@ashlr/hub 3.13.0 → 3.14.0

package/dist/core/authority/server-enforcement.d.ts

@@ -0,0 +1,110 @@
+import type { RepoEnforcement } from '../fleet/fleet-types.js';
+/** What a failed GitHub read means (drives the wording and whether a draft may treat it as definitive). */
+export type GithubReadFailure = 
+/** The feature is not on this plan for this repo (private repo on Free): definitive. */
+'plan-unavailable'
+/** Auth is missing or lacks access (401/403 other than the plan message, "Resource not accessible"). */
+ | 'no-permission'
+/** 404: no such repo, or not visible to this auth. */
+ | 'not-found'
+/** 5xx, 429 / rate limits, timeouts, network errors: try again later. */
+ | 'transient' | 'unknown';
+/**
+ * PURE: classify a failed GitHub read from its HTTP status (when known) and
+ * message (gh's stderr, or the API's `message`). The plan message wins over
+ * everything: GitHub sends it with a 403, which would otherwise read as a
+ * permission problem. A rate-limit 403 is transient, not a permission problem.
+ */
+export declare function classifyGithubReadFailure(input: {
+    status?: number | null;
+    message: string;
+}): GithubReadFailure;
+/** PURE: true only for GitHub's "not on this plan" answer — never for a permission or transient failure. */
+export declare function isPlanUnavailable(input: {
+    status?: number | null;
+    message: string;
+}): boolean;
+/** PURE: a short human phrase for a failure kind. */
+export declare function describeGithubReadFailure(kind: GithubReadFailure): string;
+export type ServerEnforcementState = 
+/** GitHub requires at least one status check on the default branch (rulesets or classic protection). */
+'enforced'
+/** Protection is readable (the plan has it) but requires no status check: G7 under `server` would owner-lane every PR. */
+ | 'no-required-checks'
+/** Rulesets / protection are not on this plan for this (private) repo: only `local` enforcement can work. */
+ | 'unavailable'
+/** Could not tell (permission, network, …): never treated as enforced. */
+ | 'unreadable';
+export interface ServerEnforcementProbe {
+    nameWithOwner: string;
+    state: ServerEnforcementState;
+    /** null = the repo itself could not be read. */
+    private: boolean | null;
+    /** Why the probe could not tell (state 'unavailable' | 'unreadable'); null otherwise. */
+    failure: GithubReadFailure | null;
+    /** One human sentence. */
+    detail: string;
+}
+/** One `gh api <path>` GET. `status` is gh's exit code (0 = the API answered 2xx). */
+export type GithubGet = (path: string) => Promise<{
+    status: number;
+    stdout: string;
+    stderr: string;
+}> | {
+    status: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * PURE: how many required status checks GitHub enforces on a branch, from the
+ * two reads merge gate G7 uses (fleet/host-merge.ts readRequiredChecks): the
+ * effective branch rules and the classic protection summary on GET /branches.
+ * Classic contexts with `enforcement_level: "off"` enforce nothing.
+ */
+export declare function countRequiredChecks(rules: unknown, branch: unknown): number;
+/**
+ * Ask GitHub whether it enforces required checks on `nameWithOwner`'s default
+ * branch. At most three GETs: the repo, its effective branch rules, the
+ * branch (classic protection summary). Never throws.
+ */
+export declare function probeServerEnforcement(nameWithOwner: string, get: GithubGet): Promise<ServerEnforcementProbe>;
+/**
+ * PURE: the enforcement a NEW grant draft names for a repo. `server` only
+ * when GitHub already enforces required checks there — anything else
+ * (unavailable, nothing required, unreadable, not probed) is `local`, which
+ * is the stricter mode: lower ceilings, and G7 then demands the App's
+ * host-verified `ashlr/verify` instead of trusting whatever ran.
+ */
+export declare function draftEnforcementFor(probe: Pick<ServerEnforcementProbe, 'state'> | null | undefined): RepoEnforcement;
+/**
+ * PURE: should a RE-APPROVAL switch a `server` repo to `local`? Only on
+ * definitive evidence that GitHub cannot or does not enforce checks there —
+ * an unreadable probe (offline, rate-limited) leaves the signed choice alone,
+ * so a flaky network during a re-approval cannot quietly rewrite the grant.
+ * A re-approval never switches `local` → `server` (that would widen the
+ * ceilings; a new grant does it).
