diff --git a/.github/workflows/node-repair.yml b/.github/workflows/node-repair.yml
new file mode 100644
index 0000000..b700746
--- /dev/null
+++ b/.github/workflows/node-repair.yml
@@ -0,0 +1,70 @@
+name: Prepare selected Node repairs
+'on':
+  workflow_call:
+    inputs:
+      request-id:
+        type: string
+        required: true
+      pull-request:
+        type: string
+        required: true
+      expected-head:
+        type: string
+        required: true
+      expected-base:
+        type: string
+        required: true
+      selections:
+        type: string
+        required: true
+    outputs:
+      candidate-artifact-id:
+        description: Immutable preparation artifact ID in this run; no validation or publication occurred.
+        value: ${{ jobs.prepare.outputs.candidate-artifact-id }}
+permissions:
+  contents: read
+jobs:
+  guard:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+    - name: Recheck canonical PR eligibility and selections
+      uses: $/node/repair
+      with:
+        operation: guard
+        request-id: ${{ inputs.request-id }}
+        pull-request: ${{ inputs.pull-request }}
+        expected-head: ${{ inputs.expected-head }}
+        expected-base: ${{ inputs.expected-base }}
+        selections: ${{ inputs.selections }}
+  prepare:
+    needs: guard
+    runs-on: ubuntu-latest
+    timeout-minutes: 50
+    permissions:
+      contents: read
+    env:
+      npm_config_ignore_scripts: 'true'
+      pnpm_config_ignore_scripts: 'true'
+      npm_config_ignore_pnpmfile: 'true'
+      pnpm_config_ignore_pnpmfile: 'true'
+    outputs:
+      candidate-artifact-id: ${{ steps.prepare.outputs.candidate-artifact-id }}
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        ref: ${{ inputs.expected-head }}
+        persist-credentials: false
+    - name: Prepare the selected candidate using trusted workflow code
+      id: prepare
+      uses: $/node/repair
+      with:
+        operation: prepare
+        request-id: ${{ inputs.request-id }}
+        pull-request: ${{ inputs.pull-request }}
+        expected-head: ${{ inputs.expected-head }}
+        expected-base: ${{ inputs.expected-base }}
+        selections: ${{ inputs.selections }}
diff --git a/docs/node-maintenance-operator.md b/docs/node-maintenance-operator.md
index f6f9f64..3a8525b 100644
--- a/docs/node-maintenance-operator.md
+++ b/docs/node-maintenance-operator.md
@@ -126,6 +126,41 @@ This change is local and unreleased. Before testing the reviewed revision live:
 No live permission, database, deployment or repository change is performed by
 these instructions. The local/native tests cannot replace that acceptance.
 
+## Candidate preparation boundary
+
+The reusable `.github/workflows/node-repair.yml` currently enables only `guard`
+and `prepare`. It accepts the existing five request inputs and returns
+`candidate-artifact-id` for the immutable artifact created in that run.
+It does not install a caller or enable repairs in an existing repository.
+
+The read-only guard fetches the canonical repository and managed PR again.
+It checks bot authorship, the same repository, maintenance branch, default
+branch, exact head/base, revision marker and selected versions. It does not
+require the old idle Check identity after the App has admitted the request.
+
+Preparation checks out only the expected head without persisted credentials.
+It uses the configured toolchain, existing audit engine, release cooldown and
+parent/direct constraint evidence. Lifecycle and local/global pnpmfile hooks
+are disabled during metadata reads, audit and lockfile-only resolution.
+Unselected versions, unrelated lockfile metadata and changed peer suffixes
+fail preparation. No project validation script runs in this job.
+
+The preparation artifact contains exactly three regular files:
+
+- `candidate.patch`: only the selected project's `pnpm-workspace.yaml` and
+  `pnpm-lock.yaml` changes, exported with external diff and text conversion off.
+- `audit.json`: a version-1 envelope containing the exact request, normalized
+  project directory, structured before audit and candidate audit.
+- `result.md`: the shared package report. It states that project validation and
+  dependency publication have not run.
+
+The envelope rejects missing/extra fields, mismatched request or project,
+unsupported versions, symlinked project parents, unconfirmed selected fixes and
+new findings. Later consumers must download by the returned artifact ID from
+the same run. A preparation success is not proof of a validated or published
+repair. Separate validation, publication and normal-audit retention remain
+later slices, followed by the isolated live repair gate and general rollout.
+
 ## Check the receiver locally
 
 Use Node 24 and run these commands from `repair-app/`:
diff --git a/node/repair/action.yml b/node/repair/action.yml
new file mode 100644
index 0000000..a424012
--- /dev/null
+++ b/node/repair/action.yml
@@ -0,0 +1,90 @@
+name: Node repair candidate
+description: Guard or prepare a selected pnpm candidate without project scripts or publication.
+inputs:
+  operation:
+    description: guard or prepare.
+    required: true
+  request-id:
+    required: true
+    description: App request UUID.
+  pull-request:
+    required: true
+    description: Managed pull request number.
+  expected-head:
+    required: true
+    description: Selected PR head SHA.
+  expected-base:
+    required: true
+    description: Selected PR base SHA.
+  selections:
+    required: true
+    description: Canonical selected package/version triples.
+outputs:
+  candidate-artifact-id:
+    description: Immutable preparation artifact ID from this run.
+    value: ${{ steps.candidate.outputs.artifact-id }}
+runs:
+  using: composite
+  steps:
+  - name: Validate the requested operation
+    shell: bash
+    env:
+      OPERATION: ${{ inputs.operation }}
+    run: |
+      case "$OPERATION" in
+        guard|prepare) ;;
+        *) echo '::error::Expected guard or prepare'; exit 1 ;;
+      esac
+  - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+    with:
+      python-version: '3.13'
+  - name: Install configuration and audit parser
+    shell: bash
+    run: python -I -m pip install PyYAML==6.0.3
+  - name: Recheck the selected PR
+    if: ${{ inputs.operation == 'guard' }}
+    shell: bash
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPAIR_REQUEST: ${{ inputs.request-id }}
+      REPAIR_PR: ${{ inputs.pull-request }}
+      REPAIR_HEAD: ${{ inputs.expected-head }}
+      REPAIR_BASE: ${{ inputs.expected-base }}
+      REPAIR_SELECTIONS: ${{ inputs.selections }}
+    run: python "$GITHUB_ACTION_PATH/../runtime/repair.py" guard
+  - name: Resolve the declared preparation toolchain
+    if: ${{ inputs.operation == 'prepare' }}
+    shell: bash
+    run: |
+      set -euo pipefail
+      python "$GITHUB_ACTION_PATH/../runtime/project.py" --github-env "$GITHUB_ENV" --resolved-config "$RUNNER_TEMP/node-repair-config.json"
+  - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+    if: ${{ inputs.operation == 'prepare' }}
+    with:
+      node-version: ${{ env.NODE_AUDIT_NODE_VERSION }}
+      check-latest: true
+  - name: Enable the declared package manager
+    if: ${{ inputs.operation == 'prepare' }}
+    shell: bash
+    run: corepack enable
+  - name: Prepare and seal the selected candidate
+    if: ${{ inputs.operation == 'prepare' }}
+    shell: bash
+    env:
+      REPAIR_REQUEST: ${{ inputs.request-id }}
+      REPAIR_PR: ${{ inputs.pull-request }}
+      REPAIR_HEAD: ${{ inputs.expected-head }}
+      REPAIR_BASE: ${{ inputs.expected-base }}
+      REPAIR_SELECTIONS: ${{ inputs.selections }}
+    run: python "$GITHUB_ACTION_PATH/../runtime/repair.py" prepare --artifact "$RUNNER_TEMP/node-repair-candidate"
+  - name: Seal the preparation artifact
+    id: candidate
+    if: ${{ inputs.operation == 'prepare' }}
+    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+    with:
+      name: node-repair-candidate-${{ inputs.request-id }}
+      if-no-files-found: error
+      path: |
+        ${{ runner.temp }}/node-repair-candidate/candidate.patch
+        ${{ runner.temp }}/node-repair-candidate/audit.json
+        ${{ runner.temp }}/node-repair-candidate/result.md
diff --git a/node/runtime/repair.py b/node/runtime/repair.py
new file mode 100644
index 0000000..2bd35e6
--- /dev/null
+++ b/node/runtime/repair.py
@@ -0,0 +1,588 @@
+"""Guard and seal one selected pnpm repair candidate; run no project scripts."""
