carson 4.2.1 → 4.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 251588ff2b1c952538965ea349b498e424c9646f6c57965dd516e7729e002035
-  data.tar.gz: 2fee9945faa9fbace57ef59dfd77cf5fb9c38992f4e573e796daeef8b1972017
+  metadata.gz: aaef0edd290f56dd797540049069bdb07d2d5e86cef8ca30c6c40d735d37740e
+  data.tar.gz: 6b5d0df422508ef217f275fdaed1ecbc0a6b3b1e800acab0c1520c38a3cd58cd
 SHA512:
-  metadata.gz: 3981e6facd927beb517b18151eb0d4804863e6adab4d4d39039e6e9313e644f57caae09e0b292e1e33d49b383e1f3f7975decfe3d0672dc372f3582b757bc513
-  data.tar.gz: 55175ac0b094290e602d79854e65208fb5f1baa23753ed05c786c48ddda562b2015de76fb7244dc90c12a2495b2d84269e40c3f9521077d646776eeab843c760
+  metadata.gz: eede4e41d8d530bb528d0515352f6879b2c4b8f64dacec0c767128f4f8151dcb22b620d0d946ebac395e5edb199f0296acfd7120c4aa211c3e70fc0069910fe1
+  data.tar.gz: ce5aa317bba3e47807e918a1432ae2ff9b7254f8f921e09420062e84cefd4bdee3eb3de20073e6d8c1167c6ccde487ac267842f4fc17ec2b6dce4ca6eedf70f8

data/RELEASE.md

@@ -7,6 +7,42 @@ Release-note scope rule:
 
 ## Unreleased
 
+## 4.3.1
+
+### Changed
+
+- **Bureau is an enhancement, not a mode.** Config simplified from `workstyle: local/remote` to `bureau: true/false` (default: false). Local delivery is always the foundation. Bureau adds PR + CI on top.
+- **Pre-push hook simplified to no-op.** Pushes to main are always legitimate — local delivery is the base. The hook no longer needs workstyle detection or push guards.
+- **Parcel-on-main guard added.** `carson deliver` blocks when run from main itself — agents must work on a workbench.
+- **Output: "Synced to remote"** replaces "Pushed to remote". Sync is objective.
+
+### Why
+
+The key insight: remote-centred is not a different path — it's local delivery with Bureau enhancement bolted on. One path, optional layer. `workstyle` dissolved into a single `bureau` toggle. 72 insertions, 166 deletions.
+
+## 4.3.0
+
+### New
+
+- **Local-centred workstyle** — Carson now supports two workstyles. Local-centred (the new default) merges parcels directly into the local vault (main) and pushes to the remote as backup. No PR, no CI gate, no waiting. Remote-centred remains available for projects that need Bureau oversight. Set `workstyle: remote` in `.carson.yml` to use the old behaviour.
+- **`Warehouse::Vault` concern** — the vault is local main, where accepted parcels live. `warehouse.accept!( parcel )` merges a branch into main via fast-forward. If the branch has diverged, the agent must rebase first.
+- **`warehouse.prepare!( parcel, message: )`** — the delivery prep phase: pack, fetch latest standard, check freshness, auto-rebase if behind. No compliance gate in local workstyle — agents handle linting and testing themselves.
+
+### Changed
+
+- **Courier is workstyle-aware** — `courier.deliver( parcel )` uses different gestures per workstyle. Local: push main to backup vault. Remote: the existing Bureau trip (unchanged). One verb, two gestures. The Courier doesn't know if it's doing "backup" or "primary" — it just delivers.
+- **CLI orchestrates local delivery** — `carson deliver` in local workstyle follows the checkin/checkout pattern: CLI builds Warehouse + Courier, orchestrates `prepare!` → `accept!` → `courier.deliver`. No Runtime in the local path.
+
+### UX
+
+- `carson deliver` output (local workstyle): `⧓ <branch> merged into main.` / `⧓ Pushed to remote.`
+- On failure: clear recovery instructions (`Rebase onto main and deliver again.`)
+- On backup failure: `⧓ Backup failed.` with recovery.
+
+### Why
+
+The 2026-03-24 retrospective clarified that for a solo developer with agents, the remote-centred machinery (PR → CI → Bureau polling → merge) added latency, cost, and complexity without serving a need. The vault (local main) is the source of truth. GitHub is the backup vault. The Courier's job is simpler and faster.
+
 ## 4.2.1
 
