template.js
-function severityLabel(seed) {
-  return `\`${seed.patternRef}\` (severity \`${seed.severity}\`)`;
-}
-var NOT_RECORDED = "not recorded";
-function renderCloseLine(record2) {
-  const status = `**Status:** ${record2.status.toUpperCase()}`;
-  const closed = `**Closed:** ${record2.closedDate ?? NOT_RECORDED}`;
-  const commit = record2.closeCommit === null ? `**Close commit:** ${NOT_RECORDED}` : `**Close commit:** \`${record2.closeCommit}\``;
-  return `${status} \xB7 ${closed} \xB7 ${commit}`;
-}
-function renderCloseProvenance(record2) {
-  return record2.closeCommit === null && record2.closedDate === null ? "*The close date and the commit were not recorded when this phase closed, so this record does not name them. Nothing has been substituted for them.*" : "*The close date and the commit are the client's own assertion about their own repository, written down when the phase was closed. Halfcycle did not observe them and does not check them.*";
-}
-function renderDoneWhenRows(record2) {
-  const rows = [];
-  for (const [key, dw] of Object.entries(record2.acceptance.doneWhen)) {
-    const mark = dw.result === "pass" ? "\u2705" : dw.result === "dropped" ? "\u2014" : dw.result;
-    rows.push(`| ${key} | ${mark} | ${dw.detail} |`);
-  }
-  return rows.join("\n");
-}
-function renderBuildRecordMarkdown(record2) {
-  const { phase } = record2;
-  const companion = `${renderPhaseSegment(phase.id)}.json`;
-  const guardsList = record2.seedGuards.map(severityLabel).join(", ");
+function statedOrNot(value, p) {
+  return value === null ? "Not stated by the client." : p.text(value);
+}
+function renderStated(attested, p) {
   const lines = [
-    // Fixed prose (vault-canonical template) + projected title slots.
-    `# Build Record \u2014 Phase ${phase.id}: ${phase.name}`,
-    "",
-    `**Format:** \`${record2.format}\` (markdown + JSON pair; portable, readable without Halfcycle systems)`,
-    "",
-    "> This Build Record was assembled automatically at phase close by `npx halfcycle close-phase`. Every data field below is projected from the companion JSON \u2014 no record content is hand-authored.",
-    "",
-    `**Engagement:** ${record2.engagement} (${record2.engagementType})`,
-    `**Phase:** ${phase.id} \u2014 ${phase.name}`,
-    renderCloseLine(record2),
-    `**Companion:** [\`${companion}\`](${companion})`,
-    "",
-    renderCloseProvenance(record2),
-    "",
-    "## What this phase proved",
-    "",
-    `${record2.thesis} **Thesis held: ${record2.thesisHeld ? "yes" : "no"}.**`,
-    "",
-    "## Delivered",
-    "",
-    `- **Packages:** ${record2.delivered.packages.join(", ")}`,
-    `- **Services:** ${record2.delivered.services.join(", ")}`,
-    `- **Tools:** ${record2.delivered.tools.join(", ")}`,
-    `- **Dogfood:** ${record2.delivered.dogfood}`,
-    "",
-    guardsList ? `Guards evaluated (results only): ${guardsList}. *(What a guard reported about this phase is recorded; the guard's own definition and its history are not.)*` : "No guards fired during this phase.",
-    "",
-    `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
-    "",
-    `**Verdict:** ${record2.acceptance.verdict} \xB7 **Findings:** ${record2.acceptance.findings}`,
-    "",
-    "| Done-when | Result | Evidence |",
-    "|---|---|---|",
-    renderDoneWhenRows(record2),
-    ""
+    attested.decision === "done-when-met" ? "> - Decision: the phase's agreed finish conditions were met." : "> - Decision: close the phase by override, without stating its finish conditions were met.",
+    `> - Name given: ${attested.actor === null ? "removed with the account that made this close" : p.text(attested.actor)}`,
+    `> - Reason given: ${attested.reason === null ? "none." : p.text(attested.reason)}`,
