mason-context 0.12.0 → 0.13.0

package/dist/mason-auto.js

@@ -1,39 +1,13 @@
 #!/usr/bin/env node
-
-// src/automation/cli.ts
-import { parseArgs } from "util";
-
-// src/automation/runtime.ts
-import { randomUUID as randomUUID3 } from "crypto";
-
-// src/audit/repair.ts
-import fs10 from "fs/promises";
-import path16 from "path";
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
-import { z as z3 } from "zod";
-
-// src/audit/audit.ts
-import fs9 from "fs/promises";
-import path15 from "path";
-
-// src/drift/drift.ts
-import fs3 from "fs/promises";
-import path6 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
-
-// src/snapshot/snapshot.ts
-import path5 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-
-// src/utils/files.ts
-import fs from "fs/promises";
-import { constants } from "fs";
-import path2 from "path";
-import { execFile } from "child_process";
-import { promisify } from "util";
-import fg from "fast-glob";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // src/utils/paths.ts
 import path from "path";
@@ -56,35 +30,24 @@ function anchorMatches(anchor, file) {
 function matchingPaths(anchors, files) {
   return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
 }
+var init_paths = __esm({
+  "src/utils/paths.ts"() {
+    "use strict";
+  }
+});
 
 // src/utils/files.ts
-var exec = promisify(execFile);
-var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
-var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
-var SOURCE_IGNORE = [
-  "**/node_modules/**",
-  "**/dist/**",
-  "**/build/**",
-  "**/.gradle/**",
-  "**/target/**",
-  "**/.git/**",
-  "**/.mason/**",
-  "**/vendor/**",
-  "**/__pycache__/**",
-  "**/venv/**",
-  "**/.venv/**",
-  "**/*.min.*",
-  "**/*.map",
-  "**/*.lock",
-  "**/generated/**",
-  "**/*.generated.*",
-  "**/R.java",
-  "**/BuildConfig.java",
-  "**/package-lock.json",
-  "**/yarn.lock",
-  "**/pnpm-lock.yaml"
-];
-var MAX_SOURCE_BYTES = 1024 * 1024;
+import fs from "fs/promises";
+import { constants } from "fs";
+import path2 from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import fg from "fast-glob";
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+  );
+}
 async function readBoundedFile(file, maxBytes) {
   const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
   try {
@@ -102,6 +65,118 @@ async function readBoundedFile(file, maxBytes) {
     await handle.close();
   }
 }
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath2 = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath2, 64 * 1024);
+    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
+      }
+      config[key] = value[key];
+    }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await exec("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await exec("git", ["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
+    } catch {
+      return null;
+    }
+  }
+  return { root, config, list, read };
+}
+var exec, SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var init_files = __esm({
+  "src/utils/files.ts"() {
+    "use strict";
+    init_paths();
+    exec = promisify(execFile);
+    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+    SOURCE_IGNORE = [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.gradle/**",
+      "**/target/**",
+      "**/.git/**",
+      "**/.mason/**",
+      "**/vendor/**",
+      "**/__pycache__/**",
+      "**/venv/**",
+      "**/.venv/**",
+      "**/*.min.*",
+      "**/*.map",
+      "**/*.lock",
+      "**/generated/**",
+      "**/*.generated.*",
+      "**/R.java",
+      "**/BuildConfig.java",
+      "**/package-lock.json",
+      "**/yarn.lock",
+      "**/pnpm-lock.yaml"
+    ];
+    MAX_SOURCE_BYTES = 1024 * 1024;
+  }
+});
 
 // src/utils/storage.ts
 import fs2 from "fs/promises";
@@ -142,7 +217,7 @@ async function readStoreJson(root, relative) {
     return parsed;
   } catch (error) {
     if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
 }
 async function writeStoreJson(root, relative, value) {
@@ -165,39 +240,231 @@ async function writeStoreJson(root, relative, value) {
     await fs2.rm(temporary, { force: true });
   }
 }
+var init_storage = __esm({
+  "src/utils/storage.ts"() {
+    "use strict";
+    init_paths();
+    init_files();
+  }
+});
 
-// src/snapshot/snapshot.ts
+// src/automation/execution.ts
+import os from "os";
+import { randomUUID as randomUUID2 } from "crypto";
 import { z } from "zod";
+function parseExecution(raw) {
+  try {
+    return executionSchema.parse(raw);
+  } catch (error) {
+    throw new Error("Invalid automation execution store; receipt history was retained.", { cause: error });
+  }
+}
+function automationFailure(error) {
+  const recorded = failureSchema.safeParse(error?.failure);
+  if (recorded.success) return recorded.data;
+  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const codes = /* @__PURE__ */ new Set();
+  let cause = error;
+  for (let i = 0; cause && i < 8; i++) {
+    codes.add(String(cause.code));
+    cause = cause.cause;
+  }
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
+}
+function failureMessage(error) {
+  const failure = automationFailure(error);
+  return `Mason automation unavailable [${failure.code}]; evidence capture/verification was not established. ${failure.message}` + (failure.receiptRecorded ? "" : " No durable failure receipt was recorded.");
+}
+async function recordExecution(root, directory, event, run) {
+  const file = directory + "/execution.json";
+  const raw = await readStoreJson(root, file);
+  const log = raw === null ? { version: 1, attempts: [], discardedAttempts: 0 } : parseExecution(raw);
+  for (const attempt2 of log.attempts) if (attempt2.status === "running") attempt2.status = "unknown";
+  log.discardedAttempts += Math.max(0, log.attempts.length - 31);
+  log.attempts = log.attempts.slice(-31);
+  const started = performance.now();
+  const attempt = {
+    id: randomUUID2(),
+    event,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    pid: process.pid,
+    host: os.hostname(),
+    status: "running"
+  };
+  log.attempts.push(attempt);
+  await writeStoreJson(root, file, log);
+  try {
+    const result = await run();
+    Object.assign(attempt, {
+      status: "completed",
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      durationMs: performance.now() - started,
+      verificationStatus: result.report.status,
+      reportPath: result.report.reportPath
+    });
+    await writeStoreJson(root, file, log);
+    return result;
+  } catch (error) {
+    const failure = automationFailure(error);
+    Object.assign(attempt, { status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), durationMs: performance.now() - started, failure });
+    delete attempt.verificationStatus;
+    delete attempt.reportPath;
+    try {
+      await writeStoreJson(root, file, { ...log, attempts: log.attempts.map((a) => a === attempt ? { ...a, failure: { ...failure, receiptRecorded: true } } : a) });
+      failure.receiptRecorded = true;
+    } catch {
+    }
+    throw Object.assign(new Error(failure.message, { cause: error }), { failure });
+  }
+}
+async function executionStatus(root, directory) {
+  const raw = await readStoreJson(root, directory + "/execution.json");
+  if (raw === null) return { status: "not-observed", attempts: [] };
+  const log = parseExecution(raw);
+  let lock = null;
+  if (log.attempts.some((attempt) => attempt.status === "running")) {
+    try {
+      lock = await readStoreJson(root, directory + "/lock");
+    } catch {
+    }
+  }
+  for (const attempt of log.attempts) {
+    if (attempt.status !== "running") continue;
+    let alive = false;
+    if (attempt.host === os.hostname() && lock?.pid === attempt.pid && lock.host === attempt.host) {
+      try {
+        process.kill(attempt.pid, 0);
+        alive = true;
+      } catch (error) {
+        alive = error.code === "EPERM";
+      }
+    }
+    if (!alive) attempt.status = "unknown";
+  }
+  return { status: log.attempts.at(-1)?.status ?? "not-observed", attempts: log.attempts, discardedAttempts: log.discardedAttempts };
+}
+var failureSchema, attemptSchema, executionSchema;
+var init_execution = __esm({
+  "src/automation/execution.ts"() {
+    "use strict";
+    init_storage();
+    failureSchema = z.object({
+      code: z.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
+      message: z.string(),
+      retryable: z.boolean(),
+      receiptRecorded: z.boolean()
+    });
+    attemptSchema = z.object({
+      id: z.string(),
+      event: z.string(),
+      startedAt: z.string(),
+      finishedAt: z.string().optional(),
+      durationMs: z.number().nonnegative().optional(),
+      pid: z.number().int().positive(),
+      host: z.string(),
+      status: z.enum(["running", "completed", "failed", "unknown"]),
+      verificationStatus: z.string().optional(),
+      reportPath: z.string().optional(),
+      failure: failureSchema.optional()
+    });
+    executionSchema = z.object({ version: z.literal(1), attempts: z.array(attemptSchema).max(32), discardedAttempts: z.number().int().nonnegative().default(0) });
+  }
+});
 
 // src/test-map.ts
 import path4 from "path";
+async function buildTestMap(dir) {
+  const rootDir = path4.resolve(dir);
+  const access = await createFileAccess(rootDir);
+  const testPatterns = [
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/*Test.kt",
+    "**/*Test.java",
+    "**/*Tests.kt",
+    "**/*Tests.java",
+    "**/test_*.py",
+    "**/*_test.py",
+    "**/*_test.go",
+    "**/*Tests.swift",
+    "**/*Test.swift",
+    "**/*_test.rs"
+  ];
+  const testFiles = await access.list(testPatterns);
+  const sourceFiles = await access.list();
+  const sourceByBaseName = /* @__PURE__ */ new Map();
+  for (const file of sourceFiles) {
+    if (testFiles.includes(file)) continue;
+    const baseName = path4.basename(file).replace(/\.[^.]+$/, "");
+    const existing = sourceByBaseName.get(baseName) ?? [];
+    existing.push(file);
+    sourceByBaseName.set(baseName, existing);
+  }
+  const paired = [];
+  const unmatched = [];
+  for (const testFile of testFiles) {
+    const testBaseName = path4.basename(testFile).replace(/\.[^.]+$/, "");
+    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
+    if (!sourceName) {
+      unmatched.push(testFile);
+      continue;
+    }
+    const candidates = sourceByBaseName.get(sourceName);
+    if (candidates && candidates.length > 0) {
+      const testDir = path4.dirname(testFile);
+      const bestMatch = candidates.reduce((best, candidate) => {
+        const candidateDir = path4.dirname(candidate);
+        const bestDir = path4.dirname(best);
+        const candidateOverlap = commonSegments(testDir, candidateDir);
+        const bestOverlap = commonSegments(testDir, bestDir);
+        return candidateOverlap > bestOverlap ? candidate : best;
+      });
+      paired.push({
+        test: testFile,
+        source: bestMatch,
+        confidence: candidates.length === 1 ? "exact" : "best-guess"
+      });
+    } else {
+      unmatched.push(testFile);
+    }
+  }
+  return { totalTestFiles: testFiles.length, paired, unmatched };
+}
+function commonSegments(pathA, pathB) {
+  const segsA = pathA.split("/");
+  const segsB = pathB.split("/");
+  let count3 = 0;
+  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
+    if (segsA[i] === segsB[i]) count3++;
+    else break;
+  }
+  return count3;
+}
+var init_test_map = __esm({
+  "src/test-map.ts"() {
+    "use strict";
+    init_files();
+  }
+});
 
 // src/snapshot/snapshot.ts
-var exec2 = promisify2(execFile2);
-var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
-var verificationFields = {
-  refreshedHash: z.string().optional(),
-  verifiedAt: z.string().optional(),
-  verifiedHash: z.string().optional(),
-  verificationFailed: z.boolean().optional(),
-  verificationNote: z.string().optional()
-};
-var featureSchema = z.object({
-  description: z.string(),
-  files: z.array(repoPath),
-  tests: z.array(repoPath).optional(),
-  type: z.enum(["capability", "infrastructure"]).optional(),
-  ...verificationFields
-}).passthrough();
-var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
-var snapshotSchema = z.object({
-  version: z.literal(2),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-  gitHash: z.string(),
-  features: z.record(featureSchema),
-  flows: z.record(flowSchema)
-}).passthrough();
+import path5 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+import { z as z2 } from "zod";
+async function inspectSnapshot(rootDir) {
+  try {
+    const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
+    const snapshot = raw === null ? null : snapshotSchema.parse(raw);
+    return { status: snapshot ? "available" : "missing", snapshot, diagnostics: [] };
+  } catch (error) {
+    return { status: "invalid", snapshot: null, diagnostics: [{
+      path: ".mason/snapshot.json",
+      message: error instanceof Error ? error.message : String(error)
+    }] };
+  }
+}
 async function getCurrentGitHash(rootDir) {
   try {
     const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
@@ -208,9 +475,48 @@ async function getCurrentGitHash(rootDir) {
     return "unknown";
   }
 }
+var exec2, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var init_snapshot = __esm({
+  "src/snapshot/snapshot.ts"() {
+    "use strict";
+    init_files();
+    init_files();
+    init_storage();
+    init_paths();
+    init_test_map();
+    exec2 = promisify2(execFile2);
+    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+    verificationFields = {
+      refreshedHash: z2.string().optional(),
+      verifiedAt: z2.string().optional(),
+      verifiedHash: z2.string().optional(),
+      verificationFailed: z2.boolean().optional(),
+      verificationNote: z2.string().optional()
+    };
+    featureSchema = z2.object({
+      description: z2.string(),
+      files: z2.array(repoPath),
+      tests: z2.array(repoPath).optional(),
+      type: z2.enum(["capability", "infrastructure"]).optional(),
+      ...verificationFields
+    }).passthrough();
+    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
+    snapshotSchema = z2.object({
+      version: z2.literal(2),
+      createdAt: z2.string(),
+      updatedAt: z2.string(),
+      gitHash: z2.string(),
+      features: z2.record(featureSchema),
+      flows: z2.record(flowSchema)
+    }).passthrough();
+  }
+});
 
 // src/drift/drift.ts
-var exec3 = promisify3(execFile3);
+import fs3 from "fs/promises";
+import path6 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -249,16 +555,17 @@ async function getWorkingTree(resolvedRoot) {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
 }
-
-// src/audit/docs.ts
-import fs4 from "fs/promises";
-import path7 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
+var exec3;
+var init_drift = __esm({
+  "src/drift/drift.ts"() {
+    "use strict";
+    init_snapshot();
+    init_paths();
+    exec3 = promisify3(execFile3);
+  }
+});
 
 // src/audit/tree.ts
-var MIN_GLYPH_LINES = 3;
-var GLYPHS = ["\u251C\u2500\u2500", "\u2514\u2500\u2500"];
 function glyphIndex(line) {
   for (const glyph of GLYPHS) {
     const idx = line.indexOf(glyph);
@@ -327,46 +634,16 @@ function extractTreeClaims(blockLines, blockStartLine) {
   }
   return claims;
 }
+var MIN_GLYPH_LINES, GLYPHS;
+var init_tree = __esm({
+  "src/audit/tree.ts"() {
+    "use strict";
+    MIN_GLYPH_LINES = 3;
+    GLYPHS = ["\u251C\u2500\u2500", "\u2514\u2500\u2500"];
+  }
+});
 
 // src/audit/claims.ts
-var ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
-  "package.json",
-  "package-lock.json",
-  "pnpm-workspace.yaml",
-  "tsconfig.json",
-  "tsup.config.ts",
-  "vitest.config.ts",
-  "Makefile",
-  "Dockerfile",
-  "docker-compose.yml",
-  "Cargo.toml",
-  "go.mod",
-  "go.sum",
-  "pyproject.toml",
-  "requirements.txt",
-  "Gemfile",
-  "composer.json",
-  "settings.gradle.kts",
-  "settings.gradle",
-  "build.gradle.kts",
-  "build.gradle",
-  "manifest.json",
-  "server.json",
-  "README.md",
-  "CHANGELOG.md",
-  "LICENSE",
-  "CLAUDE.md",
-  "AGENTS.md",
-  ".gitignore",
-  ".env.example"
-]);
-var SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
-var COMMAND_RE = /\b(npm|pnpm|yarn)\s+run\s+([A-Za-z0-9:_.-]+)/g;
-var COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
-var COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
-var IGNORE_LINE = "<!-- mason:ignore -->";
-var IGNORE_START = "<!-- mason:ignore-start -->";
-var IGNORE_END = "<!-- mason:ignore-end -->";
 function normalizePathToken(token) {
   let t = token.trim();
   if (!t) return null;
@@ -525,12 +802,55 @@ function extractClaims(content2) {
     commands: [...commands.values()]
   };
 }
+var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, COMMAND_RE, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
+var init_claims = __esm({
+  "src/audit/claims.ts"() {
+    "use strict";
+    init_tree();
+    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
+      "package.json",
+      "package-lock.json",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "tsup.config.ts",
+      "vitest.config.ts",
+      "Makefile",
+      "Dockerfile",
+      "docker-compose.yml",
+      "Cargo.toml",
+      "go.mod",
+      "go.sum",
+      "pyproject.toml",
+      "requirements.txt",
+      "Gemfile",
+      "composer.json",
+      "settings.gradle.kts",
+      "settings.gradle",
+      "build.gradle.kts",
+      "build.gradle",
+      "manifest.json",
+      "server.json",
+      "README.md",
+      "CHANGELOG.md",
+      "LICENSE",
+      "CLAUDE.md",
+      "AGENTS.md",
+      ".gitignore",
+      ".env.example"
+    ]);
+    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
+    COMMAND_RE = /\b(npm|pnpm|yarn)\s+run\s+([A-Za-z0-9:_.-]+)/g;
+    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
+    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
+    IGNORE_LINE = "<!-- mason:ignore -->";
+    IGNORE_START = "<!-- mason:ignore-start -->";
+    IGNORE_END = "<!-- mason:ignore-end -->";
+  }
+});
 
