@bluewombat/runtime 0.9.0 → 0.10.0

package/README.md

@@ -151,13 +151,17 @@ manager with no `probe`), stop `run` if it holds the ledger lock, then:
 mason cancel github:owner/name#19
 ```
 
-After a crash left a unit `running` with nobody on it, stop `run` if it
-holds the lock, then:
+A unit that was stopped (Ctrl-C, a crash) is picked up where it was by the next
+`mason run`: its workspace is kept, the Attempts it finished still count and the
+numbering goes on. To start a unit over instead (the line moved on, the work took
+a wrong turn), stop `run` if it holds the lock, then:
 
 ```bash
 mason release github:owner/name#19
 ```
 
+`release` destroys the workspace and forgets it; the next `run` isolates a fresh one.
+
 The film is `<ledger>/events.jsonl`, next to `cursor`. It is not truth after a
 crash — the ledger is. The file can grow; there is no rotation yet.
 
@@ -194,13 +198,12 @@ builder:
   producer:
     cmd: [node, ./mason-builder.mjs]
     timeoutMs: 600000
-    gates: { defaultTimeoutMs: 120000, gates: [] }
   repair:
     cmd: [node, ./mason-repair.mjs]
     timeoutMs: 600000
-    gates: { defaultTimeoutMs: 120000, gates: [] }
+  gates: { defaultTimeoutMs: 120000, gates: [] }
   maxAttempts: 3
-assembly:
+ticket:
   gates: { defaultTimeoutMs: 900000, gates: [] }
 authority:
   enabled: false
@@ -213,6 +216,7 @@ pollIntervalMs: 10000
 | `featureTracker`            | `package` (a name or path that exports `createManager`) and `options`: where Features are written and signalled                                                                                                                                                                                                                                                                                                                            |
 | `ticketTracker`             | Same shape: where the Tickets of a Feature are, and the Authority that holds the lines. May name the same package as `featureTracker`, or another                                                                                                                                                                                                                                                                                                             |
 | `workLine.stable`           | Existing directory the work folds into. Optional when the manager names a reference work line: Host then keeps its own copy at `<home>/work-line`                                                                                                                                                                                                                            |
+| `workLine.targetStable`     | A second copy of the work line, on the branch a Feature is folded into: what is merged into the Feature when it is brought up to date. Host keeps its own at `<home>/target-line` when the manager names a reference; required with an Authority otherwise |
 | `workLine.isolation`        | Package name or path exporting `strategy` — required. Host loads it like a manager; Isolator/Integrator do not sniff                                                                                                                                                                                                                                                         |
 | `workLine.isolationOptions` | What that strategy is told, unread by Host — like a manager's `options`. `isolation-git` reads `exclude`, the paths a Child never gets (default `.env`, `.env.*`). A strategy without `createStrategy` refuses any                                                                                                                                                                |
 | `workLine.warm`             | Optional `cmd` / `timeoutMs`. Runs in the workspace after Isolation, before the Builder — typically `pnpm install --frozen-lockfile`. Absent: the Builder gets a cold tree                                                                                                                                                                 |
@@ -223,26 +227,31 @@ pollIntervalMs: 10000
 | `ledger`                    | WorkLedger root (created). The Cursor is a file inside it. Default `<home>/ledger`                                                                                                                                                                                                                                                                                           |
 | `persist`                   | Package name or path exporting `openPersist({ ledgerRoot })`: how the ledger is stored under that root. Default `@bluewombat/persist-fs`; `@bluewombat/persist-sqlite` ships too. `watch` reads through the same backend                                                                                                                                                     |
 | `agents`                    | Agents a pass names instead of writing `cmd` (§ Agent passes written short)                                                                                                                                                                                                                                                                                                 |
-| `builder.producer`          | `cmd` / `timeoutMs` / `gates`. Spawned in the workspace. Exit 0 runs its own `gates`                                                                                                                                                                                                                                                                                 |
-| `builder.repair`            | The same, for a pass a Gate refused. **Required**, and never inherited — including its `gates`: a repair with none of its own runs ungated, even when `builder.producer.gates` is not empty                                                                                                                                                                               |
+| `builder.tests`             | Required. The tests of the task, written before its code by an agent that is not the producer: `{ agent, prompt, homePlugins, appDeckProfile, timeoutMs, gates }`, or `{ agent: false }` for none. Its `gates` check them (`tests-red`: they must fail, for the right reason). What it wrote is committed as a checkpoint titled `Tests: …`, which `builder.gates` can keep intact (`tests-frozen`). A ticket the tracker labels as having no tests first (`no-tests` with the GitHub manager) runs no agent and no `tests-red` |
+| `builder.e2e`               | Optional. Declares the e2e acceptance check (see § The e2e acceptance check): the pass that makes the Ticket holding the suite, `{ agent, prompt, homePlugins, appDeckProfile, timeoutMs, gates }` or `{ cmd, timeoutMs, gates }`. One command for the first pass and for a pass a Gate refused; its own `gates` (they check the form: compiles, one test per manifest id, no application file touched). Nothing is borrowed from `builder.producer`, `builder.repair` or `builder.gates`. No tests are written first for that Ticket. Needs a Feature Gate with `skipWhen: skip-test-e2e`, and the other way round |
+| `builder.producer`          | `cmd` / `timeoutMs`. Spawned in the workspace. Exit 0 runs `builder.gates`                                                                                                                                                                                                                                                                                 |
+| `builder.repair`            | The same, for a pass a Gate refused. **Required**, and never inherited: it names its own command. It is judged by the same `builder.gates` as the producer                                                                                                                                                                               |
+| `builder.gates`             | `defaultTimeoutMs` and `gates`: the one Gate list for `builder.producer` and `builder.repair`. `gates` written on either pass is refused, naming this key. Empty: the unit runs ungated |
