ci.yml

name: Code Polishy CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "23 4 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  classify:
    name: Classify change
    if: github.event_name != 'schedule'
    runs-on: ubuntu-24.04
    outputs:
      documentation: ${{ steps.level.outputs.documentation }}
    steps:
      - name: Check out requested commit and base
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          EVENT_BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || '' }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          authorization="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\r\n')"
          printf '::add-mask::%s\n' "${authorization}"
          if [[ "${EVENT_BASE}" =~ ^[0-9a-f]{40}$ && ! "${EVENT_BASE}" =~ ^0+$ ]]; then
            git -c "http.extraheader=AUTHORIZATION: basic ${authorization}" \
              fetch --no-tags origin "${GITHUB_SHA}" "${EVENT_BASE}"
            printf 'CODE_POLISHY_MERGE_BASE=%s\n' "${EVENT_BASE}" >>"${GITHUB_ENV}"
          else
            git -c "http.extraheader=AUTHORIZATION: basic ${authorization}" \
              fetch --depth=1 --no-tags origin "${GITHUB_SHA}"
            printf 'CODE_POLISHY_MERGE_BASE=\n' >>"${GITHUB_ENV}"
          fi
          unset authorization
          git checkout --detach "${GITHUB_SHA}"

      - name: Install pinned Go
        shell: bash
        run: ./tools/install-go.sh

      - name: Build policy engine
        shell: bash
        run: ./scripts/build.sh

      - name: Classify selected merge level
        id: level
        shell: bash
        run: |
          set -euo pipefail
          printf 'documentation=false\n' >>"${GITHUB_OUTPUT}"
          if [[ -z "${CODE_POLISHY_MERGE_BASE}" ]]; then
            exit
          fi
          set +e
          ./.tools/bin/code-polishy test-levels --base "${CODE_POLISHY_MERGE_BASE}" |
            tee "${RUNNER_TEMP}/code-polishy-test-levels.txt"
          status="${PIPESTATUS[0]}"
          set -e
          if [[ "${status}" -eq 0 ]] &&
            grep -q '^MERGE GATE: DOCUMENTATION ' "${RUNNER_TEMP}/code-polishy-test-levels.txt"; then
            printf 'documentation=true\n' >>"${GITHUB_OUTPUT}"
          fi
          exit "${status}"

  policy:
    name: Policy and tests (ubuntu-24.04)
    needs: classify
    if: always()
    runs-on: ubuntu-24.04
    steps:
      - name: Check out requested commit
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          EVENT_BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || '' }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          authorization="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\r\n')"
          printf '::add-mask::%s\n' "${authorization}"
          if [[ "${EVENT_BASE}" =~ ^[0-9a-f]{40}$ && ! "${EVENT_BASE}" =~ ^0+$ ]]; then
            git -c "http.extraheader=AUTHORIZATION: basic ${authorization}" \
              fetch --no-tags origin "${GITHUB_SHA}" "${EVENT_BASE}"
            printf 'CODE_POLISHY_MERGE_BASE=%s\n' "${EVENT_BASE}" >>"${GITHUB_ENV}"
          else
            git -c "http.extraheader=AUTHORIZATION: basic ${authorization}" \
              fetch --depth=1 --no-tags origin "${GITHUB_SHA}"
            printf 'CODE_POLISHY_MERGE_BASE=\n' >>"${GITHUB_ENV}"
          fi
          unset authorization
          git checkout --detach "${GITHUB_SHA}"

      - name: Install documentation policy toolchain
        if: github.event_name != 'schedule' && needs.classify.result == 'success' && needs.classify.outputs.documentation == 'true'
        shell: bash
        run: |
          set -euo pipefail
          ./tools/install-go.sh
          ./tools/install-javascript-runtime.sh
          ./tools/install-javascript-bundle.sh

      - name: Install full pinned policy toolchain
        if: github.event_name == 'schedule' || needs.classify.result != 'success' || needs.classify.outputs.documentation != 'true'
        shell: bash
        run: ./tools/install-policy-tools.sh

      - name: Build policy engine
        shell: bash
        run: |
          ./scripts/build.sh
          printf '%s/.tools/bin\n' "${GITHUB_WORKSPACE}" >>"${GITHUB_PATH}"

