@aviaratech/ai-delivery 0.2.0 → 0.3.0

package/dist/lifecycle.test.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, readdirSync, realpathSync, rmSync, symlinkSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { cpSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, readdirSync, realpathSync, rmSync, symlinkSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { test, vi } from 'vitest';
@@ -17,28 +17,124 @@ import { executeTool, resumedIssueUpdate, startTrackedIssue } from './dispatch.j
 import { defaultBaseRef, gitCommonDir } from './git.js';
 import * as githubClient from './github/client.js';
 import { createIssue, developIssue, listIssueSubissues, readyCheck, resumeCreatedIssue, updateIssue, } from './issue.js';
-import { checkoutPr, finishIssue, listPrs, mergePr, prChecks, publishPr, submitFormalReview } from './pr.js';
+import { checkoutPr, finishIssue, listPrs, mergePr, prChecks, prInfo, publishPr, submitFormalReview } from './pr.js';
 import { updateIssueWorktreeDelivery } from './services/worktreeRegistry.js';
 import { assertDeliveryRuntimeAdmitted } from './services/deliveryAdmission.js';
 import { getDeliveryRecords } from './services/deliveryRecordService.js';
 import { createIssuePhaseEvidence, verifyIssue } from './verification.js';
 import { cleanupNonIssueWorktree, prepareIssueWorktree, preparePrWorktree, prepareStandaloneWorktree, } from './worktree.js';
+const personalRoute = vi.hoisted(() => ({
+    active: false,
+    baseSha: '',
+    headSha: '',
+    reviews: [],
+    submitted: 0,
+}));
 vi.mock('./github/client.js', async (importOriginal) => {
     const actual = await importOriginal();
     return {
         ...actual,
-        createDeliveryGitHubClients: async (input) => ({
-            ...syntheticDiscoveryClients(),
-            authSource: 'app',
-            role: input.role,
-            rest: new Octokit({
+        createDeliveryGitHubClients: async (input) => {
+            if (personalRoute.active && input.config.roles.author.authSource === 'personal') {
+                const pr = () => ({
+                    number: 23,
+                    node_id: 'PR-23',
+                    html_url: 'https://github.com/example/widget/pull/23',
+                    head: { sha: personalRoute.headSha, ref: 'issue/17' },
+                    base: { sha: personalRoute.baseSha, ref: 'main' },
+                    state: 'open',
+                    draft: true,
+                    user: { login: 'host-user' },
+                });
+                if (input.role === 'reviewer') {
+                    assert.equal(input.identity, 'synthetic-reviewer');
+                    return {
+                        ...syntheticDiscoveryClients(),
+                        authSource: 'app',
+                        credentialSource: 'app:reviewer',
+                        role: 'reviewer',
+                        appActorLogin: async () => 'synthetic-reviewer[bot]',
+                        rest: {
+                            repos: { get: async () => ({ data: { full_name: 'example/widget' } }) },
+                            pulls: {
+                                get: async () => ({ data: pr() }),
+                                listReviews: async () => ({ data: personalRoute.reviews }),
+                                createReview: async (request) => {
+                                    assert.equal(request.event, 'APPROVE');
+                                    assert.equal(request.commit_id, personalRoute.headSha);
+                                    personalRoute.submitted += 1;
+                                    const review = {
+                                        id: 31,
+                                        body: request.body,
+                                        state: 'APPROVED',
+                                        commit_id: personalRoute.headSha,
+                                        user: { login: 'synthetic-reviewer[bot]' },
+                                        html_url: 'https://github.com/example/widget/pull/23#pullrequestreview-31',
+                                    };
+                                    personalRoute.reviews.push(review);
+                                    return { data: review };
+                                },
+                            },
+                        },
+                        graphql: async (query, variables) => query.includes('DeliveryReviewDecision')
+                            ? {
+                                repository: {
+                                    pullRequest: { headRefOid: personalRoute.headSha, reviewDecision: 'REVIEW_REQUIRED' },