+
+import argparse
+import copy
+import json
+import os
+import re
+import runpy
+import subprocess
+import time
+from collections import Counter
+from contextlib import contextmanager
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).parent
+CHOICES = runpy.run_path(str(ROOT / "repair_choices.py"))
+ENGINE = runpy.run_path(str(ROOT / "templates/dependency_audit.py"))
+PROJECT = runpy.run_path(str(ROOT / "project.py"))
+CANDIDATE_INSTALL = (
+    "install",
+    "--lockfile-only",
+    "--ignore-scripts",
+    "--ignore-pnpmfile",
+)
+HOOK_ENV = {
+    f"{namespace}_config_{setting}": "true"
+    for namespace in ("npm", "pnpm")
+    for setting in ("ignore_scripts", "ignore_pnpmfile")
+}
+
+
+def json_object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError("Duplicate JSON field")
+        result[key] = value
+    return result
+
+
+def request():
+    number = os.environ["REPAIR_PR"]
+    if not re.fullmatch(r"[1-9][0-9]*", number):
+        raise ValueError("Invalid PR number")
+    items = CHOICES["validate"](
+        json.loads(os.environ["REPAIR_SELECTIONS"], object_pairs_hook=json_object)
+    )
+    CHOICES["fingerprint"](
+        int(number), os.environ["REPAIR_HEAD"], os.environ["REPAIR_BASE"], items
+    )
+    identifier = os.environ["REPAIR_REQUEST"]
+    repository = os.environ["GITHUB_REPOSITORY"]
+    if not re.fullmatch(r"[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}", identifier):
+        raise ValueError("Invalid request identifier")
+    if not re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", repository) or not items:
+        raise ValueError("A repository and a nonempty selected batch are required")
+    return dict(
+        id=identifier,
+        repository=repository,
+        head=os.environ["REPAIR_HEAD"],
+        base=os.environ["REPAIR_BASE"],
+        pr=int(number),
+        selections=items,
+    )
+
+
+def gh(path):
+    return json.loads(subprocess.check_output(["gh", "api", path], text=True))
+
+
+def git(*args):
+    return subprocess.check_output(["git", *args], text=True)
+
+
+def guard(expected):
+    repo = expected["repository"]
+    repository = gh(f"repos/{repo}")
+    pr = gh(f"repos/{repo}/pulls/{expected['pr']}")
+    body = pr.get("body") or ""
+    markers = [
+        line
+        for line in re.split(r"\r?\n", body)
+        if "<!-- node-repair:revision:" in line
+    ]
+    if (
+        repository.get("full_name") != repo
+        or type(repository.get("id")) is not int
+        or not repository.get("default_branch")
+        or pr.get("number") != expected["pr"]
+        or pr.get("state") != "open"
+        or pr.get("user", {}).get("type") != "Bot"
+        or any(
+            pr.get(side, {}).get("repo", {}).get("id") != repository["id"]
+            for side in ("head", "base")
+        )
+        or pr.get("head", {}).get("ref") != "maintenance/node-security"
+        or pr.get("base", {}).get("ref") != repository["default_branch"]
+        or pr["head"].get("sha") != expected["head"]
+        or pr["base"].get("sha") != expected["base"]
+        or markers != [CHOICES["revision_marker"](expected["head"], expected["base"])]
+        or CHOICES["parse"](body) != expected["selections"]
+    ):
+        raise ValueError("PR state or selections changed; request a fresh repair")
+    return pr
+
+
+@contextmanager
+def suppress_hooks():
+    previous = {key: os.environ.get(key) for key in HOOK_ENV}
+    os.environ.update(HOOK_ENV)
+    try:
+        yield
+    finally:
+        for key, value in previous.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+
+
+def project_path(root, name):
+    if not isinstance(name, str) or not name or "\\" in name:
+        raise ValueError("Invalid project directory")
+    relative = Path(name)
+    if relative.is_absolute() or ".." in relative.parts:
+        raise ValueError("Project directory must stay inside the repository")
+    path = root
+    for part in relative.parts:
+        path /= part
+        if path.is_symlink():
+            raise ValueError("Symlinked project parents are unsupported")
+    return relative.as_posix()
+
+
+def project_context():
+    root = Path.cwd().resolve()
+    config_path = (
+        Path(os.environ.get("RUNNER_TEMP", "/tmp")) / "node-repair-config.json"
+    )
+    directory, selected = PROJECT["resolve_for_run"](root, config_path, [])
+    configuration = json.loads(config_path.read_text())["configuration"]
+    name = project_path(root, configuration["directory"])
+    if root / name != directory or selected["manager"] != "pnpm":
+        raise ValueError("Repair attempts require a standalone pnpm project")
+    PROJECT["verify_runtime"](directory, selected)
+    snapshot = ENGINE["valid_snapshot"](directory)
+    if snapshot is None:
+        raise ValueError("Invalid project snapshot")
+    return directory, selected, snapshot
+
+
+def update_policy(text, items):
+    """Replace only the selected scalar values, preserving comments and layout."""
