@bluewombat/slots 0.11.0 → 0.11.1

package/README.md

@@ -104,7 +104,10 @@ others, plus the names given with `--pass-env`), not the operator's whole
 shell; git's credential helpers are cleared for it; and `ssh`, `scp` plus the
 commands given with `--deny-shell` are denied in its own `cli-config.json`,
 rewritten every run. That
-lowers a risk and confines nothing (RESERVATIONS F32). `claude.mjs`
+lowers a risk and confines nothing: the deny list matches command names (`node -e`,
+`env gh` or an absolute path pass), the operator's files stay readable, the login
+keychain is reachable unless `gh` and `security` are denied, and `CURSOR_API_KEY`
+is visible to the agent. Real confinement is issue #36. `claude.mjs`
 needs `claude`, signed in once, and refuses those two flags: Claude is not
 isolated yet, and starting it would keep the operator's own config.
 
@@ -125,7 +128,7 @@ isolated yet, and starting it would keep the operator's own config.
 | `--deny-shell NAME`                | With `--agent-home`, also refuse this command to the vendor (`gh`, `vercel`…). `ssh` and `scp` always are. Repeatable           |
 | `--plugin-dir DIR`                 | A plugin folder of the operator's (a Mason home's `ai-plugins/core/*`). Repeatable, loaded first                                |
 | `--app-deck-profile PATH`          | The app's deck profile for this role, as a path in the checkout: `[<app dir>/].ai/profiles/<name>`. Cursor only; Claude refuses |
-| `--plugins-out DIR`                | Where the profile is built, one folder per profile. Required with `--app-deck-profile`; never the workspace                     |
+| `--plugins-out DIR`                | Where the profile is built, one folder per workspace and profile. Required with `--app-deck-profile`; never the workspace      |
 | `--deck-bin PATH`                  | The deck CLI. Default: the `@pinkpuma/deck` this package depends on                                                             |
 | `--id` / `--attempt` / `--context` | How a transcript is filed. Forwarded by the role                                                                                |
 
@@ -136,7 +139,7 @@ An agent starts with plugin folders, each passed to the vendor as
 project's [deck](https://github.com/tilap/pinkpuma-deck) profile resolves to.
 
 `--app-deck-profile .ai/profiles/builder` runs `deck materialize -C <app dir> --profile builder --out
-<plugins-out>/builder --json` before the vendor starts. The working directory
+<plugins-out>/<workspace>/builder --json` before the vendor starts. The working directory
 is the checkout the agent works on, so a role gets what the project committed
 at that commit — the base `ai-plugin.json` and `.ai/profiles/builder/`, as their
 locks pin them — never what the operator has installed. deck refuses a request
@@ -160,9 +163,12 @@ author did. `cursor-agent` ran a Claude-format one (`${CLAUDE_PLUGIN_ROOT}`,
 `PostToolUse` on edits) on a real run; a hook that runs is part of the agent's
 time and of what it reads back.
 
-deck's cache (`~/.cache/pinkpuma-deck`, or `DECK_CACHE`) has no lock, and
-`--plugins-out` holds one folder per profile: both rely on a Mason run starting
-one agent at a time, which it does.
+deck's cache (`~/.cache/pinkpuma-deck`, or `DECK_CACHE`) has no lock, so agents that
+start together (`ticket.maxParallel` above 1) materialize one after the other: the
+wrapper holds a lock in `--plugins-out` while deck runs, and takes it over when its
+holder is gone. Each workspace has its own folder there, so a running agent's plugins
+are never rewritten by another's start. The folder of a workspace that no longer exists
+is removed the next time an agent starts.
 
 `claude.mjs` takes `--plugin-dir` but refuses `--app-deck-profile`: not isolated, Claude
 also loads the operator's plugins and the project's `.claude/settings.json`, so
@@ -340,6 +346,10 @@ values). Files are
 filed under the Ticket the Task belongs to, named for the Subtask and the
 Attempt. It belongs on the **agent** command, after `--`.
 