+ */
+export declare function reapprovalDowngrades(probe: Pick<ServerEnforcementProbe, 'state'> | null | undefined): boolean;
+/**
+ * PURE: the mismatch between a signed grant's enforcement and what GitHub
+ * does today, as one sentence for status / setup / Verse; null when they
+ * agree or the probe could not tell. The grant itself is never changed here —
+ * only a re-approval (Touch ID) switches the repo.
+ */
+export declare function enforcementMismatch(grantRepo: {
+    nameWithOwner: string;
+    enforcement: RepoEnforcement;
+}, probe: ServerEnforcementProbe | null | undefined, grantSeq?: number | null): string | null;
+/**
+ * `gh api <path>` (GET only, never a shell, killed after 10 s). Under Vitest
+ * it refuses without spawning anything: a draft built by a test that did not
+ * inject a reader must never read Mason's real GitHub account — and a refusal
+ * makes every repo `local`, the stricter answer.
+ */
+export declare function defaultGithubGet(path: string): Promise<{
+    status: number;
+    stdout: string;
+    stderr: string;
+}>;
+/** Probe several repos concurrently (each probe is ≤ 3 sequential GETs). Keyed by lower-cased owner/name. */
+export declare function probeServerEnforcementAll(repos: readonly string[], get?: GithubGet): Promise<Map<string, ServerEnforcementProbe>>;

package/dist/core/authority/server-enforcement.js

@@ -0,0 +1,260 @@
+/**
+ * Server enforcement — can GitHub itself protect a grant repo's default branch?
+ *
+ * A standing grant names each repo `server` or `local` enforcement (types.ts
+ * StandingGrantRepo). `server` means GitHub's rulesets / branch protection
+ * require checks on the default branch, and merge gate G7 trusts exactly those
+ * required checks; `local` means GitHub protects nothing, so G7 requires every
+ * check on the head green AND the ashlr-fleet App's host-verified
+ * `ashlr/verify` (fleet/verify-check-run.ts), under the lower local ceilings.
+ *
+ * WHY THIS MODULE EXISTS: on GitHub Free, rulesets AND classic branch
+ * protection are unavailable for PRIVATE repos. Verified against the live API
+ * (2026-09-26, org plan "free", private ashlrai/measurably):
+ *
+ *   GET repos/X/rulesets                    → 403 "Upgrade to GitHub Pro or make this repository public to enable this feature."
+ *   GET repos/X/rules/branches/main         → 403 (same message)
+ *   GET repos/X/branches/main/protection    → 403 (same message)
+ *   GET repos/X/branches/main               → 200, protected: false
+ *
+ * So classic branch protection is NOT a fallback where rulesets are missing
+ * (it is plan-gated identically) and the fleet does not try to apply it.
+ * Drafts used to mark every repo whose visibility was unknown `server`, which
+ * made G7 send every PR in such a repo to the owner lane forever. A draft now
+ * asks GitHub and names `server` only where GitHub already enforces at least
+ * one required check on the default branch; everything else is `local`.
+ *
+ * Nothing here gates a merge: G7 re-reads the live protection on every PR.
+ * These reads only decide what a DRAFT proposes (Mason still signs it) and
+ * what status / setup report. Every call is a `gh api <path>` GET.
+ */
+import { execFile } from 'node:child_process';
+/** GitHub's wording for a plan-gated feature on a private repo (rulesets, branch protection). */
+const PLAN_UNAVAILABLE_RE = /upgrade to github pro|make this repository public to enable this feature/iu;
+const TRANSIENT_RE = /rate limit|HTTP 5\d\d|HTTP 429|timed? ?out|ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|could not resolve|network|did not answer|ran out of time|bad gateway|service unavailable/iu;
+const PERMISSION_RE = /HTTP 40[13]\b|resource not accessible|must have admin|bad credentials|requires authentication|gh auth login|not logged in/iu;
+const NOT_FOUND_RE = /HTTP 404\b|\bnot found\b/iu;
+/**
+ * PURE: classify a failed GitHub read from its HTTP status (when known) and
+ * message (gh's stderr, or the API's `message`). The plan message wins over
+ * everything: GitHub sends it with a 403, which would otherwise read as a
+ * permission problem. A rate-limit 403 is transient, not a permission problem.
