lagora-cli 1.1.0

package/dist/scripts/chunk-NBJMYAOA.js

@@ -0,0 +1,2128 @@
+import {
+  normalizeVendorId
+} from "./chunk-QJPQHKIO.js";
+
+// lib/storage.ts
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir as mkdir2, readdir, readFile as readFile2, rename, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
+import path2 from "node:path";
+
+// lib/issue-assignment.ts
+var IssueAssigneeName = class {
+  constructor(name) {
+    const trimmed = name.trim();
+    if (!trimmed) throw new Error("Assignee is required");
+    this.value = trimmed;
+  }
+};
+var IssueAssignment = class {
+  static create(input) {
+    return {
+      name: new IssueAssigneeName(input.assignee).value,
+      userId: input.assigneeUserId,
+      assignedBy: input.actor.trim() || "Language Developer",
+      assignedByUserId: input.actorUserId,
+      assignedByPrincipalSubject: input.actorPrincipalSubject,
+      assignedByPrincipalScope: input.actorPrincipalScope,
+      assignedAt: input.assignedAt
+    };
+  }
+};
+
+// lib/issue-blockers.ts
+var DEFAULT_BLOCKER_REPOSITORY = "Hyper-Accel/hyperaccel-sdk";
+var GithubRepository = class {
+  constructor(repository = DEFAULT_BLOCKER_REPOSITORY) {
+    const normalized = repository.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "") || DEFAULT_BLOCKER_REPOSITORY;
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(normalized)) {
+      throw new Error(`Unsupported GitHub repository: ${repository}`);
+    }
+    this.value = normalized;
+  }
+};
+var IssueBlockerTags = class _IssueBlockerTags {
+  static merge(tags, blockers) {
+    const activeTags = blockers.length ? blockers.map((blocker) => _IssueBlockerTags.forStatus(blocker.status)) : [];
+    return uniqueTags([..._IssueBlockerTags.withoutBlockerTags(tags), ...activeTags]);
+  }
+  static forStatus(status) {
+    if (status === "merged") return "blocker:merged";
+    if (status === "closed") return "blocker:closed";
+    return "blocker:pr";
+  }
+  static withoutBlockerTags(tags) {
+    return uniqueTags(tags).filter((tag) => !tag.startsWith("blocker:"));
+  }
+};
+var GithubPullRequestSyncService = class {
+  async sync(blocker) {
+    const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      const response = await fetch(`https://api.github.com/repos/${blocker.repository}/pulls/${blocker.number}`, {
+        headers: this.headers()
+      });
+      if (!response.ok) {
+        return { ...blocker, status: "unknown", lastSyncedAt: syncedAt, syncError: `HTTP ${response.status}` };
+      }
+      const payload = await response.json();
+      if (!isGithubPullRequestPayload(payload)) {
+        return { ...blocker, status: "unknown", lastSyncedAt: syncedAt, syncError: "Unsupported GitHub response" };
+      }
+      return {
+        ...blocker,
+        title: payload.title,
+        url: payload.html_url ?? blocker.url,
+        status: githubPrStatus(payload),
+        lastSyncedAt: syncedAt,
+        syncError: void 0
+      };
+    } catch (error) {
+      if (error instanceof Error) {
+        return { ...blocker, status: "unknown", lastSyncedAt: syncedAt, syncError: error.message };
+      }
+      throw error;
+    }
+  }
+  headers() {
+    const token = process.env.AGORA_GITHUB_TOKEN?.trim();
+    return {
+      Accept: "application/vnd.github+json",
+      "User-Agent": "legato-dev-agora",
+      ...token ? { Authorization: `Bearer ${token}` } : {}
+    };
+  }
+};
+function githubPullRequestUrl(repository, number) {
+  return `https://github.com/${repository}/pull/${number}`;
+}
+function uniqueTags(tags) {
+  return [...new Set(tags.map((tag) => tag.trim().toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9:_./-]/g, "")).filter(Boolean))];
+}
+function isGithubPullRequestPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const state = Reflect.get(value, "state");
+  return state === void 0 || typeof state === "string";
+}
+function githubPrStatus(payload) {
+  if (payload.merged_at) return "merged";
+  if (payload.state === "open") return "open";
+  if (payload.state === "closed") return "closed";
+  return "unknown";
+}
+
+// lib/server/storage-notifications.ts
+async function notifyIssueCreatedBestEffort(issue, actorUserId) {
+  try {
+    const { createIssueCreatedNotifications } = await import("./notifications-EU43SIEV.js");
+    await createIssueCreatedNotifications(issue, actorUserId);
+  } catch (error) {
+    reportNotificationError(error);
+  }
+}
+async function notifyIssueChangedBestEffort(issue, actorUserId, eventType) {
+  try {
+    const { createIssueChangeNotifications } = await import("./notifications-EU43SIEV.js");
+    await createIssueChangeNotifications({ issue, actorUserId, eventType });
+  } catch (error) {
+    reportNotificationError(error);
+  }
+}
+async function notifyIssueDeletedBestEffort(issue, actorUserId) {
+  try {
+    const { createIssueDeletedNotifications } = await import("./notifications-EU43SIEV.js");
+    await createIssueDeletedNotifications(issue, actorUserId);
+  } catch (error) {
+    reportNotificationError(error);
+  }
+}
+async function notifyVerificationChangedBestEffort(issue, run, actorUserId) {
+  const eventType = verificationNotificationEventType(run.status);
+  if (!eventType) return;
+  await notifyIssueChangedBestEffort(issue, actorUserId, eventType);
+}
+async function notifyVerificationDeletedBestEffort(issue, actorUserId) {
+  await notifyIssueChangedBestEffort(issue, actorUserId, "verification_deleted");
+}
+function verificationNotificationEventType(status) {
+  if (status === "success") return "verification_succeeded";
+  if (status === "failed") return "verification_failed";
+  if (status === "skipped") return "verification_skipped";
+  return void 0;
+}
+function reportNotificationError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.warn(`Issue notification skipped: ${message}`);
+}
+
+// lib/verification-run-staleness.ts
+var DEFAULT_VERIFICATION_RUN_STALE_MS = 9e5;
+function verificationRunStaleMs() {
+  const parsed = Number.parseInt(process.env.AGORA_VERIFICATION_RUN_STALE_MS ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_VERIFICATION_RUN_STALE_MS;
+}
+function isVerificationRunActive(run, staleMs, nowMs) {
+  if (run.status !== "running") return false;
+  const lastActivity = Date.parse(run.completedAt ?? run.startedAt ?? "");
+  if (!Number.isFinite(lastActivity)) return false;
+  return nowMs - lastActivity < staleMs;
+}
+
+// lib/verification-generated-artifact-names.ts
+function storedGeneratedArtifactFilename(relativePath) {
+  const parsed = parseGeneratedArtifactPath(relativePath);
+  const originalName = parsed.filename.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return `lowering-${parsed.stageLabel}-${originalName}`;
+}
+function generatedArtifactFilenameCandidates(relativePath) {
+  return [
+    storedGeneratedArtifactFilename(relativePath),
+    `lowering-${relativePath.replace(/[/\\]+/g, "-").replace(/[^a-zA-Z0-9._-]/g, "_")}`
+  ];
+}
+function parseGeneratedArtifactPath(filenameOrPath) {
+  const parts = filenameOrPath.split(/[\\/]+/).filter(Boolean);
+  const first = parts[0]?.toLowerCase();
+  const stageLabel = stageLabelForSegment(first);
+  return {
+    stageLabel,
+    filename: parts.at(-1) ?? filenameOrPath
+  };
+}
+function stageLabelForSegment(segment) {
+  if (segment === "mlir") return "MLIR";
+  if (segment === "core_ir") return "CORE_IR";
+  if (segment === "backend_ir") return "BACKEND_IR";
+  if (segment === "asm") return "ASM";
+  if (segment === "binary") return "BINARY";
+  if (segment === "fsim") return "FSIM";
+  return "OUTPUT";
+}
+
+// lib/server/automation-settings.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+async function readAutomationSettings() {
+  const defaults = defaultAutomationSettings();
+  try {
+    const raw = await readFile(automationSettingsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return defaults;
+    const autoLoweringEnabled = Reflect.get(parsed, "autoLoweringEnabled");
+    const updatedAt = Reflect.get(parsed, "updatedAt");
+    return {
+      autoLoweringEnabled: typeof autoLoweringEnabled === "boolean" ? autoLoweringEnabled : defaults.autoLoweringEnabled,
+      updatedAt: typeof updatedAt === "string" && updatedAt.trim() ? updatedAt.trim() : void 0
+    };
+  } catch {
+    return defaults;
+  }
+}
+async function writeAutomationSettings(input) {
+  const settings = {
+    autoLoweringEnabled: input.autoLoweringEnabled,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await mkdir(automationSettingsRoot(), { recursive: true });
+  await writeFile(automationSettingsPath(), `${JSON.stringify(settings, null, 2)}
+`);
+  return settings;
+}
+async function isAutoLoweringEnabled() {
+  return (await readAutomationSettings()).autoLoweringEnabled;
+}
+function defaultAutomationSettings() {
+  return {
+    autoLoweringEnabled: readBooleanOverride(process.env.AGORA_AUTO_LOWERING) ?? true
+  };
+}
+function readBooleanOverride(value) {
+  if (value === "1" || value === "true") return true;
+  if (value === "0" || value === "false") return false;
+  return void 0;
+}
+function automationSettingsRoot() {
+  return process.env.AGORA_SETTINGS_DIR ? path.resolve(process.env.AGORA_SETTINGS_DIR) : path.join(
+    /*turbopackIgnore: true*/
+    process.cwd(),
+    ".local-data",
+    "settings"
+  );
+}
+function automationSettingsPath() {
+  return path.join(automationSettingsRoot(), "automation.json");
+}
+
+// lib/storage.ts
+var KNOWN_AREA_TAGS = ["lowering", "fsim", "compile", "runtime", "diagnostics"];
+var dataRoot = path2.join(
+  /*turbopackIgnore: true*/
+  process.cwd(),
+  ".local-data"
+);
+var artifactsRoot = path2.join(dataRoot, "artifacts");
+var dbPath = path2.join(dataRoot, "db.json");
+var hasExplicitIssueStore = Boolean(process.env.AGORA_ISSUE_STORE);
+var hasIsolatedIssueStore = hasExplicitIssueStore && process.env.AGORA_ISSUE_STORE_MODE === "isolated";
+var issueStoreRoot = process.env.AGORA_ISSUE_STORE ? path2.resolve(process.env.AGORA_ISSUE_STORE) : path2.join(
+  /*turbopackIgnore: true*/
+  process.cwd(),
+  "issue-store"
+);
+var bundledIssueStoreRoot = path2.join(
+  /*turbopackIgnore: true*/
+  process.cwd(),
+  "issue-store"
+);
+var tagRegistryPath = path2.join(hasIsolatedIssueStore ? issueStoreRoot : dataRoot, "tags.json");
+var emptyDb = () => ({
+  issues: [],
+  bundles: [],
+  artifacts: [],
+  comments: [],
+  verificationRuns: [],
+  occurrences: []
+});
+async function writeTextAtomic(filePath, content) {
+  const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+  await writeFile2(tempPath, content);
+  await rename(tempPath, filePath);
+}
+async function writePortableIssueJson(issuePath, portable) {
+  await writeTextAtomic(issuePath, JSON.stringify(portable, null, 2));
+}
+var defaultTagRegistry = [
+  { id: "area:lowering", label: "Lowering", description: "Lowering pipeline issue", color: "red", system: true },
+  { id: "area:fsim", label: "fSIM", description: "Functional simulation or verification issue", color: "orange", system: true },
+  { id: "area:compile", label: "Compile", description: "Compilation or build issue", color: "orange", system: true },
+  { id: "area:runtime", label: "Runtime", description: "Runtime behavior issue", color: "orange", system: true },