 | `builder.maxAttempts`       | Attempts one Task may start. Default 3                                                                                                                                                                                                                                                                                                                                       |
-| `assembly.fix`              | `cmd` / `timeoutMs` / `gates`. Spawned when a judgement of the whole refused it — by an Authority, by `assembly.validate`, or by both. Judged by its own `gates`                                                                                                                                                                                                            |
-| `assembly.validate`         | `cmd` / `timeoutMs` / `gates`. Optional. A local, read-only judge of the assembled ticket, run after align, with or without an Authority. A refusal is repaired by `assembly.fix` the same as an Authority's. Judged by its own `gates`, never `builder`'s or `assembly.fix`'s                                                                                            |
-| `assembly.maxAttempts`      | Attempts that one fix may start. Default 3                                                                                                                                                                                                                                                                                                                                   |
-| `assembly.gates`            | `defaultTimeoutMs` and `gates`: the produce:false judgement-only pass — no producer of its own, re-checking the assembled ticket. Empty: the Authority judges alone. Independent of `assembly.fix.gates` / `assembly.validate.gates` — never shared with either                                                                                                          |
+| `ticket.fix`              | `cmd` / `timeoutMs` / `gates`. Spawned when a judgement of the whole refused it — by an Authority, by `ticket.validate`, or by both. Judged by its own `gates`                                                                                                                                                                                                            |
+| `ticket.validate`         | `cmd` / `timeoutMs` / `gates`. A local, read-only judge of the assembled ticket, run after align, with or without an Authority. A refusal is repaired by `ticket.fix` the same as an Authority's. Judged by its own `gates`, never `builder`'s or `ticket.fix`'s. `validate` is required when a `ticket` block is written, and so is `feature.validate`: `{ agent: false, gates }` turns the agent off and keeps the gates, and `{ agent: false }` with no gates turns the review off — a bare `gates:` counts as none. |
+| `ticket.maxAttempts`      | Attempts that one fix may start. Default 3                                                                                                                                                                                                                                                                                                                                   |
+| `ticket.gates`            | `defaultTimeoutMs` and `gates`: the produce:false judgement-only pass — no producer of its own, re-checking the assembled ticket. Empty: the Authority judges alone. Independent of `ticket.fix.gates` / `ticket.validate.gates` — never shared with either                                                                                                          |
 | `timeoutMs`                 | How long a child **outside** a Task may run: manager, isolations                                                                                                                                                                                                                                                                                                             |
-| `maxRefusals`               | Times the work may be sent back before it escalates, by an Authority, by `assembly.validate`, or by both — one shared budget. Default 3                                                                                                                                                                                                                                      |
+| `ticket.maxRefusals`               | Times the work may be sent back before it escalates, by an Authority, by `ticket.validate`, or by both — one shared budget. Default 3                                                                                                                                                                                                                                      |
+| `ticket.maxParallel`        | How many Tickets of a Project are worked on at once. Default 1: one after the other. Above 1 needs `authority.enabled`; a Ticket waiting on a check or a person holds a place, the others go on. Tickets that wait on another (*Blocked by*) still start only once it is `done` |
+| `feature`                   | Required with `authority.enabled`. How a Feature's line is delivered to the line it is folded into, by the same steps as a Ticket: the final line is merged into the Feature's work (`workLine.targetStable`, or Host's own copy of the reference), `validate` (same shape as `ticket.validate`) reviews the whole against the Feature's request and its `gates` (at least one) are where the project's checks on the whole line run, a refusal goes to `fix`, the line is published, and `gates` (at least one, the CI) judge it. `maxAttempts` and `maxRefusals` (default 3, same rule as a Ticket's) are its own. Nothing falls back to `ticket`. The merge itself is automatic only with `merge-when-ready`; the delivery to the Authority is for every Feature |
 | `pollIntervalMs`            | Set it and the process keeps draining until SIGINT. Absent: one tick. Pick it with § Choosing `pollIntervalMs` — 10000 is the floor worth having                                                                                                                                                                                                                             |
 | `observability.streams`     | `enabled`, `dir`, `keep`. Films what every child says, as it says it — one file per child under `<dir>/<ticket>/`, named in the journal by a `stream-opened` line. `dir` resolves against the config file; default `<home>/streams`. `keep` is `stdout` / `stderr`, default both. Off unless `enabled` is true: a stream is the Project's own code and prompts in the clear |
 
 Every `cmd` is named where it is used, and nothing falls back to a neighbour: a
 `repair` with no command of its own is refused rather than quietly running the
-first-pass agent again. `builder` makes the unit of work. `assembly` judges the whole
-and, when that judgement refuses it, runs `assembly.fix` — not a second first-pass.
-`assembly.validate`, when declared, is a second, local judge of the whole: it
+first-pass agent again. `builder` makes the unit of work. `ticket` judges the whole
+and, when that judgement refuses it, runs `ticket.fix` — not a second first-pass.
+`ticket.validate`, when declared, is a second, local judge of the whole: it
 runs after align, before the Authority sees the work (or before the final
-fold, with none). Its refusal is repaired by `assembly.fix` exactly as an
-Authority's is, and shares the same `maxRefusals` budget.
+fold, with none). Its refusal is repaired by `ticket.fix` exactly as an
+Authority's is, and shares the same `ticket.maxRefusals` budget.
 
 Paths a slot **writes** — `--transcript-dir`, `--agent-home` and
 `--plugins-out` — always resolve against the config file's directory, even
@@ -270,32 +279,35 @@ builder:
   producer:
     agent: cursor
     prompt: ./prompts/builder.md
-    plugins: [./ai-plugins/core/builder]
-    profile: builder
+    homePlugins: [./ai-plugins/core/builder]
+    appDeckProfile: .ai/profiles/builder
     args: [--mode, agent]           # the vendor CLI's own flags
     timeoutMs: 1200000
     gates: { defaultTimeoutMs: 120000, gates: [] }
 ```
 