+ */
+export function classifyGithubReadFailure(input) {
+    const message = input.message ?? '';
+    const status = input.status ?? null;
+    if (PLAN_UNAVAILABLE_RE.test(message))
+        return 'plan-unavailable';
+    if ((status !== null && (status >= 500 || status === 429 || status === 0)) || TRANSIENT_RE.test(message))
+        return 'transient';
+    if (status === 404 || (status === null && NOT_FOUND_RE.test(message)))
+        return 'not-found';
+    if (status === 401 || status === 403 || (status === null && PERMISSION_RE.test(message)))
+        return 'no-permission';
+    return 'unknown';
+}
+/** PURE: true only for GitHub's "not on this plan" answer — never for a permission or transient failure. */
+export function isPlanUnavailable(input) {
+    return classifyGithubReadFailure(input) === 'plan-unavailable';
+}
+/** PURE: a short human phrase for a failure kind. */
+export function describeGithubReadFailure(kind) {
+    switch (kind) {
+        case 'plan-unavailable': return 'not available on this GitHub plan for a private repo';
+        case 'no-permission': return 'your gh auth has no access (check `gh auth status`)';
+        case 'not-found': return 'not found, or not visible to your gh auth';
+        case 'transient': return 'GitHub did not answer (network, rate limit or outage) — try again';
+        default: return 'GitHub refused the read';
+    }
+}
+const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9._-]{1,100}$/u;
+const BRANCH_RE = /^[A-Za-z0-9._/-]{1,255}$/u;
+function parseJson(text) {
+    try {
+        return JSON.parse(text || 'null');
+    }
+    catch {
+        return undefined;
+    }
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function failureMessage(result) {
+    const body = record(parseJson(result.stdout));
+    const apiMessage = typeof body?.['message'] === 'string' ? body['message'] : '';
+    return `${result.stderr} ${apiMessage}`.replace(/\s+/gu, ' ').trim().slice(0, 300);
+}
+/**
+ * PURE: how many required status checks GitHub enforces on a branch, from the
+ * two reads merge gate G7 uses (fleet/host-merge.ts readRequiredChecks): the
+ * effective branch rules and the classic protection summary on GET /branches.
+ * Classic contexts with `enforcement_level: "off"` enforce nothing.
+ */
+export function countRequiredChecks(rules, branch) {
+    const contexts = new Set();
+    if (Array.isArray(rules)) {
+        for (const rule of rules) {
+            const r = record(rule);
+            if (r?.['type'] !== 'required_status_checks')
+                continue;
+            const checks = record(r['parameters'])?.['required_status_checks'];
+            if (!Array.isArray(checks))
+                continue;
+            for (const check of checks) {
+                const context = record(check)?.['context'];
+                if (typeof context === 'string' && context.length > 0)
+                    contexts.add(context);
+            }
+        }
+    }
+    const classic = record(record(record(branch)?.['protection'])?.['required_status_checks']);
+    if (classic && classic['enforcement_level'] !== 'off') {
+        for (const list of [classic['contexts'], Array.isArray(classic['checks']) ? classic['checks'].map((c) => record(c)?.['context']) : []]) {
+            if (!Array.isArray(list))
+                continue;
+            for (const context of list)
+                if (typeof context === 'string' && context.length > 0)
+                    contexts.add(context);
+        }
+    }
+    return contexts.size;
+}
+/**
+ * Ask GitHub whether it enforces required checks on `nameWithOwner`'s default
+ * branch. At most three GETs: the repo, its effective branch rules, the
+ * branch (classic protection summary). Never throws.