+The file is made before the agent starts and grows with its output, then replaced
+by the finished page. An Attempt killed at its ceiling or by an interrupt leaves
+the file as it was: the prompt, the output so far, and `exit: not returned`.
+
 ```yaml
 builder:
   producer:
@@ -374,6 +384,23 @@ Every Gate answers with one JSON object on stdout — `{"verdict":"pass"}`, or
 in, and what mason appends to its argv, is in
 [`@bluewombat/runtime`](../../host/runtime/README.md).
 
+What no Gate can see, by construction:
+
+- `sensitive-path` compares the workspace with `HEAD`, so a Builder that commits
+  its work makes it blind. `workspace-changed` covers that by refusing a workspace
+  with nothing uncommitted; keep both. On the recheck after align the work is
+  committed and `sensitive-path` always passes: use `base-diff --deny GLOB`
+  where the recheck or the Feature must answer.
+- `workspace-unchanged` on `assembly.validate` runs after the Project's own
+  commands: one that writes outside `.gitignore` (coverage, `.tsbuildinfo`, a build
+  directory) reads as the review writing. Allow those paths with `--allow GLOB`.
+- `parent-clean` on a Parent with no `.git` takes the workspace's oldest file as
+  its baseline time: a file newer than that is a leak. It is the only baseline a
+  copy-mode work line has.
+- `workspace-changed` asks whether something changed, not whether the change
+  answers the report: a producer that ignores its report and changes something
+  else passes.
+
 ```yaml
 builder:
   gates:
@@ -398,7 +425,11 @@ it first: every Gate after it then judges work that exists. It passes at
 producer to send back.
 
 `parent-clean` fail-blocks if Isolator's Parent working files changed
-(`--parent DIR`, or the other git worktrees of this Child).
+(`--parent DIR`, plus the main worktree of this Child's repository). Only files written
+after the Child was created count, so an edit that was already there is not a leak. The
+other linked worktrees are sibling Children (parallel tickets, escalated leftovers) and are
+ignored; `--siblings` watches them too, for a serial run. Not covered: an Agent writing
+into a sibling worktree.
 
 `sensitive-path` fail-retries if the workspace changed a path matching a glob.
 `*` is one segment, `**` any depth. It looks at what a fold can carry out of
@@ -572,7 +603,20 @@ in the workspace, and the Gate runs it, compares and judges.
 
 A scenario is a manifest id, and every test carries its id in its name (`S2 pays by card`). The
 comparison is exact: an id with no test, a test with no manifest id, and a test the runner
-skipped are failures. There is no retry. The verdict:
+skipped are failures. There is no retry.
+
+The report must therefore hold **only** the Feature's scenarios. A name filter is enough only for a
+runner that leaves the filtered-out tests out of its report. A runner that lists them as `skipped`
+(Vitest with `-t` does) puts tests with no manifest id in the report, and the Gate refuses the run
+(`tests that carry no id of the manifest`): restrict the files the command loads as well, for
+example to the files that hold the Feature's tests by a naming convention.
+
+```yaml
+# Vitest: only the *.feature.test.ts files are loaded, then only the manifest's scenarios run
+- pnpm exec vitest run .feature.test.ts -t "{ids}" --reporter=junit --outputFile={junit}
+```
+
+`{ids}` and `{junit}` are both required in `--run`; `mason doctor` warns when one is missing. The verdict:
 
 | Verdict | When |
 | --- | --- |
@@ -598,12 +642,22 @@ the folder (`sensitive-path feature-tests/**` in `feature.fix.gates`) would read
 