+  { id: "area:diagnostics", label: "Diagnostics", description: "Error message or diagnostic quality issue", color: "blue", system: true },
+  { id: "regression", label: "Regression", description: "Previously working behavior regressed", color: "red" },
+  { id: "needs-repro", label: "Needs Repro", description: "More reproduction details are needed", color: "gray" },
+  { id: "question", label: "Question", description: "Needs language-team clarification", color: "blue" }
+];
+async function ensureStore() {
+  await mkdir2(hasIsolatedIssueStore ? issueStoreRoot : artifactsRoot, { recursive: true });
+  try {
+    await readFile2(tagRegistryPath, "utf8");
+  } catch {
+    await writeFile2(tagRegistryPath, JSON.stringify(defaultTagRegistry, null, 2));
+  }
+}
+var dbRawCache;
+async function readDbRaw() {
+  try {
+    const details = await stat(dbPath);
+    if (dbRawCache && dbRawCache.mtimeMs === details.mtimeMs && dbRawCache.size === details.size) {
+      return dbRawCache.raw;
+    }
+    const raw = await readFile2(dbPath, "utf8");
+    dbRawCache = { mtimeMs: details.mtimeMs, size: details.size, raw };
+    return raw;
+  } catch {
+    const raw = JSON.stringify(emptyDb(), null, 2);
+    await writeTextAtomic(dbPath, raw);
+    try {
+      const details = await stat(dbPath);
+      dbRawCache = { mtimeMs: details.mtimeMs, size: details.size, raw };
+    } catch {
+      dbRawCache = void 0;
+    }
+    return raw;
+  }
+}
+async function readDb() {
+  if (hasIsolatedIssueStore) return emptyDb();
+  await ensureStore();
+  const raw = await readDbRaw();
+  const parsed = JSON.parse(raw);
+  return {
+    issues: parsed.issues ?? [],
+    bundles: parsed.bundles ?? [],
+    artifacts: parsed.artifacts ?? [],
+    comments: parsed.comments ?? [],
+    verificationRuns: parsed.verificationRuns ?? [],
+    occurrences: parsed.occurrences ?? []
+  };
+}
+async function writeDb(db) {
+  await ensureStore();
+  const raw = JSON.stringify(db, null, 2);
+  await writeTextAtomic(dbPath, raw);
+  try {
+    const details = await stat(dbPath);
+    dbRawCache = { mtimeMs: details.mtimeMs, size: details.size, raw };
+  } catch {
+    dbRawCache = void 0;
+  }
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function sanitizeFilename(filename) {
+  return filename.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+function assertSafeIssueId(id) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(id)) {
+    throw new Error(`Unsafe issue id: ${id}`);
+  }
+}
+function assertSafeFilename(filename) {
+  if (!filename || filename === "." || filename === ".." || filename !== path2.basename(filename)) {
+    throw new Error(`Unsafe artifact filename: ${filename}`);
+  }
+}
+function safeJoin(root, ...segments) {
+  const resolvedRoot = path2.resolve(root);
+  const target = path2.resolve(resolvedRoot, ...segments);
+  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${path2.sep}`)) {
+    throw new Error(`Path escapes storage root: ${segments.join("/")}`);
+  }
+  return target;
+}
+function safeArtifactPath(root, relativePath) {
+  if (path2.isAbsolute(relativePath)) {
+    throw new Error(`Absolute artifact path is not allowed: ${relativePath}`);
+  }
+  return safeJoin(root, relativePath);
+}
+function normalizeTag(tag) {
+  return tag.trim().toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9:_./-]/g, "");
+}
+function uniqueTags2(tags) {
+  return [...new Set(tags.map(normalizeTag).filter(Boolean))];
+}
+function issueAssignees(issue) {
+  const merged = [...issue.assignees ?? [], ...issue.assignee ? [issue.assignee] : []];
+  const byName = /* @__PURE__ */ new Map();
+  for (const assignee of merged) {
+    if (assignee?.name.trim()) byName.set(assignee.name.trim().toLowerCase(), assignee);
+  }
+  return [...byName.values()].filter(Boolean);
+}
+function firstAssignee(assignees) {
+  return assignees[0];
+}
+function sameOptionalId(left, right) {
+  return (left ?? "") === (right ?? "");
+}
+function normalizeSignatureText(text) {
+  return text.toLowerCase().replace(/[a-f0-9]{16,}/g, "<hash>").replace(/0x[a-f0-9]+/g, "<addr>").replace(/\d+/g, "<num>").replace(/\s+/g, " ").trim();
+}
+function rawFingerprint(input) {
+  const diagnosticSignature = normalizeSignatureText(`${input.title}
+${input.description}`).slice(0, 240);
+  const key = createHash("sha256").update(["raw", input.kernelChecksum, input.logChecksum ?? "no-log", diagnosticSignature].join("\0")).digest("hex");
+  return { key, basis: "raw", artifactHash: input.kernelChecksum, diagnosticSignature, createdAt: input.createdAt };
+}
+function upsertFingerprint(fingerprints, fingerprint) {
+  const existingIndex = fingerprints.findIndex((item) => item.key === fingerprint.key);
+  if (existingIndex >= 0) {
+    return fingerprints.map((item, index) => index === existingIndex ? fingerprint : item);
+  }
+  return [fingerprint, ...fingerprints];
+}
+function makeOccurrence(input) {
+  return {
+    id: randomUUID(),
+    issueId: input.issueId,
+    reporter: input.reporter,
+    reporterUserId: input.reporterUserId,
+    reporterPrincipalSubject: input.reporterPrincipalSubject,
+    reporterPrincipalScope: input.reporterPrincipalScope,
+    reporterVendorId: input.reporterVendorId,
+    bundleId: input.bundle.id,
+    artifactIds: input.artifacts.map((artifact) => artifact.id),
+    kernelChecksum: input.kernelChecksum,
+    source: input.bundle.source,
+    gitMetadata: input.bundle.gitMetadata,
+    environmentMetadata: input.bundle.environmentMetadata,
+    createdAt: input.createdAt
+  };
+}
+async function listTagDefinitions() {
+  await ensureStore();
+  const raw = await readFile2(tagRegistryPath, "utf8");
+  const tags = JSON.parse(raw);
+  return tags.map((tag) => ({ ...tag, id: normalizeTag(tag.id) })).filter((tag) => tag.id && tag.label);
+}
+async function addTagDefinition(input) {
+  const tags = await listTagDefinitions();
+  const id = normalizeTag(input.id);
+  if (!id || tags.some((tag) => tag.id === id)) return;
+  tags.push({
+    id,
+    label: input.label.trim() || id,
+    description: input.description?.trim() || void 0,
+    color: input.color ?? "blue"
+  });
+  await writeFile2(tagRegistryPath, JSON.stringify(tags, null, 2));
+}
+async function deleteTagDefinition(id) {
+  const normalizedId = normalizeTag(id);
+  const tags = await listTagDefinitions();
+  const target = tags.find((tag) => tag.id === normalizedId);
+  if (!target || target.system) return;
+  await writeFile2(tagRegistryPath, JSON.stringify(tags.filter((tag) => tag.id !== normalizedId), null, 2));
+}
+function deriveTags(input) {
+  const text = `${input.title}
+${input.description}`.toLowerCase();
+  const areaTags = KNOWN_AREA_TAGS.filter((tag) => text.includes(tag)).map((tag) => `area:${tag}`);
+  return uniqueTags2([
+    ...areaTags,
+    input.kernelFilename ? `kernel:${input.kernelFilename}` : "",
+    input.hasLog ? "has-log" : "no-log",
+    input.source ? `source:${input.source}` : "",
+    ...input.tags ?? []
+  ]);
+}
+async function storeFile(file, kind) {
+  const bytes = Buffer.from(await file.arrayBuffer());
+  const id = randomUUID();
+  const checksum = createHash("sha256").update(bytes).digest("hex");
+  const filename = sanitizeFilename(file.name || `${kind}.txt`);
+  const relativePath = path2.posix.join("artifacts", `${id}-${filename}`);
+  await writeFile2(safeArtifactPath(dataRoot, relativePath), bytes);
+  return {
+    id,
+    kind,
+    filename,
+    contentType: file.type || "text/plain",
+    size: bytes.byteLength,
+    checksum,
+    relativePath,
+    createdAt: now()
+  };
+}
+async function createIssue(input) {
+  if (hasIsolatedIssueStore) throw new Error("Use lagora report --store to create a portable issue");
+  const db = await readDb();
+  const createdAt = now();
+  const creatorVendorId = normalizeVendorId(input.creatorVendorId);
+  const kernelArtifact = await storeFile(input.kernelFile, "kernel");
+  const artifacts = [kernelArtifact];
+  let errorLogArtifact;
+  if (input.errorLogFile && input.errorLogFile.size > 0) {
+    errorLogArtifact = await storeFile(input.errorLogFile, "error-log");
+    artifacts.push(errorLogArtifact);
+  }
+  const bundle = {
+    id: randomUUID(),
+    source: input.source ?? "web",
+    kernelArtifactId: kernelArtifact.id,
+    errorLogArtifactId: errorLogArtifact?.id,
+    legatoBinaryVersion: input.legatoBinaryVersion,
+    cliVersion: input.cliVersion,
+    gitMetadata: input.gitMetadata,
+    environmentMetadata: input.environmentMetadata,
+    createdAt
+  };
+  const fingerprint = rawFingerprint({
+    kernelChecksum: kernelArtifact.checksum,
+    logChecksum: errorLogArtifact?.checksum,
+    title: input.title,
+    description: input.description,
+    createdAt
+  });
+  const duplicate = db.issues.find((item) => normalizeVendorId(item.creatorVendorId) === creatorVendorId && (item.fingerprint?.key === fingerprint.key || (item.fingerprints ?? []).some((existing) => existing.key === fingerprint.key)));
+  if (duplicate) {
+    const occurrence2 = makeOccurrence({
+      issueId: duplicate.id,
+      reporter: input.creator.trim() || "Kernel Developer",
+      reporterUserId: input.creatorUserId,
+      reporterPrincipalSubject: input.creatorPrincipalSubject,
+      reporterPrincipalScope: input.creatorPrincipalScope,
+      reporterVendorId: creatorVendorId,
+      bundle,
+      artifacts,
+      kernelChecksum: kernelArtifact.checksum,
+      createdAt
+    });
+    const comment = {
+      id: randomUUID(),
+      issueId: duplicate.id,
+      author: "Legato Agora",
+      kind: "system",
+      body: `\uB3D9\uC77C signature report\uAC00 \uB2E4\uC2DC \uC811\uC218\uB418\uC5C8\uC2B5\uB2C8\uB2E4. Occurrence #${(duplicate.occurrenceCount ?? 1) + 1}.`,
+      createdAt
+    };
+    duplicate.currentBundleId = bundle.id;
+    duplicate.artifactIds = [...duplicate.artifactIds ?? [], ...artifacts.map((artifact) => artifact.id)];
+    duplicate.commentIds = [...duplicate.commentIds ?? [], comment.id];
+    duplicate.occurrenceIds = [...duplicate.occurrenceIds ?? [], occurrence2.id];
+    duplicate.occurrenceCount = (duplicate.occurrenceCount ?? Math.max(1, duplicate.occurrenceIds.length)) + 1;
+    duplicate.updatedAt = createdAt;
+    db.bundles.push(bundle);
+    db.artifacts.push(...artifacts);
+    db.comments.push(comment);
+    db.occurrences.push(occurrence2);
+    await writeDb(db);
+    return duplicate.id;
+  }
+  const issue = {
+    id: randomUUID(),
+    title: input.title.trim(),
+    description: input.description.trim(),
+    status: "open",
+    creator: input.creator.trim() || "Kernel Developer",
+    creatorUserId: input.creatorUserId,
+    creatorPrincipalSubject: input.creatorPrincipalSubject,
+    creatorPrincipalScope: input.creatorPrincipalScope,
+    creatorVendorId,
+    currentBundleId: bundle.id,
+    artifactIds: artifacts.map((artifact) => artifact.id),
+    commentIds: [],
+    verificationRunIds: [],
+    tags: deriveTags({
+      title: input.title,
+      description: input.description,
+      kernelFilename: kernelArtifact.filename,
+      hasLog: Boolean(errorLogArtifact),
+      source: input.source ?? "web",
+      tags: input.tags
+    }),
+    fingerprint,
+    fingerprints: [fingerprint],
+    occurrenceCount: 1,
+    occurrenceIds: [],
+    createdAt,
