@cat-factory/contracts 0.232.0 → 0.234.0

package/dist/routes/notification-webhooks.d.ts

@@ -43,7 +43,7 @@ export declare const putNotificationWebhookContract: {
     readonly method: "put";
     readonly pathResolver: () => string;
     readonly requestBodySchema: v.ObjectSchema<{
-        readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>;
+        readonly url: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         readonly types: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>, undefined>;
         readonly runEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>, undefined>;
         readonly alertEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>, undefined>;
@@ -114,4 +114,132 @@ export declare const deleteNotificationWebhookContract: {
         readonly 204: typeof ContractNoBody;
     };
 };
+/**
+ * Read the workspace's registered endpoint. `{ webhook: null }` when none is registered: a real
+ * answer rather than a 404, so a caller's startup self-check ("am I already wired up?") reads one
+ * response shape instead of branching on a status the surface also uses for a bad path.
+ */
+export declare const getPublicNotificationWebhookContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: v.ObjectSchema<{
+            readonly webhook: v.NullableSchema<v.ObjectSchema<{
+                readonly url: v.StringSchema<undefined>;
+                readonly types: v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>;
+                readonly runEvents: v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>;
+                readonly alertEvents: v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>;
+                readonly enabled: v.BooleanSchema<undefined>;
+                readonly hasSecret: v.BooleanSchema<undefined>;
+                readonly updatedAt: v.NumberSchema<undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Register or update the endpoint. Returns the stored projection directly (not the `webhook`
+ * wrapper the read uses): a successful write always has an endpoint to describe, so wrapping it
+ * would hand every client a null to check that cannot occur.
+ *
+ * `secret` is write-only on this surface exactly as it is on the session one: supplied here,
+ * never returned by the read. An `admin` key can therefore ROTATE the signing secret but can
+ * never exfiltrate the one already stored.
+ */
+export declare const putPublicNotificationWebhookContract: {
+    readonly method: "put";
+    readonly pathResolver: () => string;
+    readonly requestBodySchema: v.ObjectSchema<{
+        readonly url: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        readonly types: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>, undefined>;
+        readonly runEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>, undefined>;
+        readonly alertEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>, undefined>;
+        readonly enabled: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        readonly secret: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 16, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: v.ObjectSchema<{
+            readonly url: v.StringSchema<undefined>;
+            readonly types: v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>;
+            readonly runEvents: v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>;
+            readonly alertEvents: v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>;
+            readonly enabled: v.BooleanSchema<undefined>;
+            readonly hasSecret: v.BooleanSchema<undefined>;
+            readonly updatedAt: v.NumberSchema<undefined>;
+        }, undefined>;
+    };
+};
+/** Remove the endpoint (deliveries stop). Idempotent: 204 whether or not one was registered. */
+export declare const deletePublicNotificationWebhookContract: {
+    readonly method: "delete";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 204: typeof ContractNoBody;
+    };
+};
 //# sourceMappingURL=notification-webhooks.d.ts.map

package/dist/routes/notification-webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-webhooks.d.ts","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAc5B,8FAA8F;AAC9F,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOzC,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKzC,CAAA;AAEF,wDAAwD;AACxD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI5C,CAAA"}
+{"version":3,"file":"notification-webhooks.d.ts","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA0B5B,8FAA8F;AAC9F,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOzC,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKzC,CAAA;AAEF,wDAAwD;AACxD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI5C,CAAA;AAIF;;;;GAIG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI/C,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK/C,CAAA;AAEF,gGAAgG;AAChG,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlD,CAAA"}