 // src/audit/git.ts
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
-var exec4 = promisify4(execFile4);
-var COMMIT_FORMAT = "%H%x09%cI%x09%s";
 function parseCommitLine(line) {
   const parts = line.split("	");
   if (parts.length < 3 || !parts[0]) return null;
@@ -610,14 +930,20 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
     return null;
   }
 }
+var exec4, COMMIT_FORMAT;
+var init_git = __esm({
+  "src/audit/git.ts"() {
+    "use strict";
+    exec4 = promisify4(execFile4);
+    COMMIT_FORMAT = "%H%x09%cI%x09%s";
+  }
+});
 
 // src/audit/docs.ts
-var exec5 = promisify5(execFile5);
-var DOC_CANDIDATES = [
-  "AGENTS.md",
-  "CLAUDE.md",
-  ".claude/CLAUDE.md"
-];
+import fs4 from "fs/promises";
+import path7 from "path";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
 async function isDirty(resolvedRoot, relPath) {
   try {
     const { stdout } = await exec5(
@@ -631,35 +957,55 @@ async function isDirty(resolvedRoot, relPath) {
   }
 }
 async function discoverDocs(resolvedRoot) {
-  const docs = [];
-  for (const candidate of DOC_CANDIDATES) {
+  const docs = await Promise.all(DOC_CANDIDATES.map(async (candidate) => {
     let content2;
     try {
       content2 = await fs4.readFile(path7.join(resolvedRoot, candidate), "utf-8");
     } catch {
-      continue;
+      return null;
     }
-    docs.push({
+    const [lastCommit, dirty] = await Promise.all([lastCommitOf(resolvedRoot, candidate), isDirty(resolvedRoot, candidate)]);
+    return {
       path: candidate,
       content: content2,
       lineCount: content2.split("\n").length,
-      lastCommit: await lastCommitOf(resolvedRoot, candidate),
-      dirty: await isDirty(resolvedRoot, candidate),
+      lastCommit,
+      dirty,
       claims: extractClaims(content2)
-    });
-  }
-  return docs;
+    };
+  }));
+  return docs.filter((doc) => doc !== null);
 }
+var exec5, DOC_CANDIDATES;
+var init_docs = __esm({
+  "src/audit/docs.ts"() {
+    "use strict";
+    init_claims();
+    init_git();
+    exec5 = promisify5(execFile5);
+    DOC_CANDIDATES = [
+      "AGENTS.md",
+      "CLAUDE.md",
+      ".claude/CLAUDE.md"
+    ];
+  }
+});
 
 // src/audit/types.ts
-var ALL_CHECKS = [
-  "deleted-reference",
-  "new-module",
-  "stale-count",
-  "dead-command",
-  "deps-changed",
-  "decision-anchor-drift"
-];
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
 
 // src/audit/checks/deleted-reference.ts
 import fs5 from "fs/promises";
@@ -751,31 +1097,17 @@ async function checkDeletedReferences(ctx) {
   }
   return result;
 }
+var init_deleted_reference = __esm({
+  "src/audit/checks/deleted-reference.ts"() {
+    "use strict";
+    init_git();
+    init_checks();
+  }
+});
 
 // src/audit/checks/new-module.ts
 import fg2 from "fast-glob";
 import path9 from "path";
-var DIR_DENYLIST = /* @__PURE__ */ new Set([
-  "node_modules",
-  "dist",
-  "build",
-  "out",
-  "coverage",
-  "target",
-  "vendor",
-  "__pycache__",
-  "venv",
-  ".venv",
-  ".git",
-  ".gradle",
-  ".mason",
-  ".claude",
-  ".github",
-  ".vscode",
-  ".idea"
-]);
-var SECOND_LEVEL_MIN_SOURCE_FILES = 2;
-var ENUMERATION_THRESHOLD = 2;
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -823,12 +1155,19 @@ async function checkNewModules(ctx) {
       }
     });
   };
-  for (const topDir of await listSubdirs(ctx.root)) {
-    const absTop = path9.join(ctx.root, topDir);
+  for (const candidate of await moduleCandidates(ctx.root, combinedDocs)) {
+    await flag(candidate.dir, candidate.sourceFileCount);
+  }
+  return result;
+}
+async function moduleCandidates(root, combinedDocs) {
+  const candidates = [];
+  for (const topDir of await listSubdirs(root)) {
+    const absTop = path9.join(root, topDir);
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count2 = await countSourceFiles(absTop);
-      if (count2 >= 1) await flag(topDir, count2);
+      const count3 = await countSourceFiles(absTop);
+      if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
     const subdirs = await listSubdirs(absTop);
@@ -836,20 +1175,49 @@ async function checkNewModules(ctx) {
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count2 = await countSourceFiles(path9.join(absTop, sub));
-      if (count2 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
-        await flag(`${topDir}/${sub}`, count2);
+      const count3 = await countSourceFiles(path9.join(absTop, sub));
+      if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
+        candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
       }
     }
   }
-  return result;
+  return candidates;
 }
+var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
+var init_new_module = __esm({
+  "src/audit/checks/new-module.ts"() {
+    "use strict";
+    init_snapshot();
+    init_git();
+    init_checks();
+    DIR_DENYLIST = /* @__PURE__ */ new Set([
+      "node_modules",
+      "dist",
+      "build",
+      "out",
+      "coverage",
+      "target",
+      "vendor",
+      "__pycache__",
+      "venv",
+      ".venv",
+      ".git",
+      ".gradle",
+      ".mason",
+      ".claude",
+      ".github",
+      ".vscode",
+      ".idea"
+    ]);
+    SECOND_LEVEL_MIN_SOURCE_FILES = 2;
+    ENUMERATION_THRESHOLD = 2;
+  }
+});
 
 // src/audit/checks/stale-count.ts
 import fs6 from "fs/promises";
 import path10 from "path";
 import fg3 from "fast-glob";
-var MEMBERS_CAP = 50;
 async function readIfExists(absPath) {
   try {
     return await fs6.readFile(absPath, "utf-8");
@@ -991,12 +1359,19 @@ async function checkStaleCounts(ctx) {
   }
   return result;
 }
+var MEMBERS_CAP;
+var init_stale_count = __esm({
+  "src/audit/checks/stale-count.ts"() {
+    "use strict";
+    init_checks();
+    MEMBERS_CAP = 50;
+  }
+});
 
 // src/audit/checks/dead-command.ts
 import fs7 from "fs/promises";
 import path11 from "path";
 import fg4 from "fast-glob";
-var AVAILABLE_SCRIPTS_CAP = 30;
 async function scriptsOf(absManifest) {
   try {
     const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
@@ -1025,18 +1400,10 @@ async function checkDeadCommands(ctx) {
   const loadWorkspaceScripts = async () => {
     if (workspaceScripts !== null) return workspaceScripts;
     workspaceScripts = /* @__PURE__ */ new Set();
-    const manifests = await fg4("**/package.json", {
-      cwd: ctx.root,
-      ignore: [
-        "**/node_modules/**",
-        "**/dist/**",
-        "**/build/**",
-        "package.json"
-      ]
-    });
+    const manifests = await commandManifests(ctx.root);
     manifestsChecked = ["package.json", ...manifests.sort()];
-    for (const manifest2 of manifests) {
-      const scripts = await scriptsOf(path11.join(ctx.root, manifest2));
+    for (const manifest of manifests) {
+      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
       for (const name of scripts ?? []) workspaceScripts.add(name);
     }
     return workspaceScripts;
@@ -1061,26 +1428,84 @@ async function checkDeadCommands(ctx) {
   }
   return result;
 }
+function commandManifests(root) {
+  return fg4("**/package.json", {
+    cwd: root,
+    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"]
+  });
+}
+var AVAILABLE_SCRIPTS_CAP;
+var init_dead_command = __esm({
+  "src/audit/checks/dead-command.ts"() {
+    "use strict";
+    init_checks();
+    AVAILABLE_SCRIPTS_CAP = 30;
+  }
+});
+
+// src/audit/release-metadata.ts
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+async function git(root, args) {
+  return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
+}
+function withoutAndroidReleaseValues(text2) {
+  if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
+  const scopes = [];
+  const normalized = [];
+  let assignments = 0;
+  for (const line of text2.split("\n")) {
+    const code = line.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/.*$/g, (token) => token.startsWith("//") ? "" : '""');
+    const assignment = line.match(/^(\s*)(versionName|versionCode)(\s*(?:=\s*|\s+))("[A-Za-z0-9._+-]+"|'[A-Za-z0-9._+-]+'|\d+)(\s*)$/);
+    if (assignment && scopes.join("/") === "android/defaultConfig" && (assignment[2] === "versionCode" ? /^\d+$/.test(assignment[4]) : /^["']/.test(assignment[4]))) {
+      normalized.push(assignment[1] + assignment[2] + assignment[3] + "<release-value>" + assignment[5]);
+      assignments++;
+    } else {
+      if (/\bversion(?:Name|Code)\b/.test(line)) return null;
+      normalized.push(line);
+    }
+    const named = code.match(/^\s*(android|defaultConfig)\s*\{\s*$/)?.[1];
+    for (const brace of code.matchAll(/[{}]/g)) {
+      if (brace[0] === "{") scopes.push(named ?? "unknown");
+      else if (!scopes.length) return null;
+      else scopes.pop();
+    }
+  }
+  return assignments && !scopes.length ? normalized.join("\n") : null;
+}
+async function releaseMetadataOnly(root, commit) {
+  if (!commit.files.length || !commit.files.every((file) => /(^|\/)build\.gradle(?:\.kts)?$/.test(file))) return false;
+  try {
+    const parents = (await git(root, ["rev-list", "--parents", "-n", "1", commit.hash])).trim().split(/\s+/);
+    if (parents.length !== 2) return false;
+    for (const file of commit.files) {
+      const raw = await git(root, ["diff", "--raw", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", parents[1], commit.hash, "--", file]);
+      if (!/^:(100644|100755) \1 [a-f0-9]+ [a-f0-9]+ M\0/.test(raw)) return false;
+      const [before, after] = await Promise.all([
+        git(root, ["show", parents[1] + ":" + file]),
+        git(root, ["show", commit.hash + ":" + file])
+      ]);
+      const previous = withoutAndroidReleaseValues(before);
+      if (previous === null || previous !== withoutAndroidReleaseValues(after)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+var exec6;
+var init_release_metadata = __esm({
+  "src/audit/release-metadata.ts"() {
+    "use strict";
+    exec6 = promisify6(execFile6);
+  }
+});
 
 // src/audit/checks/deps-changed.ts
-var MANIFEST_COMMITS_CAP = 10;
-var MANIFEST_PATHSPECS = [
-  ":(glob)**/package.json",
-  ":(glob)**/build.gradle.kts",
-  ":(glob)**/build.gradle",
-  "settings.gradle.kts",
-  "settings.gradle",
-  "gradle/libs.versions.toml",
-  ":(glob)**/Cargo.toml",
-  "go.mod",
-  "pyproject.toml",
-  "requirements.txt",
-  "Gemfile",
-  "composer.json"
-];
 async function checkDepsChanged(ctx) {
   const result = emptyResult();
   result.suppressedAdvisories = [];
+  const releaseOnly = /* @__PURE__ */ new Map();
   for (const doc of ctx.docs) {
     if (!doc.lastCommit) {
       result.skipped.push({
@@ -1110,6 +1535,15 @@ async function checkDepsChanged(ctx) {
       });
       continue;
     }
+    const relevant = [];
+    for (const commit of range.commits) {
+      if (!releaseOnly.has(commit.hash) && releaseOnly.size < 100) {
+        releaseOnly.set(commit.hash, await releaseMetadataOnly(ctx.root, commit));
+      }
+      if (!releaseOnly.get(commit.hash)) relevant.push(commit);
+    }
+    range.commits = relevant;
+    range.total = relevant.length;
     if (range.total === 0) continue;
     const latest = range.commits[0];
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
@@ -1126,111 +1560,57 @@ async function checkDepsChanged(ctx) {
   }
   return result;
 }
-
-// src/decisions/drift.ts
-import path14 from "path";
-
-// src/decisions/decisions.ts
-import fs8 from "fs/promises";
-import path13 from "path";
-import { createHash } from "crypto";
+var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
+var init_deps_changed = __esm({
+  "src/audit/checks/deps-changed.ts"() {
+    "use strict";
+    init_release_metadata();
+    init_git();
+    init_checks();
+    MANIFEST_COMMITS_CAP = 10;
+    MANIFEST_PATHSPECS = [
+      ":(glob)**/package.json",
+      ":(glob)**/build.gradle.kts",
+      ":(glob)**/build.gradle",
+      "settings.gradle.kts",
+      "settings.gradle",
+      "gradle/libs.versions.toml",
+      ":(glob)**/Cargo.toml",
+      "go.mod",
+      "pyproject.toml",
+      "requirements.txt",
+      "Gemfile",
+      "composer.json"
+    ];
+  }
+});
 
 // src/context/lexical.ts
 import path12 from "path";
-
-// src/decisions/provenance.ts
-import { z as z2 } from "zod";
-var text = (max) => z2.string().trim().min(1).max(max);
-var decisionSourceSchema = z2.object({
-  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
-  reference: text(1e3),
-  note: text(500).optional()
-}).strict();
-var attributionSchema = z2.object({
-  owner: text(200).nullable().optional(),
-  sources: z2.array(decisionSourceSchema).max(20).optional(),
-  actor: text(200).optional()
-});
-var contentSchema = z2.object({
-  title: z2.string().min(1),
-  body: z2.string().min(1),
-  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
-  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
-  owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20)
-});
-var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
-var statusSchema = z2.enum(["active", "superseded", "retired"]);
-var reviewEvidenceSchema = z2.object({
-  baseHash: z2.string(),
-  headHash: z2.string(),
-  historyAvailable: z2.boolean(),
-  changedFiles: z2.array(z2.string()),
-  localChanges: z2.array(z2.string())
-});
-var eventSchema = z2.object({
-  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
-  at: z2.string().datetime(),
-  actor: text(200).optional(),
-  note: text(1500).optional(),
-  revision: z2.number().int().positive(),
-  content: contentSchema,
-  approval: approvalSchema,
-  status: statusSchema,
-  refreshedHash: z2.string(),
-  evidence: reviewEvidenceSchema.optional()
+var init_lexical = __esm({
+  "src/context/lexical.ts"() {
+    "use strict";
+  }
 });
-var legacySchema = z2.object({
-  version: z2.literal(1),
-  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
-  title: z2.string().min(1),
-  body: z2.string().min(1),
-  category: contentSchema.shape.category,
-  files: contentSchema.shape.files,
-  createdAt: z2.string(),
-  updatedAt: z2.string(),
-  refreshedHash: z2.string(),
-  status: z2.enum(["active", "superseded"]),
-  supersededBy: z2.string().optional()
-}).passthrough();
-var currentSchema = legacySchema.extend({
-  version: z2.literal(2),
-  status: statusSchema,
-  approval: approvalSchema,
-  revision: z2.number().int().positive(),
-  owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20),
-  history: z2.array(eventSchema).min(1)
-}).superRefine((record, ctx) => {
-  const invalid = (message) => ctx.addIssue({ code: "custom", message });
-  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-  let previous;
-  for (const event of record.history) {
-    if (!previous) {
-      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
-      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
-    } else {
-      if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
-      if (previous.status !== "active") invalid("Archived decisions cannot be changed");
-      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
-      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
-      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
-      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
-      const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
-      if (event.approval !== approval) invalid("Approval disagrees with review history");
-      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
-    }
-    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
-    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
-    if (["accepted", "reaffirmed"].includes(event.kind)) {
-      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
-      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
-    }
-    previous = event;
-  }
-  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+
+// src/context/trust.ts
+function assessTrust(entry, freshness) {
+  const verification = entry.verificationFailed ? "failed" : entry.verifiedAt ? "passed" : "unverified";
+  const reasons = [];
+  if (freshness === "unknown") reasons.push("Anchors, history, or working-tree evidence are unavailable; verify before relying on this entry.");
+  if (freshness === "changed") reasons.push("Anchored files changed; verify against current code before relying on this entry.");
+  if (verification === "failed") reasons.push(`Verification failed: ${entry.verificationNote ?? "re-map this entry before relying on it"}`);
+  if (verification === "unverified") reasons.push("No correctness verification has been recorded.");
+  return { freshness, verification, verifiedAt: entry.verifiedAt, verifiedHash: entry.verifiedHash, reasons };
+}
+var init_trust = __esm({
+  "src/context/trust.ts"() {
+    "use strict";
+  }
 });
-var decisionSchema = z2.union([legacySchema, currentSchema]);
+
+// src/decisions/provenance.ts
+import { z as z3 } from "zod";
 function decisionContent(record) {
   return {
     title: record.title,
@@ -1246,10 +1626,10 @@ function decisionApproval(record) {
 }
 function effectiveDecision(record) {
   if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
-  let index = record.history.length - 1;
-  while (index >= 0 && !["accepted", "reaffirmed"].includes(record.history[index].kind)) index--;
-  if (index < 0) return record;
-  const event = record.history[index];
+  let index2 = record.history.length - 1;
+  while (index2 >= 0 && !["accepted", "reaffirmed"].includes(record.history[index2].kind)) index2--;
+  if (index2 < 0) return record;
+  const event = record.history[index2];
   return {
     ...record,
     ...event.content,
@@ -1258,7 +1638,7 @@ function effectiveDecision(record) {
     revision: event.revision,
     refreshedHash: event.refreshedHash,
     updatedAt: event.at,
-    history: record.history.slice(0, index + 1)
+    history: record.history.slice(0, index2 + 1)
   };
 }
 function decisionProvenance(record, freshness = "unknown") {
@@ -1274,8 +1654,124 @@ function decisionProvenance(record, freshness = "unknown") {
     lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
   };
 }
+function decisionTrust(record, freshness) {
+  const review = decisionProvenance(record, freshness).lastReview;
+  return assessTrust(review ? { verifiedAt: review.at, verifiedHash: review.gitHash } : {}, freshness);
+}
+function revisionKnowledge(record, freshness) {
+  return { ...decisionContent(record), ...decisionProvenance(record, freshness), trust: decisionTrust(record, freshness) };
+}
+function decisionKnowledge(record, freshness = "unknown", proposalFreshness = "unknown") {
+  const effective = effectiveDecision(record);
+  return {
+    ...revisionKnowledge(effective, freshness),
+    ...effective !== record ? { pendingProposal: revisionKnowledge(record, proposalFreshness) } : {}
+  };
+}
+var text, decisionSourceSchema, attributionSchema, contentSchema, approvalSchema, statusSchema, reviewEvidenceSchema, eventSchema, legacySchema, currentSchema, decisionSchema;
+var init_provenance = __esm({
+  "src/decisions/provenance.ts"() {
+    "use strict";
+    init_paths();
+    init_trust();
+    text = (max) => z3.string().trim().min(1).max(max);
+    decisionSourceSchema = z3.object({
+      kind: z3.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+      reference: text(1e3),
+      note: text(500).optional()
+    }).strict();
+    attributionSchema = z3.object({
+      owner: text(200).nullable().optional(),
+      sources: z3.array(decisionSourceSchema).max(20).optional(),
+      actor: text(200).optional()
+    });
+    contentSchema = z3.object({
+      title: z3.string().min(1),
+      body: z3.string().min(1),
+      category: z3.enum(["decision", "gotcha", "deprecation", "convention"]),
+      files: z3.array(z3.string().refine((f) => normalizeRepoPath(f) !== null)),
+      owner: text(200).optional(),
+      sources: z3.array(decisionSourceSchema).max(20)
+    });
+    approvalSchema = z3.enum(["unreviewed", "proposed", "accepted"]);
+    statusSchema = z3.enum(["active", "superseded", "retired"]);
+    reviewEvidenceSchema = z3.object({
+      baseHash: z3.string(),
+      headHash: z3.string(),
+      historyAvailable: z3.boolean(),
+      changedFiles: z3.array(z3.string()),
+      localChanges: z3.array(z3.string())
+    });
+    eventSchema = z3.object({
+      kind: z3.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+      at: z3.string().datetime(),
+      actor: text(200).optional(),
+      note: text(1500).optional(),
+      revision: z3.number().int().positive(),
+      content: contentSchema,
+      approval: approvalSchema,
+      status: statusSchema,
+      refreshedHash: z3.string(),
+      evidence: reviewEvidenceSchema.optional()
+    });
+    legacySchema = z3.object({
+      version: z3.literal(1),
+      id: z3.string().regex(/^[a-zA-Z0-9_-]+$/),
+      title: z3.string().min(1),
+      body: z3.string().min(1),
+      category: contentSchema.shape.category,
+      files: contentSchema.shape.files,
+      createdAt: z3.string(),
+      updatedAt: z3.string(),
+      refreshedHash: z3.string(),
+      status: z3.enum(["active", "superseded"]),
+      supersededBy: z3.string().optional()
+    }).passthrough();
+    currentSchema = legacySchema.extend({
+      version: z3.literal(2),
+      status: statusSchema,
+      approval: approvalSchema,
+      revision: z3.number().int().positive(),
+      owner: text(200).optional(),
+      sources: z3.array(decisionSourceSchema).max(20),
+      history: z3.array(eventSchema).min(1)
+    }).superRefine((record, ctx) => {
+      const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
+      const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+      let previous;
+      for (const event of record.history) {
+        if (!previous) {
+          if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
+          if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+        } else {
+          if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
+          if (previous.status !== "active") invalid("Archived decisions cannot be changed");
+          if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
+          if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
+          if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
+          if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+          const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
+          if (event.approval !== approval) invalid("Approval disagrees with review history");
+          if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+        }
+        if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
+        if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+        if (["accepted", "reaffirmed"].includes(event.kind)) {
+          if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
+          if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+        }
+        previous = event;
+      }
+      if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+    });
+    decisionSchema = z3.union([legacySchema, currentSchema]);
+  }
+});
 