 The slot that puts an assembled ticket where the Authority can read it. It runs
 **in the work line**, and mason appends `--id`, `--ref` — the name Isolator gave
-the ticket — and `--target`, the work line it is offered to.
-
-`git.mjs` pushes that name to the work line's own remote. A plain push, no force
-of any kind: Integrator only ever adds history, so republishing after a refusal
-is a fast-forward. A rejection means the name moved under us, which is the one
-case worth refusing rather than overwriting.
+the ticket — `--target`, the work line it is offered to, and `--kind` (`ticket`, or
+`line` for a Feature's own line).
+
+`git.mjs` pushes the Ticket's result to the work line's own remote under that
+name: one commit, made from the branch's tree on top of the work line's tip
+(`--target`), not the branch's history. The workspace is snapshotted at every
+integration, so a blob an install added and a repair removed would otherwise
+travel with it and make a pack the remote refuses. The work line remembers what
+it published (`refs/published/<ref>`) and a resubmission continues it, so the
+push stays a fast-forward; the same tree on the same line publishes nothing new.
+A plain push, no force of any kind: a rejection means the name moved under us,
+which is the one case worth refusing rather than overwriting.
+
+With `--kind line`, which Host passes when a Feature closes, the ref is pushed as
+it is: a Feature's line is the history the Authority built by folding Tickets
+into it, already on the remote, so the push is a fast-forward of it.
 