package/dist/routes/notification-webhooks.js

@@ -1,13 +1,24 @@
 import { ContractNoBody, defineApiContract } from '@toad-contracts/valibot';
 import * as v from 'valibot';
-import { notificationWebhookSchema, putNotificationWebhookSchema, } from '../notification-webhooks.js';
+import { notificationWebhookSchema, publicNotificationWebhookSchema, putNotificationWebhookSchema, } from '../notification-webhooks.js';
 import { errorResponses } from './_shared.js';
-// Management routes for a workspace's OUTBOUND notification webhook — session-authed and mounted
-// under `/workspaces/:workspaceId` (so paths are relative), like the tracker/Slack settings. The
-// endpoint they configure is consumed by `WebhookNotificationChannel`, not by these routes.
+// Management routes for a workspace's OUTBOUND notification webhook, on TWO surfaces:
 //
-// These are writes to an integration's configuration, so they sit behind the
-// `integrations.manage` workspace permission like every other admin controller.
+//  1. Session-authed, mounted under `/workspaces/:workspaceId` (so paths are relative), like the
+//     tracker/Slack settings. These are writes to an integration's configuration, so they sit
+//     behind the `integrations.manage` workspace permission like every other admin controller.
+//  2. `/api/v1/notification-webhook`, on absolute paths, authenticated in-controller by an
+//     `admin`-scope public-API key. Same three verbs against the same service.
+//
+// The endpoint they configure is consumed by `WebhookNotificationChannel` and the run-lifecycle /
+// platform-alert sinks beside it, not by these routes.
+//
+// The second surface exists because the FIRST one made the push channel unreachable to exactly
+// the caller it was built for. A deployment whose operator is headless has no browser session, so
+// the receiver that run-lifecycle push exists to feed could only be registered by a human clicking
+// through an app the feature deliberately does not need. Both surfaces are thin delegates over
+// `NotificationWebhookService` (same URL guard, same write-only secret, same
+// one-row-per-workspace rule), so neither can admit an endpoint the other would reject.
 /** The workspace's registered webhook, or null when none is set. Never returns the secret. */
 export const getNotificationWebhookContract = defineApiContract({
     method: 'get',
@@ -30,4 +41,36 @@ export const deleteNotificationWebhookContract = defineApiContract({
     pathResolver: () => '/notification-webhook',
     responsesByStatusCode: { 204: ContractNoBody, ...errorResponses },
 });
+// ---- the external `/api/v1` surface (absolute paths, key-authenticated) ----
+/**
+ * Read the workspace's registered endpoint. `{ webhook: null }` when none is registered: a real
+ * answer rather than a 404, so a caller's startup self-check ("am I already wired up?") reads one
+ * response shape instead of branching on a status the surface also uses for a bad path.
+ */
+export const getPublicNotificationWebhookContract = defineApiContract({
+    method: 'get',
+    pathResolver: () => '/api/v1/notification-webhook',
+    responsesByStatusCode: { 200: publicNotificationWebhookSchema, ...errorResponses },
+});
+/**
+ * Register or update the endpoint. Returns the stored projection directly (not the `webhook`
+ * wrapper the read uses): a successful write always has an endpoint to describe, so wrapping it
+ * would hand every client a null to check that cannot occur.
+ *
+ * `secret` is write-only on this surface exactly as it is on the session one: supplied here,
+ * never returned by the read. An `admin` key can therefore ROTATE the signing secret but can
+ * never exfiltrate the one already stored.
+ */
+export const putPublicNotificationWebhookContract = defineApiContract({
+    method: 'put',
+    pathResolver: () => '/api/v1/notification-webhook',
+    requestBodySchema: putNotificationWebhookSchema,
+    responsesByStatusCode: { 200: notificationWebhookSchema, ...errorResponses },
+});
+/** Remove the endpoint (deliveries stop). Idempotent: 204 whether or not one was registered. */
+export const deletePublicNotificationWebhookContract = defineApiContract({
+    method: 'delete',
+    pathResolver: () => '/api/v1/notification-webhook',
+    responsesByStatusCode: { 204: ContractNoBody, ...errorResponses },
+});
 //# sourceMappingURL=notification-webhooks.js.map

package/dist/routes/notification-webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification-webhooks.js","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAEhF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC1C,GAAG,cAAc;KAClB;CACF,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,iBAAiB,EAAE,4BAA4B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,cAAc,EAAE;CAC7E,CAAC,CAAA;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,iCAAiC,GAAG,iBAAiB,CAAC;IACjE,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA"}
+{"version":3,"file":"notification-webhooks.js","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,sFAAsF;AACtF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,+FAA+F;AAC/F,2FAA2F;AAC3F,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,uDAAuD;AACvD,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,6EAA6E;AAC7E,wFAAwF;AAExF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC1C,GAAG,cAAc;KAClB;CACF,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,iBAAiB,EAAE,4BAA4B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,cAAc,EAAE;CAC7E,CAAC,CAAA;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,iCAAiC,GAAG,iBAAiB,CAAC;IACjE,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,iBAAiB,CAAC;IACpE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAClD,qBAAqB,EAAE,EAAE,GAAG,EAAE,+BAA+B,EAAE,GAAG,cAAc,EAAE;CACnF,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,iBAAiB,CAAC;IACpE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAClD,iBAAiB,EAAE,4BAA4B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,cAAc,EAAE;CAC7E,CAAC,CAAA;AAEF,gGAAgG;AAChG,MAAM,CAAC,MAAM,uCAAuC,GAAG,iBAAiB,CAAC;IACvE,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAClD,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA"}