      - name: Run selected policy gate
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        shell: bash
        run: code-polishy merge-gate --base="$CODE_POLISHY_MERGE_BASE"

      - name: Run manually requested full policy gate
        if: github.event_name == 'workflow_dispatch'
        shell: bash
        run: ./.tools/bin/code-polishy gate

      - name: Run weekly online dependency security scan
        if: github.event_name == 'schedule'
        shell: bash
        run: ./.tools/bin/code-polishy supply-chain

      - name: Verify installed artifact security before tagging
        if: github.event_name != 'schedule' && needs.classify.outputs.documentation != 'true'
        shell: bash
        run: |
          ./scripts/install.sh --prefix "${RUNNER_TEMP}/artifact-security-installation"
          ./scripts/verify-installed-artifact-security.sh "${RUNNER_TEMP}/artifact-security-installation" "${RUNNER_TEMP}/artifact-security-fixture"

  macos:
    name: Policy and tests (macos-15)
    needs: classify
    if: always() && !cancelled() && github.event_name != 'schedule' && needs.classify.outputs.documentation != 'true'
    runs-on: macos-15
    steps:
      - name: Check out requested commit
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          EVENT_BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || '' }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          authorization="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\r\n')"
          printf '::add-mask::%s\n' "${authorization}"
          if [[ "${EVENT_BASE}" =~ ^[0-9a-f]{40}$ && ! "${EVENT_BASE}" =~ ^0+$ ]]; then
            git -c "http.extraheader=AUTHORIZATION: basic ${authorization}" \
              fetch --no-tags origin "${GITHUB_SHA}" "${EVENT_BASE}"
            printf 'CODE_POLISHY_MERGE_BASE=%s\n' "${EVENT_BASE}" >>"${GITHUB_ENV}"
          else
            git -c "http.extraheader=AUTHORIZATION: basic ${authorization}" \
              fetch --depth=1 --no-tags origin "${GITHUB_SHA}"
            printf 'CODE_POLISHY_MERGE_BASE=\n' >>"${GITHUB_ENV}"
          fi
          unset authorization
          git checkout --detach "${GITHUB_SHA}"

      - name: Install pinned policy toolchain
        shell: bash
        run: ./tools/install-policy-tools.sh

      - name: Build policy engine
        shell: bash
        run: ./scripts/build.sh

      - name: Run automated policy gate
        shell: bash
        run: ./.tools/bin/code-polishy gate

  windows:
    name: Native Windows contracts
    needs: classify
    if: always() && !cancelled() && github.event_name != 'schedule' && needs.classify.outputs.documentation != 'true'
    runs-on: windows-2025
    steps:
      - name: Check out requested commit
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          $ErrorActionPreference = 'Stop'
          git init .
          git remote add origin "$env:GITHUB_SERVER_URL/$env:GITHUB_REPOSITORY.git"
          $authorization = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("x-access-token:$env:GITHUB_TOKEN"))
          Write-Output "::add-mask::$authorization"
          git -c "http.extraheader=AUTHORIZATION: basic $authorization" fetch --depth=1 origin $env:GITHUB_SHA
          if ($LASTEXITCODE -ne 0) { throw 'Git fetch failed.' }
          Remove-Variable authorization
          git checkout --detach FETCH_HEAD
          if ($LASTEXITCODE -ne 0) { throw 'Git checkout failed.' }

      - name: Install checksum-pinned Windows toolchain
        shell: pwsh
        run: .\tools\install-policy-tools.ps1