+    tree = yaml.compose(text)
+    if not isinstance(tree, yaml.MappingNode):
+        raise ValueError("Invalid pnpm policy")
+    overrides = [value for key, value in tree.value if key.value == "overrides"]
+    if len(overrides) != 1 or not isinstance(overrides[0], yaml.MappingNode):
+        raise ValueError("Exactly one plain overrides mapping is required")
+    edits = []
+    for item in items:
+        values = [v for k, v in overrides[0].value if k.value == item["name"]]
+        if (
+            len(values) != 1
+            or not isinstance(values[0], yaml.ScalarNode)
+            or values[0].tag != "tag:yaml.org,2002:str"
+            or values[0].value != item["from"]
+        ):
+            raise ValueError(f"The exact pin for {item['name']} changed")
+        value = values[0]
+        edits.append(
+            (value.start_mark.index, value.end_mark.index, json.dumps(item["to"]))
+        )
+    for start, end, replacement in sorted(edits, reverse=True):
+        text = text[:start] + replacement + text[end:]
+    return text
+
+
+def check_scope(before, after, items):
+    if before is None or after is None or before[0] != after[0]:
+        raise ValueError("The repair changed package.json or invalidated package files")
+    old, new = (yaml.safe_load(s[1]["pnpm-workspace.yaml"]) for s in (before, after))
+    expected = copy.deepcopy(old)
+    for item in items:
+        if old.get("overrides", {}).get(item["name"]) != item["from"]:
+            raise ValueError("The approved pin changed")
+        expected["overrides"][item["name"]] = item["to"]
+    if expected != new:
+        raise ValueError("The repair changed unapproved pnpm policy")
+    versions = [ENGINE["locked_version_sets"](s[3]) for s in (before, after)]
+    selected = {item["name"]: item for item in items}
+    for name in versions[0].keys() | versions[1].keys():
+        if name not in selected and versions[0].get(name) != versions[1].get(name):
+            raise ValueError(f"The repair changed an unselected package: {name}")
+    for item in items:
+        if any(
+            v.get(item["name"]) != {item[key]}
+            for v, key in zip(versions, ("from", "to"))
+        ):
+            raise ValueError("The approved version must cover every installed instance")
+
+    def version(name, value):
+        if name in selected and isinstance(value, str):
+            base, separator, peers = value.partition("(")
+            if base in (selected[name]["from"], selected[name]["to"]):
+                return "<selected>" + separator + peers
+        return value
+
+    def normalize(snapshot):
+        lock = yaml.safe_load(snapshot[1]["pnpm-lock.yaml"])
+        for name, value in lock.get("overrides", {}).items():
+            lock["overrides"][name] = version(name, value)
+        for importer in lock.get("importers", {}).values():
+            for section in ("dependencies", "devDependencies", "optionalDependencies"):
+                for name, edge in importer.get(section, {}).items():
+                    if name in selected and isinstance(edge, dict):
+                        for field in ("specifier", "version"):
+                            if field in edge:
+                                edge[field] = version(name, edge[field])
+        for section in ("packages", "snapshots"):
+            entries = lock.get(section, {})
+            for key in list(entries):
+                name, separator, base = key.split("(", 1)[0].rpartition("@")
+                if (
+                    separator
+                    and name in selected
+                    and base in (selected[name]["from"], selected[name]["to"])
+                ):
+                    suffix = key[len(f"{name}@{base}") :]
+                    del entries[key]
+                    entries[f"{name}@<selected>{suffix}"] = None
+                    continue
+                if section == "snapshots":
+                    for kind in ("dependencies", "optionalDependencies"):
+                        for name, value in entries[key].get(kind, {}).items():
+                            entries[key][kind][name] = version(name, value)
+        return lock
+
+    if normalize(before) != normalize(after):
+        raise ValueError("The repair changed unrelated lockfile metadata or edges")
+
+
+def verified_targets(directory, before, snapshot, items, deadline, age):
+    proof = copy.deepcopy(before)
+    validate_audit(proof)
+    ENGINE["describe_pnpm_fixes"](
+        directory, proof, snapshot[1], [], deadline, {}, collect_proof=True
+    )
+    cutoff = datetime.now(timezone.utc) - timedelta(minutes=age)
+    for item in items:
+        if (
+            yaml.safe_load(snapshot[1]["pnpm-workspace.yaml"])
+            .get("overrides", {})
+            .get(item["name"])
+            != item["from"]
+        ):
+            raise ValueError("Approved exact pin is missing")
+        details = proof["vulnerabilities"].get(item["name"], {}).get("via", [])
+        if not details or any(
+            detail.get("_repairFrom") != item["from"]
+            or item["to"] not in detail.get("_verifiedRepairVersions", [])
+            or item["from"] not in detail.get("_verifiedVulnerableVersions", [])
+            for detail in details
+        ):
+            raise ValueError("Published patch and parent compatibility are unverified")
+        for field in ("dependencies", "devDependencies", "optionalDependencies"):
+            constraint = snapshot[2].get(field, {}).get(item["name"])
+            if constraint is None:
+                continue
+            allowed = False
+            for alternative in (
+                constraint.split("||") if isinstance(constraint, str) else []
+            ):
+                result = ENGINE["run"](
+                    directory,
+                    "view",
+                    f"{item['name']}@{alternative.strip()} {item['to']}",
+                    "version",
+                    "--json",
+                    deadline=deadline,
+                )
+                try:
+                    values = json.loads(result.stdout)
+                except ValueError:
+                    values = None
+                if result.returncode == 0 and (
+                    values == item["to"]
+                    or isinstance(values, list)
+                    and item["to"] in values
+                ):
+                    allowed = True
+            if not allowed:
+                raise ValueError("Direct manifest compatibility is unverified")
+        result = ENGINE["run"](
+            directory, "view", item["name"], "time", "--json", deadline=deadline
+        )
+        if result.returncode:
+            raise ValueError("Release publication time is unavailable")
+        published = json.loads(result.stdout).get(item["to"])
+        if not isinstance(published, str):
+            raise ValueError("Release publication time is unavailable")
+        stamp = datetime.fromisoformat(published.replace("Z", "+00:00"))
+        if stamp.tzinfo is None or stamp > cutoff:
+            raise ValueError("The selected patch has not passed the release cooldown")
+    if ENGINE["valid_snapshot"](directory) != snapshot:
+        raise ValueError("Metadata lookup changed dependency files")
+    return proof
+
+
+def validate_audit(data):
+    if (
+        not isinstance(data, dict)
+        or data.get("package_manager") != "pnpm"
+        or not isinstance(data.get("metadata"), dict)
+        or not isinstance(data.get("advisories"), dict)
+        or not isinstance(data.get("vulnerabilities"), dict)
+        or data.get("error")
+    ):
+        raise ValueError("A complete structured pnpm audit is required")
+    raw = []
+    for advisory in data["advisories"].values():
+        if (
+            not isinstance(advisory, dict)
+            or any(
+                not isinstance(advisory.get(key), str) or not advisory[key]
+                for key in (
+                    "module_name",
+                    "severity",
+                    "title",
+                    "url",
+                    "vulnerable_versions",
+                )
+            )
+            or advisory["severity"] not in ENGINE["SEVERITY_ORDER"]
+            or not isinstance(advisory.get("findings"), list)
+            or any(
+                not isinstance(finding, dict)
+                or not isinstance(finding.get("version"), str)
+                or not finding["version"]
+                for finding in advisory["findings"]
+            )
+            or "patched_versions" not in advisory
+            or advisory["patched_versions"] is not None
+            and not isinstance(advisory["patched_versions"], str)
+        ):
+            raise ValueError("Malformed raw audit advisory")
+        raw.append(
+            (
+                advisory["module_name"],
+                advisory["title"],
+                advisory["url"],
+                advisory["vulnerable_versions"],
+                advisory["severity"],
+                tuple(