+    ...walkLines(attested.walk, p),
+    `> - Code closed at (commit): ${statedOrNot(attested.closeCommit, p)}`,
+    `> - What the phase set out to prove: ${statedOrNot(attested.statements.thesis, p)}`,
+    `> - What came out of it: ${statedOrNot(attested.statements.outcome, p)}`
   ];
-  if (record2.acceptance.inv002ProdBypassProbe) {
-    lines.push(`**Production bypass probe:** ${record2.acceptance.inv002ProdBypassProbe.result} \u2014 ${record2.acceptance.inv002ProdBypassProbe.detail}`, "");
+  const deviations = attested.statements.deviations;
+  if (deviations.length === 0) {
+    lines.push("> - Changes from the plan: None stated by the client.");
+  } else {
+    lines.push("> - Changes from the plan:");
+    deviations.forEach((deviation, i) => {
+      lines.push(`>   - Change ${String(i + 1)}: ${p.text(deviation)}`);
+    });
   }
-  lines.push("## Gates that earned their keep", "", `**${record2.gatesEarnedKeep.defectsCaughtPreHuman}** defects were caught by the gates before the human walk; the walk itself found **${record2.gatesEarnedKeep.bugsReachingHumanWalk}**. Named: ${record2.gatesEarnedKeep.named.join("; ")}.`, "", "## Instruments", "", `- **Marginal-cost self-accounting:** ${record2.instruments.marginalCostSelfAccounting}`, `- **COE add-rate:** seam-new ${record2.instruments.coeAddRate.seamNew}, seam-repeat ${record2.instruments.coeAddRate.seamRepeat}, model-limitation ${record2.instruments.coeAddRate.modelLimitation}. ${record2.instruments.coeAddRate.notes}`, "", "## Invariants exercised", "", record2.invariantsExercised.join(", "), "", "## Deviations & decisions recorded", "", ...record2.deviations.map((d) => `- ${d}`), "", "## Tasks", "", `- **Planned:** ${record2.tasks.planned} \xB7 **Landed:** ${record2.tasks.landed} \xB7 **Cancelled:** ${record2.tasks.cancelled.length > 0 ? record2.tasks.cancelled.join(", ") : "none"}`, "");
   return lines.join("\n");
 }
+function renderClose(heading, observed, attested, p) {
+  return [
+    heading,
+    headline(observed, attested),
+    OBSERVED_LABEL,
+    [
+      `- Closed at: ${closedAtText(observed.closedAt, p)}`,
+      `- Signed in as: ${signedInAs(observed.closedBy, p)}`,
+      ...outstanding(observed.crossed, p),
+      machines(observed.seatCoverage)
+    ].join("\n"),
+    STATED_LABEL,
+    renderStated(attested, p)
+  ];
+}
+function renderBuildRecordV2Markdown(record2) {
+  const p = makePrinter();
+  const attestedBySequence = /* @__PURE__ */ new Map();
+  for (const close of record2.attested.closes)
+    attestedBySequence.set(close.sequence, close);
+  const observedSequences = new Set(record2.observed.closes.map((c) => c.sequence));
+  if (attestedBySequence.size !== record2.attested.closes.length || observedSequences.size !== record2.observed.closes.length || attestedBySequence.size !== observedSequences.size || [...observedSequences].some((s) => !attestedBySequence.has(s))) {
+    throw new Error(MISMATCHED_HALVES);
+  }
+  const phase = p.text(record2.phase);
+  const closes = [...record2.observed.closes].sort((a, b) => a.sequence - b.sequence);
+  const total = closes.length;
+  const latest = closes[total - 1];
+  const body = [
+    `Phase: ${phase} (the name the client gave it)`,
+    OBSERVED_LABEL,
+    [
+      `- Method version: ${p.text(record2.observed.methodVersion)}. This is the version of the Halfcycle method the project was run under; it does not change during a project.`,
+      `- Halfcycle's reference for this project: ${p.text(record2.observed.engagementId)}`,
+      `- Record format: ${p.text(record2.format)}`
+    ].join("\n"),