 ### Fixed

data/VERSION

@@ -1 +1 @@
-4.2.1
+4.3.1

data/config/hooks/pre-push

@@ -1,60 +1,14 @@
 #!/usr/bin/env bash
-# Carson pre-push hook — enforces push policy in governed repositories.
+# Carson pre-push hook.
 #
-# Guards:
-#   1. Blocks direct push to main/master refs.
-#   2. Blocks raw git push in governed repos — agents must use `carson deliver`.
-#      Carson bypasses via --no-verify internally. No env-var signal to spoof.
+# Local delivery is always the base — pushes to main are legitimate.
+# When bureau enhancement is enabled, the Bureau path runs through
+# Runtime.deliver!, not through raw git push. So the hook has nothing
+# to enforce in either case.
 #
-# Bypass: git push --no-verify
+# The hook remains installed for future use (e.g. bureau-specific guards).
+# For now: consume stdin and exit.
 set -euo pipefail
 
-hooks_dir="$(cd "$(dirname "$0")" && pwd)"
-style="$(cat "$hooks_dir/workflow_style" 2>/dev/null || echo "branch")"
-[ "$style" = "trunk" ] && exit 0
-
-# --- Guard 1: block pushes to main/master refs ---
-
-remote_name="${1:-unknown}"
-remote_url="${2:-unknown}"
-has_commit_push=false
-while read -r local_ref local_sha remote_ref remote_sha; do
-	case "$remote_ref" in
-		refs/heads/main|refs/heads/master)
-			echo "Pushes to ${remote_ref#refs/heads/} go through PRs, not direct push." >&2
-			echo "Use \`carson deliver\` instead — it handles push, PR, and merge with safety guards." >&2
-			echo "Bypass: git push --no-verify" >&2
-			exit 1
-			;;
-	esac
-	[[ "$local_sha" != "0000000000000000000000000000000000000000" ]] && has_commit_push=true
-done
-
-# --- Guard 2: block raw git push in governed repos ---
-# All pushes in governed repos are blocked unconditionally.
-# Carson bypasses this hook via --no-verify when pushing internally.
-# No env-var bypass — cannot be spoofed.
-
-config_file="${HOME}/.carson/config.json"
-if [[ -f "$config_file" ]]; then
-	repo_root="$(git rev-parse --show-toplevel 2>/dev/null || echo "")"
-	if [[ -n "$repo_root" ]]; then
-		normalised="$(cd "$repo_root" && pwd -P)"
-		if grep -qF "\"$normalised\"" "$config_file" 2>/dev/null; then
-			echo "This repo is Carson-governed — use \`carson deliver\` instead of raw \`git push\`." >&2
-			echo "Use \`carson deliver\` instead — it handles push, PR, and merge with safety guards." >&2
-			echo "Bypass: git push --no-verify" >&2
-			exit 1
-		fi
-	fi
-fi
-
-# --- Template sync on push ---
-
-if $has_commit_push; then
-	if [[ -n "${CARSON_BIN:-}" ]]; then
-		ruby "$CARSON_BIN" template apply --push-prep || exit 1
-	else
-		carson template apply --push-prep || exit 1
-	fi
-fi
+cat > /dev/null
+exit 0

data/lib/carson/config.rb

@@ -33,7 +33,8 @@ module Carson
 			:govern_repos, :govern_merge_method,
 			:govern_agent_provider, :govern_state_path,
 			:govern_check_wait,
-			:poll_interval_at_bureau
+			:poll_interval_at_bureau,
+			:bureau
 
 		def self.load( repo_root: )
 			base_data = default_data
@@ -85,6 +86,7 @@ module Carson
 				"deliver" => {
 				"poll_interval_at_bureau" => 30
 			},
+			"bureau" => false,
 			"govern" => {
 					"repos" => [],
 					"merge" => {
@@ -247,6 +249,8 @@ module Carson
 			deliver_hash = fetch_hash( hash: data, key: "deliver" )
 			@poll_interval_at_bureau = fetch_non_negative_integer( hash: deliver_hash, key: "poll_interval_at_bureau" )
 