+                    sorted(
+                        f"{advisory['module_name']}@{finding['version']}"
+                        for finding in advisory["findings"]
+                    )
+                ),
+                advisory["patched_versions"],
+            )
+        )
+    observed = []
+    for name, finding in data["vulnerabilities"].items():
+        if (
+            not isinstance(name, str)
+            or not name
+            or not isinstance(finding, dict)
+            or not isinstance(finding.get("via"), list)
+            or not finding["via"]
+        ):
+            raise ValueError("Malformed audit finding")
+        for detail in finding["via"]:
+            if (
+                not isinstance(detail, dict)
+                or any(
+                    not isinstance(detail.get(key), str) or not detail[key]
+                    for key in ("title", "url", "range", "severity")
+                )
+                or detail["severity"] not in ENGINE["SEVERITY_ORDER"]
+                or not isinstance(detail.get("nodes"), list)
+                or any(not isinstance(node, str) for node in detail["nodes"])
+                or "patchedRange" not in detail
+                or detail["patchedRange"] is not None
+                and not isinstance(detail["patchedRange"], str)
+            ):
+                raise ValueError("Malformed audit advisory")
+            observed.append(
+                (
+                    name,
+                    detail["title"],
+                    detail["url"],
+                    detail["range"],
+                    detail["severity"],
+                    tuple(sorted(detail["nodes"])),
+                    detail.get("patchedRange"),
+                )
+            )
+    if Counter(raw) != Counter(observed):
+        raise ValueError("Raw and normalized audit advisories do not match")
+    normalized = {
+        str(index): detail
+        for index, (_, _, detail) in enumerate(ENGINE["audit_entries"](data, "pnpm"))
+    }
+    if (
+        not ENGINE["counts_match_details"](
+            data["metadata"].get("vulnerabilities"),
+            data["vulnerabilities"],
+            "pnpm",
+            data["advisories"],
+        )
+        or not ENGINE["counts_match_details"](
+            data["metadata"].get("vulnerabilities"),
+            data["vulnerabilities"],
+            "pnpm",
+            normalized,
+        )
+        or ENGINE["finding_ids"](data, "pnpm") is None
+    ):
+        raise ValueError("Audit counts do not match findings")
+
+
+def validate_envelope(data, expected, directory):
+    if (
+        not isinstance(data, dict)
+        or set(data)
+        != {"schema_version", "request", "project_directory", "before", "candidate"}
+        or type(data["schema_version"]) is not int
+        or data["schema_version"] != 1
+        or not isinstance(data["request"], dict)
+        or set(data["request"])
+        != {"id", "repository", "head", "base", "pr", "selections"}
+        or data["request"] != expected
+        or type(data["request"].get("pr")) is not int
+        or data["project_directory"] != directory
+        or project_path(Path.cwd().resolve(), directory) != directory
+    ):
+        raise ValueError("Candidate audit does not match the request and project")
+    CHOICES["fingerprint"](
+        expected["pr"], expected["head"], expected["base"], expected["selections"]
+    )
+    for key in ("before", "candidate"):
+        validate_audit(data[key])
+    remaining = ENGINE["finding_ids"](data["candidate"], "pnpm")
+    for item in expected["selections"]:
+        details = data["before"]["vulnerabilities"].get(item["name"], {}).get("via", [])
+        if not details or any(
+            detail["url"] in remaining
+            or item["to"] not in detail.get("_verifiedRepairVersions", [])
+            or item["from"] not in detail.get("_verifiedVulnerableVersions", [])
+            for detail in details
+        ):
+            raise ValueError("Selected fixes are not confirmed by the audit evidence")
+    if ENGINE["newly_reported_findings"](data["before"], data["candidate"], "pnpm"):
+        raise ValueError("The candidate introduced findings")
+    return data
+
+
+def read_envelope(path, expected, directory):
+    if path.is_symlink() or not path.is_file():
+        raise ValueError("Candidate audit must be a regular file")
+    return validate_envelope(
+        json.loads(path.read_text(encoding="utf-8"), object_pairs_hook=json_object),
+        expected,
+        directory,
+    )
+
+
+def export_patch(paths):
+    return subprocess.check_output(
+        [
+            "git",
+            "diff",
+            "--no-ext-diff",
+            "--no-textconv",
+            "--binary",
+            "HEAD",
+            "--",
+            *paths,
+        ]
+    )
+
+
+def prepare(expected, artifact):
+    with suppress_hooks():
+        return prepare_candidate(expected, artifact)
+
+
+def prepare_candidate(expected, artifact):
+    root = Path.cwd().resolve()
+    if (
+        git("rev-parse", "HEAD").strip() != expected["head"]
+        or git("status", "--porcelain", "--untracked-files=all").strip()
+    ):
+        raise ValueError("Preparation requires a clean checkout of the expected head")
+    directory, selected, snapshot = project_context()
+    deadline = time.monotonic() + 40 * 60
+    before = ENGINE["audit"](directory, deadline=deadline)
+    items = expected["selections"]
+    proof = verified_targets(
+        directory, before, snapshot, items, deadline, selected["minimumReleaseAge"]
+    )
+    workspace = directory / "pnpm-workspace.yaml"
+    workspace.write_text(update_policy(workspace.read_text(), items))
+    if ENGINE["run"](directory, *CANDIDATE_INSTALL, deadline=deadline).returncode:
+        raise ValueError("Candidate lockfile resolution failed")
+    candidate = ENGINE["valid_snapshot"](directory)
+    check_scope(snapshot, candidate, items)
+    after = ENGINE["audit"](directory, deadline=deadline)
+    validate_audit(after)
+    fixed = ENGINE["confirmed_fixes"](proof, after, "pnpm", snapshot, candidate)
+    required = {
+        detail["url"]
+        for item in items
+        for detail in proof["vulnerabilities"][item["name"]]["via"]
+    }
+    if not required <= fixed:
+        raise ValueError("The candidate did not confirm every selected advisory fix")
+    ENGINE["describe_pnpm_fixes"](directory, after, candidate[1], [], deadline, {})
+    if ENGINE["valid_snapshot"](directory) != candidate:
+        raise ValueError("Audit lookup changed the candidate")
+    paths = [
+        (directory / name).relative_to(root).as_posix()
+        for name in ("pnpm-workspace.yaml", "pnpm-lock.yaml")
+    ]
+    status = git("status", "--porcelain=v1", "-z", "--untracked-files=all")
+    if any(
+        not entry.startswith(" M ") or entry[3:] not in paths
+        for entry in status.split("\0")
+        if entry
+    ):
+        raise ValueError(
+            "Preparation changed files outside the selected dependency scope"
+        )
+    patch = export_patch(paths)
+    if not patch:
+        raise ValueError("No candidate changes were produced")
+    envelope = dict(
+        schema_version=1,
+        request=expected,
+        project_directory=directory.relative_to(root).as_posix(),
+        before=proof,
+        candidate=after,
+    )
+    validate_envelope(envelope, expected, envelope["project_directory"])
+    report = (
+        "## Package security candidate\n\n"
+        "Candidate preparation succeeded. Project validation has not run. No dependency change has been published.\n\n"
+        + ENGINE["format_audit_summary"](
+            proof, after, "pnpm", fixed_ids=fixed, locks=(snapshot[3], candidate[3])
+        )
+    )
+    if artifact.resolve() != artifact or artifact.is_relative_to(root):
+        raise ValueError("Candidate artifacts must be outside the project checkout")
+    artifact.mkdir(parents=True, exist_ok=False)
+    (artifact / "candidate.patch").write_bytes(patch)
+    (artifact / "audit.json").write_text(
+        json.dumps(envelope, ensure_ascii=False) + "\n"
+    )
+    (artifact / "result.md").write_text(report + "\n")
+    if set(p.name for p in artifact.iterdir()) != {
+        "candidate.patch",
+        "audit.json",
+        "result.md",
+    } or any(p.is_symlink() or not p.is_file() for p in artifact.iterdir()):
+        raise ValueError("Invalid sealed artifact members")
+    return envelope
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("operation", choices=("guard", "prepare"))
+    parser.add_argument("--artifact", type=Path)
+    args = parser.parse_args()
+    expected = request()
+    if args.operation == "guard":
+        guard(expected)
+    elif args.artifact is None:
+        parser.error("prepare requires --artifact")
+    else:
+        prepare(expected, args.artifact)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/node/tests/test_selected_repairs.py b/node/tests/test_selected_repairs.py
