fix: replace orchestrator-develop branch references with main

The orchestrator-develop branch no longer exists. Update all fallback clone commands and test fixtures to use main instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ci: set macOS builds to continue-on-error
2026-05-31 22:06:16 -07:00 · 2026-03-09 19:59:58 +00:00 · 2026-03-05 23:33:04 +00:00 · 2026-03-05 11:56:43 +00:00 · 2026-03-05 09:39:53 +00:00
16 changed files with 1727 additions and 1797 deletions
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -1,4 +1,5 @@
 {
+  "root": true,
  "plugins": ["jest", "@typescript-eslint", "prettier", "unicorn"],
  "extends": ["plugin:unicorn/recommended", "plugin:github/recommended", "plugin:prettier/recommended"],
  "parser": "@typescript-eslint/parser",
--- a/action.yml
+++ b/action.yml
@@ -279,30 +279,24 @@ inputs:
    description:
      '[Orchestrator] Specifies the repo for the unity builder. Useful if you forked the repo for testing, features, or
      fixes.'
-  gitIntegrityCheck:
-    description: 'Run git integrity checks before build (fsck, lock cleanup, submodule validation)'
+  syncStrategy:
+    description: 'Workspace sync strategy: full, git-delta, direct-input, storage-pull'
    required: false
-    default: 'false'
-  gitAutoRecover:
-    description: 'Attempt automatic recovery if git corruption is detected'
+    default: 'full'
+  syncInputRef:
+    description: 'URI for direct-input or storage-pull content (storage://remote/path or file path)'
    required: false
-    default: 'false'
-  cleanReservedFilenames:
-    description: 'Remove Windows reserved filenames that cause Unity import loops'
+  syncStorageRemote:
+    description: 'rclone remote name for storage-backed inputs (defaults to rcloneRemote)'
    required: false
-    default: 'false'
-  buildArchiveEnabled:
-    description: 'Archive build output after successful build'
+  syncRevertAfter:
+    description: 'Revert overlaid changes after job completion'
    required: false
-    default: 'false'
-  buildArchivePath:
-    description: 'Path to store build archives'
+    default: 'true'
+  syncStatePath:
+    description: 'Path to sync state file for delta tracking'
    required: false
-    default: './build-archives'
-  buildArchiveRetention:
-    description: 'Days to retain build archives before cleanup'
-    required: false
-    default: '30'
+    default: '.game-ci/sync-state.json'

 outputs:
  volume:
--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/index.js.map
+++ b/dist/index.js.map
--- a/src/index.ts
+++ b/src/index.ts
@@ -3,7 +3,8 @@ import { Action, BuildParameters, Cache, Orchestrator, Docker, ImageTag, Output
 import { Cli } from './model/cli/cli';
 import MacBuilder from './model/mac-builder';
 import PlatformSetup from './model/platform-setup';
-import { BuildReliabilityService } from './model/orchestrator/services/reliability';
+import { IncrementalSyncService } from './model/orchestrator/services/sync';
+import { SyncStrategy } from './model/orchestrator/services/sync/sync-state';

 async function runMain() {
  try {
@@ -15,42 +16,23 @@ async function runMain() {
    Action.checkCompatibility();
    Cache.verify();

-    // Always configure git environment for CI reliability
-    BuildReliabilityService.configureGitEnvironment();
-
    const { workspace, actionFolder } = Action;

    const buildParameters = await BuildParameters.create();
    const baseImage = new ImageTag(buildParameters);

-    // Pre-build reliability checks
-    if (buildParameters.gitIntegrityCheck) {
-      core.info('Running git integrity checks...');
-
-      const isHealthy = BuildReliabilityService.checkGitIntegrity(workspace);
-      BuildReliabilityService.cleanStaleLockFiles(workspace);
-      BuildReliabilityService.validateSubmoduleBackingStores(workspace);
-
-      if (buildParameters.cleanReservedFilenames) {
-        BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
-      }
-
-      if (!isHealthy && buildParameters.gitAutoRecover) {
-        core.info('Git corruption detected, attempting automatic recovery...');
-        const recovered = BuildReliabilityService.recoverCorruptedRepo(workspace);
-        if (!recovered) {
-          core.warning('Automatic recovery failed. Build may encounter issues.');
-        }
-      }
-    } else if (buildParameters.cleanReservedFilenames) {
-      // cleanReservedFilenames can run independently of gitIntegrityCheck
-      BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
-    }
-
    let exitCode = -1;

    if (buildParameters.providerStrategy === 'local') {
      core.info('Building locally');
+
+      // Apply incremental sync strategy before build
+      const syncStrategy = buildParameters.syncStrategy as SyncStrategy;
+      if (syncStrategy !== 'full') {
+        core.info(`[Sync] Applying sync strategy: ${syncStrategy}`);
+        await applySyncStrategy(buildParameters, workspace);
+      }
+
      await PlatformSetup.setup(buildParameters, actionFolder);
      exitCode =
        process.platform === 'darwin'
@@ -60,18 +42,21 @@ async function runMain() {
              actionFolder,
              ...buildParameters,
            });
+
+      // Revert overlays after job completion if configured
+      if (buildParameters.syncRevertAfter && syncStrategy !== 'full') {
+        core.info('[Sync] Reverting overlay changes after job completion');
+        try {
+          await IncrementalSyncService.revertOverlays(workspace, buildParameters.syncStatePath);
+        } catch (revertError) {
+          core.warning(`[Sync] Overlay revert failed: ${(revertError as Error).message}`);
+        }
+      }
    } else {
      await Orchestrator.run(buildParameters, baseImage.toString());
      exitCode = 0;
    }

-    // Post-build: archive and enforce retention
-    if (buildParameters.buildArchiveEnabled && exitCode === 0) {
-      core.info('Archiving build output...');
-      BuildReliabilityService.archiveBuildOutput(buildParameters.buildPath, buildParameters.buildArchivePath);
-      BuildReliabilityService.enforceRetention(buildParameters.buildArchivePath, buildParameters.buildArchiveRetention);
-    }
-
    // Set output
    await Output.setBuildVersion(buildParameters.buildVersion);
    await Output.setAndroidVersionCode(buildParameters.androidVersionCode);
@@ -85,4 +70,58 @@ async function runMain() {
  }
 }

+/**
+ * Apply the configured sync strategy to the workspace before build.
+ */
+async function applySyncStrategy(buildParameters: BuildParameters, workspace: string): Promise<void> {
+  const strategy = buildParameters.syncStrategy as SyncStrategy;
+  const resolvedStrategy = IncrementalSyncService.resolveStrategy(strategy, workspace, buildParameters.syncStatePath);
+
+  if (resolvedStrategy === 'full') {
+    core.info('[Sync] Resolved to full sync (no incremental state available)');
+
+    return;
+  }
+
+  switch (resolvedStrategy) {
+    case 'git-delta': {
+      const targetReference = buildParameters.gitSha || buildParameters.branch;
+      const changedFiles = await IncrementalSyncService.syncGitDelta(
+        workspace,
+        targetReference,
+        buildParameters.syncStatePath,
+      );
+      core.info(`[Sync] Git delta sync applied: ${changedFiles} file(s) changed`);
+      break;
+    }
+    case 'direct-input': {
+      if (!buildParameters.syncInputRef) {
+        throw new Error('[Sync] direct-input strategy requires syncInputRef to be set');
+      }
+      const overlays = await IncrementalSyncService.applyDirectInput(
+        workspace,
+        buildParameters.syncInputRef,
+        buildParameters.syncStorageRemote || undefined,
+        buildParameters.syncStatePath,
+      );
+      core.info(`[Sync] Direct input applied: ${overlays.length} overlay(s)`);
+      break;
+    }
+    case 'storage-pull': {
+      if (!buildParameters.syncInputRef) {
+        throw new Error('[Sync] storage-pull strategy requires syncInputRef to be set');
+      }
+      const pulledFiles = await IncrementalSyncService.syncStoragePull(workspace, buildParameters.syncInputRef, {
+        rcloneRemote: buildParameters.syncStorageRemote || undefined,
+        syncRevertAfter: buildParameters.syncRevertAfter,
+        statePath: buildParameters.syncStatePath,
+      });
+      core.info(`[Sync] Storage pull complete: ${pulledFiles.length} file(s)`);
+      break;
+    }
+    default:
+      core.warning(`[Sync] Unknown sync strategy: ${resolvedStrategy}`);
+  }
+}
+
 runMain();
--- a/src/model/build-parameters.ts
+++ b/src/model/build-parameters.ts
@@ -106,12 +106,11 @@ class BuildParameters {
  public cacheUnityInstallationOnMac!: boolean;
  public unityHubVersionOnMac!: string;
  public dockerWorkspacePath!: string;
-  public gitIntegrityCheck!: boolean;
-  public gitAutoRecover!: boolean;
-  public cleanReservedFilenames!: boolean;
-  public buildArchiveEnabled!: boolean;
-  public buildArchivePath!: string;
-  public buildArchiveRetention!: number;
+  public syncStrategy!: string;
+  public syncInputRef!: string;
+  public syncStorageRemote!: string;
+  public syncRevertAfter!: boolean;
+  public syncStatePath!: string;

  public static shouldUseRetainedWorkspaceMode(buildParameters: BuildParameters) {
    return buildParameters.maxRetainedWorkspaces > 0 && Orchestrator.lockedWorkspace !== ``;
@@ -248,12 +247,11 @@ class BuildParameters {
      cacheUnityInstallationOnMac: Input.cacheUnityInstallationOnMac,
      unityHubVersionOnMac: Input.unityHubVersionOnMac,
      dockerWorkspacePath: Input.dockerWorkspacePath,
-      gitIntegrityCheck: Input.gitIntegrityCheck,
-      gitAutoRecover: Input.gitAutoRecover,
-      cleanReservedFilenames: Input.cleanReservedFilenames,
-      buildArchiveEnabled: Input.buildArchiveEnabled,
-      buildArchivePath: Input.buildArchivePath,
-      buildArchiveRetention: Input.buildArchiveRetention,
+      syncStrategy: Input.syncStrategy,
+      syncInputRef: Input.syncInputRef,
+      syncStorageRemote: Input.syncStorageRemote,
+      syncRevertAfter: Input.syncRevertAfter,
+      syncStatePath: Input.syncStatePath,
    };
  }

--- a/src/model/input.ts
+++ b/src/model/input.ts
@@ -241,6 +241,28 @@ class Input {
    return Input.getInput('dockerWorkspacePath') ?? '/github/workspace';
  }