+    updatedAt: createdAt
+  };
+  const occurrence = makeOccurrence({
+    issueId: issue.id,
+    reporter: issue.creator,
+    reporterUserId: issue.creatorUserId,
+    reporterPrincipalSubject: issue.creatorPrincipalSubject,
+    reporterPrincipalScope: issue.creatorPrincipalScope,
+    reporterVendorId: issue.creatorVendorId,
+    bundle,
+    artifacts,
+    kernelChecksum: kernelArtifact.checksum,
+    createdAt
+  });
+  issue.occurrenceIds.push(occurrence.id);
+  const systemComment = {
+    id: randomUUID(),
+    issueId: issue.id,
+    author: "Legato Agora",
+    kind: "system",
+    body: bundle.source === "cli" ? "CLI report received with local reproduction metadata. Lowering and fsim automation will be attached in M2." : "Manual web report created. Prefer CLI reporting when reproducibility metadata matters.",
+    createdAt
+  };
+  issue.commentIds.push(systemComment.id);
+  db.issues.unshift(issue);
+  db.bundles.push(bundle);
+  db.artifacts.push(...artifacts);
+  db.comments.push(systemComment);
+  db.occurrences.push(occurrence);
+  await writeDb(db);
+  await notifyIssueCreatedBestEffort(issue, issue.creatorUserId);
+  return issue.id;
+}
+async function addComment(input) {
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  const createdAt = now();
+  if (!issue) {
+    await addPortableComment(input, createdAt);
+    return;
+  }
+  const comment = {
+    id: randomUUID(),
+    issueId: input.issueId,
+    author: input.author.trim() || "Language Developer",
+    authorUserId: input.authorUserId,
+    authorPrincipalSubject: input.authorPrincipalSubject,
+    authorPrincipalScope: input.authorPrincipalScope,
+    kind: input.kind,
+    body: input.body.trim(),
+    createdAt
+  };
+  issue.commentIds.push(comment.id);
+  issue.updatedAt = createdAt;
+  if (comment.kind === "solution") {
+    issue.status = "resolved";
+  } else if (comment.kind === "analysis" && issue.status === "open") {
+    issue.status = "investigating";
+  }
+  db.comments.push(comment);
+  await writeDb(db);
+  await notifyIssueChangedBestEffort(issue, input.authorUserId, "comment_added");
+}
+async function addPortableComment(input, createdAt) {
+  assertSafeIssueId(input.issueId);
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const comment = {
+    id: randomUUID(),
+    issueId: portable.id,
+    author: input.author.trim() || "Language Developer",
+    authorUserId: input.authorUserId,
+    authorPrincipalSubject: input.authorPrincipalSubject,
+    authorPrincipalScope: input.authorPrincipalScope,
+    kind: input.kind,
+    body: input.body.trim(),
+    createdAt
+  };
+  portable.comments = [...portable.comments ?? [], comment];
+  portable.updatedAt = createdAt;
+  if (comment.kind === "solution") {
+    portable.status = "resolved";
+  } else if (comment.kind === "analysis" && (portable.status ?? "open") === "open") {
+    portable.status = "investigating";
+  }
+  await writePortableIssueJson(issuePath, portable);
+}
+async function updatePortableComment(input, updatedAt) {
+  assertSafeIssueId(input.issueId);
+  const issuePath = await readablePortableIssuePath(input.issueId);
+  if (!issuePath) return { ok: false, reason: "issue_not_found" };
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const comments = portable.comments ?? [];
+  const comment = comments.find((item) => item.id === input.commentId);
+  if (!comment) {
+    return input.commentId === `${portable.id}-system-comment` ? { ok: false, reason: "system_comment_protected" } : { ok: false, reason: "comment_not_found" };
+  }
+  if (comment.kind === "system") return { ok: false, reason: "system_comment_protected" };
+  if (!canMutateComment(comment, input.author, input.authorUserId, input.authorPrincipalSubject, input.authorPrincipalScope, input.authPolicy)) return { ok: false, reason: "comment_forbidden" };
+  const actor = input.author.trim();
+  const updatedComment = {
+    ...comment,
+    kind: input.kind,
+    body: input.body.trim(),
+    editedAt: updatedAt,
+    editedBy: actor || "Language Developer",
+    editedByUserId: input.authorUserId,
+    editedByPrincipalSubject: input.authorPrincipalSubject,
+    editedByPrincipalScope: input.authorPrincipalScope
+  };
+  portable.comments = comments.map((item) => item.id === updatedComment.id ? updatedComment : item);
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+  return hydratedPortableCommentMutationResult(input.issueId, input.commentId);
+}
+async function deletePortableComment(input, deletedAt) {
+  assertSafeIssueId(input.issueId);
+  const issuePath = await readablePortableIssuePath(input.issueId);
+  if (!issuePath) return { ok: false, reason: "issue_not_found" };
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const comments = portable.comments ?? [];
+  const comment = comments.find((item) => item.id === input.commentId);
+  if (!comment) {
+    return input.commentId === `${portable.id}-system-comment` ? { ok: false, reason: "system_comment_protected" } : { ok: false, reason: "comment_not_found" };
+  }
+  if (comment.kind === "system") return { ok: false, reason: "system_comment_protected" };
+  if (!canMutateComment(comment, input.actor, input.actorUserId, input.actorPrincipalSubject, input.actorPrincipalScope, input.authPolicy)) return { ok: false, reason: "comment_forbidden" };
+  const actor = input.actor.trim();
+  const deletedComment = {
+    ...comment,
+    deletedAt,
+    deletedBy: actor || "Language Developer",
+    deletedByUserId: input.actorUserId,
+    deletedByPrincipalSubject: input.actorPrincipalSubject,
+    deletedByPrincipalScope: input.actorPrincipalScope
+  };
+  portable.comments = comments.map((item) => item.id === deletedComment.id ? deletedComment : item);
+  portable.updatedAt = deletedAt;
+  await writePortableIssueJson(issuePath, portable);
+  return hydratedPortableCommentMutationResult(input.issueId, input.commentId);
+}
+async function readablePortableIssuePath(issueId) {
+  try {
+    return await portableIssuePathFollowingDuplicate(issueId);
+  } catch (error) {
+    if (isFileNotFoundError(error)) return void 0;
+    throw error;
+  }
+}
+async function hydratedPortableCommentMutationResult(issueId, commentId) {
+  const record = await readPortableIssue(issueId, { followDuplicate: true });
+  if (!record) return { ok: false, reason: "issue_not_found" };
+  const comment = record.comments.find((item) => item.id === commentId);
+  return comment ? { ok: true, comment } : { ok: false, reason: "comment_not_found" };
+}
+function isFileNotFoundError(error) {
+  return error instanceof Error && hasNodeErrorCode(error) && error.code === "ENOENT";
+}
+function hasNodeErrorCode(error) {
+  return "code" in error && typeof error.code === "string";
+}
+function canMutateComment(comment, actor, actorUserId, actorPrincipalSubject, actorPrincipalScope, authPolicy) {
+  if (actorUserId && actorPrincipalSubject && actorPrincipalScope === "admin") return true;
+  if (comment.authorUserId && sameOptionalId(comment.authorUserId, actorUserId)) return true;
+  if (isSameTenantPrincipalLegacyOwner(comment.authorUserId, actorUserId, actorPrincipalSubject)) return true;
+  if (comment.authorUserId) return false;
+  if (authPolicy?.enforceTenantIdentity) return false;
+  return comment.author.trim().toLowerCase() === actor.trim().toLowerCase();
+}
+function isSameTenantPrincipalLegacyOwner(ownerUserId, actorUserId, actorPrincipalSubject) {
+  return Boolean(actorUserId && actorPrincipalSubject && ownerUserId === `tenant-principal:${actorPrincipalSubject}`);
+}
+async function updateComment(input) {
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  const updatedAt = now();
+  if (!issue) return updatePortableComment(input, updatedAt);
+  const comment = db.comments.find((item) => item.id === input.commentId && item.issueId === input.issueId);
+  if (!comment || !issue.commentIds.includes(comment.id)) return { ok: false, reason: "comment_not_found" };
+  if (comment.kind === "system") return { ok: false, reason: "system_comment_protected" };
+  if (!canMutateComment(comment, input.author, input.authorUserId, input.authorPrincipalSubject, input.authorPrincipalScope, input.authPolicy)) return { ok: false, reason: "comment_forbidden" };
+  const updatedComment = {
+    ...comment,
+    kind: input.kind,
+    body: input.body.trim(),
+    editedAt: updatedAt,
+    editedBy: input.author.trim() || "Language Developer",
+    editedByUserId: input.authorUserId,
+    editedByPrincipalSubject: input.authorPrincipalSubject,
+    editedByPrincipalScope: input.authorPrincipalScope
+  };
+  db.comments = db.comments.map((item) => item.id === updatedComment.id ? updatedComment : item);
+  issue.updatedAt = updatedAt;
+  await writeDb(db);
+  await notifyIssueChangedBestEffort(issue, input.authorUserId, "comment_updated");
+  return { ok: true, comment: updatedComment };
+}
+async function deleteComment(input) {
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  const deletedAt = now();
+  if (!issue) return deletePortableComment(input, deletedAt);
+  const comment = db.comments.find((item) => item.id === input.commentId && item.issueId === input.issueId);
+  if (!comment || !issue.commentIds.includes(comment.id)) return { ok: false, reason: "comment_not_found" };
+  if (comment.kind === "system") return { ok: false, reason: "system_comment_protected" };
+  if (!canMutateComment(comment, input.actor, input.actorUserId, input.actorPrincipalSubject, input.actorPrincipalScope, input.authPolicy)) return { ok: false, reason: "comment_forbidden" };
+  const deletedComment = {
+    ...comment,
+    deletedAt,
+    deletedBy: input.actor.trim() || "Language Developer",
+    deletedByUserId: input.actorUserId,
+    deletedByPrincipalSubject: input.actorPrincipalSubject,
+    deletedByPrincipalScope: input.actorPrincipalScope
+  };
+  db.comments = db.comments.map((item) => item.id === deletedComment.id ? deletedComment : item);
+  issue.updatedAt = deletedAt;
+  await writeDb(db);
+  await notifyIssueChangedBestEffort(issue, input.actorUserId, "comment_deleted");
+  return { ok: true, comment: deletedComment };
+}
+async function closeIssue(issueId, actor = "Language Developer", actorUserId, actorPrincipalSubject, actorPrincipalScope) {
+  await updateIssueStatus({ issueId, status: "resolved", actor, actorUserId, actorPrincipalSubject, actorPrincipalScope });
+}
+async function deleteIssue(issueId, actorUserId) {
+  assertSafeIssueId(issueId);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === issueId);
+  if (!issue) {
+    const record = await getIssue(issueId);
+    const deleted = await deletePortableIssue(issueId);
+    if (!hasIsolatedIssueStore && deleted && record) await notifyIssueDeletedBestEffort(record.issue, actorUserId);
+    return deleted;
+  }
+  const artifactIds = new Set(issue.artifactIds ?? []);
+  const commentIds = new Set(issue.commentIds ?? []);
+  const verificationRunIds = new Set(issue.verificationRunIds ?? []);
+  const occurrenceIds = new Set(issue.occurrenceIds ?? []);
+  const bundleIds = /* @__PURE__ */ new Set([
+    issue.currentBundleId,
+    ...db.occurrences.filter((occurrence) => occurrence.issueId === issueId || occurrenceIds.has(occurrence.id)).map((occurrence) => occurrence.bundleId)
+  ]);