+			@bureau = !!data.fetch( "bureau", false )
+
 			govern_hash = fetch_hash( hash: data, key: "govern" )
 			@govern_repos = fetch_optional_string_array( hash: govern_hash, key: "repos" ).map { |path| safe_expand_path( path ) }
 			govern_merge_hash = fetch_hash( hash: govern_hash, key: "merge" )

data/lib/carson/courier.rb

@@ -1,6 +1,8 @@
 # Carson Co.
+require "open3"
+
 module Carson
-	# The delivery person — picks up parcels and delivers them to the bureau.
+	# The delivery worker — waits at the gate, picks up parcels, delivers them.
 	#
 	# The courier is a Carson employee assigned to a warehouse. They pick up
 	# a parcel, ask the warehouse to ship it, file a waybill, and wait at
@@ -59,11 +61,13 @@ module Carson
 	# answer, the courier reports "filed" — the parcel is still at the bureau
 	# and the shelf stays sealed.
 	#
-	# == Future: destination modes
+	# == Workstyle
 	#
-	# Currently remote-centred (ship → waybill → bureau → acceptance).
-	# A future local-centred mode merges locally; remote is a synced backup.
-	# The destination mode should be injectable, not baked in.
+	# The courier's gesture depends on the workstyle:
+	# The courier delivers parcels. The default gesture is local: sync the
+	# vault to the remote. When bureau enhancement is enabled, the courier
+	# also files a PR and waits for Bureau checks — but that path runs
+	# through Runtime.deliver!, not through this default gesture.
 	class Courier
 		# Exit codes — shared contract between Carson employees and the CLI.
 		OK = 0
@@ -75,17 +79,21 @@ module Carson
 		# The courier checks the bureau up to 6 times before leaving.
 		MAX_CHECKS_AT_BUREAU = 6
 
-		def initialize( warehouse, ledger: nil, merge_method: "rebase", poll_interval_at_bureau: 30, output: $stdout )
+		def initialize( warehouse, bureau: false, ledger: nil, merge_method: "rebase", poll_interval_at_bureau: 30, output: $stdout )
 			@warehouse = warehouse
+			@bureau = bureau
 			@ledger = ledger
 			@merge_method = merge_method
 			@poll_interval_at_bureau = poll_interval_at_bureau
 			@output = output
 		end
 
-		# Deliver a parcel to the registry.
-		# Ships it, files a waybill, seals the shelf, waits at the bureau.
+		# Deliver a parcel.
+		# Default: sync the vault to the remote.
+		# Bureau enhancement: also file waybill, poll, register.
 		def deliver( parcel, title: nil, body_file: nil, commit_message: nil )
+			return deliver_locally( parcel ) unless @bureau
+
 			result = {
 				command: "deliver",
 				label: parcel.label,
@@ -246,6 +254,39 @@ module Carson
 			result[ :diagnostic ] = waybill.ci_diagnostic
 		end
 
+		# Local gesture: sync the vault to the remote.
+		# The parcel is already in the vault (accepted by the Warehouse).
+		# The courier's job is to push the vault state to the remote.
+		def deliver_locally( parcel )
+			result = {
+				command: "deliver",
+				label: parcel.label,
+				remote_main: "#{@warehouse.bureau_address}/#{@warehouse.main_label}"
+			}
+
+			remote = @warehouse.bureau_address
+			main = @warehouse.main_label
+			root = @warehouse.main_worktree_root
+
+			# The pre-push hook understands local workstyle — no bypass needed.
+			_, stderr, status = Open3.capture3(
+				"git", "-C", root, "push", remote, main
+			)
+
+			if status.success?
+				result[ :exit ] = OK
+				result[ :outcome ] = "delivered"
+				result[ :synced ] = true
+			else
+				result[ :exit ] = OK
+				result[ :outcome ] = "delivered"
+				result[ :synced ] = false
+				result[ :sync_error ] = stderr.strip
+			end
+
+			result
+		end
+
 		# Is the waybill blocked by something that won't resolve by waiting?
 		# CI failure, merge conflict, policy block — the courier should take
 		# the parcel back immediately.

data/lib/carson/runtime/deliver.rb

@@ -20,6 +20,7 @@ module Carson
 					head: current_head
 				)
 				courier = Courier.new( warehouse,
+				bureau: true,
 				ledger: ledger,
 				merge_method: config.govern_merge_method,
 				poll_interval_at_bureau: config.poll_interval_at_bureau,