+  static get syncStrategy(): string {
+    return Input.getInput('syncStrategy') ?? 'full';
+  }
+
+  static get syncInputRef(): string {
+    return Input.getInput('syncInputRef') ?? '';
+  }
+
+  static get syncStorageRemote(): string {
+    return Input.getInput('syncStorageRemote') ?? '';
+  }
+
+  static get syncRevertAfter(): boolean {
+    const input = Input.getInput('syncRevertAfter') ?? 'true';
+
+    return input === 'true';
+  }
+
+  static get syncStatePath(): string {
+    return Input.getInput('syncStatePath') ?? '.game-ci/sync-state.json';
+  }
+
  static get dockerCpuLimit(): string {
    return Input.getInput('dockerCpuLimit') ?? os.cpus().length.toString();
  }
@@ -282,38 +304,6 @@ class Input {
    return Input.getInput('skipActivation')?.toLowerCase() ?? 'false';
  }

-  static get gitIntegrityCheck(): boolean {
-    const input = Input.getInput('gitIntegrityCheck') ?? 'false';
-
-    return input === 'true';
-  }
-
-  static get gitAutoRecover(): boolean {
-    const input = Input.getInput('gitAutoRecover') ?? 'false';
-
-    return input === 'true';
-  }
-
-  static get cleanReservedFilenames(): boolean {
-    const input = Input.getInput('cleanReservedFilenames') ?? 'false';
-
-    return input === 'true';
-  }
-
-  static get buildArchiveEnabled(): boolean {
-    const input = Input.getInput('buildArchiveEnabled') ?? 'false';
-
-    return input === 'true';
-  }
-
-  static get buildArchivePath(): string {
-    return Input.getInput('buildArchivePath') ?? './build-archives';
-  }
-
-  static get buildArchiveRetention(): number {
-    return Number.parseInt(Input.getInput('buildArchiveRetention') ?? '30', 10);
-  }
-
  public static ToEnvVarFormat(input: string) {
    if (input.toUpperCase() === input) {
      return input;
--- a/src/model/orchestrator/remote-client/index.ts
+++ b/src/model/orchestrator/remote-client/index.ts
@@ -15,15 +15,24 @@ import BuildParameters from '../../build-parameters';
 import { Cli } from '../../cli/cli';
 import OrchestratorOptions from '../options/orchestrator-options';
 import ResourceTracking from '../services/core/resource-tracking';
+import { IncrementalSyncService } from '../services/sync';
+import { SyncStrategy } from '../services/sync/sync-state';

 export class RemoteClient {
  @CliFunction(`remote-cli-pre-build`, `sets up a repository, usually before a game-ci build`)
  static async setupRemoteClient() {
    OrchestratorLogger.log(`bootstrap game ci orchestrator...`);
    await ResourceTracking.logDiskUsageSnapshot('remote-cli-pre-build (start)');
-    if (!(await RemoteClient.handleRetainedWorkspace())) {
+
+    const syncStrategy = (Orchestrator.buildParameters.syncStrategy || 'full') as SyncStrategy;
+
+    if (syncStrategy !== 'full') {
+      OrchestratorLogger.log(`[Sync] Using incremental sync strategy: ${syncStrategy}`);
+      await RemoteClient.handleIncrementalSync(syncStrategy);
+    } else if (!(await RemoteClient.handleRetainedWorkspace())) {
      await RemoteClient.bootstrapRepository();
    }
+
    await RemoteClient.replaceLargePackageReferencesWithSharedReferences();
    await RemoteClient.runCustomHookFiles(`before-build`);
  }
@@ -157,6 +166,20 @@ export class RemoteClient {

      await RemoteClient.runCustomHookFiles(`after-build`);