+  const localArtifacts = db.artifacts.filter((artifact) => artifactIds.has(artifact.id) && artifact.storage !== "issue-store");
+  await writeDb({
+    issues: db.issues.filter((item) => item.id !== issueId),
+    bundles: db.bundles.filter((bundle) => !bundleIds.has(bundle.id)),
+    artifacts: db.artifacts.filter((artifact) => !artifactIds.has(artifact.id)),
+    comments: db.comments.filter((comment) => comment.issueId !== issueId && !commentIds.has(comment.id)),
+    verificationRuns: db.verificationRuns.filter((run) => run.issueId !== issueId && !verificationRunIds.has(run.id)),
+    occurrences: db.occurrences.filter((occurrence) => occurrence.issueId !== issueId && !occurrenceIds.has(occurrence.id))
+  });
+  await Promise.all(localArtifacts.map((artifact) => rm(safeArtifactPath(dataRoot, artifact.relativePath), { force: true })));
+  await notifyIssueDeletedBestEffort(issue, actorUserId);
+  return true;
+}
+async function updateIssueStatus(issueIdOrInput, status, actor = "Language Developer", actorUserId) {
+  const input = typeof issueIdOrInput === "string" ? { issueId: issueIdOrInput, status: status ?? "open", actor, actorUserId } : issueIdOrInput;
+  assertSafeIssueId(input.issueId);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  const updatedAt = now();
+  if (issue) {
+    const previousStatus = issue.status;
+    issue.status = input.status;
+    issue.updatedAt = updatedAt;
+    const comment = statusChangeComment(input, previousStatus, updatedAt);
+    issue.commentIds.push(comment.id);
+    db.comments.push(comment);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.actorUserId, "status_changed");
+    return;
+  }
+  await updatePortableIssueStatus(input, updatedAt);
+}
+async function updateIssueDescription(issueIdOrInput, description, actor = "Language Developer", actorUserId) {
+  const input = typeof issueIdOrInput === "string" ? { issueId: issueIdOrInput, description: description ?? "", actor, actorUserId } : issueIdOrInput;
+  assertSafeIssueId(input.issueId);
+  const updatedAt = now();
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    if (!canMutateIssueDescription(issue.creator, issue.creatorUserId, input.actor, input.actorUserId, input.actorPrincipalSubject, input.actorPrincipalScope, input.authPolicy)) {
+      throw new Error("issue_description_forbidden");
+    }
+    issue.description = input.description.trim();
+    issue.updatedAt = updatedAt;
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.actorUserId, "issue_description_updated");
+    return issue;
+  }
+  await updatePortableIssueDescription(input, updatedAt);
+  const record = await getIssue(input.issueId);
+  if (!hasIsolatedIssueStore && record) await notifyIssueChangedBestEffort(record.issue, input.actorUserId, "issue_description_updated");
+  if (!record) throw new Error("issue_not_found");
+  return record.issue;
+}
+async function addIssueTags(issueId, tags) {
+  const registry = await listTagDefinitions();
+  const allowed = new Set(registry.map((tag) => tag.id));
+  const normalizedTags = uniqueTags2(tags).filter((tag) => allowed.has(tag));
+  if (normalizedTags.length === 0) return;
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === issueId);
+  const updatedAt = now();
+  if (issue) {
+    issue.tags = uniqueTags2([...issue.tags ?? [], ...normalizedTags]);
+    issue.updatedAt = updatedAt;
+    await writeDb(db);
+    return;
+  }
+  await addPortableIssueTags(issueId, normalizedTags, updatedAt);
+}
+async function assignIssue(input) {
+  assertSafeIssueId(input.issueId);
+  const assignee = new IssueAssigneeName(input.assignee).value;
+  const updatedAt = now();
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const nextAssignee = IssueAssignment.create({
+      assignee,
+      assigneeUserId: input.assigneeUserId,
+      actor: input.actor,
+      actorUserId: input.actorUserId,
+      actorPrincipalSubject: input.actorPrincipalSubject,
+      actorPrincipalScope: input.actorPrincipalScope,
+      assignedAt: updatedAt
+    });
+    const assignees = [
+      ...issueAssignees(issue).filter((item) => item.name.toLowerCase() !== nextAssignee.name.toLowerCase()),
+      nextAssignee
+    ];
+    issue.assignees = assignees;
+    issue.assignee = firstAssignee(assignees);
+    issue.updatedAt = updatedAt;
+    const comment = assignmentComment(input.issueId, assignee, input.actor, updatedAt);
+    db.comments.push(comment);
+    issue.commentIds.push(comment.id);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.actorUserId, "assignment_changed");
+    return;
+  }
+  await assignPortableIssue(input, updatedAt);
+}
+async function unassignIssue(input) {
+  assertSafeIssueId(input.issueId);
+  const assignee = new IssueAssigneeName(input.assignee).value;
+  const updatedAt = now();
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const assignees = issueAssignees(issue).filter((item) => item.name.toLowerCase() !== assignee.toLowerCase());
+    issue.assignees = assignees;
+    issue.assignee = firstAssignee(assignees);
+    issue.updatedAt = updatedAt;
+    const comment = unassignmentComment(input.issueId, input.actor, updatedAt, assignee);
+    db.comments.push(comment);
+    issue.commentIds.push(comment.id);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.actorUserId, "assignment_changed");
+    return;
+  }
+  await unassignPortableIssue(input, updatedAt);
+}
+async function clearIssueAssignee(issueId, actor = "Language Developer") {
+  assertSafeIssueId(issueId);
+  const updatedAt = now();
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === issueId);
+  if (issue) {
+    issue.assignees = [];
+    issue.assignee = void 0;
+    issue.updatedAt = updatedAt;
+    const comment = unassignmentComment(issueId, actor, updatedAt);
+    db.comments.push(comment);
+    issue.commentIds.push(comment.id);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, void 0, "assignment_changed");
+    return;
+  }
+  await clearPortableIssueAssignee(issueId, actor, updatedAt);
+}
+async function addIssueBlocker(input) {
+  assertSafeIssueId(input.issueId);
+  if (!Number.isInteger(input.number) || input.number <= 0) {
+    throw new Error(`Unsupported pull request number: ${input.number}`);
+  }
+  const repository = new GithubRepository(input.repository).value;
+  const createdAt = now();
+  const blocker = {
+    id: randomUUID(),
+    kind: "github-pr",
+    repository,
+    number: input.number,
+    url: githubPullRequestUrl(repository, input.number),
+    status: "unknown",
+    addedBy: input.actor.trim() || "Language Developer",
+    addedByUserId: input.actorUserId,
+    addedByPrincipalSubject: input.actorPrincipalSubject,
+    addedByPrincipalScope: input.actorPrincipalScope,
+    addedAt: createdAt
+  };
+  const synced = await new GithubPullRequestSyncService().sync(blocker);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const blockers = [...(issue.blockers ?? []).filter((item) => item.repository !== synced.repository || item.number !== synced.number), synced];
+    issue.blockers = blockers;
+    issue.tags = IssueBlockerTags.merge(issue.tags ?? [], blockers);
+    issue.updatedAt = synced.lastSyncedAt ?? createdAt;
+    const comment = blockerComment(input.issueId, synced, input.actor, createdAt);
+    db.comments.push(comment);
+    issue.commentIds.push(comment.id);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.actorUserId, "blocker_added");
+    return synced;
+  }
+  await addPortableIssueBlocker(input.issueId, synced, input.actor, createdAt);
+  return synced;
+}
+async function syncIssueBlocker(input) {
+  assertSafeIssueId(input.issueId);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const blocker = (issue.blockers ?? []).find((item) => item.id === input.blockerId);
+    if (!blocker) throw new Error(`Blocker not found: ${input.blockerId}`);
+    const synced = await new GithubPullRequestSyncService().sync(blocker);
+    issue.blockers = (issue.blockers ?? []).map((item) => item.id === synced.id ? synced : item);
+    issue.tags = IssueBlockerTags.merge(issue.tags ?? [], issue.blockers);
+    issue.updatedAt = synced.lastSyncedAt ?? now();
+    const comment = blockerSyncComment(input.issueId, synced, input.actor, issue.updatedAt);
+    db.comments.push(comment);
+    issue.commentIds.push(comment.id);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.actorUserId, "blocker_synced");
+    return synced;
+  }
+  return syncPortableIssueBlocker(input);
+}
+async function removeIssueBlocker(input) {
+  assertSafeIssueId(input.issueId);
+  const updatedAt = now();
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const blocker = (issue.blockers ?? []).find((item) => item.id === input.blockerId);
+    if (!blocker) throw new Error(`Blocker not found: ${input.blockerId}`);
+    issue.blockers = (issue.blockers ?? []).filter((item) => item.id !== input.blockerId);
+    issue.tags = IssueBlockerTags.merge(issue.tags ?? [], issue.blockers);
+    issue.updatedAt = updatedAt;
+    const comment = blockerRemovedComment(input.issueId, blocker, input.actor, updatedAt);
+    db.comments.push(comment);
+    issue.commentIds.push(comment.id);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.actorUserId, "blocker_removed");
+    return;
+  }
+  await removePortableIssueBlocker(input, updatedAt);
+}
+async function listIssues() {
+  const db = await readDb();
+  const localIssues = db.issues.map((issue) => hydrateIssue(db, issue)).filter(Boolean);
+  const portableIssues = await readPortableIssues();
+  return [...portableIssues, ...localIssues].sort((left, right) => {
+    const leftDone = left.issue.status === "resolved" || left.issue.status === "deferred" || left.issue.status === "cancelled";
+    const rightDone = right.issue.status === "resolved" || right.issue.status === "deferred" || right.issue.status === "cancelled";
+    if (leftDone !== rightDone) return leftDone ? 1 : -1;
+    return new Date(right.issue.updatedAt).getTime() - new Date(left.issue.updatedAt).getTime();
+  });
+}
+async function getIssue(id) {
+  assertSafeIssueId(id);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === id);
+  if (issue) return hydrateIssue(db, issue);
+  return readPortableIssue(id, { followDuplicate: true });
+}
+async function readArtifactText(artifact) {
+  return readFile2(getArtifactTextPath(artifact), "utf8");
+}
+function getArtifactTextPath(artifact) {
+  return hasIsolatedIssueStore || artifact.storage === "issue-store" ? existingIssueStoreArtifactPath(artifact.relativePath) : safeArtifactPath(dataRoot, artifact.relativePath);
+}
+async function addKernelSuggestion(input) {
+  assertSafeIssueId(input.issueId);
+  assertSafeFilename(input.filename);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const artifact = await writeLocalKernelSuggestionArtifact(input, now());
+    const comment = kernelSuggestionComment(input, artifact.createdAt);
+    issue.artifactIds = [...issue.artifactIds ?? [], artifact.id];
+    issue.commentIds = [...issue.commentIds ?? [], comment.id];
+    issue.updatedAt = artifact.createdAt;
+    db.artifacts.push(artifact);
+    db.comments.push(comment);
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.authorUserId, "suggestion_added");
+    return artifact;
+  }
+  return addPortableKernelSuggestion(input);
+}
+async function updateKernelSuggestion(input) {