data/lib/carson/warehouse/vault.rb

@@ -0,0 +1,76 @@
+# The warehouse's vault concern.
+# The vault is local main — where accepted parcels live.
+# In local-centred workstyle, the vault is the source of truth.
+# In remote-centred workstyle, the vault is the backup (receives
+# the standard from the bureau's registry after acceptance).
+require "open3"
+
+module Carson
+	class Warehouse
+		module Vault
+
+			# Accept a parcel into the vault.
+			# Fast-forwards local main to include the parcel's branch.
+			# Runs from the main worktree root where main is checked out.
+			#
+			# Precondition: the parcel's branch must be a fast-forward of main.
+			# If not, the agent must rebase first.
+			#
+			# Returns a result hash:
+			#   { status: "ok", branch: ..., head: ... }
+			#   { status: "block", error: ..., recovery: ... }
+			#   { status: "error", error: ..., recovery: ... }
+			def accept!( parcel )
+				root = main_worktree_root
+
+				# Verify main is checked out in the main worktree.
+				unless main_checked_out_at?( root )
+					return {
+						status: "error",
+						error: "#{@main_label} is not checked out in the main worktree.",
+						recovery: "Check the main worktree state at #{root}."
+					}
+				end
+
+				# Fast-forward main to include the parcel's branch.
+				_, stderr, status = Open3.capture3(
+					"git", "-C", root, "merge", "--ff-only", parcel.label
+				)
+
+				return vault_accepted( parcel, root ) if status.success?
+
+				vault_blocked( parcel, stderr )
+			end
+
+		private
+
+			# Check whether main is the checked-out branch at a given path.
+			def main_checked_out_at?( root )
+				head_ref, _, status = Open3.capture3(
+					"git", "-C", root, "rev-parse", "--abbrev-ref", "HEAD"
+				)
+				status.success? && head_ref.strip == @main_label
+			end
+
+			# Build the success result after vault acceptance.
+			def vault_accepted( parcel, root )
+				new_head, = Open3.capture3( "git", "-C", root, "rev-parse", "HEAD" )
+				{
+					status: "ok",
+					branch: parcel.label,
+					head: new_head.strip
+				}
+			end
+
+			# Build the blocked/error result when vault acceptance fails.
+			def vault_blocked( parcel, stderr )
+				{
+					status: "block",
+					error: "#{parcel.label} cannot be fast-forwarded into #{@main_label}.",
+					recovery: "Rebase onto #{@main_label} and deliver again."
+				}
+			end
+
+		end
+	end
+end

data/lib/carson/warehouse.rb

@@ -6,6 +6,7 @@ require "fileutils"
 require "open3"
 
 require_relative "warehouse/workbench"
+require_relative "warehouse/vault"
 require_relative "warehouse/seal"
 require_relative "warehouse/bureau"
 
@@ -16,6 +17,7 @@ module Carson
 	# managing workbenches, and sweeping up.
 	class Warehouse
 		include Workbench
+		include Vault
 		include Seal
 		include Bureau
 
@@ -140,6 +142,49 @@ module Carson
 			end
 		end
 
+		# --- Delivery prep ---
+
+		# Prepare a parcel for delivery.
+		# Orchestrates the prep phase: pack, fetch, standard check, auto-rebase.
+		# Returns { status: "ok" } or { status: "block"/"error", error:, recovery: }.
+		def prepare!( parcel, message: nil )
+			registry = "#{bureau_address}/#{main_label}"
+
+			# Pack if the agent provided a commit message.
+			if message
+				unless pack!( message: message )
+					return { status: "error", error: "Nothing to commit.", recovery: "Stage changes first." }
+				end
+				# Update the parcel's head after packing.
+				parcel = Parcel.new( label: parcel.label, head: current_head )
+			end
+
+			# Fetch the latest standard.
+			unless fetch_latest
+				return {
+					status: "block",
+					error: "Cannot fetch latest standard.",
+					recovery: "Check network and remote config, then deliver again."
+				}
+			end
+
+			# Check if the parcel is based on the latest standard.
+			unless based_on_latest_standard?( parcel, registry: registry )
+				# Auto-rebase onto the latest standard.
+				unless rebase_on_latest_standard!( registry: registry )
+					return {
+						status: "block",
+						error: "#{parcel.label} conflicts with #{@main_label}.",
+						recovery: "Rebase onto #{@main_label}, resolve conflicts, deliver again."
+					}
+				end
+				# Update the parcel's head after rebase.
+				parcel = Parcel.new( label: parcel.label, head: current_head )
+			end
+
+			{ status: "ok", parcel: parcel }
+		end
+
 		# --- Inventory ---
 