+    total === 1 ? "This phase was closed once." : `This phase was closed ${String(total)} times. The latest close is described first; each earlier close follows, as it was recorded when it was made.`,
+    ...renderChecks(record2.observed.checks, p),
+    ...renderClose(total === 1 ? "## The close" : `## The latest close (close ${String(latest.sequence)} of ${String(total)})`, latest, attestedBySequence.get(latest.sequence), p)
+  ];
+  if (total > 1) {
+    body.push("## Earlier closes");
+    for (const close of closes.slice(0, -1)) {
+      body.push(...renderClose(`### Close ${String(close.sequence)} of ${String(total)}`, close, attestedBySequence.get(close.sequence), p));
+    }
+  }
+  const header = [`${TITLE_PREFIX}${phase}`, HEADER_WHAT, HEADER_REGISTERS, HEADER_KEPT];
+  if (p.sawHidden())
+    header.push(HEADER_HIDDEN);
+  return `${[...header, ...body].join("\n\n")}
+`;
+}
 
 // dist/build-record/write.js
-var BUILD_RECORD_DIR = join9("docs", "build-records");
-function serialiseRecordJson(record2) {
-  return JSON.stringify(record2, null, 2) + "\n";
-}
+import { closeSync, existsSync as existsSync6, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeSync } from "node:fs";
+import { basename, join as join8, resolve, relative as relative2, isAbsolute as isAbsolute2 } from "node:path";
+var BUILD_RECORD_DIR = join8("docs", "build-records");
 function assertInsideOutDir(outDir, candidate, identity) {
   const rel = relative2(outDir, resolve(candidate));
-  const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute(rel) && rel === basename(rel);
+  const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute2(rel) && rel === basename(rel);
   if (!isPlainFilename) {
     throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
   }
 }
-function writeBuildRecord(repoRoot, record2) {
-  const outDir = resolve(repoRoot, BUILD_RECORD_DIR);
-  const identity = record2.phase.id;
-  if (!isValidPhaseIdentity(identity)) {
-    throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
+function createExclusiveOnDisk(path, text) {
+  const fd = openSync(path, "wx");
+  try {
+    writeSync(fd, text);
+  } catch (err) {
+    closeSync(fd);
+    rmSync2(path, { force: true });
+    throw err;
   }
-  const segment = renderPhaseSegment(identity);
-  const jsonPath = join9(outDir, `${segment}.json`);
-  const mdPath = join9(outDir, `${segment}.md`);
-  assertInsideOutDir(outDir, jsonPath, identity);
-  assertInsideOutDir(outDir, mdPath, identity);
-  mkdirSync6(outDir, { recursive: true });
-  writeFileSync6(jsonPath, serialiseRecordJson(record2), "utf-8");
-  writeFileSync6(mdPath, renderBuildRecordMarkdown(record2), "utf-8");
-  return { jsonPath, mdPath };
+  closeSync(fd);
 }
-
-// dist/build-record/sources.js
-var MissingSourceError = class extends Error {
-  constructor(sourceName, detail) {
-    super(`[build-record] missing required source: ${sourceName} \u2014 ${detail}`);
-    this.name = "MissingSourceError";
-  }
+function renameOnDisk(from, to) {
+  renameSync(from, to);
+}
+var NODE_RECORD_PAIR_IO = {
+  createExclusive: createExclusiveOnDisk,
+  rename: renameOnDisk
 };
-function projectSeedGuards(runs) {
-  const byRef = /* @__PURE__ */ new Map();
-  for (const run of runs) {
-    if (!run.result)
-      continue;
-    for (const fired of run.result.guardsFired) {
-      const seed = projectSeedGuard(
-        fired,
-        /* includeExplanation */
-        false
-      );
-      const existing = byRef.get(seed.patternRef);
-      if (!existing) {
-        byRef.set(seed.patternRef, seed);
-      } else if (existing.severity !== seed.severity) {
-        byRef.set(seed.patternRef, pickHigherSeverity(existing, seed));
-      }
-    }
-  }
-  return [...byRef.values()].sort((a, b) => a.patternRef.localeCompare(b.patternRef));