 It takes no option, and the remote is `origin`. After the Authority folds, Host
 reads the work line back from `origin` on its own, with no way to learn what this
@@ -685,3 +739,12 @@ messages/      what a commit says: a rule, or an agent under the team's guidelin
 test/          one suite per kind; each spawns the real command
 fixtures/      fake agent CLIs the Builder suites run against
 ```
+
+## Copy mode
+
+A work line isolated by `@bluewombat/isolation-copy` has no `.git`. The slots
+that read git need one: the `git` Publisher and Refresher,
+`messages/git-producer`, and the Gates `workspace-changed`, `workspace-unchanged`,
+`sensitive-path`, `base-diff`, `ci-green`, `gitignore-leak` and `tests-only`. A
+copy-mode Project uses `parent-clean`, `project-checks` and `feature-tests`, and
+brings its own Publisher and Gates for what it hands over.

package/agents/agent-plugins.mjs

@@ -1,5 +1,14 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { listOption, textOption } from "@bluewombat/slot-kit";
@@ -13,15 +22,18 @@ import { listOption, textOption } from "@bluewombat/slot-kit";
 //                         checkout: `[<app dir>/].ai/profiles/<name>`. The base
 //                         and that profile, as the app's locks pin them
 //   --plugins-out DIR     where the profile is materialized, one folder per
-//                         profile. Required with --app-deck-profile: never the
+//                         workspace and profile (<DIR>/<workspace>/<profile>).
+//                         Required with --app-deck-profile: never the
 //                         workspace, whose tree the Gates read
 //   --deck-bin PATH       the deck CLI. Default: the @pinkpuma/deck this
 //                         package depends on
 //
 // The profile is read from the working directory — the checkout the agent
 // works on — so a role gets what the project committed at that commit, not
-// what the operator has installed. Agents of one Mason run one at a time,
-// which is why one folder per profile is enough.
+// what the operator has installed. Agents of one Mason may run side by side
+// (ticket.maxParallel above 1): each workspace has its own folder, so one
+// agent's plugins are never rewritten under another, and the runs of deck
+// that fill them take turns, because deck's cache has no lock of its own.
 
 const PROFILE_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
 
@@ -111,19 +123,34 @@ export function loadPlugins(options, cwd) {
   if (!deck.ok) {
     return deck;
   }
+  const outRoot = resolve(cwd, out);
   const args = [
     deck.path,
     "materialize",
     "-C",
     appDir,
     "--out",
-    resolve(cwd, out, profile),
+    join(outRoot, workspaceSegment(cwd), profile),
     "--json",
     ...(hasProfile ? ["--profile", profile] : []),
   ];
   // No timeout: this runs inside the agent wrapper's own process group, so
   // the slot's deadline ends deck with it.
-  const run = spawnSync(process.execPath, args, { cwd, encoding: "utf8" });
+  /** @type {import("node:child_process").SpawnSyncReturns<string>} */
+  let run;
+  try {
+    run = takingTurns(outRoot, () => {
+      retireStaleFolders(outRoot);
+      markWorkspace(outRoot, cwd);
+      return spawnSync(process.execPath, args, { cwd, encoding: "utf8" });
+    });
+  } catch (error) {
+    const said = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      reason: `deck materialize could not start for profile ${profile}: ${said}`,
+    };
+  }
   if (run.error !== undefined || run.status !== 0) {
     const said = (run.stderr || run.error?.message || `exit ${run.status}`).trim();
     return {
@@ -146,6 +173,127 @@ export function loadPlugins(options, cwd) {
   };
 }
 
+const WORKSPACE_MARK = ".workspace";
+const LOCK_NAME = ".materialize.lock";
+const LOCK_WAIT_MS = 10 * 60 * 1000;
+const LOCK_CREATION_GRACE_MS = 10 * 1000;
+
+/**
+ * The folder under `--plugins-out` that belongs to one workspace: the same
+ * name every time the same directory asks, a different one for each directory.
+ *
+ * @param {string} cwd
+ * @returns {string}
+ */
+export function workspaceSegment(cwd) {
+  return createHash("sha256").update(resolve(cwd)).digest("hex").slice(0, 12);
+}
+
+/**
+ * Record whose folder this is, so that it can be dropped once the workspace is gone.
+ *
+ * @param {string} outRoot
+ * @param {string} cwd
+ */
+function markWorkspace(outRoot, cwd) {
+  const folder = join(outRoot, workspaceSegment(cwd));
+  mkdirSync(folder, { recursive: true });
+  writeFileSync(join(folder, WORKSPACE_MARK), `${resolve(cwd)}\n`);
+}
+
+/**
+ * Drop the folders of workspaces that no longer exist (a ticket that landed