 // src/decisions/decisions.ts
+import fs8 from "fs/promises";
+import path13 from "path";
+import { createHash } from "crypto";
 async function loadDecisionStore(rootDir) {
   const records = [];
   const diagnostics = [];
@@ -1299,8 +1795,19 @@ async function loadDecisionStore(rootDir) {
   }
   return { records, diagnostics };
 }
+var init_decisions = __esm({
+  "src/decisions/decisions.ts"() {
+    "use strict";
+    init_storage();
+    init_paths();
+    init_snapshot();
+    init_lexical();
+    init_provenance();
+  }
+});
 
 // src/decisions/drift.ts
+import path14 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
   const resolvedRoot = path14.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
@@ -1330,6 +1837,16 @@ async function computeDecisionDrift(rootDir, decisions) {
   }
   return report;
 }
+var init_drift2 = __esm({
+  "src/decisions/drift.ts"() {
+    "use strict";
+    init_drift();
+    init_paths();
+    init_snapshot();
+    init_decisions();
+    init_provenance();
+  }
+});
 
 // src/audit/checks/decision-anchor.ts
 async function checkDecisionAnchors(ctx) {
@@ -1373,26 +1890,48 @@ async function checkDecisionAnchors(ctx) {
   }
   return result;
 }
+var init_decision_anchor = __esm({
+  "src/audit/checks/decision-anchor.ts"() {
+    "use strict";
+    init_drift2();
+    init_decisions();
+    init_provenance();
+    init_checks();
+  }
+});
 
 // src/audit/checks/index.ts
-var CHECKS = {
-  "deleted-reference": checkDeletedReferences,
-  "new-module": checkNewModules,
-  "stale-count": checkStaleCounts,
-  "dead-command": checkDeadCommands,
-  "deps-changed": checkDepsChanged,
-  "decision-anchor-drift": checkDecisionAnchors
-};
 function emptyResult() {
   return { issues: [], advisories: [], skipped: [] };
 }
+var CHECKS;
+var init_checks = __esm({
+  "src/audit/checks/index.ts"() {
+    "use strict";
+    init_deleted_reference();
+    init_new_module();
+    init_stale_count();
+    init_dead_command();
+    init_deps_changed();
+    init_decision_anchor();
+    CHECKS = {
+      "deleted-reference": checkDeletedReferences,
+      "new-module": checkNewModules,
+      "stale-count": checkStaleCounts,
+      "dead-command": checkDeadCommands,
+      "deps-changed": checkDepsChanged,
+      "decision-anchor-drift": checkDecisionAnchors
+    };
+  }
+});
 
 // src/audit/audit.ts
+import fs9 from "fs/promises";
+import path15 from "path";
 async function computeAudit(rootDir, options = {}) {
   const resolvedRoot = path15.resolve(rootDir);
-  const docs = await discoverDocs(resolvedRoot);
+  const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
-  const headHash = await getCurrentGitHash(resolvedRoot);
   const report = {
     version: 1,
     root: resolvedRoot,
@@ -1447,97 +1986,22 @@ async function computeAudit(rootDir, options = {}) {
   report.clean = report.issues.length === 0;
   return report;
 }
+var init_audit = __esm({
+  "src/audit/audit.ts"() {
+    "use strict";
+    init_drift();
+    init_snapshot();
+    init_docs();
+    init_types();
+    init_checks();
+  }
+});
 
 // src/audit/repair.ts
-var checkSchema = z3.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
-var commitSchema = z3.object({ hash: z3.string().regex(/^[a-f0-9]{40,64}$/), date: z3.string(), subject: z3.string() });
-var anchorSchema = z3.object({ doc: z3.string(), line: z3.number().int().positive().nullable(), excerpt: z3.string().nullable() });
-var count = z3.number().int().nonnegative();
-var evidenceSchema = z3.discriminatedUnion("kind", [
-  z3.object({
-    kind: z3.literal("missing-path"),
-    claimed: z3.string(),
-    renamedTo: z3.string().nullable(),
-    deletedInCommit: commitSchema.nullable(),
-    everTracked: z3.boolean(),
-    parentDirExists: z3.boolean()
-  }),
-  z3.object({
-    kind: z3.literal("unmentioned-dir"),
-    dir: z3.string(),
-    sourceFileCount: count,
-    firstCommit: commitSchema.nullable(),
-    checkedDocs: z3.array(z3.string())
-  }),
-  z3.object({
-    kind: z3.literal("count-mismatch"),
-    claimed: count,
-    actual: count,
-    unit: z3.string(),
-    countedFrom: z3.string(),
-    members: z3.array(z3.string())
-  }),
-  z3.object({
-    kind: z3.literal("missing-script"),
-    scriptName: z3.string(),
-    invocation: z3.string(),
-    manifestsChecked: z3.array(z3.string()),
-    availableScripts: z3.array(z3.string())
-  }),
-  z3.object({
-    kind: z3.literal("doc-behind-manifests"),
-    docLastCommit: commitSchema,
-    manifestCommits: z3.array(commitSchema.extend({ files: z3.array(z3.string()) })),
-    totalCommits: count
-  }),
-  z3.object({
-    kind: z3.literal("decision-anchor"),
-    decisionId: z3.string(),
-    title: z3.string(),
-    changedFiles: z3.array(z3.string()),
-    refreshedHash: z3.string(),
-    provenance: z3.object({}).passthrough().optional()
-  })
-]);
-var findingSchema = z3.object({ message: z3.string(), anchor: anchorSchema, evidence: evidenceSchema });
-var issueSchema = findingSchema.extend({
-  type: z3.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
-  confidence: z3.enum(["certain", "likely"])
-});
-var advisorySchema = findingSchema.extend({ type: z3.enum(["deps-changed", "decision-anchor-drift"]) });
-var checkResultSchema = z3.object({
-  issues: z3.array(issueSchema),
-  advisories: z3.array(advisorySchema),
-  suppressedAdvisories: z3.array(advisorySchema).optional(),
-  skipped: z3.array(z3.object({ check: z3.string(), reason: z3.string(), doc: z3.string().optional() }))
-});
-var reportSchema = z3.object({
-  version: z3.literal(1),
-  root: z3.string(),
-  gitAvailable: z3.literal(true),
-  headHash: commitSchema.shape.hash,
-  checksRun: z3.array(checkSchema).nonempty(),
-  docs: z3.array(z3.object({
-    path: z3.enum(DOC_CANDIDATES),
-    lastCommit: commitSchema.nullable(),
-    dirty: z3.boolean(),
-    lineCount: count
-  })).nonempty(),
-  decisionsChecked: z3.boolean(),
-  clean: z3.boolean(),
-  issues: z3.array(issueSchema),
-  advisories: z3.array(advisorySchema),
-  suppressedAdvisories: z3.array(advisorySchema).optional(),
-  skippedChecks: z3.array(z3.object({ check: z3.string(), reason: z3.string(), doc: z3.string().optional() }))
-});
-var baselineSchema = z3.object({
-  kind: z3.literal("mason-audit-repair"),
-  version: z3.literal(1),
-  createdAt: z3.string().datetime(),
-  report: reportSchema,
-  digest: z3.string().regex(/^[a-f0-9]{64}$/)
-});
-var digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+import fs10 from "fs/promises";
+import path16 from "path";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { z as z4 } from "zod";
 function findingId(finding) {
   const e = finding.evidence;
   let key;
@@ -1591,7 +2055,7 @@ async function stableAudit(root, checks, options = {}) {
 }
 async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
   const root = await fs10.realpath(rootDir);
-  const selected = z3.array(checkSchema).nonempty().parse(checks);
+  const selected = z4.array(checkSchema).nonempty().parse(checks);
   const report = await stableAudit(root, selected, options);
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
@@ -1602,7 +2066,7 @@ async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     report: storedReport
   };
-  const baselinePath = ".mason/reports/repairs/" + randomUUID2() + ".json";
+  const baselinePath = ".mason/reports/repairs/" + randomUUID3() + ".json";
   await writeStoreJson(root, baselinePath, { ...payload, digest: digest(payload) });
   return { version: 1, action: "prepare", baselinePath, report };
 }
@@ -1682,27 +2146,135 @@ async function verifyRepair(rootDir, baselinePath, options = {}) {
     scope: "Original audit checks over current context files and repository evidence. Resolved means no longer detected by that check. Advisories require separate review; this is not a certification of documentation or application correctness."
   };
 }
+var checkSchema, commitSchema, anchorSchema, count, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema, reportSchema, baselineSchema, digest;
+var init_repair = __esm({
+  "src/audit/repair.ts"() {
+    "use strict";
+    init_audit();
+    init_docs();
+    init_snapshot();
+    init_drift();
+    init_storage();
+    init_files();
+    init_paths();
+    init_types();
+    checkSchema = z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
+    commitSchema = z4.object({ hash: z4.string().regex(/^[a-f0-9]{40,64}$/), date: z4.string(), subject: z4.string() });
+    anchorSchema = z4.object({ doc: z4.string(), line: z4.number().int().positive().nullable(), excerpt: z4.string().nullable() });
+    count = z4.number().int().nonnegative();
+    evidenceSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("missing-path"),
+        claimed: z4.string(),
+        renamedTo: z4.string().nullable(),
+        deletedInCommit: commitSchema.nullable(),
+        everTracked: z4.boolean(),
+        parentDirExists: z4.boolean()
+      }),
+      z4.object({
+        kind: z4.literal("unmentioned-dir"),
+        dir: z4.string(),
+        sourceFileCount: count,
+        firstCommit: commitSchema.nullable(),
+        checkedDocs: z4.array(z4.string())
+      }),
+      z4.object({
+        kind: z4.literal("count-mismatch"),
+        claimed: count,
+        actual: count,
+        unit: z4.string(),
+        countedFrom: z4.string(),
+        members: z4.array(z4.string())
+      }),
+      z4.object({
+        kind: z4.literal("missing-script"),
+        scriptName: z4.string(),
+        invocation: z4.string(),
+        manifestsChecked: z4.array(z4.string()),
+        availableScripts: z4.array(z4.string())
+      }),
+      z4.object({
+        kind: z4.literal("doc-behind-manifests"),
+        docLastCommit: commitSchema,
+        manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
+        totalCommits: count
+      }),
+      z4.object({
+        kind: z4.literal("decision-anchor"),
+        decisionId: z4.string(),
+        title: z4.string(),
+        changedFiles: z4.array(z4.string()),
+        refreshedHash: z4.string(),
+        provenance: z4.object({}).passthrough().optional()
+      })
+    ]);
+    findingSchema = z4.object({ message: z4.string(), anchor: anchorSchema, evidence: evidenceSchema });
+    issueSchema = findingSchema.extend({
+      type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+      confidence: z4.enum(["certain", "likely"])
+    });
+    advisorySchema = findingSchema.extend({ type: z4.enum(["deps-changed", "decision-anchor-drift"]) });
+    checkResultSchema = z4.object({
+      issues: z4.array(issueSchema),
+      advisories: z4.array(advisorySchema),
+      suppressedAdvisories: z4.array(advisorySchema).optional(),
+      skipped: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+    });
+    reportSchema = z4.object({
+      version: z4.literal(1),
+      root: z4.string(),
+      gitAvailable: z4.literal(true),
+      headHash: commitSchema.shape.hash,
+      checksRun: z4.array(checkSchema).nonempty(),
+      docs: z4.array(z4.object({
+        path: z4.enum(DOC_CANDIDATES),
+        lastCommit: commitSchema.nullable(),
+        dirty: z4.boolean(),
+        lineCount: count
+      })).nonempty(),
+      decisionsChecked: z4.boolean(),
+      clean: z4.boolean(),
+      issues: z4.array(issueSchema),
+      advisories: z4.array(advisorySchema),
+      suppressedAdvisories: z4.array(advisorySchema).optional(),
+      skippedChecks: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+    });
+    baselineSchema = z4.object({
+      kind: z4.literal("mason-audit-repair"),
+      version: z4.literal(1),
+      createdAt: z4.string().datetime(),
+      report: reportSchema,
+      digest: z4.string().regex(/^[a-f0-9]{64}$/)
+    });
+    digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+  }
+});
 