+                                },
+                            }
+                            : syntheticDiscoveryClients().graphql(query, variables),
+                    };
+                }
+                assert.equal(input.identity, 'host-author');
+                const clients = await actual.createDeliveryGitHubClients({
+                    ...input,
+                    env: { AUTHOR_TOKEN: 'selected-personal-token', GH_TOKEN: 'ambient-token' },
+                });
+                Object.assign(clients, {
+                    authenticatedAuthor: async () => ({ actorLogin: 'host-user', credentialIdentity: 'user:37' }),
+                    graphql: syntheticDiscoveryClients().graphql,
+                    rest: {
+                        issues: { get: async () => ({ data: { title: 'Synthetic issue' } }) },
+                        git: { getRef: async () => ({ data: { object: { sha: personalRoute.baseSha } } }) },
+                        pulls: {
+                            list: async () => ({ data: [] }),
+                            create: async () => ({ data: pr() }),
+                            get: async () => ({ data: pr() }),
+                        },
+                        request: async () => Promise.reject(Object.assign(new Error('Rules unreadable'), { status: 403 })),
+                    },
+                });
+                return clients;
+            }
+            const rest = new Octokit({
                 request: {
                     fetch: async () => {
                         throw new Error('Unexpected network request in synthetic lifecycle test.');
                     },
                 },
-            }),
-        }),
+            });
+            if (input.role === 'reviewer') {
+                Object.assign(rest.repos, { get: async () => ({ data: { full_name: 'example/widget' } }) });
+            }
+            return {
+                ...syntheticDiscoveryClients(),
+                authSource: input.role === 'author' && input.config.roles.author.authSource === 'personal' ? 'personal' : 'app',
+                role: input.role,
+                ...(input.role === 'author'
+                    ? {
+                        authenticatedAuthor: async () => ({
+                            actorLogin: input.config.roles.author.authSource === 'personal' ? 'host-user' : 'synthetic-author[bot]',
+                            credentialIdentity: input.config.roles.author.authSource === 'personal' ? 'user:37' : 'app:201',
+                        }),
+                        credentialSource: input.config.roles.author.authSource === 'personal' ? 'env:AUTHOR_TOKEN' : 'app:author',
+                    }
+                    : {}),
+                ...(input.role === 'reviewer'
+                    ? { appActorLogin: async () => 'synthetic-reviewer', credentialSource: 'app:reviewer' }
+                    : {}),
+                rest,
+            };
+        },
     };
 });
 function git(root, ...args) {
@@ -100,14 +196,16 @@ async function fixture(options = {}) {
             policy: { contract: 'RepositoryDeliveryPolicy@1', module: './policy.mjs' },
             repository: 'example/widget',
             roles: {
-                author: {
-                    credentialEnv: {
-                        appId: 'AUTHOR_APP_ID',
-                        installationId: 'AUTHOR_INSTALLATION_ID',
-                        privateKeyPath: 'AUTHOR_KEY_PATH',
+                author: options.personalAuthor
+                    ? { authSource: 'personal', credentialEnv: { token: 'AUTHOR_TOKEN' }, identity: 'host-author' }
+                    : {
+                        credentialEnv: {
+                            appId: 'AUTHOR_APP_ID',
+                            installationId: 'AUTHOR_INSTALLATION_ID',
+                            privateKeyPath: 'AUTHOR_KEY_PATH',
+                        },
+                        identity: 'synthetic-author',
                     },
-                    identity: 'synthetic-author',
-                },
                 reviewer: {
                     credentialEnv: {
                         appId: 'REVIEWER_APP_ID',
@@ -144,7 +242,7 @@ export default {
     return { policyDigest, policyEvidence: { ...content, evidenceId: digest(content) },
       requiredStages: [{ id: 'check', dependsOn: [], semanticInputKeys: ['source'],
         resourceClass: 'source_only', commands: [{ label: 'count', argv: [process.execPath, '-e',
-          ${JSON.stringify(`const fs=require('fs');const p=${JSON.stringify(counter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }${options.twoStages