+ */
+export async function probeServerEnforcement(nameWithOwner, get) {
+    const out = (state, isPrivate, failure, detail) => ({ nameWithOwner, state, private: isPrivate, failure, detail });
+    if (!REPO_RE.test(nameWithOwner))
+        return out('unreadable', null, 'unknown', 'not an owner/name repo');
+    let repo;
+    try {
+        repo = await get(`repos/${nameWithOwner}`);
+    }
+    catch (error) {
+        repo = { status: 1, stdout: '', stderr: error.message };
+    }
+    if (repo.status !== 0) {
+        const failure = classifyGithubReadFailure({ message: failureMessage(repo) });
+        return out('unreadable', null, failure, `could not read ${nameWithOwner}: ${describeGithubReadFailure(failure)}`);
+    }
+    const info = record(parseJson(repo.stdout));
+    const isPrivate = info?.['private'] === true ? true : info?.['private'] === false ? false : null;
+    const branchName = typeof info?.['default_branch'] === 'string' && BRANCH_RE.test(info['default_branch']) ? info['default_branch'] : null;
+    if (!branchName)
+        return out('unreadable', isPrivate, 'unknown', `${nameWithOwner} has no readable default branch`);
+    const encoded = branchName.split('/').map(encodeURIComponent).join('/');
+    let rules;
+    try {
+        rules = await get(`repos/${nameWithOwner}/rules/branches/${encoded}?per_page=100`);
+    }
+    catch (error) {
+        rules = { status: 1, stdout: '', stderr: error.message };
+    }
+    let rulesBody = [];
+    if (rules.status !== 0) {
+        const failure = classifyGithubReadFailure({ message: failureMessage(rules) });
+        if (failure === 'plan-unavailable') {
+            return out('unavailable', isPrivate, failure, `GitHub rulesets are unavailable on this plan for ${isPrivate === false ? 'repo' : 'private repo'} ${nameWithOwner}`);
+        }
+        // G7 reads a 404 here as "no rulesets" (older GHES); anything else is unknown.
+        if (failure !== 'not-found')
+            return out('unreadable', isPrivate, failure, `could not read ${nameWithOwner}'s branch rules: ${describeGithubReadFailure(failure)}`);
+    }
+    else {
+        rulesBody = parseJson(rules.stdout);
+    }
+    let branch;
+    try {
+        branch = await get(`repos/${nameWithOwner}/branches/${encoded}`);
+    }
+    catch (error) {
+        branch = { status: 1, stdout: '', stderr: error.message };
+    }
+    if (branch.status !== 0) {
+        const failure = classifyGithubReadFailure({ message: failureMessage(branch) });
+        return out('unreadable', isPrivate, failure, `could not read ${nameWithOwner}'s ${branchName} branch: ${describeGithubReadFailure(failure)}`);
+    }
+    const required = countRequiredChecks(rulesBody, parseJson(branch.stdout));
+    return required > 0
+        ? out('enforced', isPrivate, null, `GitHub requires ${required} check${required === 1 ? '' : 's'} on ${nameWithOwner}:${branchName}`)
+        : out('no-required-checks', isPrivate, null, `GitHub requires no status check on ${nameWithOwner}:${branchName}`);
+}
+/**
+ * PURE: the enforcement a NEW grant draft names for a repo. `server` only
+ * when GitHub already enforces required checks there — anything else
+ * (unavailable, nothing required, unreadable, not probed) is `local`, which
+ * is the stricter mode: lower ceilings, and G7 then demands the App's
+ * host-verified `ashlr/verify` instead of trusting whatever ran.
+ */
+export function draftEnforcementFor(probe) {
+    return probe?.state === 'enforced' ? 'server' : 'local';
+}
+/**
+ * PURE: should a RE-APPROVAL switch a `server` repo to `local`? Only on
+ * definitive evidence that GitHub cannot or does not enforce checks there —
+ * an unreadable probe (offline, rate-limited) leaves the signed choice alone,
+ * so a flaky network during a re-approval cannot quietly rewrite the grant.
+ * A re-approval never switches `local` → `server` (that would widen the
+ * ceilings; a new grant does it).
+ */
+export function reapprovalDowngrades(probe) {
+    return probe?.state === 'unavailable' || probe?.state === 'no-required-checks';
+}
+/**
+ * PURE: the mismatch between a signed grant's enforcement and what GitHub
+ * does today, as one sentence for status / setup / Verse; null when they
+ * agree or the probe could not tell. The grant itself is never changed here —
+ * only a re-approval (Touch ID) switches the repo.
+ */
+export function enforcementMismatch(grantRepo, probe, grantSeq = null) {
+    if (grantRepo.enforcement !== 'server' || !probe)
+        return null;
+    const grant = grantSeq === null ? 'the grant' : `grant #${grantSeq}`;
+    if (probe.state === 'unavailable') {
+        return `${grant} says server enforcement for ${grantRepo.nameWithOwner}, but GitHub rulesets are unavailable on this plan for ${probe.private === false ? 'this repo' : 'this private repo'} ` +
+            '— G7 sends its PRs to the owner lane; re-approve (`ashlr authority re-approve`) to switch it to local enforcement with ashlr/verify';
+    }
+    if (probe.state === 'no-required-checks') {
+        return `${grant} says server enforcement for ${grantRepo.nameWithOwner}, but GitHub requires no check on its default branch ` +
+            '— G7 sends its PRs to the owner lane; run `ashlr authority protect --apply`, or re-approve to switch it to local enforcement with ashlr/verify';
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// The default reader: a bounded, read-only `gh api <path>`
+// ---------------------------------------------------------------------------
+const GH_PATH_RE = /^[A-Za-z0-9][A-Za-z0-9._~/?=&%-]{0,400}$/u;
+const GH_TIMEOUT_MS = 10_000;
+/**
+ * `gh api <path>` (GET only, never a shell, killed after 10 s). Under Vitest
+ * it refuses without spawning anything: a draft built by a test that did not
+ * inject a reader must never read Mason's real GitHub account — and a refusal
+ * makes every repo `local`, the stricter answer.