 // src/automation/evidence.ts
+var evidence_exports = {};
+__export(evidence_exports, {
+  checkCache: () => checkCache,
+  git: () => git2,
+  hash: () => hash,
+  readInputs: () => readInputs,
+  workspace: () => workspace
+});
 import fs11 from "fs/promises";
 import path17 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
 import fg5 from "fast-glob";
-import { z as z4 } from "zod";
-var exec6 = promisify6(execFile6);
-var engineVersion = true ? "0.12.0" : "development";
-var hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
-async function git(root, ...args) {
-  return (await exec6("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
+import { z as z5 } from "zod";
+async function git2(root, ...args) {
+  return (await exec7("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
 }
 async function workspace(dir) {
-  const root = await fs11.realpath((await git(dir, "rev-parse", "--show-toplevel")).trim());
-  const gitDir = await fs11.realpath((await git(root, "rev-parse", "--absolute-git-dir")).trim());
+  const root = await fs11.realpath((await git2(dir, "rev-parse", "--show-toplevel")).trim());
+  const gitDir = await fs11.realpath((await git2(root, "rev-parse", "--absolute-git-dir")).trim());
   let branch;
   try {
-    branch = (await git(root, "symbolic-ref", "--quiet", "HEAD")).trim();
+    branch = (await git2(root, "symbolic-ref", "--quiet", "HEAD")).trim();
   } catch {
     branch = "detached";
   }
@@ -1718,23 +2290,20 @@ async function content(root, file) {
     throw error;
   }
 }
-var manifest = /(^|\/)(package\.json|pnpm-workspace\.yaml|Cargo\.toml|settings\.gradle(?:\.kts)?|build\.gradle(?:\.kts)?|libs\.versions\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)$/;
-var internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
 async function readInputs(root) {
-  const [headText, status, inventory, index, shallowPath, replacements] = await Promise.all([
-    git(root, "rev-parse", "HEAD"),
-    git(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
+  const [headText, docStatus, inventory, shallowPath, replacements] = await Promise.all([
+    git2(root, "rev-parse", "HEAD"),
+    git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
     fg5("**/*", {
       cwd: root,
       dot: true,
       onlyFiles: false,
       followSymbolicLinks: false,
       objectMode: true,
-      ignore: ["**/.git/**", "**/node_modules/**", ".mason/reports/**"]
+      ignore: SOURCE_IGNORE
     }),
-    git(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports"),
-    git(root, "rev-parse", "--git-path", "shallow"),
-    git(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
+    git2(root, "rev-parse", "--git-path", "shallow"),
+    git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
   ]);
   const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
   const files = entries.map((f) => f.path);
@@ -1759,28 +2328,37 @@ async function readInputs(root) {
       claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
     }
   }
-  const metadata = [];
-  for (const file of files) {
-    if (manifest.test(file) || file.startsWith(".mason/decisions/") && file.endsWith(".json") || file === ".mason/config.json") {
-      metadata.push([file, await content(root, file)]);
-    }
-  }
   if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
-  const common = [1, engineVersion, head, shallow, replacements, docContents];
-  const layout = hash(entries.map((f) => [f.path, f.dirent.isDirectory() ? "directory" : "file"]));
-  const manifests = hash(metadata.filter(([file]) => manifest.test(file)));
-  const decisions = hash(metadata.filter(([file]) => !manifest.test(file)));
+  const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
+  const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
+  const decisionDirectory = await storePath(root, ".mason/decisions");
+  const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
+    if (error.code === "ENOENT") return "absent";
+    throw error;
+  });
+  const [modules, counts, manifests, decisionFiles] = await Promise.all([
+    combinedDocs ? moduleCandidates(root, combinedDocs) : [],
+    Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
+    commandManifests(root),
+    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+  ]);
+  const packages = await Promise.all(["package.json", ...manifests.sort()].map(async (file) => [file, await content(root, file)]));
+  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => [file, await content(root, file)]));
+  const [status, index2] = decisions.length ? await Promise.all([
+    git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
+    git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
+  ]) : ["", ""];
+  const common = [2, engineVersion, head, shallow, replacements, docContents];
   const keys = {
-    "deleted-reference": hash([common, layout, claims]),
-    "new-module": hash([common, layout]),
-    "stale-count": hash([common, layout, manifests]),
-    "dead-command": hash([common, layout, manifests]),
-    "deps-changed": hash([common, status]),
-    "decision-anchor-drift": hash([common, layout, decisions, status, index])
+    "deleted-reference": hash([common, claims, docStatus]),
+    "new-module": hash([common, modules]),
+    "stale-count": hash([common, counts]),
+    "dead-command": hash([common, packages]),
+    "deps-changed": hash([common, docStatus]),
+    "decision-anchor-drift": hash([common, decisionPresence, decisions, status, index2])
   };
   return { fingerprint: hash(keys), head, docs, keys };
 }
-var cacheSchema = z4.object({ version: z4.literal(1), entries: z4.record(z4.object({ key: z4.string(), result: checkResultSchema })), digest: z4.string() });
 function checkCache(raw, inputs) {
   let entries = {};
   let diagnostic = null;
@@ -1806,34 +2384,38 @@ function checkCache(raw, inputs) {
     return { version: 1, entries: canonical, digest: hash(canonical) };
   } };
 }
+var exec7, engineVersion, hash, internal, cacheSchema;
+var init_evidence = __esm({
+  "src/automation/evidence.ts"() {
+    "use strict";
+    init_docs();
+    init_claims();
+    init_repair();
+    init_checks();
+    init_files();
+    init_new_module();
+    init_stale_count();
+    init_dead_command();
+    init_storage();
+    exec7 = promisify7(execFile7);
+    engineVersion = true ? "0.13.0" : "development";
+    hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+    internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
+    cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
+  }
+});
 
 // src/automation/store.ts
 import fs12 from "fs/promises";
-import os from "os";
-import { z as z5 } from "zod";
-var hostSchema = z5.enum(["claude", "codex"]);
-var stateSchema = z5.object({
-  version: z5.literal(1),
-  root: z5.string(),
-  gitDir: z5.string(),
-  branch: z5.string(),
-  baselines: z5.array(z5.object({ path: z5.string(), at: z5.string(), event: z5.string(), fingerprint: z5.string() })).max(128),
-  sessions: z5.record(z5.object({
-    host: hostSchema,
-    seen: z5.string().nullable(),
-    continued: z5.boolean(),
-    initialIssues: z5.array(z5.string()),
-    initialDocs: z5.record(z5.string().nullable()),
-    lastUsed: z5.string(),
-    mutationObserved: z5.boolean(),
-    pending: z5.record(z5.string()),
-    coverageGaps: z5.array(z5.string()),
-    events: z5.record(z5.object({ at: z5.string(), count: z5.number().int().positive() }))
-  })),
-  updatedAt: z5.string(),
-  fingerprint: z5.string().nullable(),
-  latest: z5.string().nullable()
-});
+import os2 from "os";
+import { z as z6 } from "zod";
+function parseState(raw) {
+  try {
+    return stateSchema.parse(raw);
+  } catch (error) {
+    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+  }
+}
 async function withLock(root, directory, run) {
   const file = await storePath(root, directory + "/lock", true);
   const deadline = Date.now() + 5e3;
@@ -1841,12 +2423,21 @@ async function withLock(root, directory, run) {
   while (!handle) {
     try {
       handle = await fs12.open(file, "wx", 384);
-      await handle.writeFile(JSON.stringify({ pid: process.pid, host: os.hostname() }));
+      try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os2.hostname() }));
+      } catch (error) {
+        await handle.close().catch(() => {
+        });
+        handle = void 0;
+        await fs12.rm(file, { force: true }).catch(() => {
+        });
+        throw error;
+      }
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       try {
         const owner = JSON.parse(await fs12.readFile(file, "utf8"));
-        if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
+        if (owner.host === os2.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
           try {
             process.kill(owner.pid, 0);
           } catch (probe) {
@@ -1879,11 +2470,40 @@ async function withLock(root, directory, run) {
     await fs12.unlink(file);
   }
 }
+var hostSchema, events, stateSchema;
+var init_store = __esm({
+  "src/automation/store.ts"() {
+    "use strict";
+    init_storage();
+    hostSchema = z6.enum(["claude", "codex"]);
+    events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
+    stateSchema = z6.object({
+      version: z6.literal(1),
+      root: z6.string(),
+      gitDir: z6.string(),
+      branch: z6.string(),
+      baselines: z6.array(z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })).max(128),
+      sessions: z6.record(z6.object({
+        host: hostSchema,
+        seen: z6.string().nullable(),
+        continued: z6.boolean(),
+        initialIssues: z6.array(z6.string()),
+        initialDocs: z6.record(z6.string().nullable()),
+        lastUsed: z6.string(),
+        mutationObserved: z6.boolean(),
+        pending: z6.record(z6.string()),
+        coverageGaps: z6.array(z6.string()),
+        events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
+      })),
+      updatedAt: z6.string(),
+      fingerprint: z6.string().nullable(),
+      latest: z6.string().nullable()
+    });
+  }
+});
 
 // src/automation/runtime.ts
-var SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved claims no longer fail their checks; advisories need separate review. Repair only within the user's task authorization.";
-var priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
-var cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+import { randomUUID as randomUUID4 } from "crypto";
 function summarize(report) {
   const open = report.findings.filter((f) => f.status !== "resolved");
   return [
@@ -1897,7 +2517,7 @@ function summarize(report) {
 }
 async function automate(dir, event) {
   const ws = await workspace(dir);
-  return withLock(ws.root, ws.directory, async () => {
+  return withLock(ws.root, ws.directory, () => recordExecution(ws.root, ws.directory, event.event, async () => {
     const inputs = await readInputs(ws.root);
     const statePath = ws.directory + "/state.json";
     const raw = await readStoreJson(ws.root, statePath);
@@ -1912,7 +2532,7 @@ async function automate(dir, event) {
       updatedAt: now,
       fingerprint: null,
       latest: null
-    } : stateSchema.parse(raw);
+    } : parseState(raw);
     if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
       throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
     }
@@ -1920,7 +2540,7 @@ async function automate(dir, event) {
       const previous = await readStoreJson(ws.root, state.latest);
       if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
       try {
-        await git(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
+        await git2(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
       } catch {
         throw new Error("Detached checkout moved to a different history; original repair evidence was retained. Inspect that baseline explicitly.");
       }
@@ -1968,7 +2588,7 @@ async function automate(dir, event) {
         branch: ws.branch,
         head: inputs.head,
         baselinePaths: [],
-        reportPath: ws.directory + "/checks/" + randomUUID3() + ".json",
+        reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
         findings: [],
         diagnostics: ["No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md exists. Documentation capture is unavailable; other Mason tools remain usable."],
         checks: { ran: [], reused: [], skipped: [] },
@@ -2033,7 +2653,7 @@ async function automate(dir, event) {
       branch: ws.branch,
       head: inputs.head,
       baselinePaths: state.baselines.map((b) => b.path),
-      reportPath: ws.directory + "/checks/" + randomUUID3() + ".json",
+      reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
       findings: [...merged.values()],
       diagnostics: [...new Set(diagnostics)],
       checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: current?.skippedChecks ?? [] },
@@ -2055,16 +2675,17 @@ async function automate(dir, event) {
     state.fingerprint = inputs.fingerprint;
     state.latest = report.reportPath;
     if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
-    await writeStoreJson(ws.root, ws.directory + "/cache.json", cache.serialize());
+    if (cache.ran.size || cached === null || cache.diagnostic) await writeStoreJson(ws.root, ws.directory + "/cache.json", cache.serialize());
     await writeStoreJson(ws.root, statePath, state);
     return { report, message: notify ? summarize(report) : null, continueOnce };
-  });
+  }));
 }
 async function automationStatus(dir) {
   const ws = await workspace(dir);
+  const execution = await executionStatus(ws.root, ws.directory);
   const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
-  if (raw === null) return { version: 1, status: "not-observed", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {} };
-  const state = stateSchema.parse(raw);
+  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution };
+  const state = parseState(raw);
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
   const inputs = await readInputs(ws.root);
   const latest = state.latest ? await readStoreJson(ws.root, state.latest) : null;
@@ -2074,38 +2695,174 @@ async function automationStatus(dir) {
     host.sessions++;
     host.observedEvents = [.../* @__PURE__ */ new Set([...host.observedEvents, ...Object.keys(session.events)])];
   }
+  const unfinished = ["failed", "unknown", "running"].includes(execution.status);
   return {
     version: 1,
-    status: inputs.fingerprint === state.fingerprint ? "current" : "changed",
+    status: unfinished ? "unavailable" : inputs.fingerprint === state.fingerprint ? "current" : "changed",
     root: ws.root,
     branch: ws.branch,
     baselinePaths: state.baselines.map((b) => b.path),
     reportPath: state.latest,
-    verificationStatus: latest?.status ?? "unavailable",
+    verificationStatus: unfinished ? "unavailable" : latest?.status ?? "unavailable",
     hosts,
+    execution,
     note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
   };
 }
+var SCOPE, priority, cleanText;
+var init_runtime = __esm({
+  "src/automation/runtime.ts"() {
+    "use strict";
+    init_execution();
+    init_repair();
+    init_types();
+    init_storage();
+    init_evidence();
+    init_store();
+    SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved claims no longer fail their checks; advisories need separate review. Repair only within the user's task authorization.";
+    priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
+    cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+  }
+});
 
-// src/automation/adapters.ts
-import { z as z6 } from "zod";
-var inputSchema = z6.object({
-  cwd: z6.string().min(1),
-  session_id: z6.string().min(1).max(500),
-  hook_event_name: z6.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
-  tool_name: z6.string().optional(),
-  tool_use_id: z6.string().max(500).optional(),
-  tool_input: z6.unknown().optional(),
-  stop_hook_active: z6.boolean().optional(),
-  permission_mode: z6.string().optional()
+// src/setup/model.ts
+import { z as z7 } from "zod";
+async function loadSetup(root) {
+  const raw = await readStoreJson(root, ".mason/setup.json");
+  if (raw === null) return null;
+  return setupSchema.parse(raw);
+}
+async function loadSetupReceipt(root, directory, host) {
+  const raw = await readStoreJson(root, directory + "/setup-" + host + ".json");
+  if (raw === null) return null;
+  const receipt = receiptSchema.parse(raw);
+  if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
+  return receipt;
+}
+var runtimeSchema, setupHostSchema, setupSchema, receiptSchema;
+var init_model = __esm({
+  "src/setup/model.ts"() {
+    "use strict";
+    init_storage();
+    runtimeSchema = z7.object({
+      id: z7.string().regex(/^[a-f0-9]{24}$/),
+      version: z7.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      hashes: z7.record(z7.string().regex(/^[a-f0-9]{64}$/))
+    });
+    setupHostSchema = z7.object({
+      runtime: runtimeSchema,
+      revision: z7.string().uuid(),
+      fingerprint: z7.string(),
+      mcpFingerprint: z7.string(),
+      instructions: z7.array(z7.string())
+    });
+    setupSchema = z7.object({ version: z7.literal(1), hosts: z7.object({
+      codex: setupHostSchema.optional(),
+      claude: setupHostSchema.optional()
+    }) });
+    receiptSchema = z7.object({
+      version: z7.literal(1),
+      host: z7.enum(["codex", "claude"]),
+      status: z7.enum(["installing", "configured"]),
+      initialReportPath: z7.string(),
+      initialBaselinePaths: z7.array(z7.string()),
+      root: z7.string(),
+      revision: z7.string().uuid(),
+      configuredAt: z7.string().optional()
+    });
+  }
 });
-var lifecycle = {
-  SessionStart: "session_start",
-  UserPromptSubmit: "turn_start",
-  PreToolUse: "before_tool",
-  PostToolUse: "after_tool",
-  Stop: "task_end"
-};
+
+// src/setup/observations.ts
+var observations_exports = {};
+__export(observations_exports, {
+  observationPath: () => observationPath,
+  observeActivation: () => observeActivation,
+  readObservation: () => readObservation
+});
+import fs13 from "fs/promises";
+import { z as z8 } from "zod";
+function observationPath(directory, host, revision) {
+  return `${directory}/activation/${host}-${revision}.json`;
+}
+async function readObservation(root, directory, host, revision) {
+  const raw = await readStoreJson(root, observationPath(directory, host, revision));
+  if (raw === null) return null;
+  const record = observationSchema.parse(raw);
+  if (record.root !== root || record.host !== host || record.revision !== revision) throw new Error("Activation receipt belongs to another installation.");
+  return record;
+}
+async function observeActivation(dir, event, options = {}) {
+  const host = process.env.MASON_SETUP_HOST, revision = process.env.MASON_SETUP_REVISION;
+  if (host !== "codex" && host !== "claude" || !revision || !process.env.MASON_SETUP_ROOT) return null;
+  try {
+    const capturedDirectory = options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
+    const ws = capturedDirectory ? { root: await fs13.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs13.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const setup = await loadSetup(ws.root);
+    if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
+    const directory = ws.directory + "/activation";
+    await withLock(ws.root, directory, async () => {
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const record = await readObservation(ws.root, ws.directory, host, revision) ?? {
+        version: 1,
+        root: ws.root,
+        revision,
+        host,
+        contextCalls: 0,
+        sessions: {}
+      };
+      if (event === "context") {
+        record.contextCalls++;
+        record.lastContextAt = now;
+      } else if (options.sessionId) {
+        const key = hash(options.sessionId);
+        const session = record.sessions[key] ?? { events: [], at: now };
+        if (event !== "task_end" && session.events.includes(event)) return;
+        session.events = [.../* @__PURE__ */ new Set([...session.events, event])];
+        session.at = now;
+        if (event === "task_end") {
+          session.verificationStatus = options.verificationStatus;
+          session.reportPath = options.reportPath;
+        }
+        record.sessions[key] = session;
+        const ordered = Object.entries(record.sessions).sort(([, a], [, b]) => b.at.localeCompare(a.at));
+        record.sessions = Object.fromEntries(ordered.slice(0, 32));
+      } else return;
+      await writeStoreJson(ws.root, observationPath(ws.directory, host, revision), record);
+    });
+    return null;
+  } catch (error) {
+    return "Mason activation observation could not be saved; activation coverage is unknown. " + (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, 300);
+  }
+}
+var observationSchema;
+var init_observations = __esm({
+  "src/setup/observations.ts"() {
+    "use strict";
+    init_evidence();
+    init_store();
+    init_storage();
+    init_model();
+    observationSchema = z8.object({
+      version: z8.literal(1),
+      root: z8.string(),
+      revision: z8.string(),
+      host: z8.enum(["codex", "claude"]),
+      contextCalls: z8.number().int().nonnegative(),
+      lastContextAt: z8.string().optional(),
+      sessions: z8.record(z8.object({
+        events: z8.array(z8.enum(events)),
+        at: z8.string(),
+        verificationStatus: z8.string().optional(),
+        reportPath: z8.string().optional()
+      }))
+    });
+  }
+});
+
+// src/automation/adapters.ts
+import { z as z9 } from "zod";
 function normalizeHook(host, raw) {
   hostSchema.parse(host);
   const input2 = inputSchema.parse(raw);
@@ -2126,17 +2883,23 @@ async function runAutomationHook(host, stdin) {
     const input2 = normalizeHook(host, JSON.parse(stdin));
     name = input2.name;
     const result = await automate(input2.cwd, input2.event);
+    const { observeActivation: observeActivation2 } = await Promise.resolve().then(() => (init_observations(), observations_exports));
+    const warning = await observeActivation2(result.report.root, input2.event.event, {
+      sessionId: input2.event.sessionId,
+      verificationStatus: result.report.status,
+      reportPath: result.report.reportPath
+    });
+    if (warning) result.message = [result.message, warning].filter(Boolean).join("\n");
     if (!result.message) return null;
     if (name === "Stop") {
       return result.continueOnce ? { decision: "block", reason: result.message } : { systemMessage: result.message };
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
-    const message = "Mason automation unavailable; evidence capture/verification was not established. " + (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
-    return { systemMessage: message, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message } } : {} };
+    const message2 = failureMessage(error);
+    return { systemMessage: message2, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {} };
   }
 }
-var HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
 function hookConfig(host, command = "npx --no-install --package mason-context mason-auto") {
   const handler = { type: "command", command: command + " hook --host " + host, timeout: 30 };
   return { hooks: Object.fromEntries(HOOK_EVENTS.map((name) => [
@@ -2144,20 +2907,51 @@ function hookConfig(host, command = "npx --no-install --package mason-context ma
     [{ ...["PreToolUse", "PostToolUse"].includes(name) ? { matcher: ".*" } : {}, hooks: [{ ...handler }] }]
   ])) };
 }
+var inputSchema, lifecycle, HOOK_EVENTS;
+var init_adapters = __esm({
+  "src/automation/adapters.ts"() {
+    "use strict";
+    init_execution();
+    init_runtime();
+    init_store();
+    inputSchema = z9.object({
+      cwd: z9.string().min(1),
+      session_id: z9.string().min(1).max(500),
+      hook_event_name: z9.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+      tool_name: z9.string().optional(),
+      tool_use_id: z9.string().max(500).optional(),
+      tool_input: z9.unknown().optional(),
+      stop_hook_active: z9.boolean().optional(),
+      permission_mode: z9.string().optional()
+    });
+    lifecycle = {
+      SessionStart: "session_start",
+      UserPromptSubmit: "turn_start",
+      PreToolUse: "before_tool",
+      PostToolUse: "after_tool",
+      Stop: "task_end"
+    };
+    HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
+  }
+});
 