 Host writes the `cmd` it stands for — `node <slots>/<role>.mjs --prompt-file …
--- node <slots>/agents/cursor.mjs --transcript-dir … --plugin-dir … --profile
+-- node <slots>/agents/cursor.mjs --transcript-dir … --plugin-dir … --app-deck-profile
 … --plugins-out … --agent-arg …` — with `<slots>` the
 `node_modules/@bluewombat/slots` next to the config. Nothing past the config
 knows a pass was written short. The roles: `builder.producer`,
-`builder.repair`, `assembly.fix`, `assembly.validate`, and `authority.describe`
-(an argv, or `{ agent, prompt?, plugins?, profile?, args? }`).
+`builder.repair`, `ticket.fix`, `ticket.validate`, and `authority.describe`
+(an argv, or `{ agent, prompt?, homePlugins?, appDeckProfile?, args? }`).
 
 | Key       | Meaning                                                                                                   |
 | --------- | --------------------------------------------------------------------------------------------------------- |
 | `agent`   | A name `agents` declares. With `cmd` beside it, the pass is refused                                       |
 | `prompt`  | `--prompt-file` of the role slot. Absent: the role's built-in template                                    |
 | `rules`   | `--rules-file` of the role slot                                                                           |
-| `plugins` | Plugin folders of the Mason home, each a `--plugin-dir`                                                   |
-| `profile` | The project's deck profile for this role. Needs the agent's `pluginsOut`. See the slots' § Agents/Plugins |
+| `homePlugins` | Plugin folders of the Mason home, each a `--plugin-dir`                                               |
+| `appDeckProfile` | The app's deck profile for this role, as a path: `[<app dir>/].ai/profiles/<name>`. Needs the agent's `pluginsOut`. See the slots' § Agents/Plugins |
 | `args`    | Appended to the agent's own `args`, each an `--agent-arg`                                                 |
 
-A `profile` is read in the project, not in the Mason home: the role gets the
-base plugins and that profile, as the project's committed deck locks pin them.
+An `appDeckProfile` is read in the app, not in the Mason home: the role gets the
+app's base plugins, that profile's plugins and its `prompt.md`, as the app's
+committed deck locks pin them. deck keeps profiles in `<app>/.ai/profiles/<name>`,
+so the path has that shape; `<app dir>` is where the app's `.ai/` is in the
+checkout (`.` by default, `apps/web` in a monorepo). It stays inside the checkout.
 `mason doctor` checks those locks in the work line without the network.
 
 Every tracker field lives in the `options` of its side. Host does not read them.
@@ -406,15 +418,15 @@ The config always names a producer (and a repair). Implementer can still run a
 Task as its Gate sequence alone — that is the first judgement of the assembled
 ticket, which makes nothing.
 
-### Assembly fix
+### Ticket fix
 
 Spawned in the ticket workspace when a judgement of the whole refused it
 (`--report`, `--report-from`). Same argv as a Builder otherwise. Host hands
-Implementer `assembly.fix` as that pass's only agent: there is no first-pass
+Implementer `ticket.fix` as that pass's only agent: there is no first-pass
 producer at this moment. The refusal it repairs may have come from an
-Authority or from `assembly.validate`.
+Authority or from `ticket.validate`.
 
-### Assembly validate
+### Ticket validate
 
 Spawned in the ticket workspace after align, with or without an Authority —
 `--intention`, `--id`, `--attempt`, `--context`. No `--report`: it is a
@@ -425,17 +437,18 @@ that completes cleanly but finds a problem is still a refusal.
 