+  assertSafeIssueId(input.issueId);
+  assertSafeFilename(input.filename);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const artifactIndex = db.artifacts.findIndex((artifact2) => artifact2.id === input.suggestionArtifactId);
+    const artifact = artifactIndex >= 0 ? db.artifacts[artifactIndex] : void 0;
+    if (!artifact || artifact.kind !== "kernel-suggestion" || !(issue.artifactIds ?? []).includes(artifact.id)) {
+      throw new Error(`Kernel suggestion not found: ${input.suggestionArtifactId}`);
+    }
+    const updatedAt = now();
+    const updatedArtifact = await rewriteKernelSuggestionArtifact(artifact, input.content);
+    const comment = kernelSuggestionUpdatedComment(input, updatedAt);
+    db.artifacts[artifactIndex] = updatedArtifact;
+    db.comments.push(comment);
+    issue.commentIds = [...issue.commentIds ?? [], comment.id];
+    issue.updatedAt = updatedAt;
+    await writeDb(db);
+    await notifyIssueChangedBestEffort(issue, input.authorUserId, "suggestion_updated");
+    return updatedArtifact;
+  }
+  return updatePortableKernelSuggestion(input);
+}
+async function recordVerificationResult(input) {
+  assertSafeIssueId(input.issueId);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const run2 = await recordLocalVerificationResult(db, issue, input);
+    await writeDb(db);
+    await notifyVerificationChangedBestEffort(issue, run2, input.actorUserId);
+    return run2;
+  }
+  const run = await recordPortableVerificationResult(input);
+  const record = await getIssue(input.issueId);
+  if (!hasIsolatedIssueStore && record) await notifyVerificationChangedBestEffort(record.issue, run, input.actorUserId);
+  return run;
+}
+async function updateVerificationRunResult(input) {
+  assertSafeIssueId(input.issueId);
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (issue) {
+    const run2 = await updateLocalVerificationRun(db, issue, input);
+    await writeDb(db);
+    await notifyVerificationChangedBestEffort(issue, run2, input.actorUserId);
+    return run2;
+  }
+  const run = await updatePortableVerificationRun(input);
+  const record = await getIssue(input.issueId);
+  if (!hasIsolatedIssueStore && record) await notifyVerificationChangedBestEffort(record.issue, run, input.actorUserId);
+  return run;
+}
+async function deleteVerificationRuns(input) {
+  assertSafeIssueId(input.issueId);
+  const runIds = [...new Set(input.runIds.filter(Boolean))];
+  if (runIds.length === 0) return { deletedRunIds: [] };
+  const db = await readDb();
+  const issue = db.issues.find((item) => item.id === input.issueId);
+  if (!issue) {
+    const record = await getIssue(input.issueId);
+    const result = await deletePortableVerificationRuns(input.issueId, runIds);
+    if (!hasIsolatedIssueStore && result.deletedRunIds.length > 0 && record) {
+      await notifyVerificationDeletedBestEffort(record.issue, input.actorUserId);
+    }
+    return result;
+  }
+  const selectedRunIds = new Set(runIds);
+  const runs = db.verificationRuns.filter((run) => run.issueId === input.issueId && selectedRunIds.has(run.id));
+  const deletedRunIds = runs.map((run) => run.id);
+  if (deletedRunIds.length === 0) return { deletedRunIds: [] };
+  const artifactIds = new Set(runs.flatMap((run) => verificationRunArtifactIds(db.artifacts, run)));
+  const localArtifacts = db.artifacts.filter((artifact) => artifactIds.has(artifact.id) && artifact.storage !== "issue-store");
+  issue.verificationRunIds = (issue.verificationRunIds ?? []).filter((id) => !selectedRunIds.has(id));
+  issue.artifactIds = (issue.artifactIds ?? []).filter((id) => !artifactIds.has(id));
+  issue.updatedAt = now();
+  db.verificationRuns = db.verificationRuns.filter((run) => !(run.issueId === input.issueId && selectedRunIds.has(run.id)));
+  db.artifacts = db.artifacts.filter((artifact) => !artifactIds.has(artifact.id));
+  await writeDb(db);
+  await Promise.all(localArtifacts.map((artifact) => rm(safeArtifactPath(dataRoot, artifact.relativePath), { force: true })));
+  await notifyVerificationDeletedBestEffort(issue, input.actorUserId);
+  return { deletedRunIds };
+}
+async function hasRunningVerificationRun(input) {
+  const record = await getIssue(input.issueId);
+  if (!record) return false;
+  const staleMs = verificationRunStaleMs();
+  const nowMs = Date.now();
+  return record.verificationRuns.some((run) => run.kind === input.kind && sameOptionalId(run.sourceArtifactId, input.sourceArtifactId) && isVerificationRunActive(run, staleMs, nowMs));
+}
+function hydrateIssue(db, issue) {
+  const bundle = db.bundles.find((item) => item.id === issue.currentBundleId);
+  if (!bundle) return null;
+  const occurrences = (issue.occurrenceIds ?? []).map((id) => db.occurrences.find((occurrence) => occurrence.id === id)).filter(Boolean);
+  const creatorVendorId = normalizeVendorId(issue.creatorVendorId);
+  const hydratedOccurrences = occurrences.map((occurrence) => hydrateOccurrence(occurrence, creatorVendorId));
+  const hydratedIssue = {
+    ...issue,
+    creatorVendorId,
+    assignee: firstAssignee(issueAssignees(issue)),
+    assignees: issueAssignees(issue),
+    tags: issue.tags ?? [],
+    fingerprints: issue.fingerprints ?? (issue.fingerprint ? [issue.fingerprint] : []),
+    occurrenceCount: issue.occurrenceCount ?? Math.max(1, occurrences.length),
+    occurrenceIds: issue.occurrenceIds ?? hydratedOccurrences.map((occurrence) => occurrence.id)
+  };
+  return {
+    issue: hydratedIssue,
+    bundle,
+    artifacts: issue.artifactIds.map((id) => db.artifacts.find((artifact) => artifact.id === id)).filter(Boolean),
+    comments: issue.commentIds.map((id) => db.comments.find((comment) => comment.id === id)).filter(Boolean),
+    verificationRuns: (issue.verificationRunIds ?? []).map((id) => db.verificationRuns.find((run) => run.id === id)).filter(Boolean),
+    occurrences: hydratedOccurrences
+  };
+}
+function hydrateOccurrence(occurrence, fallbackVendorId) {
+  return {
+    ...occurrence,
+    reporterVendorId: normalizeVendorId(occurrence.reporterVendorId ?? fallbackVendorId)
+  };
+}
+async function recordLocalVerificationResult(db, issue, input) {
+  const completedAt = input.completedAt ?? now();
+  const startedAt = input.startedAt ?? completedAt;
+  const artifact = await writeLocalVerificationArtifact(issue.id, input.kind, input.logText, completedAt);
+  const generatedArtifacts = await writeLocalVerificationGeneratedArtifacts(input.generatedArtifactFiles, completedAt);
+  const run = {
+    id: randomUUID(),
+    issueId: issue.id,
+    bundleId: issue.currentBundleId,
+    kind: input.kind,
+    sourceArtifactId: input.sourceArtifactId,
+    status: input.status,
+    exitCode: input.exitCode,
+    logArtifactId: artifact.id,
+    toolVersion: input.toolVersion,
+    failedStage: input.failedStage,
+    completedStage: input.completedStage,
+    generatedArtifacts: input.generatedArtifacts,
+    generatedArtifactIds: generatedArtifacts.map((item) => item.id),
+    sdkRepoUrl: input.sdkRepoUrl,
+    sdkBranch: input.sdkBranch,
+    sdkCommitSha: input.sdkCommitSha,
+    sdkPreparedRoot: input.sdkPreparedRoot,
+    fingerprint: input.fingerprint,
+    startedAt,
+    completedAt,
+    requesterUserId: input.actorUserId,
+    requesterPrincipalSubject: input.actorPrincipalSubject,
+    requesterPrincipalScope: input.actorPrincipalScope
+  };
+  const comment = {
+    id: randomUUID(),
+    issueId: issue.id,
+    author: "Legato Worker",
+    kind: "system",
+    body: input.commentBody ?? verificationComment(run, artifact.filename),
+    createdAt: completedAt
+  };
+  issue.artifactIds = [...issue.artifactIds ?? [], artifact.id, ...generatedArtifacts.map((item) => item.id)];
+  issue.commentIds = [...issue.commentIds ?? [], comment.id];
+  issue.verificationRunIds = [...issue.verificationRunIds ?? [], run.id];
+  if (input.fingerprint) {
+    issue.fingerprint = input.fingerprint;
+    issue.fingerprints = upsertFingerprint(issue.fingerprints ?? [], input.fingerprint);
+  }
+  issue.updatedAt = completedAt;
+  db.artifacts.push(artifact, ...generatedArtifacts);
+  db.comments.push(comment);
+  db.verificationRuns.push(run);
+  return run;
+}
+async function updateLocalVerificationRun(db, issue, input) {
+  const completedAt = input.completedAt ?? now();
+  const run = db.verificationRuns.find((item) => item.id === input.runId && item.issueId === issue.id);
+  if (!run) throw new Error(`Verification run not found: ${input.runId}`);
+  const artifact = run.logArtifactId ? db.artifacts.find((item) => item.id === run.logArtifactId) : void 0;
+  if (!artifact) throw new Error(`Verification log artifact not found for run: ${input.runId}`);
+  await rewriteVerificationArtifact(artifact, input.logText);
+  const generatedArtifacts = await writeLocalVerificationGeneratedArtifacts(input.generatedArtifactFiles, completedAt);
+  run.status = input.status;
+  run.sourceArtifactId = input.sourceArtifactId ?? run.sourceArtifactId;
+  run.exitCode = input.exitCode;
+  run.toolVersion = input.toolVersion;
+  run.failedStage = input.failedStage;
+  run.completedStage = input.completedStage;
+  run.generatedArtifacts = input.generatedArtifacts;
+  if (generatedArtifacts.length > 0) run.generatedArtifactIds = [.../* @__PURE__ */ new Set([...run.generatedArtifactIds ?? [], ...generatedArtifacts.map((item) => item.id)])];
+  run.sdkRepoUrl = input.sdkRepoUrl ?? run.sdkRepoUrl;
+  run.sdkBranch = input.sdkBranch ?? run.sdkBranch;
+  run.sdkCommitSha = input.sdkCommitSha ?? run.sdkCommitSha;
+  run.sdkPreparedRoot = input.sdkPreparedRoot ?? run.sdkPreparedRoot;
+  run.fingerprint = input.fingerprint;
+  run.requesterUserId = input.actorUserId ?? run.requesterUserId;
+  run.requesterPrincipalSubject = input.actorPrincipalSubject ?? run.requesterPrincipalSubject;
+  run.requesterPrincipalScope = input.actorPrincipalScope ?? run.requesterPrincipalScope;
+  run.startedAt = input.startedAt ?? run.startedAt;
+  run.completedAt = input.completedAt ?? completedAt;
+  issue.artifactIds = [...issue.artifactIds ?? [], ...generatedArtifacts.map((item) => item.id)];
+  if (input.commentBody) {
+    issue.commentIds = [...issue.commentIds ?? [], newVerificationComment(db, issue.id, input.commentBody, completedAt).id];
+  }
+  if (input.fingerprint) {
+    issue.fingerprint = input.fingerprint;
+    issue.fingerprints = upsertFingerprint(issue.fingerprints ?? [], input.fingerprint);
+  }
+  issue.updatedAt = completedAt;
+  db.artifacts.push(...generatedArtifacts);
+  return run;
+}
+function newVerificationComment(db, issueId, body, createdAt) {
+  const comment = {
+    id: randomUUID(),
+    issueId,
+    author: "Legato Worker",
+    kind: "system",
+    body,
+    createdAt
+  };
+  db.comments.push(comment);
+  return comment;
+}
+function verificationRunArtifactIds(artifacts, run) {
+  const artifactIds = /* @__PURE__ */ new Set();
+  if (run.logArtifactId) artifactIds.add(run.logArtifactId);
+  if (run.generatedArtifactIds?.length) {
+    for (const id of run.generatedArtifactIds) artifactIds.add(id);
+    return [...artifactIds];
+  }
+  const expectedFilenames = new Set((run.generatedArtifacts ?? []).flatMap(generatedArtifactFilenameCandidates));
+  if (expectedFilenames.size === 0) return [...artifactIds];