      - name: Exercise the installed native Rust release
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-StrictMode -Version Latest
          .\tools\initialize-windows-sdk.ps1
          $version = (Get-Content -LiteralPath VERSION -Raw).Trim()
          $publicationDir = Join-Path $env:RUNNER_TEMP 'rust-publication'
          .\scripts\build-release.ps1 -Output (Join-Path $env:RUNNER_TEMP 'rust-release.zip') -PublicationDirectory $publicationDir
          $archive = Join-Path $publicationDir "code-polishy-$version-windows-x64.zip"
          $descriptor = Join-Path $publicationDir "code-polishy-$version-windows-x64.release.json"
          $archiveSha = [string](Get-Content -LiteralPath $descriptor -Raw | ConvertFrom-Json).archive.sha256
          $inspection = Join-Path $env:RUNNER_TEMP 'rust-release-inspection'
          $installation = Join-Path $env:RUNNER_TEMP 'rust-release-installation'
          Expand-Archive -LiteralPath $archive -DestinationPath $inspection
          & (Join-Path $inspection 'bin\code-polishy.exe') --policy-root $inspection install-bundle --source $archive --sha256 $archiveSha --prefix $installation
          if ($LASTEXITCODE -ne 0) { throw 'The fresh release installation failed.' }
          $installedEngines = @(Get-ChildItem -LiteralPath (Join-Path $installation 'releases') -Filter 'code-polishy.exe' -File -Recurse)
          if ($installedEngines.Count -ne 1) { throw 'The fresh installation did not contain exactly one release engine.' }
          $installedRoot = Split-Path -Parent (Split-Path -Parent $installedEngines[0].FullName)
          $bash = Join-Path $env:ProgramFiles 'Git\usr\bin\bash.exe'
          & $bash ./scripts/test-installed-release-rust.sh $installedRoot (Join-Path $installation 'bin\code-polishy.exe') (Join-Path $publicationDir "code-polishy-$version-rust-windows-x64.zip")
          if ($LASTEXITCODE -ne 0) { throw 'The installed Rust fixture failed.' }

      - name: Compile all Go packages and run native Windows contracts
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          .\tools\initialize-windows-sdk.ps1
          $go = '.tools\go\windows-amd64\go\bin\go.exe'
          & $go test -run '^$' ./...
          if ($LASTEXITCODE -ne 0) { throw 'Go package compilation failed.' }
          & $go test -count=1 ./internal/runner -run '^TestWindows'
          if ($LASTEXITCODE -ne 0) { throw 'Native Windows process and lock contracts failed.' }
          & $go test -count=1 ./internal/release -run '^(TestReleaseHostMatrix|TestParseLock|TestRenderLock|TestReadLock)'
          if ($LASTEXITCODE -ne 0) { throw 'Native release identity contracts failed.' }
          & $go test -count=1 ./internal/release -run '^(TestRustBundle|TestOptionalRustInstallation|TestRustIntegrity)'
          if ($LASTEXITCODE -ne 0) { throw 'Native optional Rust bundle contracts failed.' }
          & $go test -count=1 ./internal/testing -run '^TestNativeRust'
          if ($LASTEXITCODE -ne 0) { throw 'Native Rust test execution contracts failed.' }
          & $go test -count=1 ./internal/javascript -run '^TestJavaScript(ExecutableUsesNativeHostContract|BundleContainsNativeTargetPaths)$'
          if ($LASTEXITCODE -ne 0) { throw 'Native sealed JavaScript platform contract failed.' }
          & $go test -count=1 ./internal/architecture -run '^TestRuffGraphFactsAreVersionedBoundedAndPathNormalized$'
          if ($LASTEXITCODE -ne 0) { throw 'Native Ruff graph adapter contract failed.' }
          & $go test -count=1 ./internal/architecture/sourcegraph
          if ($LASTEXITCODE -ne 0) { throw 'Native source graph and cycle contracts failed.' }
          & $go test -count=1 ./internal/pythonfacts
          if ($LASTEXITCODE -ne 0) { throw 'Native Python semantics and partition contracts failed.' }
          & $go test -count=1 ./internal/repository -run '^TestDetachedWorktreeSupportsLongCheckoutPaths$'
          if ($LASTEXITCODE -ne 0) { throw 'Native Windows Git worktree contract failed.' }
          & $go test -count=1 ./internal/gaterun
          if ($LASTEXITCODE -ne 0) { throw 'Native gate report runtime contracts failed.' }
          & $go test -count=1 ./internal/behaviorreview -run '^TestIntentJournalLockRetainsConcurrentFeatureCaptures$'
          if ($LASTEXITCODE -ne 0) { throw 'Native behavior-review journal-lock contract failed.' }
          & $go test -count=1 ./internal/behaviorreview
          if ($LASTEXITCODE -ne 0) { throw 'Native behavior review runtime contracts failed.' }
          & $go test -count=1 ./internal/documentation
          if ($LASTEXITCODE -ne 0) { throw 'Native versioned documentation contracts failed.' }