index 62bf52f..3483e85 100644
--- a/node/tests/test_selected_repairs.py
+++ b/node/tests/test_selected_repairs.py
@@ -2,7 +2,11 @@
 
 import copy
 import json
+import os
 import runpy
+import shlex
+import subprocess
+import sys
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -12,6 +16,7 @@
 ROOT = Path(__file__).parents[2]
 CHOICES = runpy.run_path(str(ROOT / "node/runtime/repair_choices.py"))
 ENGINE = runpy.run_path(str(ROOT / "node/runtime/templates/dependency_audit.py"))
+REPAIR = runpy.run_path(str(ROOT / "node/runtime/repair.py"))
 FIXTURES = json.loads((ROOT / "repair-app/selection-fixtures.json").read_text())
 ITEM = {"name": "launch-editor", "from": "2.14.1", "to": "2.14.2"}
 REVISION = {"head": "a" * 40, "base": "b" * 40}
@@ -301,3 +306,620 @@ def test_html_evidence_escapes_registry_content_and_refuses_bad_links():
     detail["url"] = "javascript:alert(1)"
     report = ENGINE["format_audit_summary"](data, data, "pnpm", repair_options=[ITEM])
     assert "javascript:" not in report
+
+
+def repair_request():
+    return {
+        "id": "12345678-1234-1234-1234-123456789abc",
+        "repository": "example/project",
+        "head": REVISION["head"],
+        "base": REVISION["base"],
+        "pr": 12,
+        "selections": [ITEM],
+    }
+
+
+def repair_audit():
+    data = findings()
+    detail = data["vulnerabilities"][ITEM["name"]]["via"][0]
+    data["advisories"] = {
+        "1": {
+            "module_name": ITEM["name"],
+            "severity": detail["severity"],
+            "title": detail["title"],
+            "url": detail["url"],
+            "vulnerable_versions": detail["range"],
+            "patched_versions": detail["patchedRange"],
+            "findings": [{"version": ITEM["from"]}],
+        }
+    }
+    data["vulnerabilities"][ITEM["name"]]["via"][0]["_verifiedVulnerableVersions"] = [
+        ITEM["from"]
+    ]
+    return data
+
+
+@pytest.mark.parametrize(
+    "key,value",
+    [
+        (None, None),
+        ("REPAIR_PR", "0"),
+        ("REPAIR_PR", "01"),
+        ("REPAIR_REQUEST", "not-a-uuid"),
+        ("REPAIR_HEAD", "A" * 40),
+        ("REPAIR_BASE", "main"),
+        ("REPAIR_SELECTIONS", "[]"),
+        ("GITHUB_REPOSITORY", "../outside/project"),
+    ],
+)
+def test_repair_request_validates_the_fixed_dispatch_inputs(monkeypatch, key, value):
+    expected = repair_request()
+    for variable, setting in {
+        "REPAIR_REQUEST": expected["id"],
+        "GITHUB_REPOSITORY": expected["repository"],
+        "REPAIR_PR": str(expected["pr"]),
+        "REPAIR_HEAD": expected["head"],
+        "REPAIR_BASE": expected["base"],
+        "REPAIR_SELECTIONS": json.dumps(expected["selections"]),
+    }.items():
+        monkeypatch.setenv(variable, setting)
+    if key is None:
+        assert REPAIR["request"]() == expected
+    else:
+        monkeypatch.setenv(key, value)
+        with pytest.raises(ValueError):
+            REPAIR["request"]()
+
+
+def empty_audit():
+    return {
+        "package_manager": "pnpm",
+        "metadata": {"vulnerabilities": {"high": 0}},
+        "advisories": {},
+        "vulnerabilities": {},
+    }
+
+
+def envelope():
+    return dict(
+        schema_version=1,
+        request=repair_request(),
+        project_directory=".",
+        before=repair_audit(),
+        candidate=empty_audit(),
+    )
+
+
+@pytest.mark.parametrize(
+    "problem",
+    [
+        None,
+        "head",
+        "base",
+        "fork",
+        "branch",
+        "author",
+        "closed",
+        "number",
+        "selection",
+        "marker",
+        "duplicate-marker",
+        "unicode-marker",
+        "crlf",
+    ],
+)
+def test_repair_guard_rechecks_canonical_pr_without_an_idle_check(monkeypatch, problem):
+    expected = repair_request()
+    repository = {
+        "id": 123,
+        "full_name": expected["repository"],
+        "default_branch": "main",
+    }
+    pr = {
+        "number": 12,
+        "state": "open",
+        "user": {"type": "Bot"},
+        "head": {
+            "repo": {"id": 123},
+            "ref": "maintenance/node-security",
+            "sha": expected["head"],
+        },
+        "base": {"repo": {"id": 123}, "ref": "main", "sha": expected["base"]},
+        "body": CHOICES["render"]([ITEM], **REVISION).replace("[ ]", "[x]"),
+    }
+    if problem in ("head", "base"):
+        pr[problem]["sha"] = "c" * 40
+    elif problem == "fork":
+        pr["head"]["repo"]["id"] = 999
+    elif problem == "branch":
+        pr["head"]["ref"] = "main"
+    elif problem == "author":
+        pr["user"]["type"] = "User"
+    elif problem == "closed":
+        pr["state"] = "closed"
+    elif problem == "number":
+        pr["number"] = 13
+    elif problem == "selection":
+        pr["body"] = pr["body"].replace("[x]", "[ ]")
+    elif problem == "marker":
+        pr["body"] = pr["body"].replace(expected["head"], "c" * 40)
+    elif problem == "duplicate-marker":
+        pr["body"] += "\n" + CHOICES["revision_marker"](**REVISION)
+    elif problem == "unicode-marker":
+        marker = CHOICES["revision_marker"](**REVISION)
+        pr["body"] = pr["body"].replace(marker, "prefix\u2028" + marker)
+    elif problem == "crlf":
+        pr["body"] = pr["body"].replace("\n", "\r\n")
+    paths = []
+
+    def read(path):
+        paths.append(path)
+        return pr if "/pulls/" in path else repository
+
+    fn = REPAIR["guard"]
+    monkeypatch.setitem(fn.__globals__, "gh", read)
+    if problem and problem != "crlf":
+        with pytest.raises(ValueError):
+            fn(expected)
+    else:
+        assert fn(expected) == pr
+    assert paths == ["repos/example/project", "repos/example/project/pulls/12"]
+
+
+@pytest.mark.parametrize(
+    "field,value",
+    [
+        ("schema_version", True),
+        ("schema_version", 2),
+        ("request", {}),
+        ("before", "unavailable"),
+        ("candidate", {}),
+        ("project_directory", "../outside"),
+        ("project_directory", "/tmp/project"),
+        ("project_directory", "./"),
+        ("extra", "untrusted"),
+    ],
+)
+def test_strict_candidate_envelope_rejects_wrong_fields(field, value):
+    data = envelope()
+    data[field] = value
+    with pytest.raises(ValueError):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+
+
+@pytest.mark.parametrize(
+    "field,value",
+    [
+        ("id", "another-request"),
+        ("repository", "other/repo"),
+        ("head", "c" * 40),
+        ("base", "c" * 40),
+        ("pr", 13),
+        ("pr", True),
+        ("selections", [{**ITEM, "to": "2.14.3"}]),
+        ("extra", True),
+    ],
+)
+def test_strict_candidate_envelope_binds_every_request_field(field, value):
+    data = envelope()
+    data["request"][field] = value
+    with pytest.raises(ValueError):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+
+
+@pytest.mark.parametrize(
+    "missing", ["schema_version", "request", "project_directory", "before", "candidate"]
+)
+def test_candidate_envelope_rejects_missing_fields(missing):
+    data = envelope()
+    del data[missing]
+    with pytest.raises(ValueError):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+
+
+@pytest.mark.parametrize("advisory", ["malformed", {"severity": "unknown"}])
+def test_candidate_rejects_raw_advisories_hidden_from_normalized_counts(advisory):
+    data = envelope()
+    data["candidate"]["advisories"]["bad"] = advisory
+    with pytest.raises(ValueError, match="raw audit"):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+
+
+@pytest.mark.parametrize(
+    "field,value",
+    [
+        ("module_name", "other"),
+        ("title", "other"),
+        ("url", "https://other"),
+        ("severity", "low"),
+        ("vulnerable_versions", "*"),
+        ("patched_versions", None),
+        ("findings", [{"version": "2.14.0"}]),
+        ("findings", ["malformed"]),
+        ("findings", [{"version": ""}]),
+    ],
+)
+def test_envelope_raw_and_normalized_advisory_evidence_must_agree(field, value):
+    data = envelope()
+    data["before"]["advisories"]["1"][field] = value
+    with pytest.raises(ValueError, match="advisory|advisories"):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+
+
+@pytest.mark.parametrize("value", [[], {}, False])
+def test_envelope_rejects_malformed_normalized_patch_range(value):
+    data = envelope()
+    data["before"]["vulnerabilities"][ITEM["name"]]["via"][0]["patchedRange"] = value
+    with pytest.raises(ValueError, match="Malformed audit"):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+
+
+def test_envelope_reads_exact_json_and_rejects_symlinks_and_unproved_fixes(
+    monkeypatch, tmp_path
+):
+    monkeypatch.chdir(tmp_path)
+    path = tmp_path / "audit.json"
+    path.write_text(json.dumps(envelope()))
+    assert REPAIR["read_envelope"](path, repair_request(), ".") == envelope()
+    path.write_text('{"schema_version":1,' + json.dumps(envelope())[1:])
+    with pytest.raises(ValueError, match="Duplicate"):
+        REPAIR["read_envelope"](path, repair_request(), ".")