+ * clears its own). Only a folder that carries the mark is touched.
+ *
+ * @param {string} outRoot
+ */
+function retireStaleFolders(outRoot) {
+  let names;
+  try {
+    names = readdirSync(outRoot);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const folder = join(outRoot, name);
+    let owner;
+    try {
+      owner = readFileSync(join(folder, WORKSPACE_MARK), "utf8").trim();
+    } catch {
+      continue;
+    }
+    if (owner.length > 0 && !existsSync(owner)) {
+      rmSync(folder, { recursive: true, force: true });
+    }
+  }
+}
+
+/**
+ * Run `work` while holding the lock of `outRoot`: two agents starting together
+ * materialize one after the other, since deck's cache has no lock. A lock whose
+ * holder is gone is taken over.
+ *
+ * @template T
+ * @param {string} outRoot
+ * @param {() => T} work
+ * @returns {T}
+ */
+function takingTurns(outRoot, work) {
+  mkdirSync(outRoot, { recursive: true });
+  const lock = join(outRoot, LOCK_NAME);
+  const giveUpAt = Date.now() + LOCK_WAIT_MS;
+  for (;;) {
+    try {
+      mkdirSync(lock);
+      break;
+    } catch (error) {
+      if (/** @type {NodeJS.ErrnoException} */ (error).code !== "EEXIST") {
+        throw error;
+      }
+    }
+    if (holderGone(lock)) {
+      rmSync(lock, { recursive: true, force: true });
+      continue;
+    }
+    if (Date.now() > giveUpAt) {
+      throw new Error(`another agent held ${lock} for more than ${LOCK_WAIT_MS / 60000} minutes`);
+    }
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200);
+  }
+  try {
+    writeFileSync(join(lock, "pid"), String(process.pid));
+    return work();
+  } finally {
+    rmSync(lock, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Whether the process that took `lock` is gone. A lock with no pid yet was
+ * just made: it is given a few seconds to say whose it is.
+ *
+ * @param {string} lock
+ * @returns {boolean}
+ */
+function holderGone(lock) {
+  let pid;
+  try {
+    pid = Number(readFileSync(join(lock, "pid"), "utf8"));
+  } catch {
+    try {
+      return Date.now() - statSync(lock).mtimeMs > LOCK_CREATION_GRACE_MS;
+    } catch {
+      return false;
+    }
+  }
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return /** @type {NodeJS.ErrnoException} */ (error).code === "ESRCH";
+  }
+}
+
 /**
  * The filled prompt, then the project's own words for this role.
  *

package/agents/claude.mjs

@@ -116,7 +116,8 @@ const transcript = transcriptFor(process.argv, options, {
   prompt,
   plugins,
 });
-const run = await runAgent({ file: bin, args, cwd });
+transcript.start();
+const run = await runAgent({ file: bin, args, cwd, onOutput: transcript.tap });
 const extras = extrasFromClaude(run.stdout, outputFormat, cwd);
 transcript.write(run, extras);
 answer(run, bin, extras);

package/agents/cursor.mjs

@@ -143,10 +143,12 @@ const transcript = transcriptFor(process.argv, options, {
   prompt,
   plugins,
 });
+transcript.start();
 const run = await runAgent({
   file: bin,
   args,
   cwd,
+  onOutput: transcript.tap,
   ...(isolation.env === undefined ? {} : { env: isolation.env }),
 });
 const extras = extrasFromCursor(run.stdout, outputFormat, cwd);

package/gates/parent-clean.mjs

@@ -5,11 +5,17 @@ import { join, relative, resolve } from "node:path";
 import { emitVerdict, GATE_FLAGS, ownArgv } from "@bluewombat/slot-kit";
 
 // Parent working files must not change during the Attempt.
-// --parent DIR (repeatable). Other git worktrees of this Child are included.
+// --parent DIR (repeatable): always watched.
+// The main worktree of this Child's repository is watched too. Its other linked
+// worktrees are sibling Children (parallel tickets, escalated leftovers): they are
+// legitimately dirty, so they are ignored unless --siblings is given.
+// A watched git tree only counts files modified after this Child was created, so
+// work that was already there (a human's uncommitted edit) is not a leak.
 
 const cwd = resolve(process.cwd());
 const tokens = ownArgv(process.argv, GATE_FLAGS);
 const named = [];
+let withSiblings = false;
 
 for (let i = 0; i < tokens.length; i++) {
   const token = tokens[i];
@@ -23,12 +29,19 @@ for (let i = 0; i < tokens.length; i++) {
     i += 1;
     continue;
   }
-  emitVerdict("fail-blocking", `parent-clean does not take "${token}". Use --parent <dir>.`);
+  if (token === "--siblings") {
+    withSiblings = true;
+    continue;
+  }
+  emitVerdict(
+    "fail-blocking",
+    `parent-clean does not take "${token}". Use --parent <dir> or --siblings.`,
+  );
   process.exit(0);
 }
 
 const parents = [...named];