 		# All labels (branch names).

data/lib/cli.rb

@@ -131,25 +131,19 @@ module Carson
 			OptionParser.new do |parser|
 				parser.banner = "Usage: carson <command> [options]\n       carson <repo> <command> [options]"
 				parser.separator ""
-				parser.separator "Repository governance and workflow automation for coding agents."
-				parser.separator ""
-				parser.separator "Portfolio commands:"
-				parser.separator "    list         List governed repositories"
-				parser.separator "    onboard      Register a repository for governance (requires repo path)"
-				parser.separator "    offboard     Remove a repository from governance (requires repo path)"
-				parser.separator "    refresh      Re-install hooks and configuration (all governed repos)"
-				parser.separator "    version      Show Carson version"
+				parser.separator "Keep agents from breaking main. Keep agents from breaking each other."
 				parser.separator ""
 				parser.separator "Agent workflow:"
-				parser.separator "    checkin      Prepare a fresh workbench from the latest standard"
-				parser.separator "    deliver      Ship committed work — push, PR, merge, cleanup"
+				parser.separator "    checkin      Get a fresh workbench"
+				parser.separator "    deliver      Accept into main and back up to remote"
 				parser.separator ""
-				parser.separator "Repository commands (from CWD or with explicit repo):"
-				parser.separator "    checkout     Release a workbench when done"
-				parser.separator "    status       Show repository delivery state"
-				parser.separator "    audit        Run pre-commit health checks"
+				parser.separator "Portfolio:"
+				parser.separator "    onboard      Start governing a repository"
+				parser.separator "    offboard     Stop governing a repository"
+				parser.separator "    list         Show governed repositories"
+				parser.separator "    version      Show Carson version"
 				parser.separator ""
-				parser.separator "Run `carson <command> --help` for details on a specific command."
+				parser.separator "Run `carson <command> --help` for details."
 			end
 		end
 
@@ -813,20 +807,20 @@ module Carson
 
 			options = { json: false, title: nil, body_file: nil, commit_message: nil }
 			deliver_parser = OptionParser.new do |parser|
-				parser.banner = "Usage: carson deliver [--json] [--title TITLE] [--body-file PATH] [--commit MESSAGE]"
+				parser.banner = "Usage: carson deliver [--json] [--commit MESSAGE]"
 				parser.separator ""
-				parser.separator "Push the current branch, create or refresh the pull request, and hand the branch to Carson."
-				parser.separator "Use --commit to create one all-dirty delivery commit before Carson pushes and opens the PR."
+				parser.separator "Accept committed work into main and sync to remote."
+				parser.separator "Use --commit to stage and commit all changes before delivery."
 				parser.separator ""
 				parser.separator "Options:"
 				parser.on( "--json", "Machine-readable JSON output" ) { options[ :json ] = true }
-				parser.on( "--title TITLE", "PR title (defaults to branch name)" ) { |value| options[ :title ] = value }
-				parser.on( "--body-file PATH", "File containing PR body text" ) { |value| options[ :body_file ] = value }
-				parser.on( "--commit MESSAGE", "Commit all dirty user changes before delivery" ) { |value| options[ :commit_message ] = value }
+				parser.on( "--title TITLE", "PR title (remote workstyle only)" ) { |value| options[ :title ] = value }
+				parser.on( "--body-file PATH", "PR body file (remote workstyle only)" ) { |value| options[ :body_file ] = value }
+				parser.on( "--commit MESSAGE", "Commit all changes before delivery" ) { |value| options[ :commit_message ] = value }
 				parser.separator ""
 				parser.separator "Examples:"
 				parser.separator "    carson deliver                               Deliver existing commits"
-				parser.separator "    carson deliver --commit \"fix: harden flow\"   Commit dirty changes, then deliver"
+				parser.separator "    carson deliver --commit \"fix: harden flow\"   Commit then deliver"
 			end
 			deliver_parser.parse!( arguments )
 			if options.fetch( :commit_message, nil ).to_s.strip.empty? && !options.fetch( :commit_message, nil ).nil?
@@ -1023,12 +1017,16 @@ module Carson
 			when "template:apply"
 				runtime.template_apply!( push_prep: parsed.fetch( :push_prep, false ) )
 			when "deliver"
-				runtime.deliver!(
-					title: parsed.fetch( :title, nil ),
-					body_file: parsed.fetch( :body_file, nil ),
-					commit_message: parsed.fetch( :commit_message, nil ),
-					json_output: parsed.fetch( :json, false )
-				)
+				if runtime.config.bureau
+					runtime.deliver!(
+						title: parsed.fetch( :title, nil ),
+						body_file: parsed.fetch( :body_file, nil ),
+						commit_message: parsed.fetch( :commit_message, nil ),
+						json_output: parsed.fetch( :json, false )
+					)
+				else
+					dispatch_deliver_locally( parsed: parsed, runtime: runtime )
+				end
 			when "recover"
 				runtime.recover!(
 					check_name: parsed.fetch( :check_name ),
@@ -1081,6 +1079,89 @@ module Carson
 			report_workbench( result: result, json: parsed.fetch( :json, false ), output: runtime.output )
 		end
 