 ### Gates
 
-Four independent sequences, one per role — `builder.producer`,
-`builder.repair`, `assembly.fix`, `assembly.validate` — plus `assembly.gates`
-for the one judgement-only pass with no producer of its own (re-checking the
-assembled ticket; `ci-green` reads the checks the work line ran on what the
-Publisher placed, so it belongs there). No sharing, no dispatch choosing
-between two buckets: a check right for one pass is not necessarily right for
-another, even within the same stage. `builder.repair` is the sharpest edge —
-it does not inherit `builder.producer.gates`, so a repair Attempt with no
-Gate of its own runs ungated.
-
-Implementer's Gates are told `--stage unit` or `--stage assembly` alongside
+Four sequences: `builder.gates`, shared by `builder.producer` and
+`builder.repair` (a repair is judged by exactly what judged the first try),
+then one per assembly role — `ticket.fix`, `ticket.validate` — plus
+`ticket.gates` for the one judgement-only pass with no producer of its own
+(re-checking the assembled ticket; `ci-green` reads the checks the work line
+ran on what the Publisher placed, so it belongs there). The assembly lists are
+not shared with each other or with the builder, and no dispatch chooses between
+two buckets: a check right for one pass is not necessarily right for another,
+even within the same stage. `gates` written on `builder.producer` or
+`builder.repair` is refused, and the message names `builder.gates`.
+
+Implementer's Gates are told `--stage unit` or `--stage ticket` alongside
 `--id`, `--attempt`, `--gate-id` and `--intention`.
 Most have no use for it. `workspace-changed` does: "nothing changed" means
 nothing was done in a unit, and is the correct outcome for an assembly that
@@ -451,11 +464,11 @@ from what another child left behind, so a slow producer cannot leave its
 Gates a millisecond to answer in.
 
 What bounds the unit is therefore what you wrote:
-`builder.maxAttempts × (builder.producer.timeoutMs + Σ builder.producer.gates timeouts)`
+`builder.maxAttempts × (builder.producer.timeoutMs + Σ builder.gates timeouts)`
 for a first pass, and the same shape with `repair` in place of `producer` once
 a Gate has refused one.
 A repair and an assembly fix each carry their own `timeoutMs`. An assembly fix
-is bounded the same way from `assembly.maxAttempts` and `assembly.fix`.
+is bounded the same way from `ticket.maxAttempts` and `ticket.fix`.
 
 ```json
 {
@@ -471,6 +484,60 @@ is bounded the same way from `assembly.maxAttempts` and `assembly.fix`.
 }
 ```
 
+### The e2e acceptance check
+
+A Project proves each Feature by an acceptance suite, run once on the assembled Feature
+line, when its config says so, by a pair:
+
+```yaml
+builder:
+  e2e:                       # makes the Ticket that holds the suite (label `e2e` on the tracker)
+    agent: claude
+    prompt: ./prompts/e2e.md # {{task}} is the scenarios; {{report}}, {{refused_by}}, {{refusal}} on a refused pass
+    timeoutMs: 1800000
+    gates:                   # form only: it compiles, one test per manifest id, no application file touched
+      gates:
+        - { id: e2e-form, argv: [...], timeoutMs: 120000 }
+feature:
+  validate:
+    agent: false
+    gates:
+      defaultTimeoutMs: 120000
+      gates:
+        - id: e2e
+          skipWhen: skip-test-e2e      # Host does not run this Gate for a Feature that carries the label
+          timeoutMs: 720000
+          argv:
+            - node
+            - ./node_modules/@bluewombat/slots/gates/e2e.mjs
+            - --up
+            - pnpm e2e:up
+            - --ready
+            - pnpm e2e:ready
+            - --run
+            - pnpm e2e
+            - --down
+            - pnpm e2e:down
+```
+
+`skipWhen` is the one condition Host reads for a Gate, on a Feature's Gates only
+(`feature.validate`, `feature.gates`, `feature.fix`); its one value today is
+`skip-test-e2e`, whatever the tracker calls that label. A Gate left out is not a Gate that
+passed: the journal gets `gate-skipped` and the trace says "`e2e` not run: the Feature carries
+skip-test-e2e". The Gate knows nothing of the skip and no environment variable carries it.
+
+The tracker side: a Ticket carrying the e2e label (`e2eLabel` of the TicketTracker manager) is
+made by `builder.e2e` and has no tests written first; a Feature carrying the skip label
+(`skipTestE2eLabel` of the FeatureTracker manager) has that Ticket cancelled, with a line in
+the trace. The label is read again until the Feature is submitted. A Project that declares the
+check refuses a Feature that holds neither an e2e Ticket nor the skip label, or whose e2e
+Ticket is not blocked by every other Ticket, as `invalid`, with the reason as a comment.
+
+What the Gate proves is a red/green verdict; what the operator reads is its text in the
+journal (`gate-finished`) — a red suite is also in the reason of the refusal the fix is
+given and in the escalation. A passing suite's text is not shown on the pull request: see
+RESERVATIONS I17.
+
 ### Describer
 