+  for (const artifact of artifacts) {
+    if (artifact.id === run.logArtifactId || artifact.kind !== "verification-output") continue;
+    if (run.completedAt && artifact.createdAt !== run.completedAt) continue;
+    if (expectedFilenames.has(artifact.filename) || [...expectedFilenames].some((filename) => artifact.filename.endsWith(filename))) {
+      artifactIds.add(artifact.id);
+    }
+  }
+  return [...artifactIds];
+}
+async function rewriteVerificationArtifact(artifact, text) {
+  const bytes = Buffer.from(text, "utf8");
+  await writeFile2(getArtifactTextPath(artifact), bytes);
+  artifact.size = bytes.byteLength;
+  artifact.checksum = createHash("sha256").update(bytes).digest("hex");
+}
+async function writeLocalVerificationArtifact(issueId, kind, logText, createdAt) {
+  assertSafeIssueId(issueId);
+  const bytes = Buffer.from(logText, "utf8");
+  const id = randomUUID();
+  const filename = verificationOutputFilename(kind, createdAt);
+  const relativePath = path2.posix.join("artifacts", `${id}-${filename}`);
+  await writeFile2(safeArtifactPath(dataRoot, relativePath), bytes);
+  return verificationArtifact(id, filename, relativePath, bytes, createdAt);
+}
+async function writeLocalKernelSuggestionArtifact(input, createdAt) {
+  const bytes = Buffer.from(input.content, "utf8");
+  const id = randomUUID();
+  const filename = sanitizeFilename(input.filename);
+  const relativePath = path2.posix.join("artifacts", `${id}-${filename}`);
+  await writeFile2(safeArtifactPath(dataRoot, relativePath), bytes);
+  return kernelSuggestionArtifact(id, filename, relativePath, bytes, createdAt);
+}
+async function writeLocalVerificationGeneratedArtifacts(files, createdAt) {
+  const artifacts = [];
+  for (const file of files ?? []) {
+    const bytes = Buffer.from(file.contentBase64, "base64");
+    const id = randomUUID();
+    const filename = sanitizeFilename(file.filename);
+    const relativePath = path2.posix.join("artifacts", `${id}-${filename}`);
+    await writeFile2(safeArtifactPath(dataRoot, relativePath), bytes);
+    artifacts.push(verificationArtifact(id, filename, relativePath, bytes, createdAt, void 0, file.contentType));
+  }
+  return artifacts;
+}
+function verificationArtifact(id, filename, relativePath, bytes, createdAt, storage, contentType = "text/plain") {
+  return {
+    id,
+    kind: "verification-output",
+    filename,
+    contentType,
+    size: bytes.byteLength,
+    checksum: createHash("sha256").update(bytes).digest("hex"),
+    relativePath,
+    storage,
+    createdAt
+  };
+}
+function verificationOutputFilename(kind, createdAt) {
+  const compactTime = createdAt.replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+  return sanitizeFilename(`verify-${kind}-${compactTime}.log`);
+}
+function kernelSuggestionArtifact(id, filename, relativePath, bytes, createdAt, storage) {
+  return {
+    id,
+    kind: "kernel-suggestion",
+    filename,
+    contentType: "text/x-python",
+    size: bytes.byteLength,
+    checksum: createHash("sha256").update(bytes).digest("hex"),
+    relativePath,
+    storage,
+    createdAt
+  };
+}
+function kernelSuggestionComment(input, createdAt) {
+  return {
+    id: randomUUID(),
+    issueId: input.issueId,
+    author: input.author,
+    authorUserId: input.authorUserId,
+    authorPrincipalSubject: input.authorPrincipalSubject,
+    authorPrincipalScope: input.authorPrincipalScope,
+    kind: "system",
+    body: `Kernel suggestion saved for ${input.filename}. Base artifact: ${input.baseArtifactId}.`,
+    createdAt
+  };
+}
+function kernelSuggestionUpdatedComment(input, createdAt) {
+  return {
+    id: randomUUID(),
+    issueId: input.issueId,
+    author: input.author,
+    authorUserId: input.authorUserId,
+    authorPrincipalSubject: input.authorPrincipalSubject,
+    authorPrincipalScope: input.authorPrincipalScope,
+    kind: "system",
+    body: `Kernel suggestion updated for ${input.filename}. Artifact: ${input.suggestionArtifactId}.`,
+    createdAt
+  };
+}
+function statusChangeComment(input, previousStatus, createdAt) {
+  return {
+    id: randomUUID(),
+    issueId: input.issueId,
+    author: input.actor?.trim() || "Language Developer",
+    authorUserId: input.actorUserId,
+    authorPrincipalSubject: input.actorPrincipalSubject,
+    authorPrincipalScope: input.actorPrincipalScope,
+    kind: "system",
+    body: `Status changed from ${previousStatus} to ${input.status}.`,
+    createdAt
+  };
+}
+function assignmentComment(issueId, assignee, actor, createdAt) {
+  return {
+    id: randomUUID(),
+    issueId,
+    author: actor.trim() || "Language Developer",
+    kind: "system",
+    body: `Assigned to ${assignee}.`,
+    createdAt
+  };
+}
+function unassignmentComment(issueId, actor, createdAt, assignee) {
+  return {
+    id: randomUUID(),
+    issueId,
+    author: actor.trim() || "Language Developer",
+    kind: "system",
+    body: assignee ? `Unassigned ${assignee}.` : "Assignees cleared.",
+    createdAt
+  };
+}
+function blockerComment(issueId, blocker, actor, createdAt) {
+  return {
+    id: randomUUID(),
+    issueId,
+    author: actor.trim() || "Language Developer",
+    kind: "system",
+    body: `Blocker linked: ${blocker.repository}#${blocker.number} (${blocker.status}).`,
+    createdAt
+  };
+}
+function blockerSyncComment(issueId, blocker, actor, createdAt) {
+  return {
+    id: randomUUID(),
+    issueId,
+    author: actor.trim() || "Language Developer",
+    kind: "system",
+    body: `Blocker synced: ${blocker.repository}#${blocker.number} (${blocker.status}).`,
+    createdAt
+  };
+}
+function blockerRemovedComment(issueId, blocker, actor, createdAt) {
+  return {
+    id: randomUUID(),
+    issueId,
+    author: actor.trim() || "Language Developer",
+    kind: "system",
+    body: `Blocker removed: ${blocker.repository}#${blocker.number}.`,
+    createdAt
+  };
+}
+async function rewriteKernelSuggestionArtifact(artifact, content) {
+  const bytes = Buffer.from(content, "utf8");
+  await writeFile2(getArtifactTextPath(artifact), bytes);
+  return {
+    ...artifact,
+    size: bytes.byteLength,
+    checksum: createHash("sha256").update(bytes).digest("hex")
+  };
+}
+function verificationComment(run, filename) {
+  const exit = typeof run.exitCode === "number" ? ` exit ${run.exitCode}` : " no exit code";
+  return `Verification ${run.kind} ${run.status}.${exit}. Log artifact: ${filename}.`;
+}
+var portableIssuesCache;
+async function readPortableIssues() {
+  try {
+    const root = await readableIssueStoreRoot();
+    const issuesRoot = safeJoin(root, "issues");
+    const entries = await readdir(issuesRoot, { withFileTypes: true });
+    const issueNames = entries.filter((entry) => entry.isDirectory()).filter((entry) => /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(entry.name)).map((entry) => entry.name).sort();
+    const signature = await portableIssuesSignature(root, issueNames);
+    if (portableIssuesCache && portableIssuesCache.signature === signature) {
+      return portableIssuesCache.records;
+    }
+    const records = (await Promise.all(
+      issueNames.map((name) => readPortableIssue(name, { root }))
+    )).filter(Boolean);
+    portableIssuesCache = { signature, records };
+    return records;
+  } catch {
+    return [];
+  }
+}
+async function portableIssuesSignature(root, issueNames) {
+  const parts = await Promise.all(issueNames.map(async (name) => {
+    try {
+      const details = await stat(safeJoin(root, "issues", name, "issue.json"));
+      return `${name}:${details.mtimeMs}:${details.size}`;
+    } catch {
+      return `${name}:missing`;
+    }
+  }));
+  return `${path2.resolve(root)}
+${parts.join("\n")}`;
+}
+async function readPortableIssue(id, options = {}) {
+  try {
+    const root = options.root ?? await readableIssueStoreRoot();
+    assertSafeIssueId(id);
+    const issueDir = safeJoin(root, "issues", id);
+    const raw = await readFile2(safeJoin(issueDir, "issue.json"), "utf8");
+    const portable = JSON.parse(raw);
+    if (portable.id !== id) return null;
+    if (portable.duplicateOf) {
+      return options.followDuplicate ? readPortableIssue(portable.duplicateOf, options) : null;
+    }
+    assertSafeIssueId(portable.id);
+    const description = await readOptionalFile(safeJoin(issueDir, "description.md"));
+    const createdAt = portable.createdAt;
+    const creatorVendorId = normalizeVendorId(portable.creatorVendorId);
+    const kernelArtifact = await portableArtifact(root, portable.id, "kernel", portable.kernel.filename, portable.kernel.checksum);
+    const artifacts = [kernelArtifact];
+    let errorLogArtifact;
+    if (portable.log?.filename) {
+      errorLogArtifact = await portableArtifact(root, portable.id, "error-log", portable.log.filename);
+      artifacts.push(errorLogArtifact);
+    }
+    const sidecarArtifacts = (portable.artifacts ?? []).filter((artifact) => isSafePortableSidecarArtifact(portable.id, artifact));
+    artifacts.push(...sidecarArtifacts);
+    const bundle = {
+      id: `${portable.id}-bundle`,
+      source: portable.source ?? "shell",
+      kernelArtifactId: kernelArtifact.id,
+      errorLogArtifactId: errorLogArtifact?.id,
+      legatoBinaryVersion: portable.legatoBinaryVersion,
+      cliVersion: portable.cliVersion,
+      gitMetadata: portable.gitMetadata,
+      environmentMetadata: portable.environmentMetadata,
+      createdAt
+    };
+    const primaryOccurrence = {
+      id: `${portable.id}-primary-occurrence`,
+      issueId: portable.id,
+      reporter: portable.reporter,
+      reporterUserId: portable.reporterUserId,
+      reporterPrincipalSubject: portable.reporterPrincipalSubject,
+      reporterPrincipalScope: portable.reporterPrincipalScope,
+      reporterVendorId: creatorVendorId,
+      bundleId: bundle.id,
+      artifactIds: artifacts.map((artifact) => artifact.id),
+      kernelChecksum: kernelArtifact.checksum,
+      source: bundle.source,
+      gitMetadata: bundle.gitMetadata,
+      environmentMetadata: bundle.environmentMetadata,
+      createdAt
+    };
+    const occurrences = (portable.occurrences?.length ? portable.occurrences : [primaryOccurrence]).map((occurrence) => hydrateOccurrence(occurrence, creatorVendorId));
+    const systemComment = {
+      id: `${portable.id}-system-comment`,
+      issueId: portable.id,
+      author: "Legato Agora",
+      kind: "system",
+      body: "Portable issue bundle loaded from issue-store. Lowering and fsim automation will be attached in M2.",
+      createdAt
+    };
+    const issue = {
+      schemaVersion: portable.schemaVersion ?? 0,
+      id: portable.id,
+      title: portable.title,
+      description: description || `Reported from portable issue bundle with kernel ${portable.kernel.filename}.`,
+      status: portable.status ?? "open",
+      creator: portable.reporter,
+      creatorUserId: portable.reporterUserId,
+      creatorPrincipalSubject: portable.reporterPrincipalSubject,
+      creatorPrincipalScope: portable.reporterPrincipalScope,
+      creatorVendorId,
+      currentBundleId: bundle.id,
+      artifactIds: artifacts.map((artifact) => artifact.id),
+      commentIds: [systemComment.id, ...(portable.comments ?? []).map((comment) => comment.id)],
+      verificationRunIds: (portable.verificationRuns ?? []).map((run) => run.id),
