Repository navigation
Bounded trusted-local refactor verification with preserved original evidence.
Freezes tests and copied source, rejects path aliases/traversal, checks public Python signatures, bounds check execution, refuses overlapping/nonempty output directories and exports replayable diffs. Optional external RepairGate reports remain explicitly unbound references, with their bytes hashed for traceability.
Validation: 28 Python tests, actual three-case RepairGate regression replay, accepted fixture diff, original hashes and GitHub CI. This runner is not a security sandbox. Detached Windows children after parent exit remain outside the process-lifetime guarantee.