 How a delivered ticket describes itself — the words the manager puts on the
@@ -543,25 +610,28 @@ it each stop `mason run` at boot, and `mason doctor` reports the same offline
 and is the operator's directory.
 
 ```
-assembled → align → assembly.validate (optional, local)
-              refused  → assembly.fix, then align again, then validate again
+assembled → align → recheck (builder.gates again, on the aligned work)
+              conflict or failed → ticket.fix, then align again
+          → ticket.validate (optional, local)
+              refused  → ticket.fix, then align again, recheck, validate again
               accepted → Publisher places the work → manager opens the Submission
           → submitted, and the run comes back to it on each poll
-              assembly.gates judge what was published
-              refused  → assembly.fix, then the same Submission is offered again
-              accepted → the Authority folds it → done
+              ticket.gates judge what was published
+              refused  → ticket.fix, then the same Submission is offered again
+              accepted → has the line moved on since the align? yes: align again
+                         no: the Authority folds it → done (a refused fold also aligns again)
 ```
 
-Neither half judges: that is what `assembly.gates` are for. The Authority places
-and folds; a Gate says whether the fold may happen. `assembly.validate`, when
+Neither half judges: that is what `ticket.gates` are for. The Authority places
+and folds; a Gate says whether the fold may happen. `ticket.validate`, when
 declared, judges before either half — the same verdict has the same fate
 whether or not there is an Authority to offer the work to afterwards. After the
 Authority folds, Host brings its copy of the work line up to date with a
 fast-forward — the work line moved where the Authority is, and the next
 Isolation must start from that version, not from a copy left behind.
 
-A refusal is not a second failure path: its report reaches `assembly.fix`
-exactly as a Gate's report reaches `builder.repair`. After `maxRefusals`
+A refusal is not a second failure path: its report reaches `ticket.fix`
+exactly as a Gate's report reaches `builder.repair`. After `ticket.maxRefusals`
 refusals the ticket escalates with that report as its Trace, and `done` names
 the Submission rather than a directory on the machine that ran.
 

package/SPECS.md

@@ -103,6 +103,7 @@ The FeatureTracker's `listen` delivers Features whose specification is final.
 | `invalid` (new, or the intention changed)   | emit `invalid` on the Feature, keyed by fingerprint                                                                                                                                                                 |
 | `invalid` (same fingerprint as recorded)    | leave it; the tracker was told, and telling it is what delivered it again                                                                                                                                           |
 | `upsert` (absent or `waiting`)              | `admitFeature`, emit `accepted`. Nothing is driven here: the sweep does it                                                                                                                                          |
+| `upsert` (`open` or `escalated`) whose `skip_e2e` differs from the ledger's | `setFeatureSkipE2e`; journal `skip-e2e`; no other change |
 | `upsert` (any other state)                  | leave it; journal `skipped`. An echo of a Host report is this row                                                                                                                                                   |
 | `upsert` + `signalsResume` while `escalated` | same as `resume` — a poll snapshot has no `labeled` edge                                                                                                                                                             |
 | `resume`                                     | resume the Feature, emit `resumed`                                                                                                                                                                                  |
@@ -139,6 +140,22 @@ advanced (`advanceProject`):
 4. A Feature whose Tickets are all blocked escalates; one that cannot be
    settled because the Authority lacks `settled` waits.
 
+The e2e acceptance check, when the Project declares it (`builder.e2e`):
+
+- A Feature does not open (and is reported `invalid`, once per reason) unless it holds exactly
+  one e2e Ticket (`TicketEntry.e2e`), blocked by every other live Ticket, or carries `skip_e2e`.
+- A Ticket with `e2e` is admitted with `e2e` and `no_tests`: no tests are written first, and
+  Transformers makes it with `builder.e2e` (its command, its Gates, for the first pass, a refused
+  pass and the recheck) instead of the producer and the repair.
+- A Feature with `skip_e2e` has its e2e Ticket cancelled by the sweep (journal
+  `e2e-ticket-cancelled`, a trace line), and Transformers leaves out, for that Feature, every
+  Gate of `feature.validate`, `feature.gates` and `feature.fix` that has `skipWhen:
+  skip-test-e2e`: the journal gets `gate-skipped` with the Gate id and the reason, and the trace
+  says "`<id>` not run: the Feature carries skip-test-e2e". The mark is read from the ledger as
+  each pass starts (`TransformerSlots.marks`).
+- A Feature that is not marked and no longer holds a live e2e Ticket (it was cancelled while the
+  mark was on) escalates when it closes.
+
 Host never drives an `escalated` unit: that state is frozen until a human `resume`.
 
 Every Event Host emits is a write to the tracker, and a tracker that lists by
@@ -212,22 +229,22 @@ and the Gate sequence starts empty. Example Gates live in
 `@bluewombat/slots/gates/` (`parent-clean`, `sensitive-path`,
 `workspace-changed`, `ci-green`).
 