      - name: Install native release from source
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $prefix = Join-Path $env:RUNNER_TEMP 'installed-code-polishy'
          $originalUserPath = [Environment]::GetEnvironmentVariable('Path', 'User')
          try {
            .\scripts\install.ps1 -Prefix $prefix -AddToUserPath
            if ($LASTEXITCODE -ne 0) { throw 'Native source installation failed.' }
            $launcherRoot = [System.IO.Path]::GetFullPath((Join-Path $prefix 'bin')).TrimEnd([System.IO.Path]::DirectorySeparatorChar)
            $userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
            $matches = @($userPath -split ';' | Where-Object {
              $_ -and [System.StringComparer]::OrdinalIgnoreCase.Equals(
                [Environment]::ExpandEnvironmentVariables($_.Trim()).TrimEnd([System.IO.Path]::DirectorySeparatorChar),
                $launcherRoot
              )
            })
            if ($matches.Count -ne 1) { throw 'The native installer did not add exactly one user PATH entry.' }
          } finally {
            [Environment]::SetEnvironmentVariable('Path', $originalUserPath, 'User')
          }
          "CODE_POLISHY_WINDOWS_PREFIX=$prefix" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Exercise the installed native release
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $prefix = $env:CODE_POLISHY_WINDOWS_PREFIX

          $releaseEngine = @(Get-ChildItem -LiteralPath (Join-Path $prefix 'releases') -Filter 'code-polishy.exe' -File -Recurse)
          if ($releaseEngine.Count -ne 1) { throw 'Installed release did not contain exactly one engine.' }
          $releaseRoot = Split-Path -Parent (Split-Path -Parent $releaseEngine[0].FullName)
          if (Test-Path -LiteralPath (Join-Path $releaseRoot 'skills')) {
            throw 'Installed release carried optional agent skills.'
          }
          $launcher = Join-Path $prefix 'bin\code-polishy.exe'
          $target = Join-Path $env:RUNNER_TEMP 'code-polishy-target'
          New-Item -ItemType Directory -Path (Join-Path $target 'src') | Out-Null
          New-Item -ItemType Directory -Path (Join-Path $target 'scripts') | Out-Null
          @'
          {
            "version": 4,
            "project": {"kind": "application", "capabilities": []},
            "scope": {"development": ["scripts/test.ps1"]},
            "quality": {},
            "portability": {},
            "modules": [
              {"name": "application", "paths": ["src/**"]},
              {"name": "tooling", "paths": ["scripts/**"]}
            ],
            "verification": {
              "mergeGate": {"recommendedModules": ["application"]},
              "behaviorReview": {
                "defaultRequiredAt": "on-request",
                "features": [
                  {"name": "windows-state", "description": "The native application state remains directly observable through its boundary suite.", "modules": ["application"], "suites": ["application-focused"]}
                ]
              }
            },
            "checks": [
              {"name": "application-build", "provides": ["build"], "argv": ["pwsh", "-NoProfile", "-NonInteractive", "-File", "./scripts/test.ps1"], "modules": ["application"], "runOn": ["build"]},
              {"name": "tooling-build", "provides": ["build"], "argv": ["pwsh", "-NoProfile", "-NonInteractive", "-File", "./scripts/test.ps1"], "modules": ["tooling"], "runOn": ["build"]}
            ],
            "tests": {"paths": ["scripts/test.ps1"], "ownership": [{"paths": ["scripts/test.ps1"], "module": "application", "focusedSuite": "application-focused"}], "suites": [
              {"name": "application-focused", "kind": "unit", "scope": "module", "modules": ["application"], "paths": ["scripts/test.ps1"], "argv": ["pwsh", "-NoProfile", "-NonInteractive", "-File", "./scripts/test.ps1"]},
              {"name": "tooling-focused", "kind": "unit", "scope": "module", "modules": ["tooling"], "paths": ["scripts/test.ps1"], "argv": ["pwsh", "-NoProfile", "-NonInteractive", "-File", "./scripts/test.ps1"]},
              {"name": "full", "kind": "integration", "scope": "repository", "cost": "standard", "argv": ["pwsh", "-NoProfile", "-NonInteractive", "-File", "./scripts/test.ps1"], "runOn": ["recommended", "full"]}
            ]},
            "supplyChain": {},
            "exceptions": []
          }
          '@ | Set-Content -LiteralPath (Join-Path $target '.code-polishy.json')
          @'
          $ErrorActionPreference = 'Stop'
          $root = Split-Path -Parent $PSScriptRoot
          $data = Get-Content -LiteralPath (Join-Path $root 'src\data.json') -Raw | ConvertFrom-Json
          if ($data.state -ne 'base') { throw 'Expected base behavior.' }
          '@ | Set-Content -LiteralPath (Join-Path $target 'scripts\test.ps1')
          Set-Content -LiteralPath (Join-Path $target 'src\data.json') -Value '{"platform":"windows","state":"base"}'
          & git.exe -C $target init -b main
          & git.exe -C $target config user.name 'Code Polishy CI'
          & git.exe -C $target config user.email 'ci@example.invalid'
          $releaseManifest = Get-Content -LiteralPath (Join-Path $releaseRoot 'release-manifest.json') -Raw | ConvertFrom-Json
          $archiveDigest = 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
          $archives = @('darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64', 'windows-x64') | ForEach-Object {
            [ordered]@{
              host = $_
              url = "https://example.invalid/code-polishy-$($releaseManifest.codePolishyVersion)-$($_).zip"
              sha256 = $archiveDigest
              size = 1
            }
          }
          $lock = [ordered]@{
            lockVersion = 2
            codePolishyVersion = $releaseManifest.codePolishyVersion
            releaseDigest = $releaseManifest.releaseDigest
            features = @($releaseManifest.features)
            publication = [ordered]@{
              indexUrl = 'https://example.invalid/release-index.json'
              indexSha256 = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
              archives = @($archives)
            }
          }
          $lock | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath (Join-Path $target '.code-polishy.lock.json') -Encoding utf8NoBOM
          & $launcher --repo-root $target agents install
          if ($LASTEXITCODE -ne 0) { throw 'Installed canonical agent guidance failed.' }