+    link = tmp_path / "link.json"
+    link.symlink_to(path)
+    with pytest.raises(ValueError, match="regular"):
+        REPAIR["read_envelope"](link, repair_request(), ".")
+    (tmp_path / "real").mkdir()
+    (tmp_path / "alias").symlink_to(tmp_path / "real", target_is_directory=True)
+    data = {**envelope(), "project_directory": "alias"}
+    with pytest.raises(ValueError, match="Symlinked"):
+        REPAIR["validate_envelope"](data, repair_request(), "alias")
+    for key in ["_verifiedRepairVersions", "_verifiedVulnerableVersions"]:
+        data = envelope()
+        del data["before"]["vulnerabilities"][ITEM["name"]]["via"][0][key]
+        with pytest.raises(ValueError, match="not confirmed"):
+            REPAIR["validate_envelope"](data, repair_request(), ".")
+    data = envelope()
+    data["candidate"] = repair_audit()
+    with pytest.raises(ValueError, match="not confirmed"):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+    data = envelope()
+    data["before"]["metadata"]["vulnerabilities"]["high"] = 0
+    with pytest.raises(ValueError, match="counts"):
+        REPAIR["validate_envelope"](data, repair_request(), ".")
+
+
+def repair_files(directory, version="2.14.1"):
+    policy = {
+        "packages": ["."],
+        "minimumReleaseAge": 14400,
+        "overrides": {ITEM["name"]: version, "untouched": "1.0.0"},
+    }
+    lock = {
+        "lockfileVersion": "9.0",
+        "settings": {"autoInstallPeers": True},
+        "overrides": policy["overrides"],
+        "importers": {
+            ".": {
+                "dependencies": {
+                    ITEM["name"]: {
+                        "specifier": version,
+                        "version": version + "(peer@1.0.0)",
+                    },
+                    "untouched": {"specifier": "^1.0.0", "version": "1.0.0"},
+                }
+            }
+        },
+        "packages": {
+            f"{ITEM['name']}@{version}": {"resolution": {"integrity": version}},
+            "untouched@1.0.0": {"resolution": {"integrity": "untouched"}},
+        },
+        "snapshots": {
+            f"{ITEM['name']}@{version}(peer@1.0.0)": {},
+            "untouched@1.0.0": {
+                "dependencies": {ITEM["name"]: version + "(peer@1.0.0)"}
+            },
+        },
+    }
+    (directory / "package.json").write_text(
+        json.dumps(
+            {
+                "name": "fixture",
+                "packageManager": "pnpm@11.21.0",
+                "dependencies": {ITEM["name"]: "^2.14.1"},
+            }
+        )
+    )
+    (directory / "pnpm-workspace.yaml").write_text(yaml.safe_dump(policy))
+    (directory / "pnpm-lock.yaml").write_text(yaml.safe_dump(lock))
+    return ENGINE["valid_snapshot"](directory)
+
+
+@pytest.mark.parametrize(
+    "problem",
+    [
+        None,
+        "setting",
+        "unselected-metadata",
+        "importer",
+        "peers",
+        "snapshot-peers",
+        "unselected-version",
+        "policy",
+        "manifest",
+    ],
+)
+def test_candidate_scope_preserves_unrelated_metadata_and_peer_suffixes(
+    tmp_path, problem
+):
+    before = repair_files(tmp_path)
+    after = repair_files(tmp_path, ITEM["to"])
+    assert before is not None and after is not None
+    if problem:
+        files = dict(after[1])
+        lock = yaml.safe_load(files["pnpm-lock.yaml"])
+        if problem == "setting":
+            lock["settings"]["autoInstallPeers"] = False
+        elif problem == "unselected-metadata":
+            lock["packages"]["untouched@1.0.0"]["resolution"]["integrity"] = "changed"
+        elif problem == "importer":
+            lock["importers"]["."]["dependencies"]["untouched"]["specifier"] = "*"
+        elif problem == "peers":
+            lock["importers"]["."]["dependencies"][ITEM["name"]]["version"] = (
+                ITEM["to"] + "(peer@2.0.0)"
+            )
+        elif problem == "unselected-version":
+            lock["packages"]["added@1.0.0"] = {}
+        elif problem == "snapshot-peers":
+            key = ITEM["name"] + "@" + ITEM["to"] + "(peer@1.0.0)"
+            lock["snapshots"][key.replace("peer@1.0.0", "peer@2.0.0")] = lock[
+                "snapshots"
+            ].pop(key)
+        elif problem == "policy":
+            policy = yaml.safe_load(files["pnpm-workspace.yaml"])
+            policy["minimumReleaseAge"] = 0
+            files["pnpm-workspace.yaml"] = yaml.safe_dump(policy).encode()
+        elif problem == "manifest":
+            (tmp_path / "package.json").write_text('{"packageManager":"pnpm@11.21.0"}')
+        files["pnpm-lock.yaml"] = yaml.safe_dump(lock).encode()
+        for name, value in files.items():
+            (tmp_path / name).write_bytes(value)
+        after = ENGINE["valid_snapshot"](tmp_path)
+        with pytest.raises(ValueError):
+            REPAIR["check_scope"](before, after, [ITEM])
+    else:
+        REPAIR["check_scope"](before, after, [ITEM])
+
+
+@pytest.mark.parametrize(
+    "problem", [None, "parent", "direct", "young", "unavailable", "pin"]
+)
+def test_targets_use_verified_sets_and_independent_direct_constraints(
+    monkeypatch, tmp_path, problem
+):
+    snapshot = repair_files(tmp_path)
+    fn = REPAIR["verified_targets"]
+    engine = fn.__globals__["ENGINE"]
+    target = {**ITEM, "to": "2.14.3"}
+
+    def describe(directory, proof, files, *args, **kwargs):
+        detail = proof["vulnerabilities"][ITEM["name"]]["via"][0]
+        detail.update(
+            fixVersion="2.14.2",
+            _repairFrom=ITEM["from"],
+            _verifiedVulnerableVersions=[ITEM["from"]],
+            _verifiedRepairVersions=[] if problem == "parent" else ["2.14.2", "2.14.3"],
+        )
+
+    def lookup(directory, command, package, *fields, **kwargs):
+        if fields[0] == "time":
+            value = {
+                target["to"]: "2999-01-01T00:00:00Z"
+                if problem == "young"
+                else "2020-01-01T00:00:00Z"
+            }
+        else:
+            assert package == "launch-editor@^2.14.1 2.14.3"
+            value = [] if problem == "direct" else target["to"]
+        return SimpleNamespace(
+            returncode=1 if problem == "unavailable" else 0, stdout=json.dumps(value)
+        )
+
+    monkeypatch.setitem(engine, "describe_pnpm_fixes", describe)
+    monkeypatch.setitem(engine, "run", lookup)
+    if problem == "pin":
+        target = {**target, "from": "2.14.0"}
+    if problem:
+        with pytest.raises(ValueError):
+            fn(tmp_path, repair_audit(), snapshot, [target], float("inf"), 14400)
+    else:
+        # A common selected patch may exceed this advisory's minimum patch.