package/dist/routes/visual-confirm.d.ts

@@ -1015,7 +1015,7 @@ export declare const approveVisualConfirmContract: {
             readonly initiatedBy: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
             readonly initiatedByRole: v.OptionalSchema<v.NullableSchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>, undefined>;
             readonly mode: v.OptionalSchema<v.PicklistSchema<["live", "dry_run"], undefined>, undefined>;
-            readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api"], undefined>, undefined>;
+            readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api", "tracker", "schedule"], undefined>, undefined>;
             readonly createdAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
             readonly rev: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
             readonly diagnostics: v.OptionalSchema<v.ObjectSchema<{
@@ -2067,7 +2067,7 @@ export declare const requestVisualConfirmFixContract: {
             readonly initiatedBy: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
             readonly initiatedByRole: v.OptionalSchema<v.NullableSchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>, undefined>;
             readonly mode: v.OptionalSchema<v.PicklistSchema<["live", "dry_run"], undefined>, undefined>;
-            readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api"], undefined>, undefined>;
+            readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api", "tracker", "schedule"], undefined>, undefined>;
             readonly createdAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
             readonly rev: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
             readonly diagnostics: v.OptionalSchema<v.ObjectSchema<{
@@ -3117,7 +3117,7 @@ export declare const recaptureVisualConfirmContract: {
             readonly initiatedBy: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
             readonly initiatedByRole: v.OptionalSchema<v.NullableSchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>, undefined>;
             readonly mode: v.OptionalSchema<v.PicklistSchema<["live", "dry_run"], undefined>, undefined>;
-            readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api"], undefined>, undefined>;
+            readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api", "tracker", "schedule"], undefined>, undefined>;
             readonly createdAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
             readonly rev: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
             readonly diagnostics: v.OptionalSchema<v.ObjectSchema<{

package/dist/routes/workspaces.d.ts

@@ -1518,7 +1518,7 @@ export declare const createWorkspaceContract: {
                 readonly initiatedBy: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
                 readonly initiatedByRole: v.OptionalSchema<v.NullableSchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>, undefined>;
                 readonly mode: v.OptionalSchema<v.PicklistSchema<["live", "dry_run"], undefined>, undefined>;
-                readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api"], undefined>, undefined>;
+                readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api", "tracker", "schedule"], undefined>, undefined>;
                 readonly createdAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
                 readonly rev: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
                 readonly diagnostics: v.OptionalSchema<v.ObjectSchema<{
@@ -4786,7 +4786,7 @@ export declare const getWorkspaceContract: {
                 readonly initiatedBy: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
                 readonly initiatedByRole: v.OptionalSchema<v.NullableSchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>, undefined>;
                 readonly mode: v.OptionalSchema<v.PicklistSchema<["live", "dry_run"], undefined>, undefined>;
-                readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api"], undefined>, undefined>;
+                readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api", "tracker", "schedule"], undefined>, undefined>;
                 readonly createdAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
                 readonly rev: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
                 readonly diagnostics: v.OptionalSchema<v.ObjectSchema<{