          $docsStatusBefore = (& git.exe -C $target status --porcelain=v1 --untracked-files=all | Out-String)
          $docsList = (& $launcher --repo-root $target docs list 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0) {
            Write-Output $docsList
            throw 'Installed native documentation list failed.'
          }
          if ($docsList -notlike '*agent-workflows*Agent Workflows*' -or
              $docsList -notlike '*behavior-review*Behavior and Final-State Review*' -or
              $docsList -notlike '*adding-a-language*Adding a Language Pack*') {
            throw "Installed native documentation list omitted required topics: $docsList"
          }
          $docsFind = (& $launcher --repo-root $target docs find behavior review 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0 -or $docsFind -notlike '*behavior-review*Behavior and Final-State Review*') {
            Write-Output $docsFind
            throw 'Installed native documentation search failed.'
          }
          $docsRead = (& $launcher --repo-root $target docs read agents 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0 -or $docsRead -notlike '# Agent Workflows*') {
            Write-Output $docsRead
            throw 'Installed native documentation read failed.'
          }
          $docsStatusAfter = (& git.exe -C $target status --porcelain=v1 --untracked-files=all | Out-String)
          if ($docsStatusAfter -ne $docsStatusBefore) {
            throw 'Installed native documentation commands changed the target repository.'
          }
          $packRoot = (& $launcher --repo-root $target pack root 2>&1 | Out-String).Trim()
          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($packRoot)) {
            throw 'Installed native pack root inspection failed.'
          }

          & $launcher --repo-root $target format --files src/data.json
          if ($LASTEXITCODE -ne 0) { throw 'Installed sealed JavaScript formatter failed.' }
          & $launcher --repo-root $target check --files src/data.json
          if ($LASTEXITCODE -ne 0) { throw 'Installed sealed JavaScript checks failed.' }
          & git.exe -C $target add --all
          & git.exe -C $target commit -m 'Initialize native acceptance target'
          & git.exe -C $target update-ref refs/remotes/origin/main HEAD
          & git.exe -C $target symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main