-Four independent Gate sequences, one per role — `builder.producer.gates`, `builder.repair.gates`, `assembly.fix.gates`,
-`assembly.validate.gates` — plus `assembly.gates` for the one judgement-only
-pass with no producer of its own. No sequence is shared and nothing is
-dispatched between buckets: a check that is right for one pass can be wrong
+Four Gate sequences: `builder.gates`, shared by `builder.producer` and
+`builder.repair`, then `ticket.fix.gates`, `ticket.validate.gates` and
+`ticket.gates` for the one judgement-only pass with no producer of its own.
+The assembly sequences are not shared and nothing is dispatched between buckets: a check that is right for one pass can be wrong
 for another, even within the same stage — `workspace-changed` says an Attempt
 that changed nothing did nothing, which is true of `builder.producer`/`repair`
-and false of `assembly.gates`'s pass, whose correct outcome is that nothing
-was left to do. `builder.repair` does not inherit `builder.producer.gates`: a
-repair Attempt with no Gate of its own runs ungated. The assembly's
+and false of `ticket.gates`'s pass, whose correct outcome is that nothing
+was left to do. A repair Attempt is judged by `builder.gates`, the same list as the
+producer's (Host hands Implementer that list as both `gates` and `repairGates`). The assembly's
 judgement-only pass produces nothing unless something refused it first: it is
-a judgement, and a refusal is `assembly.fix`, not a second first-pass. Two
-things may judge it: `assembly.gates` (and an Authority's own checks on what
-was published) and, optionally, `assembly.validate` — a local, read-only pass
-that runs before either, judged by its own `assembly.validate.gates`, not
-`assembly.gates`. Both send a refusal to the same `fix` and spend the same
-`maxRefusals` budget.
+a judgement, and a refusal is `ticket.fix`, not a second first-pass. Two
+things may judge it: `ticket.gates` (and an Authority's own checks on what
+was published) and, optionally, `ticket.validate` — a local, read-only pass
+that runs before either, judged by its own `ticket.validate.gates`, not
+`ticket.gates`. Both send a refusal to the same `fix` and spend the same
+`ticket.maxRefusals` budget.
 
 Every child of a Task carries its own ceiling and no other. Every `cmd` names
 its own `timeoutMs`, and none is inherited from a neighbour — nothing else
@@ -236,7 +253,7 @@ or its sequence's `defaultTimeoutMs`, and a Gate that would end up with neither
 is refused when the config loads. Nothing is derived from what another child
 left behind, so what bounds a whole Task is arithmetic the Project can do:
 the builder's `maxAttempts` times its producer's ceiling plus the sum of its Gates'.
-An assembly fix is bounded the same way from `assembly.maxAttempts` and `assembly.fix`.
+An assembly fix is bounded the same way from `ticket.maxAttempts` and `ticket.fix`.
 Root `timeoutMs` bounds what is outside a Task — the manager, the
 isolations. Host has no flag named after a tracker (`--repo` is not a Host
 flag): tracker fields come from that package.
@@ -406,6 +423,11 @@ positional: `release github:owner/name#19`.
     open, escalated or submitted. A Feature blocked by another does not open
     until it is `done`. A Feature whose Tickets are not all `task-ready` does
     not open.
+16b. With the e2e check declared: a Feature without an e2e Ticket nor `skip_e2e` does not open and
+    is reported `invalid`; with `skip_e2e` its e2e Ticket is cancelled and the e2e Gate is not run,
+    the journal and the trace saying so; with an e2e Ticket the line is judged once by the suite,
+    red goes to `feature.fix` and green lets the line be offered. A Project without `builder.e2e`
+    is unchanged.
 17. After an escalation, a `probe` of `gone` cancels that Ticket (or Feature)
     and the sweep goes on. `unavailable` leaves the
     escalation. A listen that missed the source does not probe. GitHub: a 404

package/dist/cli.js

@@ -35,15 +35,15 @@ Shared flags: --config FILE --feature-tracker NAME --feature-tracker-option KEY=
               --builder -- CMD --builder-timeout-ms N --builder-max-attempts N
               --builder-repair -- CMD --builder-repair-timeout-ms N
               --builder-gate ID -- CMD --builder-gate-timeout-ms N
-              --assembly-fix -- CMD --assembly-fix-timeout-ms N --assembly-max-attempts N
-              --assembly-validate -- CMD --assembly-validate-timeout-ms N
-              --assembly-gate ID -- CMD --assembly-gate-timeout-ms N
+              --ticket-fix -- CMD --ticket-fix-timeout-ms N --ticket-max-attempts N
+              --ticket-validate -- CMD --ticket-validate-timeout-ms N
+              --ticket-gate ID -- CMD --ticket-gate-timeout-ms N
               --timeout-ms N --poll-interval-ms N
 
 A gate's --*-gate-timeout-ms comes before the --*-gate it bounds.
 
 watch / status also take --json (snapshot as JSON). explain takes an optional role
-(builder.producer, builder.repair, assembly.fix, assembly.validate, authority.describe) and --json.
+(builder.producer, builder.repair, ticket.fix, ticket.validate, authority.describe) and --json.
 