package/dist/run-provenance.d.ts

@@ -0,0 +1,107 @@
+import * as v from 'valibot';
+/**
+ * How a run entered the system. See `ExecutionInstance.intakeOrigin`.
+ *
+ * - `ui`: someone started it in the app, on their own board. The read-time default, and what
+ *   every legacy run is.
+ * - `public-api`: started headlessly through the `/api/v1` surface.
+ * - `tracker`: dispatched from a pushed ticket by a per-ticket issue-intake schedule.
+ * - `schedule`: a recurring schedule fired it, either on its cadence or because a tracker push
+ *   drained its queue early. Both are the same run against the same reused block (ADR 0032), so
+ *   they deliberately share one origin; what differs is only what made the tick happen.
+ *
+ * `ui` is the DEFAULT, which makes it a positive claim that a human is watching in the app, not
+ * a catch-all for "nothing said". Every UNATTENDED start path names itself, so a path that
+ * states nothing is the app: the one caller allowed to rely on the default. That rule exists
+ * because the opposite reading is silent, and it already cost one bug (a webhook-dispatched run
+ * defaulted into `ui` and its parked review's questions never reached the requester's ticket).
+ */
+export declare const intakeOriginSchema: v.PicklistSchema<["ui", "public-api", "tracker", "schedule"], undefined>;
+export type IntakeOrigin = v.InferOutput<typeof intakeOriginSchema>;
+/**
+ * Whether a run entered headlessly ({@link HEADLESS_INTAKE}). `undefined` is every legacy run
+ * and degrades to `ui`, the safe reading: no outbound writeback for a run whose intake cannot
+ * be proven headless.
+ *
+ * `=== true` rather than the bare lookup, which the type says is already a `boolean`. The value
+ * reaches here off a run's persisted `detail` JSON, and the picklist is a CLOSED vocabulary whose
+ * members outlive their retirement in stored rows: a run written under a member later dropped
+ * from the type indexes to `undefined` at runtime, and the declared `boolean` would be a lie the
+ * caller reads as "not headless" anyway. Saying so explicitly makes unrecognised and absent one
+ * answer on purpose rather than by luck.
+ */
+export declare function isHeadlessIntake(origin: IntakeOrigin | undefined): boolean;
+/**
+ * Whether a run may LAND its work. `live` (the default, and every run before this existed) is the
+ * historical behaviour. `dry_run` is the sandboxed mode: the pipeline runs in full and opens its
+ * pull request, so the human sees a real diff on a real branch, but nothing merges: neither the
+ * `merger` step's auto-merge nor the manual merge endpoint.
+ *
+ * The PR is deliberately still opened. The deliverable a non-developer initiator needs to SEE is the diff,
+ * and withholding the push would leave them reading prose about work they cannot inspect; what
+ * makes the mode a sandbox is that the change cannot reach the default branch, not that it stays
+ * invisible.
+ *
+ * Requested per run at start, and FORCED for the roles a task's merge preset lists in
+ * `dryRunRoles`. The two compose one way only: a live request from a sandboxed role is a dry run,
+ * and there is no way to ask out of it, or the setting would be advisory.
+ */
+export declare const runModeSchema: v.PicklistSchema<["live", "dry_run"], undefined>;
+export type RunMode = v.InferOutput<typeof runModeSchema>;
+/**
+ * Whether a run is sandboxed. A helper rather than `=== 'dry_run'` scattered across the merge path
+ * and the SPA, so every place that must refuse to land work (or must say that a run will never
+ * land any) reads the mode the same way, and so a run persisted before the mode existed
+ * (absent ⇒ `live`) can never be mistaken for one.
+ */
+export declare function isDryRun(mode: RunMode | null | undefined): boolean;
+/**
+ * Per-run diagnostic context captured for AFTER-THE-FACT investigation of a run (esp. a
+ * failure): the "where/what did this run actually execute on" facts that were previously
+ * spread across the DB (repo↔service↔installation joins), the harness transcript (model), or
+ * lost entirely (which backend a step ran on). Stamped by the engine at dispatch and refined
+ * on the first poll; it reflects the MOST RECENT container-step dispatch (the step most likely
+ * relevant to a failure), not a per-step history. Rides in the run's `detail` JSON (no dedicated
+ * column), like `ExecutionInstance.notes`/`frontendBindings`. Absent on legacy runs and on
+ * runs with no container step (pure inline/gate pipelines). NEVER carries a token or secret.
+ */
+export declare const runDiagnosticsSchema: v.ObjectSchema<{
+    /** Context of the most recent container-step dispatch. */
+    readonly lastDispatch: v.OptionalSchema<v.ObjectSchema<{
+        /** Index of the dispatched step within the pipeline. */
+        readonly stepIndex: v.NumberSchema<undefined>;
+        /** The step's agent kind (`coder`, `merger`, a custom kind, …). */
+        readonly agentKind: v.StringSchema<undefined>;
+        /** Resolved model ref `provider:model` (e.g. `anthropic:claude-opus-4-8`); null if unresolved. */
+        readonly model: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
+        /**
+         * Which runner backend the step actually ran on, the datum that distinguishes a native
+         * host-process run from a sandboxed container: `local-native` | `local-container` |
+         * `runner-pool` | `cloudflare-container`. Filled on the first poll (the transport reports
+         * it); absent until then or on an older runtime.
+         */
+        readonly executionBackend: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** The repo the step operated on. */
+        readonly repo: v.OptionalSchema<v.ObjectSchema<{
+            readonly owner: v.StringSchema<undefined>;
+            readonly name: v.StringSchema<undefined>;
+            /** The base branch the work branched from. */
+            readonly baseBranch: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** VCS provider (`github` | `gitlab`), resolved from the run's repo origin. */
+            readonly provider: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, undefined>;
+        /** Epoch ms the dispatch was recorded. */
+        readonly at: v.NumberSchema<undefined>;
+    }, undefined>, undefined>;
+    /**
+     * The control-plane (orchestrator) host running the engine, NOT necessarily where the agent
+     * ran (a container step runs elsewhere; see `lastDispatch.executionBackend`). `platform` is the
+     * orchestrator's `process.platform` (e.g. `win32` pins a Windows local deployment, the class
+     * of host that surfaced the native-Windows git-auth break). Best-effort.
+     */
+    readonly host: v.OptionalSchema<v.ObjectSchema<{
+        readonly platform: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+}, undefined>;
+export type RunDiagnostics = v.InferOutput<typeof runDiagnosticsSchema>;
+//# sourceMappingURL=run-provenance.d.ts.map