+function serialiseServedRecord(rawRecord) {
+  return JSON.stringify(rawRecord, null, 2) + "\n";
 }
-var SEVERITY_ORDINAL = { info: 0, warn: 1, block: 2 };
-function pickHigherSeverity(a, b) {
-  return (SEVERITY_ORDINAL[a.severity] ?? -1) >= (SEVERITY_ORDINAL[b.severity] ?? -1) ? a : b;
+function isEexist(err) {
+  return typeof err === "object" && err !== null && err.code === "EEXIST";
 }
-function normalizeLegacyLine(parsed) {
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return parsed;
+function readIfPresent(path) {
+  try {
+    return readFileSync7(path, "utf-8");
+  } catch {
+    return null;
   }
-  const record2 = parsed;
-  if (record2["outcome"] !== void 0)
-    return parsed;
-  return {
-    ...record2,
-    runId: record2["runId"] ?? syntheticRunId(record2),
-    outcome: "evaluated"
-  };
 }
-function syntheticRunId(record2) {
-  const key = [
-    record2["engagementId"],
-    record2["occurredAt"],
-    record2["runType"],
-    record2["phase"]
-  ].join("|");
-  const hex = createHash3("sha256").update(`legacy-guard-eval-run:${key}`).digest("hex");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
-}
-function readGuardEvalLog(logDir, phaseId) {
-  const logPath = join10(logDir, `${renderPhaseSegment(phaseId)}.jsonl`);
-  if (!existsSync6(logPath)) {
-    throw new MissingSourceError("guard-eval log", `no runner guard-eval log at ${logPath} for phase ${phaseId}`);
-  }
-  const raw = readFileSync7(logPath, "utf-8");
-  const runs = [];
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed === "")
-      continue;
-    const parsed = JSON.parse(trimmed);
-    runs.push(guardEvalRunSchema.parse(normalizeLegacyLine(parsed)));
+function isOwnEarlierRecord(existingText, served) {
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(existingText);
+  } catch {
+    return false;
   }
-  return runs;
+  const existing = buildRecordV2Schema.safeParse(parsedJson);
+  if (!existing.success)
+    return false;
+  const old = existing.data;
+  if (old.observed.engagementId !== served.observed.engagementId)
+    return false;
+  if (old.phase !== served.phase)
+    return false;
+  const oldCloses = old.observed.closes.length;
+  const newCloses = served.observed.closes.length;
+  if (oldCloses < newCloses)
+    return true;
+  if (oldCloses > newCloses)
+    return false;
+  const oldSequences = new Set(old.observed.closes.map((c) => c.sequence));
+  return served.observed.closes.every((c) => oldSequences.has(c.sequence));
 }
-function readOrchestrationState(phasesDir, phaseId) {
-  const statePath = join10(phasesDir, `${renderPhaseSegment(phaseId)}-orchestration-state.json`);
-  if (!existsSync6(statePath)) {
-    throw new MissingSourceError("orchestration state", `no orchestration-state file at ${statePath} for phase ${phaseId}`);
+function writeRecordPair(repoRoot, phase, rawRecord, record2, io = NODE_RECORD_PAIR_IO) {
+  if (!isValidPhaseIdentity(phase)) {
+    throw new InvalidPhaseIdentityError(phase, BUILD_RECORD_DIR);
   }
-  const parsed = JSON.parse(readFileSync7(statePath, "utf-8"));
-  if (!parsed.tasks || typeof parsed.tasks !== "object") {
-    throw new MissingSourceError("orchestration state", `${statePath} has no tasks map`);
+  const outDir = resolve(repoRoot, BUILD_RECORD_DIR);
+  const segment = renderPhaseSegment(phase);
+  const jsonPath = join8(outDir, `${segment}.json`);
+  const mdPath = join8(outDir, `${segment}.md`);
+  const jsonTmp = `${jsonPath}.tmp`;
+  const mdTmp = `${mdPath}.tmp`;
+  for (const candidate of [jsonPath, mdPath, jsonTmp, mdTmp]) {
+    assertInsideOutDir(outDir, candidate, phase);
+  }
+  const jsonText = serialiseServedRecord(rawRecord);
+  const mdText = renderBuildRecordV2Markdown(record2);