+          ${JSON.stringify(options.firstStageScript ?? `const fs=require('fs');const p=${JSON.stringify(counter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }${options.twoStages
             ? `, { id: 'second', dependsOn: ['check'], semanticInputKeys: ['source'],
         resourceClass: 'source_only', commands: [{ label: 'retry', argv: [process.execPath, '-e',
           ${JSON.stringify(`const fs=require('fs');const p=${JSON.stringify(secondCounter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));if(fs.existsSync(${JSON.stringify(failSecond)}))process.exit(7);`)}] }] }`
@@ -607,6 +705,356 @@ test('issue worktree verification resumes a completed stage and rejects changed
         rmSync(root, { recursive: true, force: true });
     }
 });
+test('a progressing stage remains observable beyond a former short deadline', async () => {
+    const marker = join(tmpdir(), `ai-delivery-stage-start-${process.pid}-${Date.now()}`);
+    const { root } = await fixture({
+        firstStageScript: `const fs=require('fs');fs.writeFileSync(${JSON.stringify(marker)},'started');process.stdout.write('begin');setTimeout(()=>{process.stdout.write('end');},180);`,
+    });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        writeFileSync(join(row.path, 'change.txt'), 'feature\n');
+        git(row.path, 'add', 'change.txt');
+        git(row.path, 'commit', '-qm', 'synthetic progressing stage');
+        const progressSpy = vi.spyOn(process.stderr, 'write');
+        let completed = false;
+        const run = verifyIssue({ issueNumber: 17, repoRoot: row.path }).then((value) => {
+            completed = true;
+            return value;
+        });
+        const markerDeadline = Date.now() + 2_000;
+        while (!existsSync(marker) && Date.now() < markerDeadline)
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        assert.equal(existsSync(marker), true);
+        assert.equal(completed, false, 'stage must remain observable while its process runs');
+        assert.ok(progressSpy.mock.calls.some(([chunk]) => String(chunk).includes('"state":"running"') && String(chunk).includes('"stageId":"check"')));
+        await new Promise((resolve) => setTimeout(resolve, 40));
+        assert.equal(completed, false, 'useful work continues beyond the injected former deadline');
+        const result = await run;
+        assert.equal(result.stageReceipts.length, 1);
+    }
+    finally {
+        vi.restoreAllMocks();
+        rmSync(marker, { force: true });
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test('cancelling verification stops its owned descendant and preserves an unrelated process', async () => {
+    const marker = join(tmpdir(), `ai-delivery-stage-child-${process.pid}-${Date.now()}`);
+    const heartbeat = `${marker}-heartbeat`;
+    const unrelatedHeartbeat = `${marker}-unrelated`;
+    const { root } = await fixture({
+        firstStageScript: `const fs=require('fs');const {spawn}=require('child_process');const child=spawn(process.execPath,['-e',${JSON.stringify(`const fs=require('fs');setInterval(()=>fs.appendFileSync(${JSON.stringify(heartbeat)},'x'),20);`)}],{stdio:'ignore'});child.unref();fs.writeFileSync(${JSON.stringify(marker)},String(child.pid));setTimeout(()=>{},400);`,
+    });
+    let descendantPid;
+    const unrelated = spawn(process.execPath, ['-e', `const fs=require('fs');setInterval(()=>fs.appendFileSync(${JSON.stringify(unrelatedHeartbeat)},'x'),20);`], {
+        detached: true,
+        stdio: 'ignore',
+    });
+    unrelated.unref();
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        writeFileSync(join(row.path, 'change.txt'), 'feature\n');
+        git(row.path, 'add', 'change.txt');
+        git(row.path, 'commit', '-qm', 'synthetic cancellable stage');
+        const controller = new AbortController();
+        const run = verifyIssue({
+            issueNumber: 17,
+            repoRoot: row.path,
+            signal: controller.signal,
+        });
+        const markerDeadline = Date.now() + 2_000;
+        while (!existsSync(marker) && Date.now() < markerDeadline)
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        assert.equal(existsSync(marker), true);
+        descendantPid = Number(readFileSync(marker, 'utf8'));
+        controller.abort();
+        await assert.rejects(run, /cancelled/u);
+        assert.equal(existsSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check')), false);
+        await new Promise((resolve) => setTimeout(resolve, 60));
+        const stoppedSize = existsSync(heartbeat) ? readFileSync(heartbeat).length : 0;