+        proof = fn(tmp_path, repair_audit(), snapshot, [target], float("inf"), 14400)
+        assert (
+            target["to"]
+            in proof["vulnerabilities"][ITEM["name"]]["via"][0][
+                "_verifiedRepairVersions"
+            ]
+        )
+
+
+@pytest.mark.parametrize("problem", [None, "install", "audit", "scope", "extra-file"])
+def test_preparation_seals_only_three_members_without_validation(
+    monkeypatch, tmp_path, problem
+):
+    project = tmp_path / "project"
+    project.mkdir()
+    before = repair_files(project)
+    changed = tmp_path / "changed"
+    changed.mkdir()
+    candidate = repair_files(changed, ITEM["to"])
+    monkeypatch.chdir(project)
+    fn = REPAIR["prepare"]
+    module = fn.__globals__
+    engine = module["ENGINE"]
+    monkeypatch.setenv("npm_config_ignore_pnpmfile", "false")
+    monkeypatch.setitem(
+        module,
+        "project_context",
+        lambda: (project, {"minimumReleaseAge": 14400}, before),
+    )
+    monkeypatch.setitem(module, "verified_targets", lambda *a, **kw: repair_audit())
+    monkeypatch.setitem(module, "export_patch", lambda paths: b"sealed patch\n")
+    status = []
+
+    def command(*args):
+        if args == ("rev-parse", "HEAD"):
+            return REVISION["head"]
+        if "-z" in args:
+            return " M pnpm-lock.yaml\0 M pnpm-workspace.yaml\0" + (
+                "?? unrelated\0" if problem == "extra-file" else ""
+            )
+        status.append(args)
+        return ""
+
+    def install(directory, *args, **kwargs):
+        import os
+
+        assert args == REPAIR["CANDIDATE_INSTALL"]
+        assert all(
+            os.environ[key] == value for key, value in REPAIR["HOOK_ENV"].items()
+        )
+        (project / "pnpm-lock.yaml").write_bytes(candidate[1]["pnpm-lock.yaml"])
+        if problem == "scope":
+            (project / "package.json").write_text("{}")
+        return SimpleNamespace(returncode=1 if problem == "install" else 0)
+
+    audits = iter(
+        [repair_audit(), "unavailable" if problem == "audit" else empty_audit()]
+    )
+    monkeypatch.setitem(module, "git", command)
+    monkeypatch.setitem(engine, "run", install)
+    monkeypatch.setitem(engine, "audit", lambda *a, **kw: next(audits))
+    monkeypatch.setitem(engine, "describe_pnpm_fixes", lambda *a, **kw: None)
+    artifact = tmp_path / "sealed"
+    if problem:
+        with pytest.raises(ValueError):
+            fn(repair_request(), artifact)
+        assert not artifact.exists()
+    else:
+        result = fn(repair_request(), artifact)
+        assert set(p.name for p in artifact.iterdir()) == {
+            "candidate.patch",
+            "audit.json",
+            "result.md",
+        }
+        assert (
+            REPAIR["read_envelope"](artifact / "audit.json", repair_request(), ".")
+            == result
+        )
+        assert "Project validation has not run" in (artifact / "result.md").read_text()
+    import os
+
+    assert os.environ["npm_config_ignore_pnpmfile"] == "false"
+
+
+def test_patch_export_never_executes_repository_diff_helpers(monkeypatch, tmp_path):
+    def git(*args):
+        return subprocess.run(
+            ["git", *args], cwd=tmp_path, check=True, capture_output=True
+        )
+
+    git("init", "-q")
+    git("config", "user.name", "Fixture")
+    git("config", "user.email", "fixture@example.invalid")
+    path = tmp_path / "pnpm-workspace.yaml"
+    path.write_text("overrides: {launch-editor: 2.14.1}\n")
+    (tmp_path / ".gitattributes").write_text("*.yaml diff=evil\n")
+    git("add", ".")
+    git("commit", "-qm", "fixture")
+    hook = tmp_path / "external.sh"
+    hook.write_text("#!/bin/sh\ntouch helper-executed\nprintf forged\n")
+    hook.chmod(0o755)
+    git("config", "diff.evil.textconv", str(hook))
+    git("config", "diff.external", str(hook))
+    monkeypatch.setenv("GIT_EXTERNAL_DIFF", str(hook))
+    path.write_text("overrides: {launch-editor: 2.14.2}\n")
+    monkeypatch.chdir(tmp_path)
+    patch = REPAIR["export_patch"]([path.name])
+    assert b"-overrides: {launch-editor: 2.14.1}" in patch
+    assert b"+overrides: {launch-editor: 2.14.2}" in patch
+    assert not (tmp_path / "helper-executed").exists()
+
+
+def test_repair_workflow_uses_trusted_code_and_has_only_read_only_preparation():
+    workflow = yaml.safe_load((ROOT / ".github/workflows/node-repair.yml").read_text())
+    action = yaml.safe_load((ROOT / "node/repair/action.yml").read_text())
+    assert set(workflow["on"]["workflow_call"]["inputs"]) == {
+        "request-id",
+        "pull-request",
+        "expected-head",
+        "expected-base",
+        "selections",
+    }
+    assert set(workflow["jobs"]) == {"guard", "prepare"}
+    for job in workflow["jobs"].values():
+        assert set(job["permissions"].values()) == {"read"}
+        assert any(step.get("uses") == "$/node/repair" for step in job["steps"])
+    prepare = workflow["jobs"]["prepare"]
+    assert prepare["env"] == REPAIR["HOOK_ENV"]
+    checkout = prepare["steps"][0]
+    assert checkout["with"] == {
+        "ref": "${{ inputs.expected-head }}",
+        "persist-credentials": False,
+    }
+    assert "candidate-artifact-id" in prepare["outputs"]
+    upload = next(
+        step for step in action["runs"]["steps"] if step.get("id") == "candidate"
+    )
+    assert [Path(p).name for p in upload["with"]["path"].splitlines()] == [
+        "candidate.patch",
+        "audit.json",
+        "result.md",
+    ]
+    assert not any(
+        "validate" in step.get("run", "") or "publish" in step.get("run", "")
+        for step in action["runs"]["steps"]
+    )
+
+
+def test_parser_install_isolated_from_checkout_module_shadowing(tmp_path):
+    action = yaml.safe_load((ROOT / "node/repair/action.yml").read_text())
+    command = next(
+        step["run"]
+        for step in action["runs"]["steps"]
+        if step.get("name") == "Install configuration and audit parser"
+    )
+    assert command == "python -I -m pip install PyYAML==6.0.3"
+    legacy_command = command.replace("python -I -m pip", "python -m pip", 1)
+
+    for name, command_to_run, shadowed in [
+        ("legacy", legacy_command, True),
+        ("isolated", command, False),
+    ]:
+        checkout = tmp_path / name
+        checkout.mkdir()
+        marker = checkout / "project-code-executed"
+        (checkout / "pip.py").write_text(
+            "import os\nfrom pathlib import Path\n"
+            'Path(os.environ["PIP_SHADOW_MARKER"]).write_text("executed")\n'
+        )
+        environment = os.environ.copy()
+        environment.update(
+            {
+                "PIP_SHADOW_MARKER": str(marker),
+                "PIP_NO_INDEX": "true",
+                "PIP_DISABLE_PIP_VERSION_CHECK": "1",
+                "PIP_CACHE_DIR": str(tmp_path / "pip-cache"),
+            }
+        )
+        arguments = shlex.split(command_to_run)
+        assert arguments[0] == "python"
+        arguments[0] = sys.executable
+        result = subprocess.run(
+            arguments,
+            cwd=checkout,
+            env=environment,
+            capture_output=True,
+            text=True,
+        )
+        assert result.returncode == 0, result.stderr
+        assert marker.exists() is shadowed
diff --git a/node/tests/verify_node_project.py b/node/tests/verify_node_project.py
index 2b64e85..f5ebcb3 100644
--- a/node/tests/verify_node_project.py
+++ b/node/tests/verify_node_project.py
@@ -10,9 +10,99 @@
 from pathlib import Path
 from unittest.mock import patch
 
+import yaml
+
 ROOT = Path(__file__).parents[1]
 
 
+def check_pnpm_repair(project, command, version):
+    """Exercise real hooks and selected resolution through production primitives."""