+  mkdirSync5(outDir, { recursive: true });
+  let createdJson = false;
+  try {
+    io.createExclusive(jsonPath, jsonText);
+    createdJson = true;
+    io.createExclusive(mdPath, mdText);
+    return { kind: "created", jsonPath, mdPath };
+  } catch (err) {
+    if (createdJson)
+      rmSync2(jsonPath, { force: true });
+    if (!isEexist(err))
+      throw err;
   }
-  const tasks = {};
-  for (const [id, t] of Object.entries(parsed.tasks)) {
-    if (!t || typeof t.status !== "string") {
-      throw new MissingSourceError("orchestration state", `task ${id} has no status`);
-    }
-    tasks[id] = { status: t.status };
+  const existingJson = readIfPresent(jsonPath);
+  if (existingJson === null) {
+    return { kind: "in-the-way", path: existsSync6(jsonPath) ? jsonPath : mdPath };
   }
-  return { tasks };
-}
-function readPhaseClose(repoRoot, phaseId) {
-  const path = closeRecordPath(repoRoot, phaseId);
-  if (!existsSync6(path))
-    return { closeCommit: null, closedDate: null };
-  let parsed;
+  if (existingJson === jsonText) {
+    replaceOne(io, mdTmp, mdPath, mdText);
+    return { kind: "up-to-date", jsonPath, mdPath };
+  }
+  if (!isOwnEarlierRecord(existingJson, record2)) {
+    return { kind: "in-the-way", path: jsonPath };
+  }
+  replaceOne(io, jsonTmp, jsonPath, jsonText);
   try {
-    parsed = JSON.parse(readFileSync7(path, "utf-8"));
+    replaceOne(io, mdTmp, mdPath, mdText);
   } catch (err) {
-    throw new InvalidCloseRecordError(path, `it is not readable JSON: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  const record2 = parseCloseRecord(path, parsed);
-  if (renderPhaseSegment(record2.phase) !== renderPhaseSegment(phaseId)) {
-    throw new InvalidCloseRecordError(path, `it records the close of ${String(record2.phase)}, not of ${String(phaseId)}`);
+    try {
+      replaceOne(io, jsonTmp, jsonPath, existingJson);
+    } catch {
+      rmSync2(jsonPath, { force: true });
+    }
+    throw err;
   }
-  return { closeCommit: record2.closeCommit, closedDate: record2.closedDate };
+  return { kind: "replaced", jsonPath, mdPath };
 }
-function validateNarrated(narrated) {
-  const req = (v, name) => {
-    if (v === void 0 || v === null || v === "") {
-      throw new MissingSourceError("narrated artefact", `${name} is missing`);
-    }
-  };
-  req(narrated.engagement, "engagement");
-  req(narrated.engagementType, "engagementType");
-  req(narrated.phase?.name, "phase.name");
-  assertValidPhaseIdentity(narrated.phase?.id, BUILD_RECORD_DIR);
-  req(narrated.status, "status");
-  req(narrated.thesis, "thesis");
-  req(narrated.delivered, "delivered");
-  req(narrated.acceptance, "acceptance");
-  req(narrated.acceptance?.verdict, "acceptance.verdict");
-  req(narrated.gatesEarnedKeep, "gatesEarnedKeep");
-  req(narrated.instruments, "instruments");
-  if (!Array.isArray(narrated.deviations)) {
-    throw new MissingSourceError("narrated artefact", "deviations must be an array");
-  }
-  return narrated;
-}
-function loadSources(opts) {
-  const orchestration = readOrchestrationState(opts.phasesDir, opts.phaseId);
-  const guardEvalRuns = readGuardEvalLog(opts.guardEvalLogDir, opts.phaseId);
-  const close = readPhaseClose(opts.repoRoot, opts.phaseId);
-  const narrated = validateNarrated(opts.narrated);
-  if (!Array.isArray(opts.touchedInvariants)) {
-    throw new MissingSourceError("feature-spec Touches", "touchedInvariants must be an array");
+function replaceOne(io, tmp, finalPath, text) {
+  rmSync2(tmp, { force: true });
+  try {
+    io.createExclusive(tmp, text);
+    io.rename(tmp, finalPath);
+  } catch (err) {
+    rmSync2(tmp, { force: true });
+    throw err;
   }
-  return {
-    orchestration,