          & $launcher --repo-root $target doctor --strict
          if ($LASTEXITCODE -ne 0) { throw 'Installed launcher doctor failed.' }
          & $launcher --repo-root $target task-session --module application -- pwsh -NoProfile -NonInteractive -Command 'exit 0'
          if ($LASTEXITCODE -ne 0) { throw 'Installed native task session failed.' }

          $behaviorStarted = Get-Date
          $behaviorBase = (& git.exe -C $target rev-parse HEAD).Trim()
          $intent = Join-Path $env:RUNNER_TEMP 'windows-behavior-intent.txt'
          Set-Content -LiteralPath $intent -Value 'Change the Windows fixture state to candidate and keep it covered.'
          & $launcher --repo-root $target behavior-review capture-intent --intent-file $intent
          if ($LASTEXITCODE -ne 0) { throw 'Installed native intent capture failed.' }

          @'
          $ErrorActionPreference = 'Stop'
          $root = Split-Path -Parent $PSScriptRoot
          $data = Get-Content -LiteralPath (Join-Path $root 'src\data.json') -Raw | ConvertFrom-Json
          if ($data.state -ne 'candidate') { throw 'Expected candidate behavior.' }
          '@ | Set-Content -LiteralPath (Join-Path $target 'scripts\test.ps1')
          Set-Content -LiteralPath (Join-Path $target 'src\data.json') -Value '{"platform":"windows","state":"candidate"}'
          & $launcher --repo-root $target format --files src/data.json
          if ($LASTEXITCODE -ne 0) { throw 'Installed native candidate formatting failed.' }
          & git.exe -C $target add scripts/test.ps1 src/data.json
          $correction = Join-Path $env:RUNNER_TEMP 'windows-behavior-correction.txt'
          Set-Content -LiteralPath $correction -Value 'Keep the candidate state direct and remove any rejected alternate path.'
          & $launcher --repo-root $target behavior-review capture-intent --intent-file $correction
          if ($LASTEXITCODE -ne 0) { throw 'Installed native dirty correction capture failed.' }
          $journalPath = Join-Path $target '.code-polishy-reports\behavior-review\intent-journal.json'
          $journal = Get-Content -LiteralPath $journalPath -Raw | ConvertFrom-Json
          if ($journal.entries.Count -ne 2 -or $journal.entries[1].candidate_state_sha256 -notmatch '^[0-9a-f]{64}$') {
            throw 'Installed native dirty correction capture lacks ordered candidate-state evidence.'
          }
          & git.exe -C $target commit -m 'Change native fixture behavior'
          if ($LASTEXITCODE -ne 0) { throw 'Native behavior candidate commit failed.' }

          $optionalCheckpoint = (& $launcher --repo-root $target checkpoint-gate --base $behaviorBase 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0) {
            Write-Output $optionalCheckpoint
            throw 'Installed optional native behavior checkpoint failed.'
          }
          if ($optionalCheckpoint -notlike '*BEHAVIOR REVIEW: NOT RUN (optional)*') {
            throw "Optional checkpoint did not report an unselected behavior review: $optionalCheckpoint"
          }
          if ($optionalCheckpoint -notlike '*FINAL STATE: NOT RUN (optional)*') {
            throw "Optional checkpoint omitted final-state disclosure: $optionalCheckpoint"
          }
          $optionalMerge = (& $launcher --repo-root $target merge-gate --base $behaviorBase 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0) {
            Write-Output $optionalMerge
            throw 'Installed optional native behavior merge failed.'
          }
          if ($optionalMerge -notlike '*BEHAVIOR REVIEW: NOT RUN (optional)*') {
            throw "Optional merge did not report an unselected behavior review: $optionalMerge"
          }
          if ($optionalMerge -notlike '*FINAL STATE: NOT RUN (optional)*') {
            throw "Optional merge omitted final-state disclosure: $optionalMerge"
          }
          $behaviorArtifacts = Join-Path $target '.code-polishy-reports\behavior-review'
          foreach ($artifact in @('packet.json', 'receipt.json')) {
            if (Test-Path -LiteralPath (Join-Path $behaviorArtifacts $artifact)) {
              throw "Optional behavior review unexpectedly created $artifact."
            }
          }