-for (const worktree of otherWorktrees(cwd)) {
+for (const worktree of otherWorktrees(cwd, withSiblings)) {
   if (!parents.includes(worktree)) {
     parents.push(worktree);
   }
@@ -67,15 +80,22 @@ if (leaked.length > 0) {
 
 emitVerdict("pass");
 
-/** Other worktrees of this repository, minus the ones git has marked prunable. */
-/** @param {string} workspace @returns {string[]} */
-function otherWorktrees(workspace) {
+/**
+ * The main worktree of this repository (git lists it first), plus the other linked
+ * worktrees when `siblings` is set. Worktrees git has marked prunable are left out.
+ */
+/** @param {string} workspace @param {boolean} siblings @returns {string[]} */
+function otherWorktrees(workspace, siblings) {
   const result = git(workspace, ["worktree", "list", "--porcelain"]);
   if (result.status !== 0) {
     return [];
   }
   const trees = [];
-  for (const record of result.stdout.split("\n\n")) {
+  const records = result.stdout.split("\n\n");
+  for (const [index, record] of records.entries()) {
+    if (index > 0 && !siblings) {
+      break;
+    }
     const lines = record.split("\n");
     const entry = lines.find((line) => line.startsWith("worktree "));
     if (entry === undefined || lines.some((line) => line.startsWith("prunable"))) {
@@ -100,10 +120,12 @@ function leaksIn(parent, workspace) {
     if (status.status !== 0) {
       return [`${parent}: git status failed`];
     }
+    const referenceMs = referenceTime(workspace);
     const lines = status.stdout
       .split("\n")
       .map((line) => line.trimEnd())
-      .filter(Boolean);
+      .filter(Boolean)
+      .filter((line) => !untouchedSince(parent, line, referenceMs));
     return lines.map((line) => `${relative(workspace, parent) || parent}: ${line}`);
   }
   const referenceMs = referenceTime(workspace);
@@ -117,6 +139,22 @@ function leaksIn(parent, workspace) {
   return dirty;
 }
 
+/**
+ * A status line whose file still exists and was last written before the Child was
+ * created is older than the Attempt. A deletion has no date and always counts.
+ * @param {string} parent
+ * @param {string} line
+ * @param {number} referenceMs
+ */
+function untouchedSince(parent, line, referenceMs) {
+  const path = line.slice(3).split(" -> ").at(-1) ?? "";
+  try {
+    return statSync(join(parent, path.replace(/^"|"$/g, ""))).mtimeMs <= referenceMs;
+  } catch {
+    return false;
+  }
+}
+
 /** @param {string} workspace */
 function referenceTime(workspace) {
   const gitFile = join(workspace, ".git");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bluewombat/slots",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "type": "module",
   "description": "Shipped mason slots: Builders, Gates, publishers, and refreshers a Project names in its config.",
   "keywords": [
@@ -52,7 +52,7 @@
     "test": "tsx --test $(find test -name '*.test.ts')"
   },
   "dependencies": {
-    "@bluewombat/slot-kit": "^0.11.0",
+    "@bluewombat/slot-kit": "^0.11.1",
     "@pinkpuma/deck": "1.1.0"
   }
 }

package/publishers/git.mjs

@@ -14,18 +14,29 @@ import {
 // Put the ticket's work where the Authority can read it, by pushing the name
 // Isolator gave it to the work line's own remote.
 //
-// A plain push, and no force of any kind. Integrator only ever adds history, so
-// republishing after a refusal is a fast-forward of what was already there. A
-// rejection therefore means the name moved under us — someone else's commit, or
-// a rewrite — and that is exactly the case worth refusing rather than
-// overwriting.
+// What is pushed is the Ticket's result, not what its workspace went through:
+// the workspace is snapshotted again at every integration, and a blob that was
+// added and removed along the way (an install, a build) would travel with its
+// history and make a pack no host accepts. So one commit is made from the
+// branch's tree, on top of the work line's tip, and that commit is pushed.
+// A resubmission continues what this slot published before, which the work line
+// remembers, so the push stays a fast-forward.
+//
+// A plain push, and no force of any kind. A rejection means the name moved
+// under us — someone else's commit, or a rewrite — and that is exactly the
+// case worth refusing rather than overwriting: a branch this slot did not
+// publish is never built upon.
 //
 // The remote is `origin`, and there is no option for it: Host reads the work
 // line back from `origin` after the Authority folds, with no way to learn what
 // this slot was told. An option that publishes to one remote while the refresh
 // reads another is a trap, so it waits for that half to become a slot too.