-    narrated,
-    close,
-    guardEvalRuns,
-    touchedInvariants: opts.touchedInvariants
-  };
 }
 
-// dist/build-record/assemble.js
-var LANDED_STATES = /* @__PURE__ */ new Set(["merged", "done"]);
-var CANCELLED_STATE = "cancelled";
-function deriveTasks(orchestration) {
-  const ids = Object.keys(orchestration.tasks);
-  const cancelled = ids.filter((id) => orchestration.tasks[id].status === CANCELLED_STATE).sort((a, b) => a.localeCompare(b));
-  const landed = ids.filter((id) => LANDED_STATES.has(orchestration.tasks[id].status)).length;
-  return { planned: ids.length, landed, cancelled };
-}
-function deriveThesisHeld(acceptance) {
-  if (acceptance.verdict !== "clean")
-    return false;
-  for (const dw of Object.values(acceptance.doneWhen)) {
-    if (dw.result === "dropped")
-      continue;
-    if (dw.result !== "pass")
-      return false;
-  }
-  return true;
+// dist/build-record/obtain.js
+import { relative as relative3 } from "node:path";
+var REFUSAL_FOLLOW_UP = {
+  "still-open": "Nothing was written. The record is produced when the phase closes.",
+  "reopened": "Nothing was written. A new record is produced when the phase closes again.",
+  "never-opened": "Nothing was written. Check the name: it must match the phase name exactly as it was opened.",
+  "never-closed": "Nothing was written.",
+  "closed-before-records": "Nothing was written."
+};
+var REFUSAL_REASONS = phaseRecordRefusalReasonSchema.options;
+function buildRecordUrl(credential, phase) {
+  return `${credential.serviceUrl}/engagements/${encodeURIComponent(credential.engagementId)}/phases/${encodeURIComponent(phase)}/build-record`;
 }
-function deriveInvariantsExercised(touched) {
-  return [...new Set(touched)].sort((a, b) => a.localeCompare(b));
+function isMissingRoute(status, body) {
+  if (status !== 404 || typeof body !== "object" || body === null)
+    return false;
+  const { error, message } = body;
+  return error === "Not Found" && typeof message === "string" && /^Route GET .* not found\.$/s.test(message);
 }
-function assembleBuildRecord(sources) {
-  const { narrated, close, orchestration } = sources;
+async function obtainBuildRecord(credential, repoRoot, phase, io = NODE_RECORD_PAIR_IO) {
+  const url = buildRecordUrl(credential, phase);
+  let res;
+  let text;
+  try {
+    res = await fetch(url, {
+      method: "GET",
+      headers: { authorization: `Bearer ${credential.token}` }
+    });
+    text = await res.text();
+  } catch (err) {
+    return {
+      kind: "unavailable",
+      why: `could not reach the Halfcycle service at ${url}: ${err instanceof Error ? err.message : String(err)}.`
+    };
+  }
+  let raw = null;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    raw = null;
+  }
+  const parsed = phaseRecordResponseSchema.safeParse(raw);
+  if (parsed.success) {
+    const answer = parsed.data;
+    if (answer.phase !== phase) {
+      return {
+        kind: "unavailable",
+        why: `the service answered for a different phase than the one asked for, so nothing was written.`
+      };
+    }
+    if (answer.outcome === "withheld")
+      return { kind: "withheld", message: answer.message };
+    if (answer.outcome === "refused") {
+      return { kind: "refused", reason: answer.reason, message: answer.message };
+    }
+    const rawRecord = raw.record;
+    let result;
+    try {
+      result = writeRecordPair(repoRoot, phase, rawRecord, answer.record, io);
+    } catch (err) {
+      return {
+        kind: "unavailable",
+        why: `the record arrived but could not be written: ${err instanceof Error ? err.message : String(err)}. Nothing was left half written.`
+      };
+    }
+    if (result.kind === "in-the-way") {