 // src/automation/install.ts
-import { z as z7 } from "zod";
-var groupSchema = z7.object({ hooks: z7.array(z7.object({ type: z7.string(), command: z7.string().optional() }).passthrough()) }).passthrough();
-var configSchema = z7.object({ hooks: z7.record(z7.array(groupSchema)).optional() }).passthrough();
-var recordSchema = z7.object({ version: z7.literal(1), hosts: z7.record(z7.object({ command: z7.string() })) });
-var configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+var install_exports = {};
+__export(install_exports, {
+  automationConfigSchema: () => automationConfigSchema,
+  configPath: () => configPath,
+  installAutomation: () => installAutomation,
+  installedAutomation: () => installedAutomation,
+  planAutomationInstall: () => planAutomationInstall
+});
+import { z as z10 } from "zod";
 async function installAutomation(dir, host, command) {
   const ws = await workspace(dir);
   return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command));
 }
-async function installLocked(root, host, command) {
+async function planAutomationInstall(root, host, command) {
   const file = configPath(host);
-  const existing = configSchema.parse(await readStoreJson(root, file) ?? {});
+  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
   const record = recordSchema.parse(await readStoreJson(root, ".mason/automation.json") ?? { version: 1, hosts: {} });
   const desired = hookConfig(host, command);
   const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
@@ -2171,7 +2965,11 @@ async function installLocked(root, host, command) {
     hooks[event].push(...desired.hooks[event]);
   }
   record.hosts[host] = { command: newCommand };
-  await writeStoreJson(root, file, { ...existing, hooks });
+  return { file, config: { ...existing, hooks }, record, newCommand };
+}
+async function installLocked(root, host, command) {
+  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command);
+  await writeStoreJson(root, file, config);
   await writeStoreJson(root, ".mason/automation.json", record);
   return {
     version: 1,
@@ -2193,7 +2991,7 @@ async function installedAutomation(dir) {
   for (const host of ["claude", "codex"]) {
     const expected = record.hosts[host];
     if (!expected) continue;
-    const current = configSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
+    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
     const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
     result[host] = {
       configPath: configPath(host),
@@ -2204,10 +3002,1395 @@ async function installedAutomation(dir) {
   }
   return result;
 }
+var groupSchema, automationConfigSchema, recordSchema, configPath;
+var init_install = __esm({
+  "src/automation/install.ts"() {
+    "use strict";
+    init_storage();
+    init_evidence();
+    init_adapters();
+    init_store();
+    groupSchema = z10.object({ hooks: z10.array(z10.object({ type: z10.string(), command: z10.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z10.object({ hooks: z10.record(z10.array(groupSchema)).optional() }).passthrough();
+    recordSchema = z10.object({ version: z10.literal(1), hosts: z10.record(z10.object({ command: z10.string() })) });
+    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+  }
+});
+
+// src/mcp/init.ts
+import { z as z11 } from "zod";
+async function loadProjectMarker(rootDir) {
+  const raw = await readStoreJson(rootDir, ".mason/project.json");
+  return raw === null ? null : markerSchema.parse(raw);
+}
+async function saveProjectMarker(rootDir, marker) {
+  await writeStoreJson(rootDir, ".mason/project.json", markerSchema.parse(marker));
+}
+var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
+var init_init = __esm({
+  "src/mcp/init.ts"() {
+    "use strict";
+    init_storage();
+    markerSchema = z11.object({
+      version: z11.literal(1),
+      initializedAt: z11.string(),
+      features: z11.object({ confluence: z11.boolean().optional() }).optional()
+    }).passthrough();
+    CLAUDE_MD_SECTION = `<!-- mason:start -->
+## Mason project knowledge
+
+Mason provides recorded decisions and file impact over MCP. A concept map is optional.
+
+- Task, bug, or change request \u2192 \`get_context\` with the task text and known files: matching decisions, related tests, impact, and any available map entries.
+- Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
+- Learned something the code cannot explain (a failed approach, an incident's cause, a workaround's reason, a review-settled convention) \u2192 \`save_decision\` with rationale, anchors, and any known owner, sources, and recorder. It creates a proposal immediately without setup or a map. Never invent attribution or record code-derivable facts, session trivia, or secrets.
+- Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, and failed verification means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
+- Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
+- For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
+- \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
+
+- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+
+- When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
+
+Inspect source for what the retrieved context does not answer.
+<!-- mason:end -->`;
+    ASSISTANT_SETUP = `UNIFIED SETUP
+When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, install a pinned private runtime, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
+If the user only requested inspection or review, report findings without running setup. The setup result distinguishes configured from observed activation. Explain the host's native trust step and request a new session; never trust hooks on the user's behalf or claim activation from generated configuration alone. After a normal task finishes, mason_automation(action: "status") or mason-auto status reports observed context use and hook events. Existing findings remain reviewable; setup does not approve advisories or manufacture decisions.
+
+The managed project guidance is:
+${CLAUDE_MD_SECTION}`;
+    QUICKSTART_PLAYBOOK = `Start with the audit and review results included in this response. No concept map is required.
+
+1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
+2. Address findings within the user's requested scope. Setup alone authorizes the Mason runtime, host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
+3. When the task reveals a real lesson or constraint, call \`save_decision\` with title, body, category, anchors, and known owner/source/actor information. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
+
+${ASSISTANT_SETUP}
+
+OPTIONAL ARCHITECTURE MAP
+A full map adds feature and flow navigation. Build it only if the user requests it, by calling \`mason_init(dir, mode: "map")\`. Decision capture and task context do not depend on that build.`;
+    MAP_PLAYBOOK = `The user has requested a full architecture map. Follow this Map-Reduce workflow to cover the codebase. Report the audit and review findings included in this response before beginning.
+
+PHASE 1 \u2014 Map (loop until done)
+Goal: process every file in the codebase, batch by batch, producing a partial concept map per batch.
+
+  1. Call \`generate_snapshot_batch(dir)\` (omit offset on the first call).
+     The response includes:
+     - \`batchId\`: identifier for this batch
+     - \`offset\`, \`nextOffset\`, \`totalFiles\`: progress markers
+     - \`instructions\`: the system prompt for the batch step
+     - \`prompt\`: the files in this batch (skeletons + a few deeper bodies)
+  2. Following the \`instructions\`, derive features and flows that involve ONLY the files in this batch. Use product-natural feature names ("home screen", not "HomeScreenAndroid") so the reduce step can merge platform variants.
+  3. Call \`save_partial_snapshot(dir, batchId, offset, features, flows)\` to persist the partial.
+  4. If \`nextOffset\` is null, the Map phase is done. Otherwise call \`generate_snapshot_batch(dir, offset=nextOffset)\` and repeat from step 2.
+
+  Briefly tell the user "Batch N of M done" each iteration so they see progress.
+
+  CRITICAL RULES FOR PHASE 1:
+  - Derive features and file paths ONLY from what appears verbatim in the \`prompt\` field of each batch response. NEVER invent paths from memory, prior projects, or what you assume a project of this kind would contain. If you have not seen a path in a batch \`prompt\`, do not put it in \`features.files\` or \`flows.chain\`.
+  - Process batches SEQUENTIALLY: one \`generate_snapshot_batch\` \u2192 derive \u2192 one \`save_partial_snapshot\` \u2192 next \`generate_snapshot_batch\`. Do not parallelise. Do not call \`save_snapshot\` during this phase \u2014 that is a Phase 2 step.
+  - You must walk every batch until \`nextOffset\` is null. Do not stop early. Do not skip ahead to reduce until every batch has been saved as a partial.
+
+PHASE 2 \u2014 Reduce (once)
+Goal: merge all partial maps into one coherent product-shaped catalog.
+
+  1. Call \`reduce_snapshot(dir)\`. It returns every partial map plus reconciliation instructions.
+  2. Follow the instructions to produce a unified \`features\` and \`flows\` map. Specifically: merge platform variants ("home Android" + "home iOS" \u2192 "home screen"), dedupe near-duplicates, reconcile descriptions, and ensure every file from every partial appears somewhere in the final map.
+  3. Call \`save_snapshot(dir, features, flows)\` ONCE with the unified map. Mason detects that partials exist and replaces the snapshot wholesale (rather than merging with any earlier state) and then clears the partials. Do not call \`save_snapshot\` more than once per Map-Reduce run.
+
+${ASSISTANT_SETUP}
+
+If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`. Re-run \`mason_init(dir, mode: "map")\` to obtain this workflow again.`;
+  }
+});
+
+// src/review/cochange.ts
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+async function buildMatrix(resolvedRoot) {
+  try {
+    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    if (shallow.trim() === "true") return null;
+    const { stdout } = await exec8(
+      "git",
+      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
+      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
+    );
+    const commitsByFile = /* @__PURE__ */ new Map();
+    const blocks = stdout.split("
");
+    let index2 = 0;
+    for (const block of blocks) {
+      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
+      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
+      for (const file of files) {
+        let set = commitsByFile.get(file);
+        if (!set) {
+          set = /* @__PURE__ */ new Set();
+          commitsByFile.set(file, set);
+        }
+        set.add(index2);
+      }
+      index2++;
+    }
+    return { commitsByFile, totalCommits: index2 };
+  } catch {
+    return null;
+  }
+}
+async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, allChangedFiles = changedFiles) {
+  const matrix = await buildMatrix(resolvedRoot);
+  if (!matrix) return null;
+  const changedSet = new Set(allChangedFiles);
+  const findings = [];
+  for (const changedFile of changedFiles) {
+    const fileCommits = matrix.commitsByFile.get(changedFile);
+    if (!fileCommits || fileCommits.size < MIN_FILE_COMMITS) continue;
+    for (const [partner, partnerCommits] of matrix.commitsByFile) {
+      if (partner === changedFile || changedSet.has(partner)) continue;
+      let shared = 0;
+      for (const c of fileCommits) {
+        if (partnerCommits.has(c)) shared++;
+      }
+      if (shared < MIN_SHARED_COMMITS) continue;
+      const rate = shared / fileCommits.size;
+      if (rate < MIN_COCHANGE_RATE) continue;
+      if (!await existsOnDisk(partner)) continue;
+      findings.push({
+        changedFile,
+        missingPartner: partner,
+        sharedCommits: shared,
+        fileCommits: fileCommits.size,
+        rate: Math.round(rate * 100) / 100
+      });
+    }
+  }
+  findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
+  return findings;
+}
+var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var init_cochange = __esm({
+  "src/review/cochange.ts"() {
+    "use strict";
+    exec8 = promisify8(execFile8);
+    HISTORY_COMMITS = 1500;
+    MIN_FILE_COMMITS = 5;
+    MIN_SHARED_COMMITS = 4;
+    MIN_COCHANGE_RATE = 0.6;
+    MAX_COMMIT_FILES = 30;
+  }
+});
+
+// src/review/evidence/paths.ts
+function evidencePath(value, sourceRoot, uri = false) {
+  if (value.length > 4e3) return null;
+  let file = value;
+  try {
+    if (uri) {
+      if (file.startsWith("file:")) {
+        const url = new URL(file);
+        if (url.hostname && url.hostname !== "localhost") return null;
+        file = decodeURIComponent(url.pathname).replace(/^\/([A-Za-z]:\/)/, "$1");
+      } else {
+        if (/^[a-z][a-z0-9+.-]*:/i.test(file)) return null;
+        file = decodeURIComponent(file);
+      }
+    }
+  } catch {
+    return null;
+  }
+  file = file.replace(/\\/g, "/");
+  const root = sourceRoot.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (file.startsWith("/") || /^[A-Za-z]:/.test(file)) {
+    if (!file.startsWith(root + "/")) return null;
+    file = file.slice(root.length + 1);
+  }
+  return normalizeRepoPath(file);
+}
+var init_paths2 = __esm({
+  "src/review/evidence/paths.ts"() {
+    "use strict";
+    init_paths();
+  }
+});
+
+// src/review/evidence/types.ts
+function messagePreview(message2) {
+  return { message: message2.slice(0, 4e3), ...message2.length > 4e3 ? { truncated: true } : {} };
+}
+var MAX_FINDINGS;
+var init_types2 = __esm({
+  "src/review/evidence/types.ts"() {
+    "use strict";
+    MAX_FINDINGS = 200;
+  }
+});
+
+// src/review/evidence/vitest.ts
+import { z as z12 } from "zod";
+function parseVitest(raw, sourceRoot) {
+  const report = schema.parse(raw);
+  const findings = [], diagnostics = [];
+  let passed = 0, failed = 0, skipped = 0;
+  for (const [index2, suite] of report.testResults.entries()) {
+    const file = evidencePath(suite.name, sourceRoot);
+    if (!file) diagnostics.push(`Test path is outside the declared checkout or invalid: ${suite.name}`);
+    let suiteFailures = 0;
+    for (const [testIndex, test] of suite.assertionResults.entries()) {
+      if (test.status === "passed") passed++;
+      else if (test.status === "failed") {
+        failed++;
+        suiteFailures++;
+        findings.push({
+          id: `${index2}:${testIndex}`,
+          ...messagePreview([test.fullName, ...test.failureMessages ?? []].join("\n")),
+          severity: "error",
+          state: "active",
+          locations: file ? [{ file, ...test.location ? { line: test.location.line, column: test.location.column } : {} }] : []
+        });
+      } else skipped++;
+    }
+    if (suite.status === "failed" && !suiteFailures) {
+      findings.push({ id: `${index2}:suite`, ...messagePreview(suite.message || `Test suite failed: ${suite.name}`), severity: "error", state: "active", locations: file ? [{ file }] : [] });
+    }
+  }
+  if (passed !== report.numPassedTests || failed !== report.numFailedTests || skipped !== report.numPendingTests + report.numTodoTests || passed + failed + skipped !== report.numTotalTests) {
+    throw new Error("Vitest summary counts disagree with its assertion results");
+  }
+  const hasFailures = failed > 0 || report.numFailedTestSuites > 0 || report.testResults.some((s) => s.status === "failed");
+  if (report.success && hasFailures) throw new Error("Vitest success conflicts with failed tests or suites");
+  const outcome = hasFailures || !report.success ? "failed" : !report.numTotalTests ? "unavailable" : !passed ? "skipped" : "passed";
+  if (!report.numTotalTests) diagnostics.push("No tests executed; an empty report is not passing test evidence.");
+  if (skipped) diagnostics.push(`${skipped} tests were skipped, pending, disabled, or todo.`);
+  return {
+    outcome,
+    findings,
+    counts: { total: report.numTotalTests, passed, failed, skipped, failedSuites: report.numFailedTestSuites },
+    incomplete: skipped > 0 || diagnostics.length > 0,
+    diagnostics
+  };
+}
+var count2, schema;
+var init_vitest = __esm({
+  "src/review/evidence/vitest.ts"() {
+    "use strict";
+    init_paths2();
+    init_types2();
+    count2 = z12.number().int().nonnegative();
+    schema = z12.object({
+      success: z12.boolean(),
+      numTotalTests: count2,
+      numPassedTests: count2,
+      numFailedTests: count2,
+      numPendingTests: count2,
+      numTodoTests: count2,
+      numFailedTestSuites: count2,
+      testResults: z12.array(z12.object({
+        name: z12.string().min(1),
+        status: z12.enum(["passed", "failed"]),
+        message: z12.string().optional(),
+        assertionResults: z12.array(z12.object({
+          fullName: z12.string(),
+          status: z12.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z12.array(z12.string()).nullable().optional(),
+          location: z12.object({ line: count2, column: count2 }).nullable().optional()
+        }))
+      }))
+    });
+  }
+});
+
+// src/review/evidence/sarif.ts
+import { z as z13 } from "zod";
+function parseSarif(raw, sourceRoot) {
+  const report = schema2.parse(raw), findings = [], diagnostics = [];
+  let active = 0, suppressed = 0, absent = 0, unresolved = 0;
+  let executed = report.runs.length > 0, executionFailed = false;
+  const reportedCommits = [], reportedCommands = [], reportedTools = [];
+  for (const [runIndex, run] of report.runs.entries()) {
+    reportedTools.push(run.tool.driver.name);
+    reportedCommits.push(...(run.versionControlProvenance ?? []).flatMap((v) => v.revisionId ? [v.revisionId] : []));
+    if (!run.invocations?.length) executed = false;
+    for (const invocation of run.invocations ?? []) {
+      if (invocation.commandLine) reportedCommands.push(invocation.commandLine);
+      if (!invocation.executionSuccessful) executionFailed = true;
+      for (const notification of invocation.toolExecutionNotifications ?? []) {
+        diagnostics.push(notification.message.text ?? notification.message.markdown ?? "SARIF tool execution notification");
+        if (notification.level === "error") executionFailed = true;
+      }
+    }
+    if (!run.results) {
+      diagnostics.push(`Run ${runIndex} omits results; analysis output is unavailable.`);
+      executed = false;
+    }
+    const resolve = (ref, seen = /* @__PURE__ */ new Set()) => {
+      if (!ref.uri && ref.index !== void 0) {
+        const key = `artifact:${ref.index}`;
+        if (seen.has(key)) return null;
+        const entry = run.artifacts?.[ref.index]?.location;
+        return entry ? resolve(entry, /* @__PURE__ */ new Set([...seen, key])) : null;
+      }
+      if (!ref.uri) return null;
+      if (!ref.uriBaseId) return ref.uri;
+      if (seen.has(ref.uriBaseId)) return null;
+      const base = run.originalUriBaseIds?.[ref.uriBaseId];
+      if (!base) return null;
+      const prefix = resolve(base, /* @__PURE__ */ new Set([...seen, ref.uriBaseId]));
+      if (!prefix) return null;
+      return /^[a-z][a-z0-9+.-]*:/i.test(ref.uri) ? ref.uri : prefix + ref.uri;
+    };
+    for (const [resultIndex, result] of (run.results ?? []).entries()) {
+      const kind = result.kind ?? "fail";
+      const isSuppressed = result.suppressions?.some((s) => s.status === "accepted");
+      if (result.suppressions?.some((s) => !s.status || s.status === "underReview")) {
+        diagnostics.push(`Suppression state unresolved for result ${runIndex}:${resultIndex}.`);
+        unresolved++;
+      }
+      const state = result.baselineState === "absent" ? "absent" : isSuppressed ? "suppressed" : kind === "fail" ? "active" : "informational";
+      if (state === "active") active++;
+      if (state === "absent") absent++;
+      if (state === "suppressed") suppressed++;
+      if (["open", "review"].includes(kind) && state === "informational") {
+        unresolved++;
+        diagnostics.push(`Result ${runIndex}:${resultIndex} needs further analysis or review.`);
+      }
+      if (kind === "pass" || kind === "notApplicable") continue;
+      const rule = result.ruleIndex !== void 0 ? run.tool.driver.rules?.[result.ruleIndex] : run.tool.driver.rules?.find((rule2) => rule2.id === result.ruleId);
+      const template = result.message.id ? rule?.messageStrings?.[result.message.id] ?? run.tool.driver.globalMessageStrings?.[result.message.id] : void 0;
+      const rawMessage = result.message.text ?? result.message.markdown ?? template?.text ?? template?.markdown;
+      if (!rawMessage) diagnostics.push(`Message cannot be resolved for result ${runIndex}:${resultIndex}.`);
+      const rendered = (rawMessage ?? `Unresolved SARIF message ${result.message.id ?? ""}`).replace(/\{(\d+)\}/g, (match, n) => result.message.arguments?.[Number(n)] ?? match);
+      const locations = [];
+      for (const entry of [...result.locations ?? [], ...result.relatedLocations ?? []]) {
+        const ref = entry.physicalLocation?.artifactLocation;
+        const uri = ref ? resolve(ref) : null;
+        const file = uri ? evidencePath(uri, sourceRoot, true) : null;
+        if (file) locations.push({ file, line: entry.physicalLocation?.region?.startLine, column: entry.physicalLocation?.region?.startColumn });
+        else diagnostics.push(`Unresolved or out-of-checkout location for result ${runIndex}:${resultIndex}.`);
+      }
+      const severity = result.level ?? rule?.defaultConfiguration?.level ?? (kind === "fail" ? "warning" : "none");
+      findings.push({ id: `${runIndex}:${resultIndex}`, ruleId: result.ruleId ?? rule?.id, ...messagePreview(rendered), severity: severity === "none" ? "note" : severity, state, locations });
+    }
+  }
+  if (!report.runs.length) diagnostics.push("SARIF contains no analysis runs.");
+  if (executionFailed) diagnostics.push("The SARIF tool reported an unsuccessful analysis invocation.");
+  return {
+    outcome: executionFailed || !report.runs.length || report.runs.some((r) => !r.results) ? "unavailable" : active ? "failed" : "passed",
+    findings,
+    counts: { active, suppressed, absent, unresolved },
+    incomplete: diagnostics.length > 0,
+    diagnostics,
+    reportedCommits,
+    reportedCommands,
+    reportedTools,
+    executed: executed && !executionFailed
+  };
+}
+var index, artifact, message, level, location, schema2;
+var init_sarif = __esm({
+  "src/review/evidence/sarif.ts"() {
+    "use strict";
+    init_paths2();
+    init_types2();
+    index = z13.number().int().nonnegative();
+    artifact = z13.object({ uri: z13.string().optional(), uriBaseId: z13.string().optional(), index: index.optional() });
+    message = z13.object({ text: z13.string().optional(), markdown: z13.string().optional(), id: z13.string().optional(), arguments: z13.array(z13.string()).optional() });
+    level = z13.enum(["error", "warning", "note", "none"]);