+        const unrelatedSize = existsSync(unrelatedHeartbeat) ? readFileSync(unrelatedHeartbeat).length : 0;
+        await new Promise((resolve) => setTimeout(resolve, 80));
+        assert.equal(existsSync(heartbeat) ? readFileSync(heartbeat).length : 0, stoppedSize);
+        assert.ok(readFileSync(unrelatedHeartbeat).length > unrelatedSize);
+    }
+    finally {
+        if (descendantPid !== undefined) {
+            try {
+                process.kill(descendantPid, 'SIGKILL');
+            }
+            catch {
+                /* already stopped */
+            }
+        }
+        if (unrelated.pid !== undefined) {
+            try {
+                process.kill(unrelated.pid, 'SIGKILL');
+            }
+            catch {
+                /* already stopped */
+            }
+        }
+        rmSync(marker, { force: true });
+        rmSync(heartbeat, { force: true });
+        rmSync(unrelatedHeartbeat, { force: true });
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test.each([
+    { name: 'nonzero exit', terminate: 'process.exit(7)', expected: /exit 7/u },
+    { name: 'signal', terminate: "process.kill(process.pid,'SIGTERM')", expected: /signal SIGTERM/u },
+])('a stage $name stops descendants holding its output pipes open', async ({ terminate, expected }) => {
+    const marker = join(tmpdir(), `ai-delivery-failed-stage-${process.pid}-${Date.now()}`);
+    const heartbeat = `${marker}-heartbeat`;
+    const { root } = await fixture({
+        firstStageScript: `const fs=require('fs');const {spawn}=require('child_process');const child=spawn(process.execPath,['-e',${JSON.stringify(`const fs=require('fs');setInterval(()=>fs.appendFileSync(${JSON.stringify(heartbeat)},'x'),20);`)}],{stdio:['ignore','inherit','inherit']});child.unref();fs.writeFileSync(${JSON.stringify(marker)},String(child.pid));${terminate};`,
+    });
+    let descendantPid;
+    let timeout;
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        writeFileSync(join(row.path, 'change.txt'), 'feature\n');
+        git(row.path, 'add', 'change.txt');
+        git(row.path, 'commit', '-qm', 'synthetic failing stage');
+        const controller = new AbortController();
+        const run = verifyIssue({ issueNumber: 17, repoRoot: row.path, signal: controller.signal });
+        const rejection = assert.rejects(run, expected);
+        const markerDeadline = Date.now() + 2_000;
+        while (!existsSync(marker) && Date.now() < markerDeadline)
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        assert.equal(existsSync(marker), true);
+        descendantPid = Number(readFileSync(marker, 'utf8'));
+        timeout = setTimeout(() => controller.abort(), 500);
+        await rejection;
+        assert.equal(existsSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check')), false);
+        await new Promise((resolve) => setTimeout(resolve, 60));
+        const stoppedSize = existsSync(heartbeat) ? readFileSync(heartbeat).length : 0;
+        await new Promise((resolve) => setTimeout(resolve, 80));
+        assert.equal(existsSync(heartbeat) ? readFileSync(heartbeat).length : 0, stoppedSize);
+    }
+    finally {
+        if (timeout !== undefined)
+            clearTimeout(timeout);
+        if (descendantPid !== undefined) {
+            try {
+                process.kill(descendantPid, 'SIGKILL');
+            }
+            catch {
+                /* already stopped */
+            }
+        }
+        rmSync(marker, { force: true });
+        rmSync(heartbeat, { force: true });
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test('MCP request cancellation stops verification and leaves no stage receipt', async () => {
+    const marker = join(tmpdir(), `ai-delivery-mcp-cancel-${process.pid}-${Date.now()}`);
+    const heartbeat = `${marker}-heartbeat`;
+    const { root, runtimeEntryPath } = await fixture({
+        firstStageScript: `const fs=require('fs');const {spawn}=require('child_process');const child=spawn(process.execPath,['-e',${JSON.stringify(`const fs=require('fs');setInterval(()=>fs.appendFileSync(${JSON.stringify(heartbeat)},'x'),20);`)}],{stdio:'ignore'});child.unref();fs.writeFileSync(${JSON.stringify(marker)},String(child.pid));setTimeout(()=>{},1000);`,
+    });
+    const server = createAiDeliveryMcpServer({ repoRoot: root, runtimeEntryPath, identity: 'synthetic-author' });
+    const client = new Client({ name: 'synthetic-cancelling-client', version: '1.0.0' });
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    let descendantPid;
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        writeFileSync(join(row.path, 'change.txt'), 'feature\n');