          $requestedReview = (& $launcher --repo-root $target behavior-review require --base $behaviorBase --feature windows-state 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0) {
            Write-Output $requestedReview
            throw 'Installed task-requested native behavior review failed.'
          }
          if ($requestedReview -notlike '*Behavior review requirement added:*') {
            throw "Task-requested behavior review did not report its journal update: $requestedReview"
          }
          $requiredStatus = (& $launcher --repo-root $target behavior-review status --base $behaviorBase 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0) {
            Write-Output $requiredStatus
            throw 'Installed task-requested behavior status failed.'
          }
          if ($requiredStatus -notlike '*BEHAVIOR REVIEW: REQUIRED (windows-state)*') {
            throw "Task-requested behavior review did not report the selected feature: $requiredStatus"
          }
          if ($requiredStatus -notlike '*FINAL STATE: NOT RUN (required)*') {
            throw "Task-requested behavior review omitted required final-state disclosure: $requiredStatus"
          }

          function Complete-BehaviorReview {
            & $launcher --repo-root $target behavior-review prepare --base $behaviorBase
            if ($LASTEXITCODE -ne 0) { throw 'Installed native behavior review preparation failed.' }
            & $launcher --repo-root $target regression-proof --base $behaviorBase --suite application-focused --evidence scripts/test.ps1 --id windows-state
            if ($LASTEXITCODE -ne 0) { throw 'Installed native regression proof failed.' }
            $packetPath = Join-Path $target '.code-polishy-reports\behavior-review\packet.json'
            $packet = Get-Content -LiteralPath $packetPath -Raw | ConvertFrom-Json
            $result = [ordered]@{
              version = 4
              review_id = $packet.review_id
              base = $packet.base
              candidate = $packet.candidate
              intent_sha256 = $packet.intent_sha256
              selection_sha256 = $packet.selection_sha256
              decision_sha256 = $packet.decision_sha256
              behaviors = @([ordered]@{
                before = 'The fixture reports the base state.'
                after = 'The fixture reports the requested candidate state.'
                classification = 'requested'
                proof_ids = @('windows-state')
                scope = [ordered]@{
                  features = @('windows-state')
                  full_candidate = $false
                }
              })
              findings = @()
              final_state_findings = @()
            }
            $resultPath = Join-Path $target '.code-polishy-reports\behavior-review\result.json'
            $result | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $resultPath -Encoding utf8
            & $launcher --repo-root $target behavior-review finalize --base $behaviorBase
            if ($LASTEXITCODE -ne 0) { throw 'Installed native behavior review finalization failed.' }
          }

          Complete-BehaviorReview
          $checkpoint = (& $launcher --repo-root $target checkpoint-gate --base $behaviorBase 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0) {
            Write-Output $checkpoint
            throw 'Installed native behavior checkpoint failed.'
          }
          if ($checkpoint -notlike '*BEHAVIOR REVIEW: PASSED (windows-state)*') {
            throw "Checkpoint did not report the passed requested feature review: $checkpoint"
          }
          if ($checkpoint -notlike '*FINAL STATE: PASSED (windows-state)*') {
            throw "Checkpoint omitted the passed final-state review: $checkpoint"
          }
          $merge = (& $launcher --repo-root $target merge-gate --base $behaviorBase 2>&1 | Out-String)
          if ($LASTEXITCODE -ne 0) {
            Write-Output $merge
            throw 'Installed native behavior merge failed.'
          }
          if ($merge -notlike '*BEHAVIOR REVIEW: PASSED (windows-state)*') {
            throw "Merge did not report the passed requested feature review: $merge"
          }
          if ($merge -notlike '*FINAL STATE: PASSED (windows-state)*') {
            throw "Merge omitted the passed final-state review: $merge"
          }
          $artifactBytes = (Get-ChildItem -LiteralPath $behaviorArtifacts -File -Recurse | Measure-Object -Property Length -Sum).Sum
          $durationSeconds = [math]::Round(((Get-Date) - $behaviorStarted).TotalSeconds)
          Write-Output "DOGFOOD SUMMARY repo=windows-native completed=true duration_seconds=$durationSeconds corrective_attempts=0 artifact_bytes=$artifactBytes"