 log also takes --problems, --all, and --json (every kept line).
 --tail N limits the text film (0 = no limit). With --json it names kept and shown when it drops lines.

package/dist/config/agent-shorthand.d.ts

@@ -2,8 +2,12 @@
 export declare const ROLE_SCRIPTS: {
     readonly "builder.producer": "builders/producer.mjs";
     readonly "builder.repair": "builders/repair.mjs";
-    readonly "assembly.fix": "assembly/fix.mjs";
-    readonly "assembly.validate": "assembly/validate.mjs";
+    readonly "builder.tests": "builders/tests.mjs";
+    readonly "builder.e2e": "builders/e2e.mjs";
+    readonly "ticket.fix": "ticket/fix.mjs";
+    readonly "ticket.validate": "ticket/validate.mjs";
+    readonly "feature.fix": "feature/fix.mjs";
+    readonly "feature.validate": "feature/validate.mjs";
     readonly "authority.describe": "messages/git-producer.mjs";
 };
 export type AgentRole = keyof typeof ROLE_SCRIPTS;
@@ -36,9 +40,26 @@ export declare function readAgents(value: unknown, configDir: string): Read<Map<
  * mapping; its keys were checked by the caller.
  */
 export declare function expandAgentPass(object: Record<string, unknown>, role: AgentRole, agents: Agents, configDir: string, key: string): Read<string[]>;
+/**
+ * Where an app's deck profile is, from the path the config gives it: the app
+ * folder that holds `.ai/` (`.` for the checkout itself) and the profile's name.
+ * deck keeps its profiles in `<app>/.ai/profiles/<name>`, so that is the shape;
+ * the app folder is what a Project may place elsewhere in its checkout.
+ *
+ * The slot that builds the profile reads the path by the same rule
+ * (`parseAppDeckProfile` in `agent-plugins.mjs`); neither depends on the other.
+ */
+export declare function parseAppDeckProfile(given: string): {
+    ok: true;
+    root: string;
+    name: string;
+} | {
+    ok: false;
+    reason: string;
+};
 /** The agent and profile a pass's argv names, written short or not; for `doctor`. */
 export declare function agentPartOf(argv: readonly string[]): {
-    profile?: string;
+    appDeckProfile?: string;
     pluginsOut?: string;
     pluginDirs: string[];
 };

package/dist/config/agent-shorthand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-shorthand.d.ts","sourceRoot":"","sources":["../../src/config/agent-shorthand.ts"],"names":[],"mappings":"AA2BA,mEAAmE;AACnE,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAgBlD,uFAAuF;AACvF,eAAO,MAAM,eAAe,aAAsE,CAAC;AAEnG,wEAAwE;AACxE,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpD,KAAK,IAAI,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAwG1F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,IAAI,CAAC,MAAM,EAAE,CAAC,CA8EhB;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAoBA"}
+{"version":3,"file":"agent-shorthand.d.ts","sourceRoot":"","sources":["../../src/config/agent-shorthand.ts"],"names":[],"mappings":"AA4BA,mEAAmE;AACnE,eAAO,MAAM,YAAY;;;;;;;;;;CAUf,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAgBlD,uFAAuF;AACvF,eAAO,MAAM,eAAe,aAO1B,CAAC;AAEH,wEAAwE;AACxE,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpD,KAAK,IAAI,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAwG1F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,IAAI,CAAC,MAAM,EAAE,CAAC,CAoFhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmB1E;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAoBA"}