+        git(row.path, 'add', 'change.txt');
+        git(row.path, 'commit', '-qm', 'synthetic MCP cancellable stage');
+        await server.connect(serverTransport);
+        await client.connect(clientTransport);
+        const controller = new AbortController();
+        const call = client.callTool({ name: 'issue_verify', arguments: { issueNumber: 17 } }, undefined, {
+            signal: controller.signal,
+        });
+        const markerDeadline = Date.now() + 2_000;
+        while (!existsSync(marker) && Date.now() < markerDeadline)
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        assert.equal(existsSync(marker), true);
+        descendantPid = Number(readFileSync(marker, 'utf8'));
+        controller.abort();
+        await assert.rejects(call, /abort/iu);
+        await new Promise((resolve) => setTimeout(resolve, 100));
+        const stoppedSize = existsSync(heartbeat) ? readFileSync(heartbeat).length : 0;
+        await new Promise((resolve) => setTimeout(resolve, 100));
+        assert.equal(existsSync(heartbeat) ? readFileSync(heartbeat).length : 0, stoppedSize);
+        assert.equal(existsSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check')), false);
+    }
+    finally {
+        await client.close();
+        await server.close();
+        if (descendantPid !== undefined) {
+            try {
+                process.kill(descendantPid, 'SIGKILL');
+            }
+            catch {
+                /* already stopped */
+            }
+        }
+        rmSync(marker, { force: true });
+        rmSync(heartbeat, { force: true });
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test('the stage output bound covers both streams and publishes no checkpoint on overflow', async () => {
+    const { root } = await fixture({
+        firstStageScript: `process.stdout.write(Buffer.alloc(4*1024*1024));process.stderr.write(Buffer.alloc(4*1024*1024+1));`,
+    });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        writeFileSync(join(row.path, 'change.txt'), 'feature\n');
+        git(row.path, 'add', 'change.txt');
+        git(row.path, 'commit', '-qm', 'synthetic output bound');
+        await assert.rejects(verifyIssue({ issueNumber: 17, repoRoot: row.path }), /captured output exceeded 8 MiB/u);
+        assert.equal(existsSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check')), false);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test('public PR dry run retains a configured host author and App reviewer', async () => {
+    const { root } = await fixture({ personalAuthor: true });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'host-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        writeFileSync(join(row.path, 'change.txt'), 'host author change\n');
+        git(row.path, 'add', 'change.txt');
+        git(row.path, 'commit', '-qm', 'synthetic host author change');
+        await verifyIssue({ issueNumber: 17, repoRoot: row.path });
+        const result = (await executeTool('issue_pr_create', { issueNumber: 17, dryRun: true }, { repoRoot: row.path, identity: 'host-author' }));
+        assert.equal(result.dryRun, true);
+        assert.deepEqual(result.reviewRoute.author, {
+            actorLogin: 'host-user',
+            authSource: 'personal',
+            credentialSource: 'env:AUTHOR_TOKEN',
+            identity: 'host-author',
+        });
+        assert.equal(result.reviewRoute.reviewer.actorLogin, 'synthetic-reviewer');
+        assert.equal(result.reviewRoute.approvalEligibility, 'unknown');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}, 15_000);
+test('public dispatch publishes with selected host token and submits the configured App review once', async () => {
+    const { root, runtimeEntryPath } = await fixture({ personalAuthor: true });
+    const originalPath = process.env.PATH;
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'host-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        writeFileSync(join(row.path, 'change.txt'), 'host author publication\n');
+        git(row.path, 'add', 'change.txt');
+        git(row.path, 'commit', '-qm', 'synthetic host publication');
+        const run = await verifyIssue({ issueNumber: 17, repoRoot: row.path });
+        personalRoute.baseSha = run.classification.base.sha;
+        personalRoute.headSha = run.classification.head.sha;
+        personalRoute.reviews.length = 0;
+        personalRoute.submitted = 0;
+        personalRoute.active = true;
+        const realGit = (originalPath ?? '')
+            .split(':')