+		# --- Local-centred delivery ---
+		# CLI orchestrates: prepare → accept → courier.deliver.
+		# No Runtime — follows the checkin/checkout pattern.
+
+		def self.dispatch_deliver_locally( parsed:, runtime: )
+			# The warehouse must be at the current worktree (where the agent works),
+			# not the main worktree root. The agent's branch and head live here.
+			warehouse = Warehouse.new(
+				path: runtime.send( :work_dir ),
+				main_label: runtime.config.main_branch,
+				bureau_address: runtime.config.git_remote
+			)
+			parcel = Parcel.new( label: warehouse.current_label, head: warehouse.current_head )
+			message = parsed.fetch( :commit_message, nil )
+			json = parsed.fetch( :json, false )
+			output = runtime.output
+
+			# Guard: cannot deliver from main itself.
+			if parcel.on_main?( runtime.config.main_branch )
+				result = { command: "deliver", status: "block",
+					error: "Cannot deliver from #{runtime.config.main_branch}.",
+					recovery: "carson checkin <name>" }
+				return report_deliver( result: result, json: json, output: output )
+			end
+
+			# Step 1: Prepare.
+			prep = warehouse.prepare!( parcel, message: message )
+			unless prep[ :status ] == "ok"
+				prep[ :command ] = "deliver"
+				return report_deliver( result: prep, json: json, output: output )
+			end
+
+			# Update parcel if prepare rebased or packed.
+			parcel = prep[ :parcel ] || parcel
+
+			# Step 2: Accept into vault.
+			accept = warehouse.accept!( parcel )
+			accept[ :command ] = "deliver"
+			unless accept[ :status ] == "ok"
+				return report_deliver( result: accept, json: json, output: output )
+			end
+
+			# Step 3: Courier syncs to remote.
+			courier = Courier.new( warehouse, output: output )
+			sync = courier.deliver( parcel )
+
+			# Combine results.
+			result = accept.merge( sync.slice( :outcome, :synced, :sync_error ) )
+			result[ :command ] = "deliver"
+			result[ :outcome ] ||= "delivered"
+			report_deliver( result: result, json: json, output: output )
+		end
+
+		# Render a local delivery result.
+		def self.report_deliver( result:, json:, output: )
+			status = result[ :status ]
+			exit_code = case status
+				when "ok" then Runtime::EXIT_OK
+				when "block" then Runtime::EXIT_BLOCK
+				else Runtime::EXIT_ERROR
+			end
+
+			if json
+				output.puts JSON.pretty_generate( result )
+			else
+				case status
+				when "ok"
+					output.puts "#{BADGE} #{result[ :branch ]} merged into main."
+					if result[ :synced ]
+						output.puts "#{BADGE} Synced to remote."
+					elsif result[ :sync_error ]
+						output.puts "#{BADGE} Sync failed."
+						output.puts "  \u2192 git push"
+					end
+				when "block", "error"
+					output.puts "#{BADGE} #{result[ :error ]}"
+					output.puts "  \u2192 #{result[ :recovery ]}" if result[ :recovery ]
+				end
+			end
+
+			exit_code
+		end
+
 		# Build a Warehouse rooted at the main worktree.
 		# Uses runtime's resolved root and config for remote/branch names.
 		def self.build_warehouse( runtime: )

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: carson
 version: !ruby/object:Gem::Version
-  version: 4.2.1
+  version: 4.3.1
 platform: ruby
 authors:
 - Hailei Wang
@@ -84,6 +84,7 @@ files:
 - lib/carson/warehouse.rb
 - lib/carson/warehouse/bureau.rb
 - lib/carson/warehouse/seal.rb
+- lib/carson/warehouse/vault.rb
 - lib/carson/warehouse/workbench.rb
 - lib/carson/waybill.rb
 - lib/carson/worktree.rb