+      // Revert sync overlays if configured
+      const syncStrategy = (Orchestrator.buildParameters.syncStrategy || 'full') as SyncStrategy;
+      if (Orchestrator.buildParameters.syncRevertAfter && syncStrategy !== 'full') {
+        try {
+          OrchestratorLogger.log('[Sync] Reverting overlay changes after job completion');
+          await IncrementalSyncService.revertOverlays(
+            OrchestratorFolders.repoPathAbsolute,
+            Orchestrator.buildParameters.syncStatePath,
+          );
+        } catch (revertError: any) {
+          RemoteClientLogger.logWarning(`[Sync] Overlay revert failed: ${revertError.message}`);
+        }
+      }
+
      // WIP - need to give the pod permissions to create config map
      await RemoteClientLogger.handleLogManagementPostJob();
    } catch (error: any) {
@@ -229,6 +252,78 @@ export class RemoteClient {
      RemoteClientLogger.log(JSON.stringify(error, undefined, 4));
    }
  }
+
+  /**
+   * Handle incremental sync strategies (git-delta, direct-input, storage-pull).
+   *
+   * For git-delta: requires an existing workspace with sync state; fetches and applies
+   * only changed files.
+   *
+   * For direct-input and storage-pull: requires an existing workspace; applies overlay
+   * content on top.
+   *
+   * Falls back to full bootstrapRepository() if incremental sync cannot proceed.
+   */
+  private static async handleIncrementalSync(strategy: SyncStrategy): Promise<void> {
+    const buildParameters = Orchestrator.buildParameters;
+    const workspacePath = OrchestratorFolders.repoPathAbsolute;
+    const statePath = buildParameters.syncStatePath;
+
+    // Resolve strategy — may fall back to 'full' if no state exists
+    const resolvedStrategy = IncrementalSyncService.resolveStrategy(strategy, workspacePath, statePath);
+
+    if (resolvedStrategy === 'full') {
+      OrchestratorLogger.log('[Sync] Falling back to full bootstrap');
+      if (!(await RemoteClient.handleRetainedWorkspace())) {
+        await RemoteClient.bootstrapRepository();
+      }
+
+      return;
+    }
+
+    switch (resolvedStrategy) {
+      case 'git-delta': {
+        const targetReference = buildParameters.gitSha || buildParameters.branch;
+        OrchestratorLogger.log(`[Sync] Git delta sync to ${targetReference}`);
+        const changedFiles = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference, statePath);
+        OrchestratorLogger.log(`[Sync] Git delta complete: ${changedFiles} file(s) updated`);
+        break;
+      }
+      case 'direct-input': {
+        const inputReference = buildParameters.syncInputRef;
+        if (!inputReference) {
+          throw new Error('[Sync] direct-input strategy requires syncInputRef');
+        }
+        OrchestratorLogger.log(`[Sync] Applying direct input: ${inputReference}`);
+        await IncrementalSyncService.applyDirectInput(
+          workspacePath,
+          inputReference,
+          buildParameters.syncStorageRemote || undefined,
+          statePath,
+        );
+        break;
+      }
+      case 'storage-pull': {
+        const storageUri = buildParameters.syncInputRef;
+        if (!storageUri) {
+          throw new Error('[Sync] storage-pull strategy requires syncInputRef');
+        }
+        OrchestratorLogger.log(`[Sync] Storage pull from: ${storageUri}`);
+        await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, {
+          rcloneRemote: buildParameters.syncStorageRemote || undefined,
+          syncRevertAfter: buildParameters.syncRevertAfter,
+          statePath,
+        });
+        break;
+      }
+      default:
+        OrchestratorLogger.logWarning(`[Sync] Unknown strategy: ${resolvedStrategy}, falling back to full`);
+        if (!(await RemoteClient.handleRetainedWorkspace())) {
+          await RemoteClient.bootstrapRepository();
+        }
+    }
+  }
+
  public static async bootstrapRepository() {
    await OrchestratorSystem.Run(
      `mkdir -p ${OrchestratorFolders.ToLinuxFolder(OrchestratorFolders.uniqueOrchestratorJobFolderAbsolute)}`,
--- a/src/model/orchestrator/services/reliability/build-reliability-service.test.ts
+++ b/src/model/orchestrator/services/reliability/build-reliability-service.test.ts
@@ -1,638 +0,0 @@
-import { execSync, execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { BuildReliabilityService } from './build-reliability-service';
-
-// Mock dependencies
-jest.mock('node:child_process');
-jest.mock('node:fs');
-jest.mock('@actions/core', () => ({
-  info: jest.fn(),
-  warning: jest.fn(),
-}));
-
-const mockExecSync = execSync as jest.MockedFunction<typeof execSync>;
-const mockExecFileSync = execFileSync as jest.MockedFunction<typeof execFileSync>;
-const mockFs = fs as jest.Mocked<typeof fs>;
-
-describe('BuildReliabilityService', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  // =========================================================================
-  // checkGitIntegrity
-  // =========================================================================
-
-  describe('checkGitIntegrity', () => {
-    it('should return true when fsck succeeds with clean output', () => {
-      mockExecSync.mockReturnValue('');
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(true);
-      expect(mockExecSync).toHaveBeenCalledWith(
-        'git -C "/repo" fsck --no-dangling',
-        expect.objectContaining({ encoding: 'utf8' }),
-      );
-    });
-
-    it('should return false when fsck output contains corruption indicators', () => {
-      mockExecSync.mockReturnValue('broken link from tree abc123');
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should return false when fsck output contains missing objects', () => {
-      mockExecSync.mockReturnValue('missing blob abc123');
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should return false when execSync throws (non-zero exit code)', () => {
-      mockExecSync.mockImplementation(() => {
-        const error: any = new Error('fsck failed');
-        error.stderr = Buffer.from('error: bad object HEAD');
-        throw error;
-      });
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should use current directory when no repoPath provided', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.checkGitIntegrity();
-      expect(mockExecSync).toHaveBeenCalledWith('git -C "." fsck --no-dangling', expect.anything());
-    });
-  });
-
-  // =========================================================================
-  // cleanStaleLockFiles
-  // =========================================================================
-
-  describe('cleanStaleLockFiles', () => {
-    it('should return 0 when .git directory does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(0);
-    });
-
-    it('should remove lock files older than 10 minutes', () => {
-      const now = Date.now();
-      const oldTime = now - 15 * 60 * 1000; // 15 minutes ago
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.statSync.mockImplementation((filePath: any) => {
-        if (filePath === path.join('/repo', '.git')) {
-          return { isDirectory: () => true } as fs.Stats;
-        }
-        return { mtimeMs: oldTime } as fs.Stats;
-      });
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/repo', '.git')) {
-          return [
-            { name: 'index.lock', isDirectory: () => false },
-            { name: 'HEAD.lock', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(2);
-      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(2);
-    });
-
-    it('should NOT remove lock files younger than 10 minutes', () => {
-      const now = Date.now();
-      const recentTime = now - 2 * 60 * 1000; // 2 minutes ago
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.statSync.mockImplementation((filePath: any) => {
-        if (filePath === path.join('/repo', '.git')) {
-          return { isDirectory: () => true } as fs.Stats;
-        }
-        return { mtimeMs: recentTime } as fs.Stats;
-      });
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/repo', '.git')) {
-          return [{ name: 'index.lock', isDirectory: () => false }] as any;
-        }
-        return [];
-      });
-
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(0);
-      expect(mockFs.unlinkSync).not.toHaveBeenCalled();
-    });
-
-    it('should recursively scan refs directory for lock files', () => {
-      const now = Date.now();
-      const oldTime = now - 15 * 60 * 1000;
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.statSync.mockImplementation((filePath: any) => {
-        if (filePath === path.join('/repo', '.git')) {
-          return { isDirectory: () => true } as fs.Stats;
-        }
-        return { mtimeMs: oldTime } as fs.Stats;
-      });
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        const gitDir = path.join('/repo', '.git');
-        if (dir === gitDir) {
-          return [{ name: 'refs', isDirectory: () => true }] as any;
-        }
-        if (dir === path.join(gitDir, 'refs')) {
-          return [{ name: 'heads', isDirectory: () => true }] as any;
-        }
-        if (dir === path.join(gitDir, 'refs', 'heads')) {
-          return [{ name: 'main.lock', isDirectory: () => false }] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(1);
-    });
-  });
-
-  // =========================================================================
-  // validateSubmoduleBackingStores
-  // =========================================================================
-
-  describe('validateSubmoduleBackingStores', () => {
-    it('should return empty array when .gitmodules does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
-      expect(result).toEqual([]);
-    });
-
-    it('should detect broken backing store for submodule', () => {
-      mockFs.existsSync.mockImplementation((p: any) => {
-        if (p === path.join('/repo', '.gitmodules')) return true;
-        if (p === path.join('/repo', 'lib/sub', '.git')) return true;
-        // Backing store does not exist
-        return false;
-      });
-      mockFs.readFileSync.mockImplementation((p: any) => {
-        if (p === path.join('/repo', '.gitmodules')) {
-          return '[submodule "sub"]\n\tpath = lib/sub\n\turl = https://example.com/sub.git';
-        }
-        if (p === path.join('/repo', 'lib/sub', '.git')) {
-          return 'gitdir: ../../.git/modules/lib/sub';
-        }
-        return '';
-      });
-      mockFs.statSync.mockReturnValue({ isFile: () => true } as fs.Stats);
-
-      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
-      expect(result).toContain('lib/sub');
-    });
-
-    it('should return empty array when all submodule backing stores are valid', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readFileSync.mockImplementation((p: any) => {
-        if (p === path.join('/repo', '.gitmodules')) {
-          return '[submodule "sub"]\n\tpath = lib/sub\n\turl = https://example.com/sub.git';
-        }
-        if (p === path.join('/repo', 'lib/sub', '.git')) {
-          return 'gitdir: ../../.git/modules/lib/sub';
-        }
-        return '';
-      });
-      mockFs.statSync.mockReturnValue({ isFile: () => true } as fs.Stats);
-
-      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
-      expect(result).toEqual([]);
-    });
-  });
-
-  // =========================================================================
-  // recoverCorruptedRepo
-  // =========================================================================
-
-  describe('recoverCorruptedRepo', () => {
-    it('should orchestrate fsck cleanup and re-fetch, returning true on success', () => {
-      // cleanStaleLockFiles: no .git dir
-      mockFs.existsSync.mockReturnValue(false);
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
-
-      // fetch succeeds, then fsck succeeds
-      mockExecSync.mockReturnValue('');
-
-      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
-      expect(result).toBe(true);
-      // Should have called fetch
-      expect(mockExecSync).toHaveBeenCalledWith('git -C "/repo" fetch --all', expect.anything());
-    });
-
-    it('should return false when recovery fails to restore integrity', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
-
-      // fetch succeeds, but fsck fails
-      mockExecSync.mockImplementation((cmd: any) => {
-        if (typeof cmd === 'string' && cmd.includes('fetch')) return '';
-        if (typeof cmd === 'string' && cmd.includes('fsck')) {
-          return 'missing blob abc123';
-        }
-        return '';
-      });
-
-      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should continue recovery even when fetch fails', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
-
-      let callCount = 0;
-      mockExecSync.mockImplementation((cmd: any) => {
-        callCount++;
-        if (typeof cmd === 'string' && cmd.includes('fetch')) {
-          throw new Error('network error');
-        }
-        // fsck call
-        return '';
-      });
-