+            .map((directory) => join(directory, 'git'))
+            .find(existsSync);
+        if (!realGit)
+            throw new Error('Git executable unavailable for public transport test.');
+        git(root, 'config', '--local', '--unset', `url.${join(root, '.git', 'remote.git')}.insteadOf`);
+        const shimDir = join(root, '.git', 'git-shim');
+        const pushMarker = join(root, '.git', 'selected-host-push');
+        mkdirSync(shimDir);
+        const shim = join(shimDir, 'git');
+        writeFileSync(shim, `#!/bin/sh
+if [ "$1" = -c ] && [ "$2" = credential.helper= ] && [ "$3" = push ]; then
+  [ "$AI_DELIVERY_GIT_TOKEN" = selected-personal-token ] || exit 91
+  [ "$("$GIT_ASKPASS" Password)" = selected-personal-token ] || exit 92
+  : > "${pushMarker}"
+  exit 0
+fi
+exec "${realGit}" "$@"
+`);
+        chmodSync(shim, 0o700);
+        process.env.PATH = `${shimDir}:${originalPath ?? ''}`;
+        const execution = { repoRoot: row.path, runtimeEntryPath, identity: 'host-author' };
+        const published = (await executeTool('issue_pr_create', { issueNumber: 17 }, execution));
+        assert.equal(published.prNumber, 23);
+        assert.equal(existsSync(pushMarker), true);
+        assert.equal(published.reviewRoute.author.actorLogin, 'host-user');
+        assert.equal(published.reviewRoute.author.credentialSource, 'env:AUTHOR_TOKEN');
+        assert.equal(published.reviewRoute.reviewer.actorLogin, 'synthetic-reviewer[bot]');
+        const info = (await executeTool('issue_pr_info', { prNumber: 23 }, execution));
+        assert.equal(info.authorLogin, 'host-user');
+        const artifactContent = {
+            authorIdentity: 'host-author',
+            checks: ['verified exact diff'],
+            diffScopeHash: digestValue(run.classification.changedPaths),
+            elapsedMs: 1,
+            findings: [],
+            head: run.classification.head,
+            issueNumber: 17,
+            prNumber: 23,
+            readOnly: true,
+            requestedEffort: 'xhigh',
+            requestedModel: 'gpt-6-astra',
+            effectiveEffort: 'xhigh',
+            effectiveModel: 'gpt-6-astra',
+            reviewerIdentity: 'synthetic-reviewer',
+            schemaVersion: 'ai-delivery.review-artifact@1',
+            summary: 'Independent exact-head review',
+            verdict: 'approve',
+        };
+        const artifact = JSON.stringify({ ...artifactContent, artifactId: digestValue(artifactContent) });
+        const reviewInput = { issueNumber: 17, prNumber: 23, identity: 'synthetic-reviewer', artifact };
+        const first = (await executeTool('issue_pr_review', reviewInput, execution));
+        assert.equal(first.reviewState.status, 'still-required');
+        assert.equal(personalRoute.submitted, 1);
+        const second = (await executeTool('issue_pr_review', reviewInput, execution));
+        assert.equal(second.receiptId, first.receiptId);
+        assert.equal(personalRoute.submitted, 1);
+    }
+    finally {
+        personalRoute.active = false;
+        personalRoute.reviews.length = 0;
+        if (originalPath === undefined)
+            delete process.env.PATH;
+        else
+            process.env.PATH = originalPath;
+        rmSync(root, { recursive: true, force: true });
+    }
+}, 15_000);
 test('scratch start derives safe names and reports the requested worktree', async () => {
     const { root, runtimeEntryPath } = await fixture();
     try {
@@ -682,11 +1130,7 @@ test('MCP request rejects unsupported legacy options before lifecycle dispatch',
         await server.close();
     }
 });
-test.each([
-    { remote: 'origin', divergentOrigin: false },
-    { remote: 'upstream', divergentOrigin: false },
-    { remote: 'upstream', divergentOrigin: true },
-])('synthetic lifecycle finishes with remote $remote and divergent origin $divergentOrigin', async (routing) => {
+async function syntheticLifecycle(routing) {
     const { root } = await fixture(routing);
     const remoteName = routing.remote;
     assert.equal(defaultBaseRef(root, remoteName), `refs/remotes/${remoteName}/main`);
@@ -724,6 +1168,7 @@ test.each([
     let mergeSha = '';
     let stalePrReadbacks = 0;
     let review = null;
+    let reviewDecision = 'REVIEW_REQUIRED';
     const calls = [];
     const createPayloads = [];
     const statuses = { Queued: 'todo', Active: 'active', Waiting: 'blocked', Shipped: 'done' };
@@ -755,11 +1200,13 @@ test.each([
         merge_commit_sha: mergeSha || null,
         mergeable: true,
         mergeable_state: 'clean',
-        user: { login: 'synthetic-author' },
+        user: { login: 'synthetic-author[bot]' },