+ */
+export function defaultGithubGet(path) {
+    if (process.env['VITEST'] === 'true')
+        return Promise.resolve({ status: 1, stdout: '', stderr: 'not read: GitHub reads are disabled under tests' });
+    if (!GH_PATH_RE.test(path))
+        return Promise.resolve({ status: 1, stdout: '', stderr: 'refused: not a gh api path' });
+    return new Promise((done) => {
+        execFile('gh', ['api', path], {
+            encoding: 'utf8',
+            timeout: GH_TIMEOUT_MS,
+            maxBuffer: 8 * 1024 * 1024,
+            env: { ...process.env, GH_PROMPT_DISABLED: '1', GH_NO_UPDATE_NOTIFIER: '1' },
+        }, (error, stdout, stderr) => {
+            const code = error?.code;
+            done({ status: error ? (typeof code === 'number' ? code : 1) : 0, stdout: stdout ?? '', stderr: stderr || (error ? error.message : '') });
+        });
+    });
+}
+/** Probe several repos concurrently (each probe is ≤ 3 sequential GETs). Keyed by lower-cased owner/name. */
+export async function probeServerEnforcementAll(repos, get = defaultGithubGet) {
+    const unique = [...new Map(repos.map((repo) => [repo.toLowerCase(), repo])).values()];
+    const probes = await Promise.all(unique.map((repo) => probeServerEnforcement(repo, get)));
+    return new Map(probes.map((probe) => [probe.nameWithOwner.toLowerCase(), probe]));
+}
+//# sourceMappingURL=server-enforcement.js.map

package/dist/core/authority/server-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-enforcement.js","sourceRoot":"","sources":["../../../src/core/authority/server-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAgB9C,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,4EAA4E,CAAC;AACzG,MAAM,YAAY,GAAG,6LAA6L,CAAC;AACnN,MAAM,aAAa,GAAG,6HAA6H,CAAC;AACpJ,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAkD;IAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;IACpC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACjE,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IAC7H,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,eAAe,CAAC;IACjH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,iBAAiB,CAAC,KAAkD;IAClF,OAAO,yBAAyB,CAAC,KAAK,CAAC,KAAK,kBAAkB,CAAC;AACjE,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,yBAAyB,CAAC,IAAuB;IAC/D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,kBAAkB,CAAC,CAAC,OAAO,sDAAsD,CAAC;QACvF,KAAK,eAAe,CAAC,CAAC,OAAO,qDAAqD,CAAC;QACnF,KAAK,WAAW,CAAC,CAAC,OAAO,2CAA2C,CAAC;QACrE,KAAK,WAAW,CAAC,CAAC,OAAO,mEAAmE,CAAC;QAC7F,OAAO,CAAC,CAAC,OAAO,yBAAyB,CAAC;IAC5C,CAAC;AACH,CAAC;AA0BD,MAAM,OAAO,GAAG,6DAA6D,CAAC;AAC9E,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAE9C,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAY,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxH,CAAC;AAED,SAAS,cAAc,CAAC,MAA0C;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,MAAe;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB;gBAAE,SAAS;YACvD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,SAAS;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,IAAI,OAAO,CAAC,mBAAmB,CAAC,KAAK,KAAK,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,QAAQ,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACtJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,KAAK,MAAM,OAAO,IAAI,IAAI;gBAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB,EAAE,GAAc;IAChF,MAAM,GAAG,GAAG,CAAC,KAA6B,EAAE,SAAyB,EAAE,OAAiC,EAAE,MAAc,EAA0B,EAAE,CAClJ,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,OAAO,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACtG,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,aAAa,KAAK,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,MAAM,UAAU,GAAG,OAAO,IAAI,EAAE,CAAC,gBAAgB,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9J,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,aAAa,iCAAiC,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,KAAyD,CAAC;IAC9D,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,GAAG,CAAC,SAAS,aAAa,mBAAmB,OAAO,eAAe,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,GAAY,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,EAC1C,oDAAoD,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,+EAA+E;QAC/E,IAAI,OAAO,KAAK,WAAW;YAAE,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,aAAa,oBAAoB,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrK,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,aAAa,aAAa,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,aAAa,MAAM,UAAU,YAAY,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChJ,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,QAAQ,GAAG,CAAC;QACjB,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,QAAQ,SAAS,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,IAAI,UAAU,EAAE,CAAC;QACrI,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,sCAAsC,aAAa,IAAI,UAAU,EAAE,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA+D;IACjG,OAAO,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA+D;IAClG,OAAO,KAAK,EAAE,KAAK,KAAK,aAAa,IAAI,KAAK,EAAE,KAAK,KAAK,oBAAoB,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAkE,EAClE,KAAgD,EAChD,WAA0B,IAAI;IAE9B,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC;IACrE,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,GAAG,KAAK,gCAAgC,SAAS,CAAC,aAAa,0DAA0D,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,GAAG;YAC5L,qIAAqI,CAAC;IAC1I,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,GAAG,KAAK,gCAAgC,SAAS,CAAC,aAAa,uDAAuD;YAC3H,gJAAgJ,CAAC;IACrJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAC/D,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC,CAAC;IACnJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACpH,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE;SAC7E,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;YACxD,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5I,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAwB,EAAE,MAAiB,gBAAgB;IACzG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/core/authority/standing-grant.d.ts

@@ -24,6 +24,7 @@
 import { type KeyObject } from 'node:crypto';
 import type { BudgetEngine } from '../routing/policy.js';
 import { type FleetEngine, type MergeRisk } from '../fleet/fleet-types.js';
+import { type ServerEnforcementState } from './server-enforcement.js';
 import { type SurfaceTarget } from './surface.js';
 import { type LeaderGrantClass, type RolloutCriteria, type SignedStandingGrantV1, type StandingGrantTrustRoot, type StandingGrantV1 } from './types.js';
 export type GrantParseResult<T> = {
@@ -95,10 +96,19 @@ export declare function standingTrustRootKeys(roots: readonly StandingGrantTrust
 export declare function verifyStandingGrant(value: unknown, ctx: StandingGrantVerifyContext, roots: readonly StandingGrantTrustRoot[]): StandingGrantVerification;
 export interface DraftRepoInput {
     nameWithOwner: string;
-    /** Private repos on the free plan cannot get server-side protection → local enforcement. null = unknown (treated as public). */
+    /** Private repos on the free plan cannot get server-side protection → local enforcement. null = unknown. */
     visibility: 'public' | 'private' | null;
     /** The checkout has a verify command (tests); null = unknown. */
     hasVerify: boolean | null;
+    /**
+     * What GitHub enforces on the default branch today (server-enforcement.ts
+     * probeServerEnforcement). The draft names `server` ONLY for 'enforced';
+     * absent / null (not probed) is `local` — the stricter mode. WHY: a repo
+     * named `server` that GitHub cannot protect (a private repo on Free has
+     * neither rulesets nor branch protection) sends every PR to the owner lane
+     * at G7 forever, while `local` gets the App's host-verified ashlr/verify.
+     */
+    serverEnforcement?: ServerEnforcementState | null;
 }
 export interface DraftSeatInput {
     seatId: string;
@@ -151,12 +161,22 @@ export declare const LOCAL_SEAT_WILDCARD = "local";
 export declare function buildDefaultGrantPayload(input: GrantDraftInput): StandingGrantV1;
 /**
  * PURE: the grant that continues `current` after a pause, an expiry or a new
- * 30-day period. Same scope, fresh ids / dates / bindings, and its ladder
- * STARTS at the stage `current` had reached — a deploy does not restart the
+ * 30-day period. Same scope (except a `server` repo GitHub cannot protect,
+ * which becomes `local` — see `serverEnforcement`), fresh ids / dates /
+ * bindings, and its ladder STARTS at the stage `current` had reached — a deploy does not restart the
  * ramp from shadow. The start rung is inside the signed payload (the first
  * stage), so the Touch ID prompt shows exactly where autonomy resumes.