+      fingerprint: portable.fingerprint,
+      fingerprints: portable.fingerprints ?? (portable.fingerprint ? [portable.fingerprint] : []),
+      occurrenceCount: portable.occurrenceCount ?? Math.max(1, occurrences.length),
+      occurrenceIds: occurrences.map((occurrence) => occurrence.id),
+      assignee: firstAssignee(issueAssignees(portable)),
+      assignees: issueAssignees(portable),
+      blockers: portable.blockers ?? [],
+      github: portable.github,
+      store: portable.store ?? {
+        bundlePath: path2.posix.join("issues", portable.id)
+      },
+      tags: uniqueTags2([
+        ...portable.tags ?? [],
+        ...deriveTags({
+          title: portable.title,
+          description,
+          kernelFilename: portable.kernel.filename,
+          hasLog: Boolean(portable.log?.filename),
+          source: portable.source ?? "shell"
+        }),
+        ...IssueBlockerTags.merge([], portable.blockers ?? [])
+      ]),
+      createdAt,
+      updatedAt: portable.updatedAt
+    };
+    return {
+      issue,
+      bundle,
+      artifacts,
+      comments: [systemComment, ...portable.comments ?? []],
+      verificationRuns: portable.verificationRuns ?? [],
+      occurrences
+    };
+  } catch {
+    return null;
+  }
+}
+async function recordPortableVerificationResult(input) {
+  assertSafeIssueId(input.issueId);
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  if (portable.id !== input.issueId) {
+    throw new Error(`Portable issue id mismatch: ${input.issueId}`);
+  }
+  assertSafeIssueId(portable.id);
+  const completedAt = input.completedAt ?? now();
+  const startedAt = input.startedAt ?? completedAt;
+  const artifact = await writePortableVerificationArtifact(portable.id, input.kind, input.logText, completedAt);
+  const generatedArtifacts = await writePortableVerificationGeneratedArtifacts(portable.id, input.generatedArtifactFiles, completedAt);
+  const bundleId = `${portable.id}-bundle`;
+  const run = {
+    id: randomUUID(),
+    issueId: portable.id,
+    bundleId,
+    sourceArtifactId: input.sourceArtifactId,
+    kind: input.kind,
+    status: input.status,
+    exitCode: input.exitCode,
+    logArtifactId: artifact.id,
+    toolVersion: input.toolVersion,
+    failedStage: input.failedStage,
+    completedStage: input.completedStage,
+    generatedArtifacts: input.generatedArtifacts,
+    generatedArtifactIds: generatedArtifacts.map((item) => item.id),
+    sdkRepoUrl: input.sdkRepoUrl,
+    sdkBranch: input.sdkBranch,
+    sdkCommitSha: input.sdkCommitSha,
+    sdkPreparedRoot: input.sdkPreparedRoot,
+    fingerprint: input.fingerprint,
+    startedAt,
+    completedAt,
+    requesterUserId: input.actorUserId,
+    requesterPrincipalSubject: input.actorPrincipalSubject,
+    requesterPrincipalScope: input.actorPrincipalScope
+  };
+  const comment = {
+    id: randomUUID(),
+    issueId: portable.id,
+    author: "Legato Worker",
+    kind: "system",
+    body: input.commentBody ?? verificationComment(run, artifact.filename),
+    createdAt: completedAt
+  };
+  portable.artifacts = [...portable.artifacts ?? [], artifact, ...generatedArtifacts];
+  portable.verificationRuns = [...portable.verificationRuns ?? [], run];
+  portable.comments = [...portable.comments ?? [], comment];
+  if (input.fingerprint) {
+    portable.fingerprint = input.fingerprint;
+    portable.fingerprints = upsertFingerprint(portable.fingerprints ?? [], input.fingerprint);
+  }
+  portable.updatedAt = completedAt;
+  await writePortableIssueJson(issuePath, portable);
+  return run;
+}
+async function updatePortableVerificationRun(input) {
+  assertSafeIssueId(input.issueId);
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  if (portable.id !== input.issueId) {
+    throw new Error(`Portable issue id mismatch: ${input.issueId}`);
+  }
+  assertSafeIssueId(portable.id);
+  const completedAt = input.completedAt ?? now();
+  const runs = portable.verificationRuns ?? [];
+  const runIndex = runs.findIndex((item) => item.id === input.runId);
+  if (runIndex < 0) throw new Error(`Verification run not found: ${input.runId}`);
+  const currentRun = runs[runIndex];
+  const artifacts = portable.artifacts ?? [];
+  const artifactIndex = artifacts.findIndex((item) => item.id === currentRun.logArtifactId);
+  if (artifactIndex < 0) throw new Error(`Verification log artifact not found for run: ${input.runId}`);
+  const updatedArtifact = await rewritePortableVerificationArtifact(artifacts[artifactIndex], input.logText);
+  const generatedArtifacts = await writePortableVerificationGeneratedArtifacts(portable.id, input.generatedArtifactFiles, completedAt);
+  const updatedRun = {
+    ...currentRun,
+    sourceArtifactId: input.sourceArtifactId ?? currentRun.sourceArtifactId,
+    status: input.status,
+    exitCode: input.exitCode,
+    toolVersion: input.toolVersion,
+    failedStage: input.failedStage,
+    completedStage: input.completedStage,
+    generatedArtifacts: input.generatedArtifacts,
+    generatedArtifactIds: generatedArtifacts.length > 0 ? [.../* @__PURE__ */ new Set([...currentRun.generatedArtifactIds ?? [], ...generatedArtifacts.map((item) => item.id)])] : currentRun.generatedArtifactIds,
+    sdkRepoUrl: input.sdkRepoUrl ?? currentRun.sdkRepoUrl,
+    sdkBranch: input.sdkBranch ?? currentRun.sdkBranch,
+    sdkCommitSha: input.sdkCommitSha ?? currentRun.sdkCommitSha,
+    sdkPreparedRoot: input.sdkPreparedRoot ?? currentRun.sdkPreparedRoot,
+    fingerprint: input.fingerprint,
+    requesterUserId: input.actorUserId ?? currentRun.requesterUserId,
+    requesterPrincipalSubject: input.actorPrincipalSubject ?? currentRun.requesterPrincipalSubject,
+    requesterPrincipalScope: input.actorPrincipalScope ?? currentRun.requesterPrincipalScope,
+    startedAt: input.startedAt ?? currentRun.startedAt,
+    // For running updates this doubles as a liveness heartbeat so orphaned runs can be detected.
+    completedAt: input.completedAt ?? completedAt
+  };
+  const nextRuns = [...runs];
+  nextRuns[runIndex] = updatedRun;
+  const nextArtifacts = [...artifacts];
+  nextArtifacts[artifactIndex] = updatedArtifact;
+  portable.artifacts = [...nextArtifacts, ...generatedArtifacts];
+  portable.verificationRuns = nextRuns;
+  if (input.commentBody) {
+    portable.comments = [...portable.comments ?? [], {
+      id: randomUUID(),
+      issueId: portable.id,
+      author: "Legato Worker",
+      kind: "system",
+      body: input.commentBody,
+      createdAt: completedAt
+    }];
+  }
+  if (input.fingerprint) {
+    portable.fingerprint = input.fingerprint;
+    portable.fingerprints = upsertFingerprint(portable.fingerprints ?? [], input.fingerprint);
+  }
+  portable.updatedAt = completedAt;
+  await writePortableIssueJson(issuePath, portable);
+  return updatedRun;
+}
+async function deletePortableVerificationRuns(issueId, runIds) {
+  assertSafeIssueId(issueId);
+  const issuePath = await portableIssuePathFollowingDuplicate(issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  if (portable.id !== issueId) {
+    throw new Error(`Portable issue id mismatch: ${issueId}`);
+  }
+  const selectedRunIds = new Set(runIds);
+  const runs = portable.verificationRuns ?? [];
+  const selectedRuns = runs.filter((run) => selectedRunIds.has(run.id));
+  const deletedRunIds = selectedRuns.map((run) => run.id);
+  if (deletedRunIds.length === 0) return { deletedRunIds: [] };
+  const artifacts = portable.artifacts ?? [];
+  const artifactIds = new Set(selectedRuns.flatMap((run) => verificationRunArtifactIds(artifacts, run)));
+  const deletedArtifacts = artifacts.filter((artifact) => artifactIds.has(artifact.id));
+  portable.verificationRuns = runs.filter((run) => !selectedRunIds.has(run.id));
+  portable.artifacts = artifacts.filter((artifact) => !artifactIds.has(artifact.id));
+  portable.updatedAt = now();
+  await writePortableIssueJson(issuePath, portable);
+  await Promise.all(deletedArtifacts.map((artifact) => rm(safeArtifactPath(issueStoreRoot, artifact.relativePath), { force: true })));
+  return { deletedRunIds };
+}
+async function addPortableKernelSuggestion(input) {
+  assertSafeIssueId(input.issueId);
+  assertSafeFilename(input.filename);
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  if (portable.id !== input.issueId) {
+    throw new Error(`Portable issue id mismatch: ${input.issueId}`);
+  }
+  const createdAt = now();
+  const artifact = await writePortableKernelSuggestionArtifact(portable.id, input.filename, input.content, createdAt);
+  portable.artifacts = [...portable.artifacts ?? [], artifact];
+  portable.comments = [...portable.comments ?? [], kernelSuggestionComment(input, createdAt)];
+  portable.updatedAt = createdAt;
+  await writePortableIssueJson(issuePath, portable);
+  return artifact;
+}
+async function updatePortableKernelSuggestion(input) {
+  assertSafeIssueId(input.issueId);
+  assertSafeFilename(input.filename);
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  if (portable.id !== input.issueId) {
+    throw new Error(`Portable issue id mismatch: ${input.issueId}`);
+  }
+  const artifactIndex = (portable.artifacts ?? []).findIndex((artifact2) => artifact2.id === input.suggestionArtifactId);
+  const artifact = artifactIndex >= 0 ? portable.artifacts?.[artifactIndex] : void 0;
+  if (!artifact || artifact.kind !== "kernel-suggestion") {
+    throw new Error(`Kernel suggestion not found: ${input.suggestionArtifactId}`);
+  }
+  const updatedAt = now();
+  const updatedArtifact = await rewriteKernelSuggestionArtifact(artifact, input.content);
+  const artifacts = [...portable.artifacts ?? []];
+  artifacts[artifactIndex] = updatedArtifact;
+  portable.artifacts = artifacts;
+  portable.comments = [...portable.comments ?? [], kernelSuggestionUpdatedComment(input, updatedAt)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+  return updatedArtifact;
+}
+async function portableIssuePathFollowingDuplicate(issueId) {
+  assertSafeIssueId(issueId);
+  const issuePath = safeJoin(issueStoreRoot, "issues", issueId, "issue.json");
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  if (portable.id !== issueId) {
+    throw new Error(`Portable issue id mismatch: ${issueId}`);
+  }
+  if (!portable.duplicateOf) return issuePath;
+  assertSafeIssueId(portable.duplicateOf);
+  return safeJoin(issueStoreRoot, "issues", portable.duplicateOf, "issue.json");
+}
+async function writePortableVerificationArtifact(issueId, kind, logText, createdAt) {
+  assertSafeIssueId(issueId);
+  const bytes = Buffer.from(logText, "utf8");
+  const id = randomUUID();
+  const filename = verificationOutputFilename(kind, createdAt);
+  const relativePath = path2.posix.join("issues", issueId, "artifacts", filename);
+  await mkdir2(safeJoin(issueStoreRoot, "issues", issueId, "artifacts"), { recursive: true });
+  await writeFile2(safeArtifactPath(issueStoreRoot, relativePath), bytes);
+  return verificationArtifact(id, filename, relativePath, bytes, createdAt, "issue-store");
+}
+async function writePortableKernelSuggestionArtifact(issueId, filename, content, createdAt) {
+  assertSafeIssueId(issueId);
+  const bytes = Buffer.from(content, "utf8");
+  const id = randomUUID();
+  const timestamp = createdAt.replace(/[:.]/g, "-");