+      return { kind: "exists", path: relative3(repoRoot, result.path) };
+    }
+    return {
+      kind: "written",
+      jsonPath: relative3(repoRoot, result.jsonPath),
+      mdPath: relative3(repoRoot, result.mdPath)
+    };
+  }
+  if (isMissingRoute(res.status, raw)) {
+    return { kind: "unavailable", why: "this Halfcycle service does not provide Build Records yet." };
+  }
+  const message = typeof raw === "object" && raw !== null && typeof raw.message === "string" ? raw.message : null;
+  if (res.ok) {
+    return {
+      kind: "unavailable",
+      why: `the service's answer was not a Build Record this version of the CLI can read, so nothing was written.`
+    };
+  }
   return {
-    format: BUILD_RECORD_FORMAT,
-    engagement: narrated.engagement,
-    engagementType: narrated.engagementType,
-    phase: { id: narrated.phase.id, name: narrated.phase.name },
-    status: narrated.status,
-    closedDate: close.closedDate,
-    closeCommit: close.closeCommit,
-    thesis: narrated.thesis,
-    thesisHeld: deriveThesisHeld(narrated.acceptance),
-    delivered: narrated.delivered,
-    seedGuards: projectSeedGuards(sources.guardEvalRuns),
-    acceptance: narrated.acceptance,
-    gatesEarnedKeep: narrated.gatesEarnedKeep,
-    instruments: narrated.instruments,
-    invariantsExercised: deriveInvariantsExercised(sources.touchedInvariants),
-    deviations: narrated.deviations,
-    tasks: deriveTasks(orchestration)
+    kind: "unavailable",
+    why: `the service answered ${res.status}${message === null ? "." : `: ${message}`}`
   };
 }
-
-// dist/build-record/index.js
-function assemblePhaseBuildRecord(opts) {
-  const sources = loadSources({
-    repoRoot: opts.repoRoot,
-    phasesDir: opts.phasesDir,
-    guardEvalLogDir: opts.guardEvalLogDir,
-    phaseId: opts.phaseId,
-    narrated: opts.narrated,
-    touchedInvariants: opts.touchedInvariants
-  });
-  const record2 = assembleBuildRecord(sources);
-  return writeBuildRecord(opts.repoRoot, record2);
+function refetchCommand(phase) {
+  const quoted = /^[A-Za-z0-9._+-]+$/.test(phase) ? phase : `'${phase.replace(/'/g, `'\\''`)}'`;
+  return `npx halfcycle@latest build-record ${quoted}`;
 }
 export {
   BUILD_RECORD_DIR,
-  BUILD_RECORD_FORMAT,
-  BUILD_RECORD_ZONE_B_DIR,
-  CLOSE_RECORD_FORMAT,
   CreateEngagementRefused,
   FLAT_FILE_TRACKER_HOME,
   HALFCYCLE_STATE_FORMAT,
-  InvalidCloseRecordError,
   InvalidPhaseIdentityError,
-  MissingSourceError,
+  NODE_RECORD_PAIR_IO,
+  REFUSAL_FOLLOW_UP,
+  REFUSAL_REASONS,
   SetupManifest,
   ZONE_B_DIR,
   agentsPointerRow,
   applySetupWrites,
-  assembleBuildRecord,
-  assemblePhaseBuildRecord,
   assertValidPhaseIdentity,
   buildEngagementRecord,
+  buildRecordUrl,
   checkDrift,
-  closeRecordPath,
   contextIndexRow,
   createEngagement,
-  deriveInvariantsExercised,
-  deriveTasks,
-  deriveThesisHeld,
   discoverRepository,
   documentSectionRow,
   engagementRecordRow,
@@ -3617,31 +3946,24 @@ export {
   install,
   isValidPhaseIdentity,
   layerDocumentRow,
-  loadSources,
   mergeSettings,
   mergeWithRecords,
   mintBoardEnterCode,
   mintOrReadIdentity,
-  parseCloseRecord,
-  projectSeedGuard,
-  projectSeedGuards,
+  obtainBuildRecord,
   questionsToPut,
   readBundlePin,
-  readGuardEvalLog,
-  readOrchestrationState,
-  readPhaseClose,
   readRemote,
   readRootCommit,
+  refetchCommand,
   renderAnchor,
-  renderBuildRecordMarkdown,
+  renderBuildRecordV2Markdown,
   renderDiscovery,
   renderPhaseSegment,
   runBootstrapScan,
   scanLayers,
-  serialiseRecordJson,
+  serialiseServedRecord,
   trackerHomeRow,
-  validateNarrated,
-  writeBuildRecord,
-  writeCloseRecord
+  writeRecordPair
 };
 //# sourceMappingURL=index.js.map