+    location = z13.object({ physicalLocation: z13.object({ artifactLocation: artifact.optional(), region: z13.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z13.object({
+      version: z13.literal("2.1.0"),
+      runs: z13.array(z13.object({
+        tool: z13.object({ driver: z13.object({ name: z13.string().min(1), rules: z13.array(z13.object({ id: z13.string(), defaultConfiguration: z13.object({ level: level.optional() }).optional(), messageStrings: z13.record(message).optional() })).optional(), globalMessageStrings: z13.record(message).optional() }) }),
+        invocations: z13.array(z13.object({ executionSuccessful: z13.boolean(), commandLine: z13.string().optional(), toolExecutionNotifications: z13.array(z13.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z13.array(z13.object({ revisionId: z13.string().optional() })).optional(),
+        originalUriBaseIds: z13.record(artifact).optional(),
+        artifacts: z13.array(z13.object({ location: artifact.optional() })).optional(),
+        results: z13.array(z13.object({
+          ruleId: z13.string().optional(),
+          ruleIndex: index.optional(),
+          message,
+          level: level.optional(),
+          kind: z13.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z13.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z13.array(z13.object({ kind: z13.enum(["inSource", "external"]), status: z13.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z13.array(location).optional(),
+          relatedLocations: z13.array(location).optional()
+        })).optional()
+      }))
+    });
+  }
+});
+
+// src/review/evidence.ts
+import path18 from "path";
+import { z as z14 } from "zod";
+function relativeArtifact(root, file) {
+  const relative = path18.isAbsolute(file) ? path18.relative(root, file) : file;
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
+  return normalized;
+}
+function linkFinding(finding, changed, pairs, decisions, freshness) {
+  const located = [...new Set(finding.locations.map((l) => l.file))];
+  const paired = pairs.filter((pair) => located.includes(pair.test));
+  const relatedChangedFiles = located.filter((file) => changed.has(file)).map((file) => ({ file, relationship: "direct" }));
+  for (const pair of paired) {
+    if (changed.has(pair.source) && !relatedChangedFiles.some((f) => f.file === pair.source)) relatedChangedFiles.push({ file: pair.source, relationship: "paired-test", confidence: pair.confidence });
+  }
+  const allFiles = [.../* @__PURE__ */ new Set([...located, ...paired.map((pair) => pair.source)])];
+  const acceptedDecisions = decisions.map(effectiveDecision).filter((d) => d.status === "active" && decisionApproval(d) === "accepted").map((d) => ({ d, viaFiles: matchingPaths(d.files, allFiles) })).filter((match) => match.viaFiles.length).map(({ d, viaFiles }) => {
+    const state = freshness[d.id] ?? "unknown", provenance = decisionProvenance(d, state);
+    return { id: d.id, title: d.title, owner: provenance.owner, freshness: state, reviewRequired: provenance.reviewRequired, viaFiles };
+  });
+  return { ...finding, relatedChangedFiles, acceptedDecisions: acceptedDecisions.slice(0, 5), totalAcceptedDecisions: acceptedDecisions.length };
+}
+async function collectReviewEvidence(root, manifests, changedFiles, decisions, decisionFreshness = {}, reviewedHead) {
+  const [headHash, workingTree] = await Promise.all([reviewedHead ?? getCurrentGitHash(root), getWorkingTree(root)]);
+  const output = {
+    version: 1,
+    scope: "committed",
+    headHash,
+    status: "unavailable",
+    checks: [],
+    diagnostics: [],
+    workingTree,
+    summary: { passed: 0, failed: 0, skipped: 0, unavailable: 0, stale: 0, unknown: 0 },
+    hint: "Evidence describes the recorded check runs for a commit, not uncommitted edits or complete test coverage. Commands and CI provenance are imported assertions, not authenticated execution. File and test-pair associations identify relevant decisions; they do not prove a decision was violated. Missing checks must be declared in the manifest to be reported."
+  };
+  const seen = /* @__PURE__ */ new Set(), changed = new Set(changedFiles);
+  let pairs;
+  if (manifests.length > 10) output.diagnostics.push("Only the first 10 evidence manifests were imported.");
+  for (const supplied of manifests.slice(0, 10)) {
+    let manifest, raw;
+    try {
+      manifest = relativeArtifact(root, supplied);
+      raw = z14.object({ version: z14.literal(1), checks: z14.array(z14.unknown()) }).parse(await readStoreJson(root, manifest));
+    } catch (error) {
+      output.diagnostics.push(`${supplied}: ${String(error)}`);
+      continue;
+    }
+    if (!raw.checks.length) output.diagnostics.push(`${manifest}: no checks declared.`);
+    for (const [index2, item] of raw.checks.entries()) {
+      if (output.checks.length >= 50) {
+        output.diagnostics.push("Only the first 50 checks were imported.");
+        break;
+      }
+      const input2 = checkSchema2.safeParse(item);
+      if (!input2.success) {
+        output.diagnostics.push(`${manifest} check ${index2}: ${input2.error.message}`);
+        continue;
+      }
+      const check = input2.data;
+      if (seen.has(check.id)) {
+        output.diagnostics.push(`Duplicate check id ${check.id}; give different runs distinct ids.`);
+        continue;
+      }
+      seen.add(check.id);
+      const result = {
+        id: check.id,
+        kind: check.kind,
+        tool: check.tool,
+        command: check.command,
+        commit: check.commit?.toLowerCase() ?? null,
+        workingTreeClean: check.workingTreeClean ?? null,
+        source: check.source ?? null,
+        manifest,
+        report: check.report ?? null,
+        outcome: "unavailable",
+        freshness: "unknown",
+        findings: [],
+        totalFindings: 0,
+        counts: {},
+        incomplete: false,
+        diagnostics: [],
+        truncated: false
+      };
+      output.checks.push(result);
+      if (check.workingTreeClean !== true) result.diagnostics.push("The check's working tree was dirty or not recorded; its results cannot be attributed to the claimed commit alone.");
+      else if (result.commit && headHash !== "unknown") result.freshness = result.commit === headHash.toLowerCase() ? "current" : "stale";
+      else result.diagnostics.push("The tested commit or reviewed HEAD is unknown.");
+      if (check.status !== "completed") {
+        result.outcome = check.status;
+        result.diagnostics.push(check.reason ?? "No reason was recorded for this skipped or unavailable check.");
+        continue;
+      }
+      try {
+        if (!check.report) throw new Error("Completed check has no report artifact.");
+        if (check.kind === "tests" !== (check.report.format === "vitest-json")) throw new Error("Test checks require vitest-json; analysis checks require sarif.");
+        const file = relativeArtifact(root, check.report.path);
+        const report = await readStoreJson(root, file);
+        if (report === null) throw new Error(`Report artifact is missing: ${file}`);
+        const sourceRoot = check.sourceRoot ?? root;
+        if (!path18.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
+        result.outcome = parsed.outcome;
+        result.counts = parsed.counts;
+        result.incomplete = parsed.incomplete;
+        result.diagnostics.push(...parsed.diagnostics);
+        result.reportedCommands = parsed.reportedCommands;
+        result.reportedTools = parsed.reportedTools;
+        if (parsed.reportedCommits?.some((commit) => !result.commit || commit.toLowerCase() !== result.commit)) {
+          result.freshness = "unknown";
+          result.incomplete = true;
+          result.diagnostics.push("Report revision metadata conflicts with, or cannot be tied to, the manifest's tested commit.");
+        }
+        if (check.exitCode == null && !parsed.executed) {
+          result.incomplete = true;
+          result.diagnostics.push("Neither an exit code nor successful analysis invocation was recorded; completion cannot be confirmed.");
+        }
+        if (check.exitCode != null && check.exitCode !== 0 && result.outcome === "passed") {
+          result.outcome = "failed";
+          result.diagnostics.push(`Check command exited ${check.exitCode} despite a report with no active failures.`);
+        }
+        if (check.report.format === "vitest-json" && pairs === void 0) {
+          try {
+            pairs = (await buildTestMap(root)).paired;
+          } catch (error) {
+            pairs = [];
+            output.diagnostics.push(`Test pairing unavailable: ${String(error)}`);
+          }
+        }
+        result.totalFindings = parsed.findings.length;
+        const testPairs = check.kind === "tests" ? pairs ?? [] : [];
+        const relevant = /* @__PURE__ */ new Set([...changed, ...testPairs.filter((p) => changed.has(p.source)).map((p) => p.test)]);
+        const touchesChange = (f) => f.locations.some((l) => relevant.has(l.file));
+        parsed.findings.sort((a, b) => Number(b.state === "active") - Number(a.state === "active") || Number(touchesChange(b)) - Number(touchesChange(a)));
+        result.findings = parsed.findings.slice(0, MAX_FINDINGS).map((f) => linkFinding(f, changed, testPairs, decisions, decisionFreshness));
+        result.truncated = parsed.findings.length > MAX_FINDINGS || result.findings.some((f) => f.truncated || f.totalAcceptedDecisions > f.acceptedDecisions.length);
+      } catch (error) {
+        result.outcome = "unavailable";
+        result.incomplete = true;
+        result.diagnostics.push(String(error));
+      }
+    }
+  }
+  if (!output.checks.length) output.diagnostics.push("No readable checks were imported.");
+  for (const check of output.checks) {
+    output.summary[check.outcome]++;
+    if (check.freshness !== "current") output.summary[check.freshness]++;
+  }
+  if (output.checks.some((c) => c.outcome === "failed" && c.freshness === "current")) output.status = "failed";
+  else if (!output.checks.length || output.checks.every((c) => c.outcome === "unavailable")) output.status = "unavailable";
+  else if (output.diagnostics.length || output.checks.some((c) => c.outcome !== "passed" || c.freshness !== "current" || c.incomplete)) output.status = "incomplete";
+  else output.status = "passed";
+  return output;
+}
+function summarizeEvidence(evidence) {
+  const previews = (values, limit) => values.slice(0, limit).map((value) => value.slice(0, 2e3));
+  const checks = evidence.checks.slice(0, 10).map((check) => {
+    const findings = check.findings.slice(0, 5).map((finding) => ({
+      ...finding,
+      ruleId: finding.ruleId?.slice(0, 200),
+      locations: finding.locations.slice(0, 5),
+      totalLocations: finding.locations.length,
+      relatedChangedFiles: finding.relatedChangedFiles.slice(0, 5),
+      totalRelatedChangedFiles: finding.relatedChangedFiles.length,
+      acceptedDecisions: finding.acceptedDecisions.map((decision) => ({ ...decision, viaFiles: decision.viaFiles.slice(0, 5) })),
+      truncated: finding.truncated || finding.locations.length > 5 || finding.relatedChangedFiles.length > 5 || (finding.ruleId?.length ?? 0) > 200 || finding.acceptedDecisions.some((d) => d.viaFiles.length > 5)
+    }));
+    return {
+      ...check,
+      findings,
+      reportedCommands: check.reportedCommands ? previews(check.reportedCommands, 5) : void 0,
+      reportedTools: check.reportedTools ? previews(check.reportedTools, 5) : void 0,
+      diagnostics: previews(check.diagnostics, 10),
+      truncated: check.truncated || check.findings.length > 5 || findings.some((f) => f.truncated) || check.diagnostics.length > 10 || check.diagnostics.some((d) => d.length > 2e3) || [check.reportedCommands ?? [], check.reportedTools ?? []].some((values) => values.length > 5 || values.some((v) => v.length > 2e3))
+    };
+  });
+  return {
+    ...evidence,
+    checks,
+    diagnostics: previews(evidence.diagnostics, 20),
+    truncated: evidence.checks.length > 10 || evidence.diagnostics.length > 20 || evidence.diagnostics.some((d) => d.length > 2e3) || checks.some((c) => c.truncated)
+  };
+}
+var checkSchema2;
+var init_evidence2 = __esm({
+  "src/review/evidence.ts"() {
+    "use strict";
+    init_storage();
+    init_paths();
+    init_snapshot();
+    init_drift();
+    init_test_map();
+    init_provenance();
+    init_vitest();
+    init_sarif();
+    init_types2();
+    checkSchema2 = z14.object({
+      id: z14.string().min(1).max(100),
+      kind: z14.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+      tool: z14.string().min(1).max(200),
+      command: z14.string().min(1).max(2e3),
+      commit: z14.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z14.boolean().optional(),
+      source: z14.string().max(2e3).optional(),
+      sourceRoot: z14.string().min(1).max(4e3).optional(),
+      status: z14.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z14.string().min(1).max(2e3).optional(),
+      exitCode: z14.number().int().nullable().optional(),
+      report: z14.object({ format: z14.enum(["vitest-json", "sarif"]), path: z14.string().min(1).max(4e3) }).optional()
+    });
+  }
+});
+
+// src/review/review.ts
+import fs14 from "fs/promises";
+import path19 from "path";
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+async function resolveMergeBase(resolvedRoot, base, head) {
+  try {
+    const { stdout } = await exec9("git", ["merge-base", base, head], {
+      cwd: resolvedRoot
+    });
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function defaultBase(resolvedRoot) {
+  for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
+    try {
+      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+        cwd: resolvedRoot
+      });
+      return ref;
+    } catch {
+    }
+  }
+  return null;
+}
+function anchorsTouched(record, changedFiles) {
+  return matchingPaths(record.files, changedFiles);
+}
+async function computeReview(rootDir, base, options = {}) {
+  const resolvedRoot = path19.resolve(rootDir);
+  const head = await getCurrentGitHash(resolvedRoot);
+  if (head === "unknown") return null;
+  const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
+  if (!mergeBase) return null;
+  const changes = await getChangesWithStatus(resolvedRoot, mergeBase, head);
+  if (changes === null) return null;
+  const changedFiles = touchedPaths(changes);
+  const report = {
+    version: 1,
+    root: resolvedRoot,
+    base,
+    mergeBase,
+    changedFiles,
+    missingPartners: [],
+    touchedDecisions: [],
+    historyAvailable: true,
+    truncated: false
+  };
+  const store = await loadDecisionStore(resolvedRoot);
+  report.diagnostics = store.diagnostics;
+  const decisionDrift = await computeDecisionDrift(resolvedRoot, store.records);
+  if (options.evidence !== void 0) {
+    report.evidence = await collectReviewEvidence(resolvedRoot, options.evidence, changedFiles, store.records, decisionDrift.freshness, head);
+    if (store.diagnostics.length) {
+      report.evidence.diagnostics.push("Invalid decision records make knowledge associations incomplete; consult review diagnostics.");
+      if (report.evidence.status === "passed") report.evidence.status = "incomplete";
+    }
+  }
+  const finalize = async () => {
+    if (report.evidence && await getCurrentGitHash(resolvedRoot) !== head) {
+      report.evidence.diagnostics.push("HEAD changed during the review; rerun to obtain consistent change and knowledge associations.");
+      for (const check of report.evidence.checks) check.freshness = "unknown";
+      report.evidence.summary.stale = 0;
+      report.evidence.summary.unknown = report.evidence.checks.length;
+      if (report.evidence.status !== "unavailable") report.evidence.status = "incomplete";
+    }
+    return report;
+  };
+  if (changedFiles.length === 0) return finalize();
+  let analyzed = changedFiles;
+  if (changedFiles.length > MAX_ANALYZED_FILES) {
+    analyzed = changedFiles.slice(0, MAX_ANALYZED_FILES);
+    report.truncated = true;
+  }
+  const partners = await findMissingPartners(
+    resolvedRoot,
+    analyzed,
+    async (relPath) => {
+      try {
+        await fs14.access(path19.join(resolvedRoot, relPath));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    changedFiles
+  );
+  if (partners === null) {
+    report.historyAvailable = false;
+  } else {
+    report.missingPartners = partners;
+  }
+  const decisions = store.records;
+  for (const record of decisions) {
+    if (record.status !== "active") continue;
+    const effective = effectiveDecision(record);
+    const touched = anchorsTouched(effective, changedFiles);
+    const proposalTouched = effective !== record ? anchorsTouched(record, changedFiles) : [];
+    if (touched.length > 0 || proposalTouched.length > 0) {
+      const { pendingProposal, ...knowledge } = decisionKnowledge(record, decisionDrift.freshness?.[record.id] ?? "unknown", decisionDrift.pendingProposals?.[record.id]?.freshness ?? "unknown");
+      report.touchedDecisions.push({
+        ...knowledge,
+        ...pendingProposal ? { pendingProposal: { ...pendingProposal, touchedFiles: proposalTouched } } : {},
+        id: record.id,
+        anchors: effective.files,
+        freshness: decisionDrift.freshness?.[record.id] ?? "unknown",
+        touchedFiles: touched
+      });
+    }
+  }
+  return finalize();
+}
+var exec9, MAX_ANALYZED_FILES;
+var init_review = __esm({
+  "src/review/review.ts"() {
+    "use strict";
+    init_drift();
+    init_provenance();
+    init_decisions();
+    init_paths();
+    init_drift2();
+    init_cochange();
+    init_evidence2();
+    init_snapshot();
+    exec9 = promisify9(execFile9);
+    MAX_ANALYZED_FILES = 50;
+  }
+});
+
+// src/mcp/onboarding.ts
+async function auditSummary(root) {
+  try {
+    const report = await computeAudit(root);
+    if (!report) return { status: "no-context-files", reason: "No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md found to audit." };
+    if (!report.gitAvailable) return { status: "unavailable", reason: "Audit needs readable Git history to verify documentation claims.", docs: report.docs };
+    return {
+      ...report,
+      status: "complete",
+      issues: report.issues.slice(0, MAX_FINDINGS2),
+      advisories: report.advisories.slice(0, MAX_FINDINGS2),
+      suppressedAdvisories: (report.suppressedAdvisories ?? []).slice(0, MAX_FINDINGS2),
+      counts: {
+        issues: report.issues.length,
+        advisories: report.advisories.length,
+        suppressedAdvisories: report.suppressedAdvisories?.length ?? 0
+      },
+      truncated: report.issues.length > MAX_FINDINGS2 || report.advisories.length > MAX_FINDINGS2 || (report.suppressedAdvisories?.length ?? 0) > MAX_FINDINGS2
+    };
+  } catch (error) {
+    return { status: "unavailable", reason: reason(error) };
+  }
+}
+async function reviewSummary(root, requestedBase, evidence) {
+  const workingTree = await getWorkingTree(root);
+  const scope = "committed";
+  try {
+    const base = requestedBase ?? await defaultBase(root);
+    if (!base) return { status: "unavailable", scope, workingTree, reason: "No default review base resolves. Pass base to mason_init, or run mason-review --base <ref>." };
+    const report = await computeReview(root, base, { evidence });
+    if (!report) return { status: "unavailable", scope, base, workingTree, reason: "The review base, merge base, or committed diff could not be read." };
+    return {
+      ...report,
+      scope,
+      workingTree,
+      ...report.evidence ? { evidence: summarizeEvidence(report.evidence) } : {},
+      status: !report.historyAvailable ? "unavailable" : report.changedFiles.length ? "complete" : "no-changes",
+      ...!report.historyAvailable ? { reason: "Co-change history could not be read; review findings are incomplete." } : {},
+      changedFiles: report.changedFiles.slice(0, MAX_FINDINGS2),
+      missingPartners: report.missingPartners.slice(0, MAX_FINDINGS2),
+      touchedDecisions: report.touchedDecisions.slice(0, MAX_FINDINGS2),
+      counts: { changedFiles: report.changedFiles.length, missingPartners: report.missingPartners.length, touchedDecisions: report.touchedDecisions.length },
+      truncated: report.truncated || [report.changedFiles, report.missingPartners, report.touchedDecisions].some((list) => list.length > MAX_FINDINGS2),
+      hint: "Reviews cover merge-base..HEAD. Uncommitted paths are reported separately in workingTree; they have not been reviewed."
+    };
+  } catch (error) {
+    return { status: "unavailable", scope, workingTree, reason: reason(error) };
+  }
+}
+async function inspectOnboarding(root, base, evidence) {
+  const [audit, review, map, decisions] = await Promise.all([
+    auditSummary(root),
+    reviewSummary(root, base, evidence),
+    inspectSnapshot(root),
+    loadDecisionStore(root)
+  ]);
+  return {
+    audit,
+    review,
+    map: { status: map.status },
+    decisions: {
+      active: decisions.records.filter((record) => record.status === "active").length,
+      ...Object.fromEntries(["accepted", "proposed", "unreviewed"].map((approval) => [approval, decisions.records.filter((record) => record.status === "active" && decisionApproval(effectiveDecision(record)) === approval).length])),
+      pendingProposals: decisions.records.filter((record) => effectiveDecision(record) !== record).length
+    },
+    diagnostics: [...map.diagnostics, ...decisions.diagnostics]
+  };
+}
+var MAX_FINDINGS2, reason;
+var init_onboarding = __esm({
+  "src/mcp/onboarding.ts"() {
+    "use strict";
+    init_audit();
+    init_review();
+    init_drift();
+    init_snapshot();
+    init_provenance();
+    init_evidence2();
+    init_decisions();
+    MAX_FINDINGS2 = 20;
+    reason = (error) => error instanceof Error ? error.message : String(error);
+  }
+});
+
+// src/setup/files.ts
+import fs15 from "fs/promises";
+import path20 from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+async function readText(root, file) {
+  try {
+    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
+    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
+    return text2;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function managedBlock(text2, start, end, body) {
+  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
+  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
+    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
+  }
+  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
+  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
+  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
+  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
+}
+async function applyEdit(root, edit) {
+  const current = await readText(root, edit.path);
+  if (current === edit.after) return false;