package/dist/run-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-provenance.d.ts","sourceRoot":"","sources":["../src/run-provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAQ5B;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kBAAkB,0EAA0D,CAAA;AACzF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAA;AA8BnE;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,kDAAkC,CAAA;AAC5D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,aAAa,CAAC,CAAA;AAEzD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAElE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;IAC/B,0DAA0D;;QAGtD,wDAAwD;;QAExD,mEAAmE;;QAEnE,kGAAkG;;QAElG;;;;;WAKG;;QAEH,qCAAqC;;;;YAKjC,8CAA8C;;YAE9C,+EAA+E;;;QAInF,0CAA0C;;;IAI9C;;;;;OAKG;;;;aAMH,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/run-provenance.js

@@ -0,0 +1,140 @@
+import * as v from 'valibot';
+// A run's PROVENANCE: how it entered the system, whether it may land its work, and where it
+// actually executed. Three small vocabularies that answer questions about the run rather than
+// about the work, all of them riding the run's `detail` JSON rather than a column, and all read
+// by policy (admission, the merge decision, the clarification writeback) or by an investigator
+// after the fact. Split out of `execution.ts`, which describes the STEPS.
+/**
+ * How a run entered the system. See `ExecutionInstance.intakeOrigin`.
+ *
+ * - `ui`: someone started it in the app, on their own board. The read-time default, and what
+ *   every legacy run is.
+ * - `public-api`: started headlessly through the `/api/v1` surface.
+ * - `tracker`: dispatched from a pushed ticket by a per-ticket issue-intake schedule.
+ * - `schedule`: a recurring schedule fired it, either on its cadence or because a tracker push
+ *   drained its queue early. Both are the same run against the same reused block (ADR 0032), so
+ *   they deliberately share one origin; what differs is only what made the tick happen.
+ *
+ * `ui` is the DEFAULT, which makes it a positive claim that a human is watching in the app, not
+ * a catch-all for "nothing said". Every UNATTENDED start path names itself, so a path that
+ * states nothing is the app: the one caller allowed to rely on the default. That rule exists
+ * because the opposite reading is silent, and it already cost one bug (a webhook-dispatched run
+ * defaulted into `ui` and its parked review's questions never reached the requester's ticket).
+ */
+export const intakeOriginSchema = v.picklist(['ui', 'public-api', 'tracker', 'schedule']);
+/**
+ * Whether an intake origin means the run's questions have to be pushed back OUT to where it came
+ * from, because there is no human overseer in the app to answer them (the parked requirements
+ * review's questions, above all).
+ *
+ * A `Record` rather than a `!== 'ui'` test on purpose: this is the classification the whole
+ * clarification writeback keys off, and a new intake surface must state which side of it falls
+ * on rather than inheriting an answer by being new. Adding a member to the picklist above fails
+ * to compile until it is answered here.
+ *
+ * `schedule` is the entry worth explaining, because "unattended" would predict `true` and the
+ * answer is `false`. A cadence fire runs against the schedule's REUSED block, and in queue mode
+ * `BugIntakeService` REPLACE-links each pick onto it: the block's linked ticket is dropped and
+ * re-pointed on the next fire, by design, so the block never accumulates stale context. Posting
+ * questions there would open a conversation on a channel that closes underneath it, since a
+ * reply arriving after the link moved resolves to no block and is dropped. What the writeback