package/dist/config/agent-shorthand.js

@@ -1,4 +1,4 @@
-import { resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 /**
  * The short way to write an agent pass: which agent, which prompt, which
  * plugins — and Host writes the argv a pass has always been.
@@ -8,13 +8,14 @@ import { resolve } from "node:path";
  *               transcripts: ./.mason/transcripts, pluginsOut: ./.mason/plugins }
  *   builder:
  *     producer: { agent: cursor, prompt: ./prompts/builder.md,
- *                 plugins: [./ai-plugins/core/builder], profile: builder, timeoutMs: … }
+ *                 homePlugins: [./ai-plugins/core/builder],
+ *                 appDeckProfile: .ai/profiles/builder, timeoutMs: … }
  *
  * expands to
  *
  *   node <slots>/builders/producer.mjs --prompt-file <prompt> --
  *     node <slots>/agents/cursor.mjs --transcript-dir … --agent-home … --api-key-env …
- *       --plugin-dir <core> --profile builder --plugins-out …
+ *       --plugin-dir <core> --app-deck-profile .ai/profiles/builder --plugins-out …
  *
  * The expansion is the whole ticket: nothing downstream knows a pass was
  * written short, so `cmd` stays the one shape the rest of Host reads, and a
@@ -26,8 +27,12 @@ const SLOTS_PACKAGE = "node_modules/@bluewombat/slots";
 export const ROLE_SCRIPTS = {
     "builder.producer": "builders/producer.mjs",
     "builder.repair": "builders/repair.mjs",
-    "assembly.fix": "assembly/fix.mjs",
-    "assembly.validate": "assembly/validate.mjs",
+    "builder.tests": "builders/tests.mjs",
+    "builder.e2e": "builders/e2e.mjs",
+    "ticket.fix": "ticket/fix.mjs",
+    "ticket.validate": "ticket/validate.mjs",
+    "feature.fix": "feature/fix.mjs",
+    "feature.validate": "feature/validate.mjs",
     "authority.describe": "messages/git-producer.mjs",
 };
 const ADAPTERS = new Set(["cursor", "claude"]);
@@ -44,7 +49,14 @@ const AGENT_KEYS = new Set([
     "args",
 ]);
 /** The keys a pass written short may carry, besides its own (`timeoutMs`, `gates`). */
-export const SHORT_PASS_KEYS = new Set(["agent", "prompt", "rules", "plugins", "profile", "args"]);
+export const SHORT_PASS_KEYS = new Set([
+    "agent",
+    "prompt",
+    "rules",
+    "homePlugins",
+    "appDeckProfile",
+    "args",
+]);
 export function readAgents(value, configDir) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         return { ok: false, reason: 'Config "agents" must be a YAML mapping of agent names.' };
@@ -176,19 +188,25 @@ export function expandAgentPass(object, role, agents, configDir, key) {
     if (rules.ok === false) {
         return rules;
     }
-    const plugins = stringList(object.plugins, `${key}.plugins`);
+    const plugins = stringList(object.homePlugins, `${key}.homePlugins`);
     if (plugins.ok === false) {
         return plugins;
     }
-    const profile = object.profile;
-    if (profile !== undefined && (typeof profile !== "string" || profile.trim().length === 0)) {
-        return { ok: false, reason: `Config "${key}.profile" must be a deck profile name.` };
-    }
-    if (profile !== undefined && agent.pluginsOut === undefined) {
-        return {
-            ok: false,
-            reason: `Config "${key}" names a deck profile, so "agents.${name}.pluginsOut" must say where it is built.`,
-        };
+    const profile = object.appDeckProfile;
+    if (profile !== undefined) {
+        if (typeof profile !== "string") {
+            return { ok: false, reason: `Config "${key}.appDeckProfile" must be a path.` };
+        }
+        const located = parseAppDeckProfile(profile);
+        if (!located.ok) {
+            return { ok: false, reason: `Config "${key}.appDeckProfile": ${located.reason}` };
+        }
+        if (agent.pluginsOut === undefined) {
+            return {
+                ok: false,
+                reason: `Config "${key}" names an app deck profile, so "agents.${name}.pluginsOut" must say where it is built.`,
+            };
+        }
     }
     const args = stringList(object.args, `${key}.args`);
     if (args.ok === false) {
@@ -224,13 +242,40 @@ export function expandAgentPass(object, role, agents, configDir, key) {
         argv.push("--plugin-dir", resolve(configDir, dir));
     }
     if (profile !== undefined && agent.pluginsOut !== undefined) {
-        argv.push("--profile", profile, "--plugins-out", agent.pluginsOut);
+        argv.push("--app-deck-profile", profile, "--plugins-out", agent.pluginsOut);
     }
     for (const arg of [...agent.args, ...args.value]) {
         argv.push("--agent-arg", arg);
     }
     return { ok: true, value: argv };
 }
+/**
+ * Where an app's deck profile is, from the path the config gives it: the app
+ * folder that holds `.ai/` (`.` for the checkout itself) and the profile's name.
+ * deck keeps its profiles in `<app>/.ai/profiles/<name>`, so that is the shape;
+ * the app folder is what a Project may place elsewhere in its checkout.
+ *
+ * The slot that builds the profile reads the path by the same rule
+ * (`parseAppDeckProfile` in `agent-plugins.mjs`); neither depends on the other.
+ */
+export function parseAppDeckProfile(given) {
+    const matched = /^(?:(.*?)\/)?\.ai\/profiles\/([^/]+)\/?$/.exec(given.trim());
+    const name = matched?.[2];
+    if (matched === null ||
+        name === undefined ||
+        !/^[A-Za-z0-9_-][A-Za-z0-9._-]*$/.test(name) ||
+        name === "current") {
+        return {
+            ok: false,
+            reason: `"${given}" is not a deck profile path: [<app dir>/].ai/profiles/<name>.`,
+        };
+    }
+    const root = matched[1] ?? ".";
+    if (isAbsolute(root) || root.split("/").includes("..")) {
+        return { ok: false, reason: `"${given}" must stay inside the checkout.` };
+    }
+    return { ok: true, root, name };
+}
 /** The agent and profile a pass's argv names, written short or not; for `doctor`. */
 export function agentPartOf(argv) {
     const split = argv.indexOf("--");
@@ -243,8 +288,8 @@ export function agentPartOf(argv) {
         if (value === undefined) {
             return;
         }
-        if (token === "--profile") {
-            found.profile = value;
+        if (token === "--app-deck-profile") {
+            found.appDeckProfile = value;
         }
         else if (token === "--plugins-out") {
             found.pluginsOut = value;