 //
-// Runs in the work line. mason appends --id, --ref and --target.
+// A Feature's line is not a Ticket's result: it is a history the Authority built
+// by folding Tickets into it, already on the remote, and it is pushed as it is,
+// a fast-forward of what the remote holds. mason says so with `--kind line`.
+//
+// Runs in the work line. mason appends --id, --ref, --target and --kind.
 
 const cwd = process.cwd();
 const tokens = ownArgv(process.argv, PUBLISHER_FLAGS);
@@ -48,18 +59,108 @@ if (!existsSync(join(cwd, ".git"))) {
 
 // C locale: git's words become the refusal a team reads on the tracker, and a
 // machine's own language would put French or German in an English thread.
-const pushed = spawnSync("git", ["-C", cwd, "push", remote, `${ref}:${ref}`], {
-  encoding: "utf8",
-  env: { ...process.env, LC_ALL: "C" },
-});
-if (pushed.error !== undefined) {
-  writeDiagnostic(`git publisher cannot run git: ${pushed.error.message}\n`);
-  process.exit(1);
+const env = { ...process.env, LC_ALL: "C" };
+/** @param {...string} args */
+const git = (...args) => spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", env });
+/** @param {{ stderr?: string | null, stdout?: string | null }} run */
+const text = (run) => `${run.stderr ?? ""}${run.stdout ?? ""}`.trim().slice(-1000);
+
+/**
+ * Runs git; a git that cannot run at all ends the slot, anything else is the caller's to read.
+ * @param {...string} args
+ */
+function run(...args) {
+  const done = git(...args);
+  if (done.error !== undefined) {
+    writeDiagnostic(`git publisher cannot run git: ${done.error.message}\n`);
+    process.exit(1);
+  }
+  return done;
 }
-if (pushed.status !== 0) {
-  const detail = `${pushed.stderr ?? ""}${pushed.stdout ?? ""}`.trim().slice(-1000);
-  emitPublishRefusal(`Could not publish ${ref}: ${detail}`);
+
+/**
+ * @param {string} what
+ * @param {{ stderr?: string | null, stdout?: string | null }} [done]
+ * @returns {never}
+ */
+function refuse(what, done) {
+  emitPublishRefusal(
+    `Could not publish ${ref}: ${what}${done === undefined ? "" : `: ${text(done)}`}`,
+  );
+  process.exit(0);
+}
+
+const kind = take(process.argv, "--kind") ?? "ticket";
+if (kind === "line") {
+  const pushedLine = run("push", remote, `refs/heads/${ref}:refs/heads/${ref}`);
+  if (pushedLine.status !== 0) {
+    refuse("the push was refused", pushedLine);
+  }
+  emitPublication(ref);
+  process.exit(0);
+}
+
+const target = take(process.argv, "--target");
+const id = take(process.argv, "--id");
+if (target === undefined || target.trim().length === 0) {
+  refuse("it was given no --target to build on");
+}
+
+// The line's tip, as the remote holds it: what the Submission is a change to.
+const fetched = run("fetch", "--quiet", remote, target);
+if (fetched.status !== 0) {
+  refuse(`cannot read ${target} from ${remote}`, fetched);
+}
+const tip = run("rev-parse", "FETCH_HEAD");
+const tipOid = tip.stdout.trim();
+if (tip.status !== 0 || tipOid.length === 0) {
+  refuse(`cannot read ${target}`, tip);
+}
+const tree = run("rev-parse", `${ref}^{tree}`);
+if (tree.status !== 0) {
+  refuse(`${ref} is not a branch of this work line`, tree);
+}
+const treeOid = tree.stdout.trim();
+
+// What this slot published before: the work line keeps it under `refs/published/`.
+// A name that holds anything else moved under us, and is left for the push to
+// reject.
+const recordName = `refs/published/${ref}`;
+let before;
+const recorded = run("rev-parse", "--verify", "--quiet", recordName).stdout.trim();
+const remoteRef = run("ls-remote", remote, `refs/heads/${ref}`);
+const remoteOid = remoteRef.stdout.trim().split(/\s+/)[0] ?? "";
+if (recorded.length > 0 && remoteRef.status === 0 && remoteOid === recorded) {
+  before = recorded;
+}
+
+// Nothing new: the same tree on the same line, already there.
+if (
+  before !== undefined &&
+  run("rev-parse", `${before}^{tree}`).stdout.trim() === treeOid &&
+  run("merge-base", "--is-ancestor", tipOid, before).status === 0
+) {
+  emitPublication(ref);
   process.exit(0);
 }
 
+const parents = [...new Set([before, tipOid].filter((oid) => oid !== undefined))];
+const made = run(
+  "commit-tree",
+  treeOid,
+  ...parents.flatMap((oid) => ["-p", oid]),
+  "-m",
+  `Submission of ${id ?? ref}`,
+);
+const commit = made.stdout.trim();
+if (made.status !== 0 || commit.length === 0) {
+  refuse("cannot make the commit", made);
+}
+
+const pushed = run("push", remote, `${commit}:refs/heads/${ref}`);
+if (pushed.status !== 0) {
+  refuse("the push was refused", pushed);
+}
+run("update-ref", recordName, commit);
+
 emitPublication(ref);