-      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
-      // Should still attempt fsck after failed fetch
-      expect(callCount).toBeGreaterThanOrEqual(2);
-    });
-  });
-
-  // =========================================================================
-  // cleanReservedFilenames
-  // =========================================================================
-
-  describe('cleanReservedFilenames', () => {
-    it('should return empty array when Assets directory does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toEqual([]);
-    });
-
-    it('should remove files with reserved names (con, prn, aux, nul)', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [
-            { name: 'con.txt', isDirectory: () => false },
-            { name: 'PRN.meta', isDirectory: () => false },
-            { name: 'aux.shader', isDirectory: () => false },
-            { name: 'nul.png', isDirectory: () => false },
-            { name: 'valid-file.cs', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(4);
-      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(4);
-    });
-
-    it('should remove directories with reserved names', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [{ name: 'com1', isDirectory: () => true }] as any;
-        }
-        return [];
-      });
-      mockFs.rmSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(1);
-      expect(mockFs.rmSync).toHaveBeenCalledWith(path.join('/project', 'Assets', 'com1'), {
-        recursive: true,
-        force: true,
-      });
-    });
-
-    it('should detect COM1 through COM9 and LPT1 through LPT9', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [
-            { name: 'com1.txt', isDirectory: () => false },
-            { name: 'COM9.meta', isDirectory: () => false },
-            { name: 'lpt1.dat', isDirectory: () => false },
-            { name: 'LPT9.log', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(4);
-    });
-
-    it('should not remove files that merely contain reserved names as substrings', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [
-            { name: 'controller.cs', isDirectory: () => false },
-            { name: 'printer-utils.cs', isDirectory: () => false },
-            { name: 'auxiliary.shader', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(0);
-    });
-  });
-
-  // =========================================================================
-  // getAvailableSpaceMB
-  // =========================================================================
-
-  describe('getAvailableSpaceMB', () => {
-    it('should return -1 when the check fails', () => {
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command failed');
-      });
-
-      const result = BuildReliabilityService.getAvailableSpaceMB('/some/path');
-      expect(result).toBe(-1);
-    });
-
-    it('should parse wmic output on Windows', () => {
-      const originalPlatform = process.platform;
-      Object.defineProperty(process, 'platform', { value: 'win32' });
-
-      // 10 GB in bytes
-      mockExecFileSync.mockReturnValue('\r\nFreeSpace=10737418240\r\n' as any);
-
-      const result = BuildReliabilityService.getAvailableSpaceMB('C:\\builds');
-      // 10737418240 / (1024 * 1024) = 10240 MB
-      expect(result).toBeCloseTo(10240, 0);
-
-      Object.defineProperty(process, 'platform', { value: originalPlatform });
-    });
-
-    it('should parse df output on Unix', () => {
-      const originalPlatform = process.platform;
-      Object.defineProperty(process, 'platform', { value: 'linux' });
-
-      mockExecFileSync.mockReturnValue('  Avail\n  5120M\n' as any);
-
-      const result = BuildReliabilityService.getAvailableSpaceMB('/builds');
-      expect(result).toBe(5120);
-
-      Object.defineProperty(process, 'platform', { value: originalPlatform });
-    });
-  });
-
-  // =========================================================================
-  // getDirectorySizeMB
-  // =========================================================================
-
-  describe('getDirectorySizeMB', () => {
-    it('should return file size for a single file', () => {
-      // 5 MB in bytes
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false, size: 5 * 1024 * 1024 } as any);
-
-      const result = BuildReliabilityService.getDirectorySizeMB('/path/to/file.zip');
-      expect(result).toBeCloseTo(5, 0);
-    });
-
-    it('should return total size for a directory tree', () => {
-      const subDir = path.join('/build', 'sub');
-
-      mockFs.statSync.mockImplementation((p: any) => {
-        const pathStr = typeof p === 'string' ? p : p.toString();
-        if (pathStr === '/build' || pathStr === subDir) {
-          return { isDirectory: () => true, size: 0 } as any;
-        }
-
-        return { isDirectory: () => false, size: 1024 * 1024 } as any; // 1 MB each
-      });
-
-      mockFs.readdirSync.mockImplementation((dirPath: any, _options?: any) => {
-        const dirStr = typeof dirPath === 'string' ? dirPath : dirPath.toString();
-        if (dirStr === '/build') {
-          return [
-            { name: 'file1.bin', isDirectory: () => false },
-            { name: 'sub', isDirectory: () => true },
-          ] as any;
-        }
-        if (dirStr === subDir) {
-          return [{ name: 'file2.bin', isDirectory: () => false }] as any;
-        }
-
-        return [] as any;
-      });
-
-      const result = BuildReliabilityService.getDirectorySizeMB('/build');
-      expect(result).toBeCloseTo(2, 0); // 2 files * 1 MB each
-    });
-
-    it('should return -1 when calculation fails', () => {
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Access denied');
-      });
-
-      const result = BuildReliabilityService.getDirectorySizeMB('/inaccessible');
-      expect(result).toBe(-1);
-    });
-  });
-
-  // =========================================================================
-  // archiveBuildOutput
-  // =========================================================================
-
-  describe('archiveBuildOutput', () => {
-    it('should skip archiving when source path does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-      expect(mockExecSync).not.toHaveBeenCalled();
-    });
-
-    it('should create archive directory and tar.gz output', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-      mockExecSync.mockReturnValue('');
-      // Make disk space check return unknown so we proceed
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command not found');
-      });
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Not mocked');
-      });
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      expect(mockFs.mkdirSync).toHaveBeenCalledWith('/archives', { recursive: true });
-      expect(mockExecSync).toHaveBeenCalledWith(expect.stringContaining('tar -czf'), expect.anything());
-    });
-
-    it('should skip archival when insufficient disk space', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-
-      // Source is 1000 MB
-      mockFs.statSync.mockImplementation((p: any) => {
-        const pathStr = typeof p === 'string' ? p : p.toString();
-        if (pathStr.endsWith('big-file.bin')) {
-          return { isDirectory: () => false, size: 1000 * 1024 * 1024 } as any;
-        }
-        return { isDirectory: () => true, size: 0 } as any;
-      });
-      mockFs.readdirSync.mockImplementation(() => {
-        return [{ name: 'big-file.bin', isDirectory: () => false }] as any;
-      });
-
-      // Only 500 MB available
-      const originalPlatform = process.platform;
-      Object.defineProperty(process, 'platform', { value: 'linux' });
-      mockExecFileSync.mockReturnValue('  Avail\n  500M\n' as any);
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      // Should NOT have attempted the tar command
-      expect(mockExecSync).not.toHaveBeenCalledWith(expect.stringContaining('tar'), expect.anything());
-
-      Object.defineProperty(process, 'platform', { value: originalPlatform });
-    });
-
-    it('should clean up partial archive on tar failure', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      // Make disk space check return unknown so we proceed
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command not found');
-      });
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Not mocked');
-      });
-
-      // tar command fails
-      mockExecSync.mockImplementation(() => {
-        const error: any = new Error('tar failed');
-        error.stderr = Buffer.from('No space left on device');
-        throw error;
-      });
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      // Should have attempted to clean up the partial archive
-      // (existsSync returns true for the partial file)
-      expect(mockFs.unlinkSync).toHaveBeenCalled();
-    });
-
-    it('should proceed with warning when disk space check fails', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-      mockExecSync.mockReturnValue('');
-
-      // Disk space check fails
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command not found');
-      });
-      // Directory size check also fails
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Not mocked');
-      });
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      // Should still proceed with tar
-      expect(mockExecSync).toHaveBeenCalledWith(expect.stringContaining('tar -czf'), expect.anything());
-    });
-  });
-
-  // =========================================================================
-  // enforceRetention
-  // =========================================================================
-
-  describe('enforceRetention', () => {
-    it('should return 0 when archive path does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.enforceRetention('/archive', 30);
-      expect(result).toBe(0);
-    });
-
-    it('should remove archives older than retention period', () => {
-      const now = Date.now();
-      const oldTime = now - 45 * 24 * 60 * 60 * 1000; // 45 days ago
-      const recentTime = now - 5 * 24 * 60 * 60 * 1000; // 5 days ago
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockReturnValue([
-        { name: 'build-old.tar.gz', isDirectory: () => false },
-        { name: 'build-recent.tar.gz', isDirectory: () => false },
-      ] as any);
-      mockFs.statSync.mockImplementation((p: any) => {
-        if ((p as string).includes('old')) {
-          return { mtimeMs: oldTime } as fs.Stats;
-        }
-        return { mtimeMs: recentTime } as fs.Stats;
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.enforceRetention('/archive', 30);
-      expect(result).toBe(1);
-      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(1);
-    });
-
-    it('should keep all archives within retention period', () => {
-      const now = Date.now();
-      const recentTime = now - 5 * 24 * 60 * 60 * 1000;
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockReturnValue([
-        { name: 'build-1.tar.gz', isDirectory: () => false },
-        { name: 'build-2.tar.gz', isDirectory: () => false },
-      ] as any);
-      mockFs.statSync.mockReturnValue({ mtimeMs: recentTime } as fs.Stats);
-
-      const result = BuildReliabilityService.enforceRetention('/archive', 30);
-      expect(result).toBe(0);
-    });
-  });
-
-  // =========================================================================
-  // configureGitEnvironment
-  // =========================================================================
-
-  describe('configureGitEnvironment', () => {
-    it('should set GIT_TERMINAL_PROMPT=0 in process.env', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.configureGitEnvironment();
-      expect(process.env.GIT_TERMINAL_PROMPT).toBe('0');
-    });
-
-    it('should configure http.postBuffer via git config', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.configureGitEnvironment();
-      expect(mockExecSync).toHaveBeenCalledWith('git config --global http.postBuffer 524288000', expect.anything());
-    });
-
-    it('should configure core.longpaths via git config', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.configureGitEnvironment();
-      expect(mockExecSync).toHaveBeenCalledWith('git config --global core.longpaths true', expect.anything());
-    });
-
-    it('should warn but not throw when git config commands fail', () => {
-      const core = require('@actions/core');
-      mockExecSync.mockImplementation(() => {
-        throw new Error('git config failed');
-      });
-
-      // Should not throw
-      expect(() => BuildReliabilityService.configureGitEnvironment()).not.toThrow();
-      expect(core.warning).toHaveBeenCalled();
-    });
-  });
-});
--- a/src/model/orchestrator/services/reliability/build-reliability-service.ts
+++ b/src/model/orchestrator/services/reliability/build-reliability-service.ts
@@ -1,527 +0,0 @@
-import { execSync, execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import * as core from '@actions/core';
-
-/**
- * Build reliability features for hardening CI pipelines.