+    repair = runpy.run_path(str(ROOT / "runtime/repair.py"))
+    engine = repair["ENGINE"]
+    fixture = project.parent / "repair"
+    fixture.mkdir()
+    markers = {
+        kind: fixture / f"{kind}-executed" for kind in ("local", "global", "lifecycle")
+    }
+    for kind in ("local", "global"):
+        hook = fixture / (".pnpmfile.cjs" if kind == "local" else "global-pnpmfile.cjs")
+        hook.write_text(
+            "require('node:fs').writeFileSync("
+            + json.dumps(str(markers[kind]))
+            + ", 'executed');\nmodule.exports = {};\n"
+        )
+    policy = yaml.safe_load(
+        (ROOT / "runtime/templates/pnpm-workspace.yaml").read_text()
+    )
+    policy.update(
+        overrides={"semver": "7.5.1"},
+        globalPnpmfile=str(fixture / "global-pnpmfile.cjs"),
+    )
+    workspace = fixture / "pnpm-workspace.yaml"
+    workspace.write_text(yaml.safe_dump(policy))
+    (fixture / "package.json").write_text(
+        json.dumps(
+            {
+                "name": "repair-hook-fixture",
+                "private": True,
+                "version": "1.0.0",
+                "packageManager": f"pnpm@{version}",
+                "dependencies": {
+                    "semver": "^7.5.1",
+                    "react": "18.2.0",
+                    "react-dom": "18.2.0",
+                },
+                "scripts": {
+                    "preinstall": "node -e "
+                    + json.dumps(
+                        "require('node:fs').writeFileSync("
+                        + json.dumps(str(markers["lifecycle"]))
+                        + ", 'executed')"
+                    )
+                },
+            }
+        )
+    )
+    subprocess.run(
+        [*command, "install", "--lockfile-only", "--ignore-scripts"],
+        cwd=fixture,
+        check=True,
+        timeout=180,
+    )
+    assert markers["local"].exists() and markers["global"].exists(), (
+        "Unsafe metadata resolution must reproduce both hooks"
+    )
+    assert not markers["lifecycle"].exists()
+    markers["local"].unlink()
+    markers["global"].unlink()
+    before = engine["valid_snapshot"](fixture)
+    assert before is not None
+    items = [{"name": "semver", "from": "7.5.1", "to": "7.5.2"}]
+    with repair["suppress_hooks"]():
+        for arguments in [
+            ("view", "semver@7.5.2", "version", "--json"),
+            ("audit", "--json"),
+        ]:
+            result = engine["run"](fixture, *arguments)
+            assert result.returncode in (0, 1), result.stderr
+            if arguments[0] == "view":
+                assert result.returncode == 0 and json.loads(result.stdout) == "7.5.2"
+        workspace.write_text(repair["update_policy"](workspace.read_text(), items))
+        result = engine["run"](fixture, *repair["CANDIDATE_INSTALL"])
+        assert result.returncode == 0, result.stderr
+        repair["check_scope"](before, engine["valid_snapshot"](fixture), items)
+    assert not any(path.exists() for path in markers.values()), (
+        "Preparation executed a project hook"
+    )
+    for snapshot in (before, engine["valid_snapshot"](fixture)):
+        lock = yaml.safe_load(snapshot[1]["pnpm-lock.yaml"])
+        assert (
+            lock["importers"]["."]["dependencies"]["react-dom"]["version"]
+            == "18.2.0(react@18.2.0)"
+        )
+    return "passed (real local/global hooks, view/audit/install, selected direct pin and unrelated peer suffix)"
+
+
 def check_npm_policy(version):
     """Prove real security repair and complete coverage under inherited config."""
     with tempfile.TemporaryDirectory(prefix="npm-policy-") as temporary:
@@ -232,6 +322,10 @@ def check(node, manager, version):
             "frozen_install_and_tests": "passed",
             "committed_state_validation": "passed without dependency changes",
         }
+        if manager == "pnpm":
+            result["selected_repair_preparation"] = check_pnpm_repair(
+                project, command, version
+            )
         if manager == "npm":
             result["inherited_npm_security_policy"] = check_npm_policy(version)
         return result
diff --git a/repair-app/pilot/README.md b/repair-app/pilot/README.md
index ef4b585..219aff9 100644
--- a/repair-app/pilot/README.md
+++ b/repair-app/pilot/README.md
@@ -28,3 +28,42 @@ failure must retain the active lock and saved conclusion until redelivery.
 Restore the original PR description after temporary probe selections, checking
 that no concurrent edit would be overwritten. Record actual source/deployment
 identities and distinguish local intercepted API tests from real GitHub events.
+
+## Isolated candidate-preparation acceptance
+
+After reviewing the preparation slice, use a separately authorized isolated
+repository. Replace its existing harmless caller's job with a call to the
+reviewed reusable workflow. Keep the default-branch workflow path
+`.github/workflows/dependency-repair.yml` and its five dispatch inputs unchanged.
+Do not replace Hydra's harmless caller or roll this out to other installations
+as part of this gate.
+
+Use the actual reviewed reference in place of `REVIEWED_REF`. For repeated
+experimentation, use a dedicated experimentation tag whose updates are reviewed.
+
+```yaml
+jobs:
+  candidate:
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: hydra-ecosystem/github-actions/.github/workflows/node-repair.yml@REVIEWED_REF
+    with:
+      request-id: ${{ inputs.request-id }}
+      pull-request: ${{ inputs.pull-request }}
+      expected-head: ${{ inputs.expected-head }}
+      expected-base: ${{ inputs.expected-base }}
+      selections: ${{ inputs.selections }}
+```
+
+Retain the exact caller and reusable-workflow revisions, the bot-authored managed
+PR's head/base, selected batch, Actions run and immutable candidate artifact ID.
+Inspect the downloaded artifact for exactly `candidate.patch`, `audit.json` and
+`result.md`. Verify request/project binding, allowed patch paths, unchanged
+unselected dependencies and a truthful preparation-only report. Also record
+that no project scripts ran and no repository dependency files were published.
+Stale consent and unavailable evidence must fail without a candidate artifact.
+
+Only guard and preparation are enabled now. This gate does not pass G-REPAIR,
+upgrade the PR or prove the later validation/publisher jobs. Those are added and
+tested in their owning slices before the final Hydra rollout.