+  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
+  const file = await storePath(root, edit.path, true);
+  const temporary = path20.join(path20.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  try {
+    const mode = await fs15.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs15.open(temporary, "wx", mode);
+    try {
+      await handle.writeFile(edit.after, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
+    await fs15.rename(temporary, file);
+    return true;
+  } finally {
+    await fs15.rm(temporary, { force: true });
+  }
+}
+var init_files2 = __esm({
+  "src/setup/files.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+  }
+});
+
+// src/setup/launcher.ts
+var BOOTSTRAP, mcpCommand, hookCommand, LAUNCHER;
+var init_launcher = __esm({
+  "src/setup/launcher.ts"() {
+    "use strict";
+    BOOTSTRAP = "require(require('node:path').join(require('node:child_process').execFileSync('git',['rev-parse','--show-toplevel'],{encoding:'utf8'}).trim(),'.mason','run.cjs'))";
+    mcpCommand = (host) => ({ command: "node", args: ["-e", BOOTSTRAP, "--", host, "mcp"] });
+    hookCommand = (host) => `node -e "${BOOTSTRAP}" -- ${host} auto`;
+    LAUNCHER = `// Managed by mason-auto setup. Rerun setup to install this checkout's pinned runtime.
+const fs = require('node:fs');
+const path = require('node:path');
+const {pathToFileURL} = require('node:url');
+const launchArgs = process.argv.slice(1);
+(async () => {
+  const root = path.dirname(__dirname);
+  const args = launchArgs;
+  const [host, command, ...rest] = args;
+  if (!['codex','claude'].includes(host) || !['auto','mcp'].includes(command)) throw new Error('Invalid Mason launcher arguments.');
+  const setup = JSON.parse(fs.readFileSync(path.join(__dirname, 'setup.json'), 'utf8'));
+  const entry = setup.hosts?.[host];
+  if (setup.version !== 1 || !entry || !/^[a-f0-9]{24}$/.test(entry.runtime?.id)) throw new Error('Mason is not configured for this host. Rerun mason-auto setup.');
+  const binary = path.join(__dirname, 'runtime', entry.runtime.id, 'node_modules', 'mason-context', 'dist', 'mason-' + command + '.js');
+  if (!fs.existsSync(binary)) throw new Error('The pinned Mason runtime is missing in this checkout. Rerun mason-auto setup --host ' + host + '.');
+  process.env.MASON_SETUP_ROOT = root;
+  process.env.MASON_SETUP_HOST = host;
+  process.env.MASON_SETUP_REVISION = entry.revision;
+  process.argv = [process.execPath, binary, ...rest];
+  await import(pathToFileURL(binary).href);
+})().catch(error => {
+  const message = 'Mason setup unavailable: ' + error.message;
+  if (launchArgs[1] === 'auto' && launchArgs[2] === 'hook') { console.log(JSON.stringify({systemMessage: message})); process.exitCode = 0; }
+  else { console.error(message); process.exitCode = 2; }
+});
+`;
+  }
+});
+
+// src/setup/config.ts
+import { isDeepStrictEqual } from "util";
+import { parse, stringify } from "smol-toml";
+import { z as z15 } from "zod";
+async function instructionEdits(root, host) {
+  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
+  const existing = found.find((f) => f.text !== null);
+  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
+  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
+  const edits = [{
+    path: primary.path,
+    before: primary.text,
+    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
+  }];
+  if (primary.path === "AGENTS.md") {
+    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
+    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
+    for (const file of secondary) {
+      const text2 = file.text ?? "";
+      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
+      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
+      if (text2.trim() === imported) continue;
+      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
+      edits.push({
+        path: file.path,
+        before: file.text,
+        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
+      });
+    }
+  }
+  return edits;
+}
+function managedMcp(previous, host) {
+  const options = previous === void 0 ? {} : object.parse(previous);
+  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
+  return { ...options, ...mcpCommand(host) };
+}
+async function mcpEdit(root, host) {
+  const file = mcpPath(host), before = await readText(root, file);
+  if (host === "claude") {
+    const config2 = before === null ? {} : object.parse(JSON.parse(before));
+    const servers2 = object.parse(config2.mcpServers ?? {});
+    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host) } }, null, 2) + "\n" };
+  }
+  const config = parse(before ?? "");
+  const managed = (before ?? "").includes(TOML_START);
+  const servers = config.mcp_servers;
+  const desired = managedMcp(servers?.mason, host);
+  let base = before ?? "";
+  if (servers?.mason && !managed) {
+    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
+    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
+    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
+    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
+  }
+  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
+  const parsed = parse(after);
+  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
+  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
+  return { path: file, before, after };
+}
+async function hookEdits(root, host) {
+  const file = configPath(host), before = await readText(root, file);
+  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+  const plan = await planAutomationInstall2(root, host, hookCommand(host));
+  return [
+    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
+    { path: ".mason/automation.json", before: await readText(root, ".mason/automation.json"), after: JSON.stringify(plan.record, null, 2) + "\n" }
+  ];
+}
+async function ancillaryEdits(root) {
+  const ignore = await readText(root, ".gitignore");
+  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+  let parentIgnored = false;
+  try {
+    parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
+  } catch (error) {
+    if (error.code !== 1) throw error;
+  }
+  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
+  const rules = [...retainParentRule ? ["!/.mason/", "/.mason/*"] : [], "!/.mason/decisions/", "!/.mason/decisions/**", "!/.mason/setup.json", "!/.mason/automation.json", "!/.mason/project.json", "!/.mason/run.cjs", "/.mason/reports/", "/.mason/runtime/"].join("\n");
+  return [
+    { path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) },
+    { path: ".mason/run.cjs", before: await readText(root, ".mason/run.cjs"), after: LAUNCHER }
+  ];
+}
+async function inspectHostConfig(root, host, plannedMcp) {
+  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
+  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
+  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
+  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
+  const expected = hookConfig(host, hookCommand(host));
+  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
+  return {
+    mcp,
+    mcpDisabled: mcp?.enabled === false,
+    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
+      event,
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+    ])),
+    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
+  };
+}
+var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
+var init_config = __esm({
+  "src/setup/config.ts"() {
+    "use strict";
+    init_init();
+    init_docs();
+    init_adapters();
+    init_install();
+    init_files2();
+    init_launcher();
+    object = z15.record(z15.unknown());
+    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
+    TOML_START = "# mason:mcp:start";
+    TOML_END = "# mason:mcp:end";
+    POINTER_START = "<!-- mason:agents:start -->";
+    POINTER_END = "<!-- mason:agents:end -->";
+  }
+});
+
+// src/setup/runtime.ts
+import fs16 from "fs/promises";
+import path21 from "path";
+import { fileURLToPath } from "url";
+import { randomUUID as randomUUID6, createHash as createHash4 } from "crypto";
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+async function packageRoot() {
+  let directory = path21.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 8; i++) {
+    try {
+      const pkg = JSON.parse(await fs16.readFile(path21.join(directory, "package.json"), "utf8"));
+      if (pkg.name === "mason-context") return directory;
+    } catch {
+    }
+    directory = path21.dirname(directory);
+  }
+  throw new Error("Cannot locate the executing Mason distribution. Reinstall Mason and rerun setup.");
+}
+async function sourceRuntime() {
+  const source = await packageRoot();
+  const pkg = JSON.parse(await fs16.readFile(path21.join(source, "package.json"), "utf8"));
+  const hashes = Object.fromEntries(await Promise.all(BINARIES.map(async (file) => [file, checksum(await fs16.readFile(path21.join(source, file)))])));
+  return { source, runtime: runtimeSchema.parse({ id: hash([pkg.version, pkg.dependencies, hashes]).slice(0, 24), version: pkg.version, hashes }) };
+}
+async function verifyRuntime(root, runtime) {
+  try {
+    const saved = await readStoreJson(root, `.mason/runtime/${runtime.id}/receipt.json`);
+    if (JSON.stringify(saved) !== JSON.stringify(runtime)) return false;
+    const base = `.mason/runtime/${runtime.id}/node_modules/mason-context/`;
+    const pkg = await readStoreJson(root, base + "package.json");
+    if (pkg?.name !== "mason-context" || pkg.version !== runtime.version) return false;
+    for (const file of BINARIES) {
+      if (checksum(await fs16.readFile(await storePath(root, base + file))) !== runtime.hashes[file]) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function installRuntime(root, selected) {
+  const { runtime, source } = selected;
+  if (await verifyRuntime(root, runtime)) return runtime;
+  const relative = `.mason/runtime/${runtime.id}`;
+  const target = await storePath(root, relative, true);
+  const stage = await storePath(root, ".mason/runtime/.install-" + randomUUID6(), true);
+  await fs16.mkdir(stage);
+  try {
+    const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+    const options = { timeout: 12e4, maxBuffer: 2 * 1024 * 1024, windowsHide: true };
+    const packed = JSON.parse((await exec10(npm, ["pack", "--ignore-scripts", "--json", "--pack-destination", stage], { ...options, cwd: source })).stdout);
+    const filename = packed[0]?.filename;
+    if (typeof filename !== "string" || path21.basename(filename) !== filename) throw new Error("npm did not produce a Mason package archive.");
+    await fs16.rename(path21.join(stage, filename), path21.join(stage, "mason.tgz"));
+    await fs16.writeFile(path21.join(stage, "package.json"), JSON.stringify({ name: "mason-project-runtime", private: true, version: "1.0.0" }));
+    await exec10(npm, ["install", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund", "--save-exact", "./mason.tgz"], { ...options, cwd: stage });
+    for (const file of BINARIES) {
+      if (checksum(await fs16.readFile(path21.join(stage, "node_modules/mason-context", file))) !== runtime.hashes[file]) throw new Error("Installed Mason binary differs from the selected distribution.");
+    }
+    await fs16.writeFile(path21.join(stage, "receipt.json"), JSON.stringify(runtime, null, 2) + "\n");
+    try {
+      await fs16.rename(target, target + ".previous-" + randomUUID6());
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await fs16.rename(stage, target);
+    if (!await verifyRuntime(root, runtime)) throw new Error("The installed Mason runtime could not be verified.");
+    return runtime;
+  } finally {
+    await fs16.rm(stage, { recursive: true, force: true });
+  }
+}
+var exec10, checksum, BINARIES;
+var init_runtime2 = __esm({
+  "src/setup/runtime.ts"() {
+    "use strict";
+    init_model();
+    init_storage();
+    init_evidence();
+    exec10 = promisify10(execFile10);
+    checksum = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+    BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
+  }
+});
+
+// src/setup/status.ts
+var status_exports = {};
+__export(status_exports, {
+  setupStatus: () => setupStatus,
+  summarizeActivation: () => summarizeActivation
+});
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+async function setupStatus(dir) {
+  const ws = await workspace(dir);
+  const setup = await loadSetup(ws.root);
+  if (!setup) {
+    const partial = await Promise.all(["codex", "claude"].map(async (host) => ({
+      host,
+      receipt: await loadSetupReceipt(ws.root, ws.directory, host)
+    })));
+    const pending = partial.filter((item) => item.receipt !== null).map((item) => item.host);
+    return {
+      version: 1,
+      status: pending.length ? "incomplete" : "not-configured",
+      hosts: {},
+      next: pending.length ? "Setup did not finish. Rerun mason-auto setup --host " + pending[0] + " to resume using the retained original evidence." : "Run mason-auto setup --host codex or --host claude."
+    };
+  }
+  const hosts = {};
+  const launcherCurrent = await readText(ws.root, ".mason/run.cjs") === LAUNCHER;
+  const automation = await automationStatus(ws.root);
+  for (const host of ["codex", "claude"]) {
+    const entry = setup.hosts[host];
+    if (!entry) continue;
+    const instructions = await instructionEdits(ws.root, host);
+    const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
+    const installed = await verifyRuntime(ws.root, entry.runtime);
+    const config = await inspectHostConfig(ws.root, host);
+    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
+    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
+    const local = await loadSetupReceipt(ws.root, ws.directory, host);
+    const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
+    const observation = await readObservation(ws.root, ws.directory, host, entry.revision);
+    const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
+    const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
+    const observedEvents = complete?.events ?? sessions[0]?.events ?? [];
+    const pending = [];
+    if (!installed || !launcherCurrent) pending.push("Install this checkout's pinned runtime by rerunning setup.");
+    if (!mcp || !hooks || !instructionsCurrent || !configured) pending.push("Rerun setup to reconcile project configuration; inspect any disabled host settings.");
+    if (!observation?.contextCalls) pending.push("Start a new assistant session and request task context through Mason's get_context tool.");
+    if (!complete) pending.push("Review/trust the host configuration, then complete a normal task to observe the full hook lifecycle.");
+    if (automation.status === "unavailable") pending.push("The latest automation attempt did not establish verification. Run mason-auto check and inspect its diagnostics.");
+    const healthy = installed && launcherCurrent && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
+    hosts[host] = {
+      status: healthy ? complete && observation?.contextCalls ? "active" : "pending" : "attention",
+      runtime: installed && launcherCurrent ? "installed" : "missing-or-changed",
+      mcp: mcp ? "configured" : "changed",
+      instructions: instructionsCurrent ? "current" : "changed",
+      hookConfiguration: hooks ? "configured" : "disabled-or-changed",
+      observedEvents,
+      contextCalls: observation?.contextCalls ?? 0,
+      verificationStatus: automation.status === "current" ? automation.verificationStatus ?? "unavailable" : "unavailable",
+      pending
+    };
+  }
+  const statuses = Object.values(hosts).map((host) => host.status);
+  const decisions = await loadDecisionStore(ws.root);
+  return {
+    version: 1,
+    status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
+    root: ws.root,
+    hosts,
+    decisionRecords: decisions.records.length,
+    diagnostics: decisions.diagnostics,
+    scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
+  };
+}
+function summarizeActivation(status) {
+  const lines = ["Mason setup: " + status.status + "."];
+  for (const [host, state] of Object.entries(status.hosts)) {
+    lines.push(
+      `${host}: ${state.status}`,
+      `  Runtime: ${state.runtime}; MCP: ${state.mcp}; instructions: ${state.instructions}.`,
+      `  Hooks: ${state.hookConfiguration}; observed: ${state.observedEvents.join(", ") || "none"}.`,
+      `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
+      ...state.pending.map((message2) => "  Next: " + message2)
+    );
+  }
+  if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
+  if (status.next) lines.push(status.next);
+  return lines.join("\n");
+}
+var init_status = __esm({
+  "src/setup/status.ts"() {
+    "use strict";
+    init_evidence();
+    init_store();
+    init_runtime();
+    init_decisions();
+    init_adapters();
+    init_model();
+    init_runtime2();
+    init_config();
+    init_launcher();
+    init_files2();
+    init_observations();
+  }
+});
+
+// src/setup/setup.ts
+var setup_exports = {};
+__export(setup_exports, {
+  selectHost: () => selectHost,
+  setupProject: () => setupProject,
+  summarizeSetup: () => summarizeSetup
+});
+import { randomUUID as randomUUID7 } from "crypto";
+async function selectHost(root, explicit) {
+  if (explicit) return explicit;
+  if (process.env.MASON_SETUP_HOST === "codex" || process.env.MASON_SETUP_HOST === "claude") return process.env.MASON_SETUP_HOST;
+  const found = [];
+  if (await readText(root, ".codex/config.toml") !== null || await readText(root, ".codex/hooks.json") !== null) found.push("codex");
+  if (await readText(root, ".claude/settings.json") !== null || await readText(root, ".mcp.json") !== null) found.push("claude");
+  if (found.length === 1) return found[0];
+  throw new Error("Choose the assistant for setup with --host codex or --host claude.");
+}
+async function setupProject(dir, options = {}) {
+  const ws = await workspace(dir);
+  const host = await selectHost(ws.root, options.host);
+  return withLock(ws.root, ".mason/reports/setup-lock", async () => {
+    const existing = await loadSetup(ws.root);
+    const previousReceipt = await loadSetupReceipt(ws.root, ws.directory, host);
+    const marker = await loadProjectMarker(ws.root);
+    const instructions = await instructionEdits(ws.root, host);
+    const mcp = await mcpEdit(ws.root, host);
+    const hooks = await hookEdits(ws.root, host);
+    const ancillary = await ancillaryEdits(ws.root);
+    const edits = [...ancillary, ...instructions, mcp, ...hooks];
+    const setupBefore = await readText(ws.root, ".mason/setup.json");
+    const selected = await sourceRuntime();
+    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after)).mcp);
+    const desiredHooks = hookConfig(host, hookCommand(host)).hooks;
+    const fingerprint = hash({
+      runtime: selected.runtime,
+      launcher: LAUNCHER,
+      mcp: mcpFingerprint,
+      hooks: desiredHooks,
+      instructions: instructions.map((edit) => edit.path)
+    });
+    const previous = existing?.hosts[host];
+    const changed = edits.some((edit) => edit.before !== edit.after) || previous?.fingerprint !== fingerprint;
+    const revision = !changed && previous ? previous.revision : randomUUID7();
+    const setup = existing ?? { version: 1, hosts: {} };
+    setup.hosts[host] = { runtime: selected.runtime, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
+    const initial = await automate(ws.root, { event: "turn_start" });
+    const findings = await inspectOnboarding(ws.root, options.base, options.evidence);
+    const receiptPath = ws.directory + "/setup-" + host + ".json";
+    const initialReportPath = previousReceipt?.initialReportPath ?? initial.report.reportPath;
+    const initialBaselinePaths = previousReceipt?.initialBaselinePaths ?? initial.report.baselinePaths;
+    await writeStoreJson(ws.root, receiptPath, {
+      version: 1,
+      host,
+      status: "installing",
+      initialReportPath,
+      initialBaselinePaths,
+      root: ws.root,
+      revision
+    });
+    await installRuntime(ws.root, selected);
+    const changedFiles = [];
+    for (const edit of edits) if (await applyEdit(ws.root, edit)) changedFiles.push(edit.path);
+    if (await applyEdit(ws.root, { path: ".mason/setup.json", before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(".mason/setup.json");
+    if (!marker) {
+      await saveProjectMarker(ws.root, { version: 1, initializedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      changedFiles.push(".mason/project.json");
+    }
+    const checked = await automate(ws.root, { event: "turn_start" });
+    const configured = await inspectHostConfig(ws.root, host);
+    await writeStoreJson(ws.root, receiptPath, {
+      version: 1,
+      host,
+      status: "configured",
+      initialReportPath,
+      initialBaselinePaths,
+      root: ws.root,
+      revision,
+      configuredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      version: 1,
+      action: "setup",
+      status: "configured",
+      host,
+      root: ws.root,
+      runtime: selected.runtime,
+      changedFiles,
+      initialReportPath,
+      findings,
+      reportPath: checked.report.reportPath,
+      activation: await setupStatus(ws.root),
+      next: configured.disabled || configured.mcpDisabled ? "Mason hooks or MCP are disabled in project configuration. Review that setting before activation." : host === "codex" ? "Review/trust this project's MCP configuration and hooks in Codex (/hooks in the CLI), then start a new session and give it a normal task." : "Approve the project MCP server in Claude Code, then start a new session and give it a normal task."
+    };
+  });
+}
+function summarizeSetup(result) {
+  const audit = result.findings.audit;
+  return [
+    `Mason configured for ${result.host}.`,
+    "  Runtime installed; MCP server and lifecycle hooks configured.",
+    "  Project instructions updated; original audit evidence retained.",
+    `  ${result.changedFiles.length} shared files changed.`,
+    `Initial audit: ${audit.status}${"counts" in audit ? `; ${audit.counts.issues} issues, ${audit.counts.advisories + audit.counts.suppressedAdvisories} advisories` : ""}.`,
+    ..."issues" in audit ? audit.issues.slice(0, 3).map((f) => "  " + f.message) : [],
+    `Original evidence: ${result.initialReportPath}`,
+    "Activation: " + result.activation.status + ".",
+    result.next,
+    "After the task finishes, run mason-auto status. Configuration alone does not establish activation."
+  ].join("\n");
+}
+var init_setup = __esm({
+  "src/setup/setup.ts"() {
+    "use strict";
+    init_evidence();
+    init_store();
+    init_runtime();
+    init_init();
+    init_onboarding();
+    init_storage();
+    init_files2();
+    init_config();
+    init_launcher();
+    init_adapters();
+    init_model();
+    init_runtime2();
+    init_status();
+  }
+});
 