- * Provides git integrity checks, stale lock cleanup, submodule validation,
- * reserved filename removal, build archival, and git environment configuration.
- * All features are opt-in and fail gracefully (warnings only).
- */
-export class BuildReliabilityService {
-  // Windows reserved device names that cause Unity asset importer infinite loops
-  private static readonly RESERVED_NAMES = new Set([
-    'con',
-    'prn',
-    'aux',
-    'nul',
-    'com1',
-    'com2',
-    'com3',
-    'com4',
-    'com5',
-    'com6',
-    'com7',
-    'com8',
-    'com9',
-    'lpt1',
-    'lpt2',
-    'lpt3',
-    'lpt4',
-    'lpt5',
-    'lpt6',
-    'lpt7',
-    'lpt8',
-    'lpt9',
-  ]);
-
-  // Lock files to look for in the .git directory
-  private static readonly LOCK_FILE_NAMES = new Set(['index.lock', 'shallow.lock', 'config.lock', 'HEAD.lock']);
-
-  // Maximum age in milliseconds before a lock file is considered stale (10 minutes)
-  private static readonly LOCK_FILE_MAX_AGE_MS = 10 * 60 * 1000;
-
-  /**
-   * Run git fsck to check repository integrity.
-   * Returns true if the repo is healthy, false if corruption detected.
-   */
-  static checkGitIntegrity(repoPath: string = '.'): boolean {
-    core.info(`[Reliability] Checking git integrity in ${repoPath}`);
-
-    try {
-      const output = execSync(`git -C "${repoPath}" fsck --no-dangling`, {
-        encoding: 'utf8',
-        timeout: 120_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-
-      // Parse output for corruption indicators
-      const corruptionPatterns = [
-        /broken link/i,
-        /missing (blob|tree|commit|tag)/i,
-        /dangling/i,
-        /corrupt/i,
-        /error in /i,
-      ];
-
-      for (const pattern of corruptionPatterns) {
-        if (pattern.test(output)) {
-          core.warning(`[Reliability] Git integrity check found issues: ${output.trim()}`);
-          return false;
-        }
-      }
-
-      core.info('[Reliability] Git integrity check passed');
-      return true;
-    } catch (error: any) {
-      // execSync throws on non-zero exit code
-      const stderr = error.stderr?.toString() ?? error.message;
-      core.warning(`[Reliability] Git integrity check failed: ${stderr}`);
-      return false;
-    }
-  }
-
-  /**
-   * Remove stale .lock files from the .git directory.
-   * Only removes lock files older than 10 minutes to avoid interfering with active operations.
-   * Returns the number of lock files removed.
-   */
-  static cleanStaleLockFiles(repoPath: string = '.'): number {
-    const gitDir = path.join(repoPath, '.git');
-    if (!fs.existsSync(gitDir) || !fs.statSync(gitDir).isDirectory()) {
-      return 0;
-    }
-
-    core.info(`[Reliability] Scanning for stale lock files in ${gitDir}`);
-    const now = Date.now();
-    let removed = 0;
-
-    const cleanDirectory = (directory: string): void => {
-      if (!fs.existsSync(directory)) return;
-
-      try {
-        const entries = fs.readdirSync(directory, { withFileTypes: true });
-        for (const entry of entries) {
-          const fullPath = path.join(directory, entry.name);
-          if (entry.isDirectory()) {
-            cleanDirectory(fullPath);
-          } else if (entry.name.endsWith('.lock')) {
-            // Check if it is a known lock file location OR under refs/
-            const relativePath = path.relative(gitDir, fullPath);
-            const isKnownLock = BuildReliabilityService.LOCK_FILE_NAMES.has(entry.name);
-            const isRefsLock = relativePath.startsWith('refs' + path.sep);
-
-            if (isKnownLock || isRefsLock) {
-              try {
-                const stat = fs.statSync(fullPath);
-                const ageMs = now - stat.mtimeMs;
-
-                if (ageMs > BuildReliabilityService.LOCK_FILE_MAX_AGE_MS) {
-                  fs.unlinkSync(fullPath);
-                  removed++;
-                  core.info(
-                    `[Reliability] Removed stale lock file (age: ${Math.round(ageMs / 1000)}s): ${relativePath}`,
-                  );
-                } else {
-                  core.info(
-                    `[Reliability] Lock file is recent (age: ${Math.round(ageMs / 1000)}s), skipping: ${relativePath}`,
-                  );
-                }
-              } catch {
-                core.warning(`[Reliability] Could not remove lock file: ${fullPath}`);
-              }
-            }
-          }
-        }
-      } catch {
-        // Directory not accessible
-      }
-    };
-
-    cleanDirectory(gitDir);
-
-    if (removed > 0) {
-      core.info(`[Reliability] Cleaned ${removed} stale lock file(s)`);
-    } else {
-      core.info('[Reliability] No stale lock files found');
-    }
-
-    return removed;
-  }
-
-  /**
-   * Validate that submodule .git files point to existing backing stores
-   * under .git/modules/. Returns list of submodule paths with broken backing stores.
-   */
-  static validateSubmoduleBackingStores(repoPath: string = '.'): string[] {
-    const broken: string[] = [];
-    const gitmodulesPath = path.join(repoPath, '.gitmodules');
-
-    if (!fs.existsSync(gitmodulesPath)) {
-      core.info('[Reliability] No .gitmodules found, skipping submodule validation');
-      return broken;
-    }
-
-    core.info(`[Reliability] Validating submodule backing stores in ${repoPath}`);
-
-    try {
-      const content = fs.readFileSync(gitmodulesPath, 'utf8');
-      const pathMatches = content.matchAll(/path\s*=\s*(.+)/g);
-
-      for (const match of pathMatches) {
-        const submodulePath = match[1].trim();
-        const gitFile = path.join(repoPath, submodulePath, '.git');
-
-        if (!fs.existsSync(gitFile)) {
-          // Submodule not initialized -- not necessarily broken
-          continue;
-        }
-
-        try {
-          const stat = fs.statSync(gitFile);
-          if (stat.isFile()) {
-            // .git is a file -- should contain "gitdir: <path>"
-            const gitFileContent = fs.readFileSync(gitFile, 'utf8').trim();
-            const gitdirMatch = gitFileContent.match(/^gitdir:\s*(.+)$/);
-
-            if (gitdirMatch) {
-              const backingStore = path.resolve(path.join(repoPath, submodulePath), gitdirMatch[1]);
-              if (!fs.existsSync(backingStore)) {
-                broken.push(submodulePath);
-                core.warning(`[Reliability] Submodule ${submodulePath} has broken backing store: ${backingStore}`);
-              } else {
-                core.info(`[Reliability] Submodule ${submodulePath} backing store OK`);
-              }
-            } else {
-              broken.push(submodulePath);
-              core.warning(`[Reliability] Submodule ${submodulePath} .git file has invalid format`);
-            }
-          }
-        } catch {
-          // Can't read .git file
-          core.warning(`[Reliability] Could not read .git file for submodule: ${submodulePath}`);
-        }
-      }
-    } catch (error: any) {
-      core.warning(`[Reliability] Could not read .gitmodules: ${error.message}`);
-    }
-
-    if (broken.length > 0) {
-      core.warning(`[Reliability] ${broken.length} submodule(s) have broken backing stores`);
-    } else {
-      core.info('[Reliability] All submodule backing stores are valid');
-    }
-
-    return broken;
-  }
-
-  /**
-   * Orchestrate recovery of a corrupted repository.
-   * Sequence: fsck -> clean locks -> re-fetch -> retry fsck.
-   * Returns true if recovery succeeded.
-   */
-  static recoverCorruptedRepo(repoPath: string = '.'): boolean {
-    core.warning(`[Reliability] Attempting automatic recovery for ${repoPath}`);
-
-    // Step 1: Clean stale lock files that may be preventing operations
-    const locksRemoved = BuildReliabilityService.cleanStaleLockFiles(repoPath);
-    if (locksRemoved > 0) {
-      core.info(`[Reliability] Recovery: cleaned ${locksRemoved} lock file(s)`);
-    }
-
-    // Step 2: Re-fetch to restore missing objects
-    try {
-      core.info('[Reliability] Recovery: re-fetching from remote');
-      execSync(`git -C "${repoPath}" fetch --all`, {
-        encoding: 'utf8',
-        timeout: 300_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info('[Reliability] Recovery: fetch completed');
-    } catch (error: any) {
-      core.warning(`[Reliability] Recovery: fetch failed: ${error.stderr?.toString() ?? error.message}`);
-    }
-
-    // Step 3: Retry fsck
-    const healthy = BuildReliabilityService.checkGitIntegrity(repoPath);
-    if (healthy) {
-      core.info('[Reliability] Recovery succeeded -- repository is healthy');
-    } else {
-      core.warning('[Reliability] Recovery failed -- repository still has integrity issues');
-    }
-
-    return healthy;
-  }
-
-  /**
-   * Scan a directory tree for files/directories with Windows reserved names.
-   * These names (con, prn, aux, nul, com1-9, lpt1-9) with any extension
-   * cause Unity asset importer infinite loops on Windows.
-   * Returns list of paths that were removed.
-   */
-  static cleanReservedFilenames(projectPath: string): string[] {
-    const assetsPath = path.join(projectPath, 'Assets');
-    if (!fs.existsSync(assetsPath)) {
-      core.info(`[Reliability] No Assets directory found at ${assetsPath}, skipping reserved filename scan`);
-      return [];
-    }
-
-    core.info(`[Reliability] Scanning for reserved filenames in ${assetsPath}`);
-    const cleaned: string[] = [];
-
-    const scanDirectory = (directory: string): void => {
-      try {
-        const entries = fs.readdirSync(directory, { withFileTypes: true });
-        for (const entry of entries) {
-          const nameWithoutExtension = entry.name.split('.')[0].toLowerCase();
-          const fullPath = path.join(directory, entry.name);
-
-          if (BuildReliabilityService.RESERVED_NAMES.has(nameWithoutExtension)) {
-            try {
-              if (entry.isDirectory()) {
-                fs.rmSync(fullPath, { recursive: true, force: true });
-              } else {
-                fs.unlinkSync(fullPath);
-              }
-              cleaned.push(fullPath);
-              core.warning(`[Reliability] Removed reserved filename: ${fullPath}`);
-            } catch {
-              core.warning(`[Reliability] Could not remove reserved filename: ${fullPath}`);
-            }
-          } else if (entry.isDirectory()) {
-            scanDirectory(fullPath);
-          }
-        }
-      } catch {
-        // Directory not accessible
-      }
-    };
-
-    scanDirectory(assetsPath);
-
-    if (cleaned.length > 0) {
-      core.warning(`[Reliability] Cleaned ${cleaned.length} reserved filename(s)`);
-    } else {
-      core.info('[Reliability] No reserved filenames found');
-    }
-
-    return cleaned;
-  }
-
-  /**
-   * Get available disk space in megabytes for a given directory.
-   * Returns -1 if the check fails (unknown space).
-   *
-   * Cross-platform: uses wmic on Windows, df on Unix.
-   */
-  static getAvailableSpaceMB(directoryPath: string): number {
-    try {
-      if (process.platform === 'win32') {
-        const drive = path.parse(directoryPath).root;
-        const driveLetter = drive.replace(/[:\\\/]/g, '');
-        const output = execFileSync(
-          'wmic',
-          ['logicaldisk', 'where', `DeviceID='${driveLetter}:'`, 'get', 'FreeSpace', '/value'],
-          { encoding: 'utf8', timeout: 10_000 },
-        );
-        const match = output.match(/FreeSpace=(\d+)/);
-
-        return match ? Number.parseInt(match[1], 10) / (1024 * 1024) : -1;
-      } else {
-        const output = execFileSync('df', ['-BM', '--output=avail', directoryPath], {
-          encoding: 'utf8',
-          timeout: 10_000,
-        });
-        const lines = output.trim().split('\n');
-
-        return Number.parseInt(lines[lines.length - 1], 10);
-      }
-    } catch {
-      return -1; // Unknown, caller should proceed with warning
-    }
-  }
-
-  /**
-   * Calculate the total size of a directory in megabytes.
-   * Returns -1 if the calculation fails.
-   */
-  static getDirectorySizeMB(directoryPath: string): number {
-    try {
-      const stat = fs.statSync(directoryPath);
-      if (!stat.isDirectory()) {
-        return stat.size / (1024 * 1024);
-      }
-
-      let totalBytes = 0;
-      const walkDirectory = (dir: string): void => {
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-          const fullPath = path.join(dir, entry.name);
-          if (entry.isDirectory()) {
-            walkDirectory(fullPath);
-          } else {
-            try {
-              totalBytes += fs.statSync(fullPath).size;
-            } catch {
-              // Skip inaccessible files
-            }
-          }
-        }
-      };
-
-      walkDirectory(directoryPath);
-
-      return totalBytes / (1024 * 1024);
-    } catch {
-      return -1;
-    }
-  }
-
-  /**
-   * Create a tar.gz archive of build output.
-   *
-   * Validates disk space before archiving. Skips archival with a warning