         head: { sha: headSha, ref: 'issue/17' },
         base: { sha: baseSha, ref: 'main' },
     });
     const graphql = async (query, variables = {}) => {
+        if (query.includes('DeliveryReviewDecision'))
+            return { repository: { pullRequest: { headRefOid: headSha, reviewDecision } } };
         if (query.includes('ProjectDeliveryConfiguration'))
             return {
                 organization: {
@@ -894,6 +1341,10 @@ test.each([
     };
     const rest = {
         request: async (route, parameters) => {
+            if (route === 'GET /repos/{owner}/{repo}/rules/branches/{branch}')
+                return { data: [{ type: 'pull_request', parameters: { required_approving_review_count: 1 } }] };
+            if (route === 'GET /repos/{owner}/{repo}/branches/{branch}/protection')
+                throw Object.assign(new Error('Synthetic protected branch visibility unavailable'), { status: 403 });
             if (route === 'GET /orgs/{org}/issue-fields')
                 return {
                     data: [
@@ -1113,7 +1564,7 @@ test.each([
         headSha = git(row.path, 'rev-parse', 'HEAD');
         const run = await verifyIssue({ issueNumber, repoRoot: row.path });
         await assert.rejects(publishPr(context, { issueNumber, body: 'Closes #17' }), /Delivery Impact/);
-        await assert.rejects(publishPr(context, { issueNumber }), /Git push requires the selected author GitHub App installation token/);
+        await assert.rejects(publishPr(context, { issueNumber }), /Git push requires the selected author credential token/);
         // The public push requires a real author App installation token. Bind a synthetic
         // publication at that external boundary so the remaining public phases run offline.
         git(row.path, 'push', '-q', remoteName, `${headSha}:refs/heads/issue/17`);
@@ -1138,7 +1589,9 @@ test.each([
             status: 'pr-published',
         });
         assert.equal((await listPrs(context)).pullRequests[0]?.number, prNumber);
+        assert.equal((await prInfo(context, { prNumber })).authorLogin, 'synthetic-author[bot]');
         assert.equal((await prChecks(context, prNumber)).combinedStatus, 'success');
+        assert.equal((await prChecks(context, prNumber)).reviewState.status, 'still-required');
         await assert.rejects(checkoutPr(context, prNumber), /open in-repository branch/u);
         assert.equal(git(remote, 'rev-parse', 'refs/heads/issue/17'), headSha);
         await assert.rejects(mergePr(context, { issueNumber, prNumber }), /submitted independent review/);
@@ -1173,8 +1626,11 @@ test.each([
         await assert.rejects(submitFormalReview(personalReviewer, { artifact, issueNumber, prNumber }), /reviewer GitHub App role/);
         const reviewResult = await submitFormalReview(reviewer, { artifact, issueNumber, prNumber });
         assert.equal(reviewResult.githubReviewId, 31);
+        assert.equal(reviewResult.reviewState.status, 'still-required');
         await publishPr(context, { issueNumber, draft: false });
         assert.equal(prDraft, false);
+        await assert.rejects(mergePr(context, { issueNumber, prNumber }), /submitted APPROVED review.*still requires/u);
+        reviewDecision = 'APPROVED';
         checksPassed = false;
         await assert.rejects(mergePr(context, { issueNumber, prNumber }), /failed or pending checks/);
         checksPassed = true;
@@ -1200,7 +1656,9 @@ test.each([
         const result = JSON.parse(originalResult);
         const { resultId: _resultId, ...resultContent } = result;
         const wrongResult = { ...resultContent, mergeSha: 'a'.repeat(40) };
-        writeFileSync(resultPath, JSON.stringify({ ...wrongResult, resultId: digestValue(wrongResult) }), { mode: 0o600 });
+        writeFileSync(resultPath, JSON.stringify({ ...wrongResult, resultId: digestValue(wrongResult) }), {
+            mode: 0o600,
+        });
         await assert.rejects(finishIssue(context, { issueNumber, prNumber, strategy: 'merge' }), /exact prepared merge intent/u);
         writeFileSync(resultPath, originalResult, { mode: 0o600 });
         const reviewedHead = headSha;
@@ -1263,5 +1721,10 @@ test.each([
     finally {
         rmSync(root, { recursive: true, force: true });
     }
-});
+}
+test.each([
+    { remote: 'origin', divergentOrigin: false },
+    { remote: 'upstream', divergentOrigin: false },
+    { remote: 'upstream', divergentOrigin: true },
+])('synthetic lifecycle finishes with remote $remote and divergent origin $divergentOrigin', syntheticLifecycle, 15_000);
 //# sourceMappingURL=lifecycle.test.js.map