 // src/automation/cli.ts
-var USAGE = `Usage: mason-auto <install|config|status|check|hook> [options]
+init_execution();
+init_runtime();
+init_adapters();
+init_install();
+init_store();
+import { parseArgs } from "util";
+var USAGE = `Usage: mason-auto <setup|install|config|status|check|hook> [options]
 
+  setup [--host claude|codex]  Install a pinned runtime, MCP, instructions and hooks; retain the initial audit
   install --host claude|codex  Merge lifecycle hooks into this project's host config
   config --host claude|codex   Print the host config without writing
   status                      Read configured hooks and observed runtime events
@@ -2216,35 +4399,52 @@ var USAGE = `Usage: mason-auto <install|config|status|check|hook> [options]
 
   --dir <path>                Project directory (defaults to cwd)
   --command <prefix>          Installed executable prefix for install/config
-  --json                      Machine-readable check output (status always uses JSON)
+  --json                      Machine-readable output (status also uses JSON when piped)
 
 check exits 0 for verified checks, 1 for issues, 2 for incomplete/unavailable.
 Hooks are advisory and exit 0; a failed capture is reported explicitly.
 Local evidence is written under .mason/reports/. No LLM calls or source edits.`;
+var parseCli = (argv2) => parseArgs({ args: argv2, allowPositionals: true, options: {
+  dir: { type: "string" },
+  host: { type: "string" },
+  command: { type: "string" },
+  json: { type: "boolean" },
+  help: { type: "boolean", short: "h" }
+} });
+function isHookCommand(argv2) {
+  try {
+    const parsed = parseCli(argv2);
+    return parsed.positionals[0] === "hook" && !parsed.values.help;
+  } catch {
+    return false;
+  }
+}
 async function runAutomationCli(argv2, stdin = "", io = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
 }) {
+  let action = "";
   try {
-    const { values, positionals } = parseArgs({ args: argv2, allowPositionals: true, options: {
-      dir: { type: "string" },
-      host: { type: "string" },
-      command: { type: "string" },
-      json: { type: "boolean" },
-      help: { type: "boolean", short: "h" }
-    } });
+    const { values, positionals } = parseCli(argv2);
     if (values.help || !positionals.length) {
       io.out(USAGE);
       return 0;
     }
     if (positionals.length !== 1) throw new Error("Expected one command.");
-    const [action] = positionals;
+    [action] = positionals;
     const dir = values.dir ?? process.cwd();
     if (action === "hook") {
       const output = await runAutomationHook(hostSchema.parse(values.host), stdin);
       if (output) io.out(JSON.stringify(output));
       return 0;
     }
+    if (action === "setup") {
+      if (values.command) throw new Error("--command applies to install/config, not managed setup.");
+      const { setupProject: setupProject2, summarizeSetup: summarizeSetup2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
+      const result = await setupProject2(dir, { host: values.host ? hostSchema.parse(values.host) : void 0 });
+      io.out(values.json ? JSON.stringify(result, null, 2) : summarizeSetup2(result));
+      return 0;
+    }
     if (action === "install" || action === "config") {
       const host = hostSchema.parse(values.host);
       io.out(JSON.stringify(action === "install" ? await installAutomation(dir, host, values.command) : hookConfig(host, values.command), null, 2));
@@ -2252,7 +4452,10 @@ async function runAutomationCli(argv2, stdin = "", io = {
     }
     if (values.host || values.command) throw new Error("--host and --command apply only to install/config/hook.");
     if (action === "status") {
-      io.out(JSON.stringify({ ...await automationStatus(dir), configured: await installedAutomation(dir) }, null, 2));
+      const { setupStatus: setupStatus2, summarizeActivation: summarizeActivation2 } = await Promise.resolve().then(() => (init_status(), status_exports));
+      const setup = await setupStatus2(dir);
+      const result = { ...await automationStatus(dir), configured: await installedAutomation(dir), setup };
+      io.out(values.json || !process.stdout.isTTY ? JSON.stringify(result, null, 2) : summarizeActivation2(setup));
       return 0;
     }
     if (action !== "check") throw new Error("Unknown automation command: " + action);
@@ -2260,12 +4463,13 @@ async function runAutomationCli(argv2, stdin = "", io = {
     io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
     return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
   } catch (error) {
-    const message = "Mason automation unavailable: " + (error instanceof Error ? error.message : String(error));
-    if (argv2.includes("hook")) {
-      io.out(JSON.stringify({ systemMessage: message }));
+    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
+    if (action === "hook" || isHookCommand(argv2)) {
+      io.out(JSON.stringify({ systemMessage: message2 }));
       return 0;
     }
-    io.err(message);
+    if (argv2.includes("--json")) io.out(JSON.stringify({ version: 1, ...action === "setup" ? { action, status: "incomplete", next: "Rerun the same setup command to resume." } : { status: "unavailable" }, failure: automationFailure(error) }));
+    else io.err(message2);
     return 2;
   }
 }
@@ -2273,7 +4477,7 @@ async function runAutomationCli(argv2, stdin = "", io = {
 // bin/mason-auto.ts
 var argv = process.argv.slice(2);
 var input = "";
-if (argv.includes("hook") && !argv.some((a) => a === "--help" || a === "-h") && !process.stdin.isTTY) {
+if (isHookCommand(argv) && !process.stdin.isTTY) {
   for await (const chunk of process.stdin) {
     input += chunk.toString();
     if (Buffer.byteLength(input) > 1024 * 1024) break;