-   * if insufficient space is detected, preventing partial writes on full disks.
-   */
-  static archiveBuildOutput(sourcePath: string, archivePath: string): void {
-    if (!fs.existsSync(sourcePath)) {
-      core.info(`[Reliability] No build output to archive at ${sourcePath}`);
-      return;
-    }
-
-    fs.mkdirSync(archivePath, { recursive: true });
-
-    // Check available disk space before archiving
-    const sourceSizeMB = BuildReliabilityService.getDirectorySizeMB(sourcePath);
-    const availableSpaceMB = BuildReliabilityService.getAvailableSpaceMB(archivePath);
-
-    if (sourceSizeMB >= 0 && availableSpaceMB >= 0) {
-      const neededMB = Math.ceil(sourceSizeMB * 1.1); // 10% safety margin
-      if (availableSpaceMB < neededMB) {
-        core.warning(
-          `[Reliability] Insufficient disk space for archive. ` +
-            `Need ~${neededMB}MB, available: ${Math.floor(availableSpaceMB)}MB. Skipping archive.`,
-        );
-        return;
-      }
-      core.info(
-        `[Reliability] Disk space check passed: need ~${neededMB}MB, available: ${Math.floor(availableSpaceMB)}MB`,
-      );
-    } else if (availableSpaceMB < 0) {
-      core.warning('[Reliability] Could not determine available disk space. Proceeding with archive cautiously.');
-    }
-
-    const timestamp = new Date().toISOString().replace(/[.:]/g, '-');
-    const archiveFile = path.join(archivePath, `build-${timestamp}.tar.gz`);
-
-    try {
-      execSync(`tar -czf "${archiveFile}" -C "${path.dirname(sourcePath)}" "${path.basename(sourcePath)}"`, {
-        encoding: 'utf8',
-        timeout: 600_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info(`[Reliability] Build output archived to ${archiveFile}`);
-    } catch (error: any) {
-      core.warning(`[Reliability] Failed to archive build output: ${error.stderr?.toString() ?? error.message}`);
-
-      // Clean up partial archive if it exists to avoid leaving corrupted files
-      try {
-        if (fs.existsSync(archiveFile)) {
-          fs.unlinkSync(archiveFile);
-          core.info(`[Reliability] Cleaned up partial archive: ${archiveFile}`);
-        }
-      } catch {
-        // Best-effort cleanup
-      }
-    }
-  }
-
-  /**
-   * Enforce retention policy -- delete archives older than the retention period.
-   * Returns the number of old archives removed.
-   */
-  static enforceRetention(archivePath: string, retentionDays: number): number {
-    if (!fs.existsSync(archivePath)) {
-      return 0;
-    }
-
-    const now = Date.now();
-    const retentionMs = retentionDays * 24 * 60 * 60 * 1000;
-    let removed = 0;
-
-    try {
-      const entries = fs.readdirSync(archivePath, { withFileTypes: true });
-      for (const entry of entries) {
-        const fullPath = path.join(archivePath, entry.name);
-        try {
-          const stat = fs.statSync(fullPath);
-          const ageMs = now - stat.mtimeMs;
-
-          if (ageMs > retentionMs) {
-            if (entry.isDirectory()) {
-              fs.rmSync(fullPath, { recursive: true, force: true });
-            } else {
-              fs.unlinkSync(fullPath);
-            }
-            removed++;
-            core.info(
-              `[Reliability] Removed old archive: ${entry.name} (age: ${Math.round(
-                ageMs / (24 * 60 * 60 * 1000),
-              )} days)`,
-            );
-          }
-        } catch {
-          core.warning(`[Reliability] Could not process archive entry: ${fullPath}`);
-        }
-      }
-    } catch {
-      core.warning(`[Reliability] Could not read archive directory: ${archivePath}`);
-      return 0;
-    }
-
-    if (removed > 0) {
-      core.info(
-        `[Reliability] Retention enforced: removed ${removed} old archive(s), retention: ${retentionDays} days`,
-      );
-    }
-
-    return removed;
-  }
-
-  /**
-   * Configure git environment variables for CI reliability.
-   * Sets GIT_TERMINAL_PROMPT=0, increases http.postBuffer, enables core.longpaths.
-   */
-  static configureGitEnvironment(): void {
-    core.info('[Reliability] Configuring git environment for CI');
-
-    // Prevent git from prompting for credentials (hangs in CI)
-    process.env.GIT_TERMINAL_PROMPT = '0';
-    core.info('[Reliability] Set GIT_TERMINAL_PROMPT=0');
-
-    try {
-      // Increase http.postBuffer to 500MB for large pushes
-      execSync('git config --global http.postBuffer 524288000', {
-        encoding: 'utf8',
-        timeout: 10_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info('[Reliability] Set http.postBuffer=524288000 (500MB)');
-    } catch (error: any) {
-      core.warning(`[Reliability] Could not set http.postBuffer: ${error.message}`);
-    }
-
-    try {
-      // Enable long paths on Windows
-      execSync('git config --global core.longpaths true', {
-        encoding: 'utf8',
-        timeout: 10_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info('[Reliability] Set core.longpaths=true');
-    } catch (error: any) {
-      core.warning(`[Reliability] Could not set core.longpaths: ${error.message}`);
-    }
-  }
-}
--- a/src/model/orchestrator/services/reliability/index.ts
+++ b/src/model/orchestrator/services/reliability/index.ts
@@ -1 +0,0 @@
-export { BuildReliabilityService } from './build-reliability-service';
--- a/src/model/orchestrator/services/sync/incremental-sync-service.ts
+++ b/src/model/orchestrator/services/sync/incremental-sync-service.ts
@@ -0,0 +1,315 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { SyncState, SyncStrategy } from './sync-state';
+import { SyncStateManager } from './sync-state-manager';
+
+/**
+ * Service for incremental workspace synchronization.
+ *
+ * Supports multiple sync strategies:
+ * - full: Traditional clone + cache restore (default)
+ * - git-delta: Fetch and apply only changed files since last sync
+ * - direct-input: Apply file changes passed as job input (no git push required)
+ * - storage-pull: Fetch changed files from rclone-backed generic storage
+ */
+export class IncrementalSyncService {
+  /**
+   * Load sync state from the workspace.
+   */
+  static loadSyncState(workspacePath: string, statePath?: string): SyncState | undefined {
+    return SyncStateManager.loadState(workspacePath, statePath);
+  }
+
+  /**
+   * Save sync state to the workspace.
+   */
+  static saveSyncState(workspacePath: string, state: SyncState, statePath?: string): void {
+    SyncStateManager.saveState(workspacePath, state, statePath);
+  }
+
+  /**
+   * Determine the appropriate sync strategy based on workspace state and configuration.
+   */
+  static resolveStrategy(requestedStrategy: SyncStrategy, workspacePath: string, statePath?: string): SyncStrategy {
+    if (requestedStrategy === 'full') {
+      return 'full';
+    }
+
+    // git-delta requires an existing sync state
+    if (requestedStrategy === 'git-delta') {
+      const state = SyncStateManager.loadState(workspacePath, statePath);
+      if (!state) {
+        OrchestratorLogger.log('[Sync] No sync state found, falling back to full sync');
+
+        return 'full';
+      }
+
+      return 'git-delta';
+    }
+
+    return requestedStrategy;
+  }
+
+  /**
+   * Execute a git-delta sync: fetch latest and apply only changed files.
+   *
+   * @param workspacePath - Path to the git workspace
+   * @param targetReference - Git ref to sync to (commit SHA, branch, tag)
+   * @param statePath - Optional custom path for sync state file
+   * @returns Number of files changed
+   */
+  static async syncGitDelta(workspacePath: string, targetReference: string, statePath?: string): Promise<number> {
+    const state = SyncStateManager.loadState(workspacePath, statePath);
+    if (!state) {
+      throw new Error('Cannot git-delta sync without existing sync state');
+    }
+
+    OrchestratorLogger.log(`[Sync] Git delta: ${state.lastSyncCommit.slice(0, 8)} -> ${targetReference.slice(0, 8)}`);
+
+    // Fetch latest
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" fetch origin`, true);
+
+    // Get list of changed files
+    const diffOutput = await OrchestratorSystem.Run(
+      `git -C "${workspacePath}" diff --name-only ${state.lastSyncCommit}..${targetReference}`,
+      true,
+    );
+
+    const changedFiles = diffOutput.split('\n').filter(Boolean);
+    OrchestratorLogger.log(`[Sync] ${changedFiles.length} file(s) changed`);
+
+    if (changedFiles.length > 0) {
+      // Checkout target ref
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout ${targetReference}`, true);
+    }
+
+    // Update sync state
+    const newState: SyncState = {
+      lastSyncCommit: targetReference,
+      lastSyncTimestamp: new Date().toISOString(),
+      workspaceHash: SyncStateManager.calculateWorkspaceHash(workspacePath),
+      pendingOverlays: state.pendingOverlays,
+    };
+    SyncStateManager.saveState(workspacePath, newState, statePath);
+
+    return changedFiles.length;
+  }
+
+  /**
+   * Apply a direct input overlay from a local archive or storage URI.
+   *
+   * For storage URIs (storage://remote:bucket/path), the archive is fetched via rclone.
+   * For local paths, the archive is extracted directly.
+   *
+   * @param workspacePath - Path to the workspace
+   * @param inputReference - Local path or storage:// URI to the input archive
+   * @param rcloneRemote - rclone remote name for storage:// URIs (optional, uses URI-embedded remote)
+   * @param statePath - Optional custom path for sync state file
+   * @returns List of overlay paths applied
+   */
+  static async applyDirectInput(
+    workspacePath: string,
+    inputReference: string,
+    rcloneRemote?: string,
+    statePath?: string,
+  ): Promise<string[]> {
+    let localArchive = inputReference;
+
+    // If storage URI, fetch via rclone first
+    if (inputReference.startsWith('storage://')) {
+      const parsed = IncrementalSyncService.parseStorageUri(inputReference);
+      const remote = rcloneRemote || parsed.remote;
+      const remotePath = parsed.path;
+
+      localArchive = path.join(workspacePath, '.game-ci-input-overlay.tar');
+      OrchestratorLogger.log(`[Sync] Fetching input from storage: ${inputReference}`);
+
+      await IncrementalSyncService.executeRcloneCopy(remote, remotePath, path.dirname(localArchive));
+    }
+
+    if (!fs.existsSync(localArchive)) {
+      throw new Error(`Input archive not found: ${localArchive}`);
+    }
+
+    OrchestratorLogger.log(`[Sync] Applying direct input overlay from ${localArchive}`);
+
+    // Extract overlay
+    await OrchestratorSystem.Run(`tar -xf "${localArchive}" -C "${workspacePath}"`, true);
+
+    // Track overlay in sync state
+    const state = SyncStateManager.loadState(workspacePath, statePath) || {
+      lastSyncCommit: '',
+      lastSyncTimestamp: new Date().toISOString(),
+      pendingOverlays: [],
+    };
+
+    state.pendingOverlays.push(localArchive);
+    SyncStateManager.saveState(workspacePath, state, statePath);
+
+    return [localArchive];
+  }
+
+  /**
+   * Execute a storage-pull sync: pull changed files from an rclone remote.
+   *
+   * This strategy fetches content from a remote storage backend (S3, GCS, Azure, etc.)
+   * and overlays it onto the workspace. Supports two modes:
+   * - overlay: extract on top of existing workspace (default)
+   * - clean: fresh git checkout, then apply overlay
+   *
+   * @param workspacePath - Path to the workspace
+   * @param storageUri - storage://remote:bucket/path URI pointing to remote content
+   * @param options - Configuration for the storage-pull operation
+   * @returns List of files pulled from storage
+   */
+  static async syncStoragePull(
+    workspacePath: string,
+    storageUri: string,
+    options: {
+      rcloneRemote?: string;
+      cleanMode?: boolean;
+      syncRevertAfter?: boolean;
+      statePath?: string;
+    } = {},
+  ): Promise<string[]> {
+    if (!storageUri.startsWith('storage://')) {
+      throw new Error(`Invalid storage URI: ${storageUri}. Must start with storage://`);
+    }
+
+    // Verify rclone is available
+    try {
+      await OrchestratorSystem.Run('rclone version', true, true);
+    } catch {
+      throw new Error('rclone binary not found. Install rclone to use storage-pull sync strategy.');
+    }
+
+    const parsed = IncrementalSyncService.parseStorageUri(storageUri);
+    const remote = options.rcloneRemote || parsed.remote;
+    const remotePath = parsed.path;
+
+    OrchestratorLogger.log(`[Sync] Storage pull: ${remote}:${remotePath} -> ${workspacePath}`);
+
+    // Clean mode: reset workspace to clean git state before applying overlay
+    if (options.cleanMode) {
+      OrchestratorLogger.log('[Sync] Clean mode: resetting workspace to HEAD');
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout -- .`, true);
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" clean -fd`, true);
+    }
+
+    // Pull from remote storage directly into workspace
+    const rcloneSource = `${remote}:${remotePath}`;