  */
-export declare function buildReapprovalGrantPayload(current: StandingGrantV1, currentStageIndex: number, input: Omit<GrantDraftInput, 'repos' | 'seats'>): StandingGrantV1;
+export declare function buildReapprovalGrantPayload(current: StandingGrantV1, currentStageIndex: number, input: Omit<GrantDraftInput, 'repos' | 'seats'> & {
+    /**
+     * What GitHub enforces per repo today (lower-cased owner/name → state).
+     * A `server` repo GitHub definitively cannot / does not protect
+     * ('unavailable' | 'no-required-checks') is switched to `local` at the
+     * local ceilings — the only scope change a re-approval makes, and always
+     * a narrowing. Unreadable or absent entries leave the signed choice alone.
+     */
+    serverEnforcement?: ReadonlyMap<string, ServerEnforcementState>;
+}): StandingGrantV1;
 /** Plain-language lines describing a grant's scope (CLI confirmation, the Touch ID sheet, logs). */
 export declare function describeGrantScope(grant: StandingGrantV1): string[];
 export declare function installedGrantPath(): string;

package/dist/core/authority/standing-grant.js

@@ -27,6 +27,7 @@ import { join } from 'node:path';
 import { BUDGET_MODES } from '../routing/types.js';
 import { FLEET_ENGINES, MERGE_RISK_RANK, REPO_STAGE_RANK } from '../fleet/fleet-types.js';
 import { canonicalJson } from './canonical-json.js';
+import { draftEnforcementFor, reapprovalDowngrades } from './server-enforcement.js';
 import { keyIdForPublicKeyPem } from './custody-client.js';
 import { authorityDir, ensureAuthorityDir, readPrivateText, withLedgerTransaction, writePrivateAtomically, } from './ledger.js';
 import { currentHostBinding, verifyAuthoritySurface } from './surface.js';
@@ -518,7 +519,8 @@ export function buildDefaultGrantPayload(input) {
             continue;
         seen.add(key);
         const plan = DEFAULT_REPO_PLAN[repoName(candidate.nameWithOwner)];
-        const local = candidate.visibility === 'private';
+        const local = candidate.visibility === 'private'
+            || draftEnforcementFor(candidate.serverEnforcement ? { state: candidate.serverEnforcement } : null) === 'local';
         const canMerge = plan !== undefined && !(plan.needsVerify && candidate.hasVerify !== true);
         const risk = local ? 'low' : plan?.risk ?? 'low';
         planned.push({
@@ -592,15 +594,29 @@ export function buildDefaultGrantPayload(input) {
 }
 /**
  * PURE: the grant that continues `current` after a pause, an expiry or a new
- * 30-day period. Same scope, fresh ids / dates / bindings, and its ladder
- * STARTS at the stage `current` had reached — a deploy does not restart the
+ * 30-day period. Same scope (except a `server` repo GitHub cannot protect,
+ * which becomes `local` — see `serverEnforcement`), fresh ids / dates /
+ * bindings, and its ladder STARTS at the stage `current` had reached — a deploy does not restart the
  * ramp from shadow. The start rung is inside the signed payload (the first
  * stage), so the Touch ID prompt shows exactly where autonomy resumes.
  */
 export function buildReapprovalGrantPayload(current, currentStageIndex, input) {
     const from = Math.max(0, Math.min(currentStageIndex, current.rollout.stages.length - 1));
+    const ceiling = STANDING_GRANT_CEILINGS.localEnforcement;
+    const repos = current.repos.map((repo) => {
+        const state = input.serverEnforcement?.get(repo.nameWithOwner.toLowerCase());
+        if (repo.enforcement !== 'server' || !reapprovalDowngrades(state === undefined ? null : { state }))
+            return structuredClone(repo);
+        return {
+            ...repo,
+            enforcement: 'local',
+            maxRisk: MERGE_RISK_RANK[repo.maxRisk] > MERGE_RISK_RANK[ceiling.maxRisk] ? ceiling.maxRisk : repo.maxRisk,
+            maxMergesPerDay: Math.min(repo.maxMergesPerDay, ceiling.maxMergesPerDay),
+        };
+    });
     const payload = {
         ...structuredClone(current),
+        repos,
         grantId: input.grantId,
         grantSeq: input.grantSeq,
         keyId: input.keyId,