+  const safeFilename = sanitizeFilename(`${timestamp}-suggestion-${filename}`);
+  const relativePath = path2.posix.join("issues", issueId, "artifacts", safeFilename);
+  await mkdir2(safeJoin(issueStoreRoot, "issues", issueId, "artifacts"), { recursive: true });
+  await writeFile2(safeArtifactPath(issueStoreRoot, relativePath), bytes);
+  return kernelSuggestionArtifact(id, safeFilename, relativePath, bytes, createdAt, "issue-store");
+}
+async function rewritePortableVerificationArtifact(artifact, text) {
+  const bytes = Buffer.from(text, "utf8");
+  await writeFile2(safeArtifactPath(issueStoreRoot, artifact.relativePath), bytes);
+  return {
+    ...artifact,
+    size: bytes.byteLength,
+    checksum: createHash("sha256").update(bytes).digest("hex")
+  };
+}
+async function writePortableVerificationGeneratedArtifacts(issueId, files, createdAt) {
+  assertSafeIssueId(issueId);
+  const artifacts = [];
+  const artifactDir = safeJoin(issueStoreRoot, "issues", issueId, "artifacts");
+  const timestamp = createdAt.replace(/[:.]/g, "-");
+  await mkdir2(artifactDir, { recursive: true });
+  for (const file of files ?? []) {
+    const bytes = Buffer.from(file.contentBase64, "base64");
+    const id = randomUUID();
+    const filename = sanitizeFilename(`${timestamp}-${file.filename}`);
+    const relativePath = path2.posix.join("issues", issueId, "artifacts", filename);
+    await writeFile2(safeArtifactPath(issueStoreRoot, relativePath), bytes);
+    artifacts.push(verificationArtifact(id, filename, relativePath, bytes, createdAt, "issue-store", file.contentType));
+  }
+  return artifacts;
+}
+async function updatePortableIssueStatus(input, updatedAt) {
+  assertSafeIssueId(input.issueId);
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const previousStatus = portable.status ?? "open";
+  portable.status = input.status;
+  portable.comments = [...portable.comments ?? [], statusChangeComment({ ...input, issueId: portable.id }, previousStatus, updatedAt)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+}
+async function updatePortableIssueDescription(input, updatedAt) {
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  if (!canMutateIssueDescription(portable.reporter, portable.reporterUserId, input.actor, input.actorUserId, input.actorPrincipalSubject, input.actorPrincipalScope, input.authPolicy)) {
+    throw new Error("issue_description_forbidden");
+  }
+  portable.updatedAt = updatedAt;
+  await writeTextAtomic(safeJoin(path2.dirname(issuePath), "description.md"), input.description.trim());
+  await writePortableIssueJson(issuePath, portable);
+}
+function canMutateIssueDescription(owner, ownerUserId, actor, actorUserId, actorPrincipalSubject, actorPrincipalScope, authPolicy) {
+  if (actorUserId && actorPrincipalSubject && actorPrincipalScope === "admin") return true;
+  if (ownerUserId && actorUserId && ownerUserId === actorUserId) return true;
+  if (isSameTenantPrincipalLegacyOwner(ownerUserId, actorUserId, actorPrincipalSubject)) return true;
+  if (ownerUserId) return false;
+  if (authPolicy?.enforceTenantIdentity) return false;
+  return owner.trim().toLowerCase() === actor.trim().toLowerCase();
+}
+async function addPortableIssueTags(id, tags, updatedAt) {
+  assertSafeIssueId(id);
+  const issuePath = await portableIssuePathFollowingDuplicate(id);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  portable.tags = uniqueTags2([...portable.tags ?? [], ...tags]);
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+}
+async function assignPortableIssue(input, updatedAt) {
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const assignee = new IssueAssigneeName(input.assignee).value;
+  const nextAssignee = IssueAssignment.create({
+    assignee,
+    assigneeUserId: input.assigneeUserId,
+    actor: input.actor,
+    actorUserId: input.actorUserId,
+    actorPrincipalSubject: input.actorPrincipalSubject,
+    actorPrincipalScope: input.actorPrincipalScope,
+    assignedAt: updatedAt
+  });
+  const assignees = [
+    ...issueAssignees(portable).filter((item) => item.name.toLowerCase() !== nextAssignee.name.toLowerCase()),
+    nextAssignee
+  ];
+  portable.assignees = assignees;
+  portable.assignee = firstAssignee(assignees);
+  portable.comments = [...portable.comments ?? [], assignmentComment(portable.id, assignee, input.actor, updatedAt)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+}
+async function unassignPortableIssue(input, updatedAt) {
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const assignee = new IssueAssigneeName(input.assignee).value;
+  const assignees = issueAssignees(portable).filter((item) => item.name.toLowerCase() !== assignee.toLowerCase());
+  portable.assignees = assignees;
+  portable.assignee = firstAssignee(assignees);
+  portable.comments = [...portable.comments ?? [], unassignmentComment(portable.id, input.actor, updatedAt, assignee)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+}
+async function clearPortableIssueAssignee(issueId, actor, updatedAt) {
+  const issuePath = await portableIssuePathFollowingDuplicate(issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  portable.assignees = [];
+  portable.assignee = void 0;
+  portable.comments = [...portable.comments ?? [], unassignmentComment(portable.id, actor, updatedAt)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+}
+async function addPortableIssueBlocker(issueId, blocker, actor, updatedAt) {
+  const issuePath = await portableIssuePathFollowingDuplicate(issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const blockers = [...(portable.blockers ?? []).filter((item) => item.repository !== blocker.repository || item.number !== blocker.number), blocker];
+  portable.blockers = blockers;
+  portable.tags = IssueBlockerTags.merge(portable.tags ?? [], blockers);
+  portable.comments = [...portable.comments ?? [], blockerComment(portable.id, blocker, actor, updatedAt)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+}
+async function syncPortableIssueBlocker(input) {
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const blocker = (portable.blockers ?? []).find((item) => item.id === input.blockerId);
+  if (!blocker) throw new Error(`Blocker not found: ${input.blockerId}`);
+  const synced = await new GithubPullRequestSyncService().sync(blocker);
+  const updatedAt = synced.lastSyncedAt ?? now();
+  const blockers = (portable.blockers ?? []).map((item) => item.id === synced.id ? synced : item);
+  portable.blockers = blockers;
+  portable.tags = IssueBlockerTags.merge(portable.tags ?? [], blockers);
+  portable.comments = [...portable.comments ?? [], blockerSyncComment(portable.id, synced, input.actor, updatedAt)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+  return synced;
+}
+async function removePortableIssueBlocker(input, updatedAt) {
+  const issuePath = await portableIssuePathFollowingDuplicate(input.issueId);
+  const raw = await readFile2(issuePath, "utf8");
+  const portable = JSON.parse(raw);
+  const blocker = (portable.blockers ?? []).find((item) => item.id === input.blockerId);
+  if (!blocker) throw new Error(`Blocker not found: ${input.blockerId}`);
+  const blockers = (portable.blockers ?? []).filter((item) => item.id !== input.blockerId);
+  portable.blockers = blockers;
+  portable.tags = IssueBlockerTags.merge(portable.tags ?? [], blockers);
+  portable.comments = [...portable.comments ?? [], blockerRemovedComment(portable.id, blocker, input.actor, updatedAt)];
+  portable.updatedAt = updatedAt;
+  await writePortableIssueJson(issuePath, portable);
+}
+async function deletePortableIssue(id) {
+  assertSafeIssueId(id);
+  const root = await readableIssueStoreRoot();
+  const record = await readPortableIssue(id, { root, followDuplicate: false });
+  if (!record) return false;
+  await rm(safeJoin(root, "issues", id), { recursive: true, force: true });
+  if (!hasIsolatedIssueStore) await deleteGitBackedPortableIssue(id);
+  return true;
+}
+async function deleteGitBackedPortableIssue(id) {
+  try {
+    const { deleteStoredReportBundle } = await import("./report-bundle-sync-3U7QTP4Z.js");
+    await deleteStoredReportBundle(id);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to sync deleted issue ${id} to git-backed issue-store: ${message}`);
+  }
+}
+async function portableArtifact(root, issueId, kind, filename, checksum) {
+  assertSafeIssueId(issueId);
+  assertSafeFilename(filename);
+  const relativePath = path2.posix.join("issues", issueId, "artifacts", filename);
+  const fullPath = safeArtifactPath(root, relativePath);
+  const fileStat = await stat(fullPath);
+  const checksumValue = checksum ?? createHash("sha256").update(await readFile2(fullPath)).digest("hex");
+  return {
+    id: `${issueId}-${kind}`,
+    kind,
+    filename,
+    contentType: "text/plain",
+    size: fileStat.size,
+    checksum: checksumValue,
+    relativePath,
+    storage: "issue-store",
+    createdAt: fileStat.birthtime.toISOString()
+  };
+}
+function isSafePortableSidecarArtifact(issueId, artifact) {
+  try {
+    if (artifact.kind !== "verification-output" && artifact.kind !== "kernel-suggestion") return false;
+    assertSafeFilename(artifact.filename);
+    if (artifact.storage && artifact.storage !== "issue-store") return false;
+    const expectedPrefix = path2.posix.join("issues", issueId, "artifacts") + "/";
+    if (!artifact.relativePath.startsWith(expectedPrefix)) return false;
+    if (path2.posix.basename(artifact.relativePath) !== artifact.filename) return false;
+    const artifactsRootForIssue = safeJoin(issueStoreRoot, "issues", issueId, "artifacts");
+    const artifactPath = safeArtifactPath(issueStoreRoot, artifact.relativePath);
+    if (!artifactPath.startsWith(`${artifactsRootForIssue}${path2.sep}`)) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readOptionalFile(filePath) {
+  try {
+    return await readFile2(filePath, "utf8");
+  } catch {
+    return "";
+  }
+}
+async function readableIssueStoreRoot() {
+  if (hasExplicitIssueStore || await hasIssuesDirectory(issueStoreRoot)) return issueStoreRoot;
+  return bundledIssueStoreRoot;
+}
+async function hasIssuesDirectory(root) {
+  try {
+    const rootStat = await stat(safeJoin(root, "issues"));
+    return rootStat.isDirectory();
+  } catch {
+    return false;
+  }
+}
+function existingIssueStoreArtifactPath(relativePath) {
+  const primaryPath = safeArtifactPath(issueStoreRoot, relativePath);
+  if (hasExplicitIssueStore || issueStoreRoot === bundledIssueStoreRoot || existsSync(primaryPath)) return primaryPath;
+  return safeArtifactPath(bundledIssueStoreRoot, relativePath);
+}
+
+export {
+  storedGeneratedArtifactFilename,
+  readAutomationSettings,
+  writeAutomationSettings,
+  isAutoLoweringEnabled,
+  listTagDefinitions,
+  addTagDefinition,
+  deleteTagDefinition,
+  createIssue,
+  addComment,
+  updateComment,
+  deleteComment,
+  closeIssue,
+  deleteIssue,
+  updateIssueStatus,
+  updateIssueDescription,
+  addIssueTags,
+  assignIssue,
+  unassignIssue,
+  clearIssueAssignee,
+  addIssueBlocker,
+  syncIssueBlocker,
+  removeIssueBlocker,
+  listIssues,
+  getIssue,
+  readArtifactText,
+  getArtifactTextPath,
+  addKernelSuggestion,
+  updateKernelSuggestion,
+  recordVerificationResult,
+  updateVerificationRunResult,
+  deleteVerificationRuns,
+  hasRunningVerificationRun
+};