+    await OrchestratorSystem.Run(`rclone copy "${rcloneSource}" "${workspacePath}" --transfers 8 --checkers 16`, true);
+
+    // List what was pulled for tracking
+    let pulledFiles: string[] = [];
+    try {
+      const lsOutput = await OrchestratorSystem.Run(`rclone ls "${rcloneSource}"`, true, true);
+      pulledFiles = lsOutput
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => {
+          // rclone ls outputs: "  <size> <path>"
+          const trimmed = line.trim();
+          const spaceIndex = trimmed.indexOf(' ');
+
+          return spaceIndex >= 0 ? trimmed.slice(spaceIndex + 1).trim() : trimmed;
+        })
+        .filter(Boolean);
+    } catch {
+      OrchestratorLogger.logWarning('[Sync] Could not list pulled files from remote');
+    }
+
+    OrchestratorLogger.log(`[Sync] Pulled ${pulledFiles.length} file(s) from storage`);
+
+    // Update sync state with overlay tracking
+    const state = SyncStateManager.loadState(workspacePath, options.statePath) || {
+      lastSyncCommit: '',
+      lastSyncTimestamp: new Date().toISOString(),
+      pendingOverlays: [],
+    };
+
+    state.pendingOverlays.push(storageUri);
+    state.lastSyncTimestamp = new Date().toISOString();
+    state.workspaceHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+    SyncStateManager.saveState(workspacePath, state, options.statePath);
+
+    return pulledFiles;
+  }
+
+  /**
+   * Parse a storage:// URI into remote and path components.
+   *
+   * Supported formats:
+   * - storage://remote:bucket/path  (explicit remote with colon separator)
+   * - storage://remote/path         (remote name is first path segment)
+   *
+   * @param uri - The storage:// URI to parse
+   * @returns Object with remote name and path
+   */
+  static parseStorageUri(uri: string): { remote: string; path: string } {
+    if (!uri.startsWith('storage://')) {
+      throw new Error(`Invalid storage URI: ${uri}. Must start with storage://`);
+    }
+
+    const stripped = uri.replace('storage://', '');
+
+    // Check for explicit remote:path format (e.g., "myremote:bucket/path")
+    const colonIndex = stripped.indexOf(':');
+    if (colonIndex > 0) {
+      return {
+        remote: stripped.slice(0, colonIndex),
+        path: stripped.slice(colonIndex + 1),
+      };
+    }
+
+    // Fallback: first segment is remote name (e.g., "myremote/bucket/path")
+    const slashIndex = stripped.indexOf('/');
+    if (slashIndex > 0) {
+      return {
+        remote: stripped.slice(0, slashIndex),
+        path: stripped.slice(slashIndex + 1),
+      };
+    }
+
+    // Just a remote name with no path
+    return {
+      remote: stripped,
+      path: '',
+    };
+  }
+
+  /**
+   * Execute rclone copy with standard flags.
+   */
+  private static async executeRcloneCopy(remote: string, remotePath: string, destinationPath: string): Promise<void> {
+    await OrchestratorSystem.Run(
+      `rclone copy "${remote}:${remotePath}" "${destinationPath}" --transfers 8 --checkers 16`,
+      true,
+    );
+  }
+
+  /**
+   * Revert pending overlays by restoring git state.
+   */
+  static async revertOverlays(workspacePath: string, statePath?: string): Promise<void> {
+    const state = SyncStateManager.loadState(workspacePath, statePath);
+    if (!state || state.pendingOverlays.length === 0) {
+      return;
+    }
+
+    OrchestratorLogger.log(`[Sync] Reverting ${state.pendingOverlays.length} overlay(s)`);
+
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout -- .`, true);
+
+    // Clean untracked files from overlays
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" clean -fd`, true);
+
+    state.pendingOverlays = [];
+    state.workspaceHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+    SyncStateManager.saveState(workspacePath, state, statePath);
+
+    OrchestratorLogger.log('[Sync] Overlays reverted');
+  }
+}
--- a/src/model/orchestrator/services/sync/incremental-sync.test.ts
+++ b/src/model/orchestrator/services/sync/incremental-sync.test.ts
@@ -0,0 +1,544 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { IncrementalSyncService } from './incremental-sync-service';
+import { SyncStateManager } from './sync-state-manager';
+import { SyncState } from './sync-state';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+// Mock dependencies
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-system');
+jest.mock('../core/orchestrator-logger');
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+const mockSystem = OrchestratorSystem as jest.Mocked<typeof OrchestratorSystem>;
+const mockLogger = OrchestratorLogger as jest.Mocked<typeof OrchestratorLogger>;
+
+afterEach(() => {
+  jest.clearAllMocks();
+  jest.restoreAllMocks();
+});
+
+describe('IncrementalSyncService', () => {
+  const workspacePath = '/workspace/project';
+
+  describe('parseStorageUri', () => {
+    it('parses storage://remote:bucket/path format', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote:mybucket/some/path');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket/some/path' });
+    });
+
+    it('parses storage://remote/path format', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote/mybucket/path');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket/path' });
+    });
+
+    it('parses storage://remote:bucket with no sub-path', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote:mybucket');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket' });
+    });
+
+    it('handles remote-only URI without path', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote');
+      expect(result).toEqual({ remote: 'myremote', path: '' });
+    });
+
+    it('throws on invalid URI without storage:// prefix', () => {
+      expect(() => IncrementalSyncService.parseStorageUri('http://example.com')).toThrow('Invalid storage URI');
+    });
+
+    it('throws on empty URI', () => {
+      expect(() => IncrementalSyncService.parseStorageUri('')).toThrow('Invalid storage URI');
+    });
+  });
+
+  describe('resolveStrategy', () => {
+    it('returns full when full is requested', () => {
+      const result = IncrementalSyncService.resolveStrategy('full', workspacePath);
+      expect(result).toBe('full');
+    });
+
+    it('returns git-delta when sync state exists', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      const result = IncrementalSyncService.resolveStrategy('git-delta', workspacePath);
+      expect(result).toBe('git-delta');
+    });
+
+    it('falls back to full when git-delta requested but no sync state', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = IncrementalSyncService.resolveStrategy('git-delta', workspacePath);
+      expect(result).toBe('full');
+    });
+
+    it('returns direct-input as-is', () => {
+      const result = IncrementalSyncService.resolveStrategy('direct-input', workspacePath);
+      expect(result).toBe('direct-input');
+    });
+
+    it('returns storage-pull as-is', () => {
+      const result = IncrementalSyncService.resolveStrategy('storage-pull', workspacePath);
+      expect(result).toBe('storage-pull');
+    });
+  });
+
+  describe('syncGitDelta', () => {
+    const targetReference = 'def456789';
+
+    beforeEach(() => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123456',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+    });
+
+    it('fetches and checks out changed files', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce('file1.txt\nfile2.cs\n'); // git diff
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout
+
+      const result = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(result).toBe(2);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" fetch origin'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('diff --name-only abc123456..def456789'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(expect.stringContaining('checkout def456789'), true);
+    });
+
+    it('skips checkout when no files changed', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce(''); // git diff (empty)
+
+      const result = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(result).toBe(0);
+
+      // Should only have fetch + diff calls, no checkout
+      expect(mockSystem.Run).toHaveBeenCalledTimes(2);
+    });
+
+    it('throws when no sync state exists', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await expect(IncrementalSyncService.syncGitDelta(workspacePath, targetReference)).rejects.toThrow(
+        'Cannot git-delta sync without existing sync state',
+      );
+    });
+
+    it('saves updated sync state after delta sync', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce('file1.txt\n'); // git diff
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout
+
+      await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.lastSyncCommit).toBe(targetReference);
+    });
+  });
+
+  describe('applyDirectInput', () => {
+    it('extracts a local archive to workspace', async () => {
+      const archivePath = '/tmp/overlay.tar';
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        if (p === archivePath) return true;
+
+        // State file path does not exist
+        return false;
+      });
+      mockSystem.Run.mockResolvedValueOnce(''); // tar extract
+
+      const result = await IncrementalSyncService.applyDirectInput(workspacePath, archivePath);
+
+      expect(result).toEqual([archivePath]);
+      expect(mockSystem.Run).toHaveBeenCalledWith(expect.stringContaining('tar -xf "/tmp/overlay.tar"'), true);
+    });
+
+    it('fetches archive from storage URI via rclone then extracts', async () => {
+      const storageUri = 'storage://s3remote:builds/overlay.tar';
+
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        const pathString = p.toString();
+        if (pathString.includes('.game-ci-input-overlay.tar')) return true;
+
+        return false;
+      });
+      mockSystem.Run.mockResolvedValue(''); // rclone copy + tar extract
+
+      const result = await IncrementalSyncService.applyDirectInput(workspacePath, storageUri);
+
+      expect(result.length).toBe(1);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "s3remote:builds/overlay.tar"'),
+        true,
+      );
+    });
+
+    it('throws when local archive does not exist', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await expect(IncrementalSyncService.applyDirectInput(workspacePath, '/missing/archive.tar')).rejects.toThrow(
+        'Input archive not found',
+      );
+    });
+
+    it('tracks overlay in sync state', async () => {
+      const archivePath = '/tmp/overlay.tar';
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        if (p === archivePath) return true;
+
+        return false;
+      });
+      mockSystem.Run.mockResolvedValueOnce('');
+
+      await IncrementalSyncService.applyDirectInput(workspacePath, archivePath);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toContain(archivePath);
+    });
+  });
+
+  describe('syncStoragePull', () => {
+    const storageUri = 'storage://s3:game-builds/latest';
+
+    beforeEach(() => {
+      mockFs.existsSync.mockReturnValue(false); // no existing state
+    });
+
+    it('pulls files from rclone remote into workspace', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version check
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce('  1234 file1.txt\n  5678 dir/file2.cs\n'); // rclone ls
+
+      const result = await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(result).toEqual(['file1.txt', 'dir/file2.cs']);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "s3:game-builds/latest" "/workspace/project"'),
+        true,
+      );
+    });
+
+    it('uses custom rclone remote when provided', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, {
+        rcloneRemote: 'custom-remote',
+      });
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "custom-remote:game-builds/latest"'),
+        true,
+      );
+    });
+
+    it('resets workspace in clean mode before pull', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout -- .
+      mockSystem.Run.mockResolvedValueOnce(''); // git clean -fd
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, { cleanMode: true });
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" checkout -- .'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" clean -fd'),
+        true,
+      );
+    });
+
+    it('throws on invalid storage URI', async () => {
+      await expect(IncrementalSyncService.syncStoragePull(workspacePath, 'http://example.com')).rejects.toThrow(
+        'Invalid storage URI',
+      );
+    });
+
+    it('throws when rclone binary is not available', async () => {
+      mockSystem.Run.mockRejectedValueOnce(new Error('command not found: rclone'));
+
+      await expect(IncrementalSyncService.syncStoragePull(workspacePath, storageUri)).rejects.toThrow(
+        'rclone binary not found',
+      );
+    });
+
+    it('saves sync state with overlay tracking', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce('  100 a.txt\n'); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toContain(storageUri);
+    });
+
+    it('handles rclone ls failure gracefully', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockRejectedValueOnce(new Error('ls failed')); // rclone ls fails
+
+      const result = await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(result).toEqual([]);
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Could not list pulled files'));
+    });
+  });
+
+  describe('revertOverlays', () => {
+    it('reverts git state and cleans untracked files', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: ['/tmp/overlay.tar', 'storage://s3:builds/content'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+      mockSystem.Run.mockResolvedValue('');
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" checkout -- .'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" clean -fd'),
+        true,
+      );
+    });
+
+    it('clears pending overlays in saved state', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: ['/tmp/overlay.tar'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+      mockSystem.Run.mockResolvedValue('');
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toEqual([]);
+    });
+
+    it('does nothing when no overlays are pending', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).not.toHaveBeenCalled();
+    });
+
+    it('does nothing when no sync state exists', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).not.toHaveBeenCalled();
+    });
+  });
+});
+
+describe('SyncStateManager', () => {
+  const workspacePath = '/workspace/project';
+
+  describe('loadState', () => {
+    it('returns parsed state from default path', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toEqual(state);
+      expect(mockFs.readFileSync).toHaveBeenCalledWith(path.join(workspacePath, '.game-ci/sync-state.json'), 'utf8');
+    });
+
+    it('uses custom state path when provided', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      SyncStateManager.loadState(workspacePath, 'custom/state.json');
+
+      expect(mockFs.readFileSync).toHaveBeenCalledWith(path.join(workspacePath, 'custom/state.json'), 'utf8');
+    });
+
+    it('returns undefined when state file does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toBeUndefined();
+    });
+
+    it('returns undefined and logs warning on malformed JSON', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue('not-valid-json{{{');
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toBeUndefined();
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to load sync state'));
+    });
+  });
+
+  describe('saveState', () => {
+    it('writes state to default path with pretty JSON', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: ['overlay1'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalledWith(
+        path.join(workspacePath, '.game-ci/sync-state.json'),
+        JSON.stringify(state, undefined, 2),
+        'utf8',
+      );
+    });
+
+    it('creates parent directories if they do not exist', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(false);
+
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockFs.mkdirSync).toHaveBeenCalledWith(expect.stringContaining('.game-ci'), { recursive: true });
+    });
+
+    it('logs warning on write failure instead of throwing', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.writeFileSync.mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      // Should not throw
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to save sync state'));
+    });
+  });
+
+  describe('calculateWorkspaceHash', () => {
+    it('produces a deterministic SHA-256 hash from workspace files', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockImplementation((filePath: fs.PathOrFileDescriptor) => {
+        const p = filePath.toString();
+        if (p.includes('ProjectVersion.txt')) return 'm_EditorVersion: 2022.3.10f1';
+        if (p.includes('manifest.json')) return '{"dependencies":{}}';
+        if (p.includes('packages-lock.json')) return '{"dependencies":{}}';
+        if (p.includes('csc.rsp')) return '-nullable+';
+
+        return '';
+      });
+
+      const hash1 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+      const hash2 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash1).toBe(hash2);
+      expect(hash1).toHaveLength(64); // SHA-256 hex digest
+    });
+
+    it('produces different hashes for different workspace content', () => {
+      let callCount = 0;
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockImplementation(() => {
+        callCount++;
+
+        return callCount <= 4 ? 'content-v1' : 'content-v2';
+      });
+
+      const hash1 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+      const hash2 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash1).not.toBe(hash2);
+    });
+
+    it('includes missing file markers in hash for absent files', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const hash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash).toHaveLength(64);
+    });
+  });
+
+  describe('hasDrifted', () => {
+    it('returns false when workspace hash matches', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      const savedHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      const result = SyncStateManager.hasDrifted(workspacePath, savedHash);
+
+      expect(result).toBe(false);
+    });
+
+    it('returns true when workspace hash differs', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = SyncStateManager.hasDrifted(workspacePath, 'some-old-hash-that-will-not-match');
+
+      expect(result).toBe(true);
+    });
+  });
+});
--- a/src/model/orchestrator/services/sync/index.ts
+++ b/src/model/orchestrator/services/sync/index.ts
@@ -0,0 +1,3 @@
+export { SyncState, SyncStrategy } from './sync-state';
+export { IncrementalSyncService } from './incremental-sync-service';
+export { SyncStateManager } from './sync-state-manager';
--- a/src/model/orchestrator/services/sync/sync-state-manager.ts
+++ b/src/model/orchestrator/services/sync/sync-state-manager.ts
@@ -0,0 +1,125 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { SyncState } from './sync-state';
+
+/**
+ * Manages persistent sync state for incremental workspace updates.
+ *
+ * The sync state tracks what has been synced to a workspace, enabling
+ * delta-based updates instead of full clones. State is stored as a JSON
+ * file in the workspace (default: .game-ci/sync-state.json).
+ */
+export class SyncStateManager {
+  static readonly DEFAULT_STATE_PATH = '.game-ci/sync-state.json';
+
+  /**
+   * Key workspace files whose content is hashed for drift detection.
+   * Changes to any of these files indicate the workspace may have been
+   * modified outside of the sync system.
+   */
+  private static readonly WORKSPACE_HASH_FILES = [
+    'ProjectSettings/ProjectVersion.txt',
+    'Packages/manifest.json',
+    'Packages/packages-lock.json',
+    'Assets/csc.rsp',
+  ];
+
+  /**
+   * Load sync state from the workspace.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param statePath - Relative path to the state file (default: .game-ci/sync-state.json)
+   * @returns The loaded sync state, or undefined if no state exists or parsing fails
+   */
+  static loadState(workspacePath: string, statePath?: string): SyncState | undefined {
+    const resolvedPath = path.join(workspacePath, statePath || SyncStateManager.DEFAULT_STATE_PATH);
+
+    if (!fs.existsSync(resolvedPath)) {
+      return;
+    }
+
+    try {
+      const content = fs.readFileSync(resolvedPath, 'utf8');
+
+      return JSON.parse(content) as SyncState;
+    } catch {
+      OrchestratorLogger.logWarning(`[SyncState] Failed to load sync state from ${resolvedPath}`);
+
+      return;
+    }
+  }
+
+  /**
+   * Save sync state to the workspace.
+   *
+   * Creates parent directories if they do not exist.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param state - The sync state to persist
+   * @param statePath - Relative path to the state file (default: .game-ci/sync-state.json)
+   */
+  static saveState(workspacePath: string, state: SyncState, statePath?: string): void {
+    const resolvedPath = path.join(workspacePath, statePath || SyncStateManager.DEFAULT_STATE_PATH);
+
+    try {
+      const directory = path.dirname(resolvedPath);
+      if (!fs.existsSync(directory)) {
+        fs.mkdirSync(directory, { recursive: true });
+      }
+
+      fs.writeFileSync(resolvedPath, JSON.stringify(state, undefined, 2), 'utf8');
+      OrchestratorLogger.log(
+        `[SyncState] State saved: commit=${state.lastSyncCommit}, overlays=${state.pendingOverlays.length}`,
+      );
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[SyncState] Failed to save sync state: ${error.message}`);
+    }
+  }
+
+  /**
+   * Calculate a SHA-256 hash of key workspace files for drift detection.
+   *
+   * Hashes the content of known workspace files (ProjectVersion.txt,
+   * manifest.json, etc.) to produce a fingerprint. If the hash changes
+   * between syncs, the workspace may have been modified externally.
+   *
+   * Files that do not exist are skipped (their absence is part of the hash).
+   *
+   * @param workspacePath - Root path of the workspace
+   * @returns Hex-encoded SHA-256 hash string
+   */
+  static calculateWorkspaceHash(workspacePath: string): string {
+    const hash = crypto.createHash('sha256');
+
+    for (const relativePath of SyncStateManager.WORKSPACE_HASH_FILES) {
+      const filePath = path.join(workspacePath, relativePath);
+      try {
+        if (fs.existsSync(filePath)) {
+          const content = fs.readFileSync(filePath, 'utf8');
+          hash.update(`${relativePath}:${content}`);
+        } else {
+          hash.update(`${relativePath}:__missing__`);
+        }
+      } catch {
+        hash.update(`${relativePath}:__error__`);
+      }
+    }
+
+    return hash.digest('hex');
+  }
+
+  /**
+   * Check if the workspace has drifted from a previously saved hash.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param savedHash - The previously saved workspace hash to compare against
+   * @returns true if the current workspace hash differs from the saved hash
+   */
+  static hasDrifted(workspacePath: string, savedHash: string): boolean {
+    const currentHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+    return currentHash !== savedHash;
+  }
+}
--- a/src/model/orchestrator/services/sync/sync-state.ts
+++ b/src/model/orchestrator/services/sync/sync-state.ts
@@ -0,0 +1,19 @@
+/**
+ * Persistent sync state for incremental workspace updates.
+ * Stored on the runner to track what has already been synced.
+ */
+export interface SyncState {
+  /** Last successfully synced git commit SHA */
+  lastSyncCommit: string;
+
+  /** ISO 8601 timestamp of last sync */
+  lastSyncTimestamp: string;
+
+  /** SHA-256 hash of workspace state (optional) */
+  workspaceHash?: string;
+
+  /** List of overlay paths that haven't been reverted */
+  pendingOverlays: string[];
+}
+
+export type SyncStrategy = 'full' | 'git-delta' | 'direct-input' | 'storage-pull';
Author	SHA1	Message	Date
frostebite	d503b0b61a	fix: replace orchestrator-develop branch references with main The orchestrator-develop branch no longer exists. Update all fallback clone commands and test fixtures to use main instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 19:59:58 +00:00
frostebite	07eec62d28	ci: set macOS builds to continue-on-error Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 23:33:04 +00:00
frostebite	4870fb5a5c	feat(sync): complete incremental sync protocol with storage-pull, state management, and tests (#799 ) - Add storage-pull strategy: rclone-based sync from remote storage with overlay and clean modes, URI parsing (storage://remote:bucket/path), transfer parallelism, and automatic rclone availability checking - Add SyncStateManager: persistent state load/save with configurable paths, workspace hash calculation via SHA-256 of key project files, and drift detection for external modification awareness - Add action.yml inputs: syncStrategy, syncInputRef, syncStorageRemote, syncRevertAfter, syncStatePath with sensible defaults - Wire sync into Input (5 getters), BuildParameters (5 fields), index.ts (local build path), and RemoteClient (orchestrator path) with post-job overlay revert when syncRevertAfter is true - Add 42 unit tests covering all strategies, URI parsing, state management, hash calculation, drift detection, error handling, and edge cases (missing rclone, invalid URIs, absent state, empty diffs) - Add root:true to eslintrc to prevent plugin resolution conflicts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 11:56:43 +00:00
frostebite	3033ee0067	feat(orchestrator): incremental sync protocol — git delta, direct input, and storage-backed sync Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 09:39:53 +00:00
				`@@ -1 +0,0 @@`
				`export { BuildReliabilityService } from './build-reliability-service';`