+ * needs is not "was anyone present" but "is there a STABLE place to hold a conversation", and a
+ * reused block does not have one. Per-ticket dispatch does, which is why it is `true`: one
+ * permanent block per ticket. Giving queue mode the same treatment is a change to the LINKAGE
+ * (a per-run link, or a block per pick), never a flip of this flag.
+ */
+const HEADLESS_INTAKE = {
+    ui: false,
+    'public-api': true,
+    tracker: true,
+    schedule: false,
+};
+/**
+ * Whether a run entered headlessly ({@link HEADLESS_INTAKE}). `undefined` is every legacy run
+ * and degrades to `ui`, the safe reading: no outbound writeback for a run whose intake cannot
+ * be proven headless.
+ *
+ * `=== true` rather than the bare lookup, which the type says is already a `boolean`. The value
+ * reaches here off a run's persisted `detail` JSON, and the picklist is a CLOSED vocabulary whose
+ * members outlive their retirement in stored rows: a run written under a member later dropped
+ * from the type indexes to `undefined` at runtime, and the declared `boolean` would be a lie the
+ * caller reads as "not headless" anyway. Saying so explicitly makes unrecognised and absent one
+ * answer on purpose rather than by luck.
+ */
+export function isHeadlessIntake(origin) {
+    return origin != null && HEADLESS_INTAKE[origin] === true;
+}
+/**
+ * Whether a run may LAND its work. `live` (the default, and every run before this existed) is the
+ * historical behaviour. `dry_run` is the sandboxed mode: the pipeline runs in full and opens its
+ * pull request, so the human sees a real diff on a real branch, but nothing merges: neither the
+ * `merger` step's auto-merge nor the manual merge endpoint.
+ *
+ * The PR is deliberately still opened. The deliverable a non-developer initiator needs to SEE is the diff,
+ * and withholding the push would leave them reading prose about work they cannot inspect; what
+ * makes the mode a sandbox is that the change cannot reach the default branch, not that it stays
+ * invisible.
+ *
+ * Requested per run at start, and FORCED for the roles a task's merge preset lists in
+ * `dryRunRoles`. The two compose one way only: a live request from a sandboxed role is a dry run,
+ * and there is no way to ask out of it, or the setting would be advisory.
+ */
+export const runModeSchema = v.picklist(['live', 'dry_run']);
+/**
+ * Whether a run is sandboxed. A helper rather than `=== 'dry_run'` scattered across the merge path
+ * and the SPA, so every place that must refuse to land work (or must say that a run will never
+ * land any) reads the mode the same way, and so a run persisted before the mode existed
+ * (absent ⇒ `live`) can never be mistaken for one.
+ */
+export function isDryRun(mode) {
+    return mode === 'dry_run';
+}
+/**
+ * Per-run diagnostic context captured for AFTER-THE-FACT investigation of a run (esp. a
+ * failure): the "where/what did this run actually execute on" facts that were previously
+ * spread across the DB (repo↔service↔installation joins), the harness transcript (model), or
+ * lost entirely (which backend a step ran on). Stamped by the engine at dispatch and refined
+ * on the first poll; it reflects the MOST RECENT container-step dispatch (the step most likely
+ * relevant to a failure), not a per-step history. Rides in the run's `detail` JSON (no dedicated
+ * column), like `ExecutionInstance.notes`/`frontendBindings`. Absent on legacy runs and on
+ * runs with no container step (pure inline/gate pipelines). NEVER carries a token or secret.
+ */
+export const runDiagnosticsSchema = v.object({
+    /** Context of the most recent container-step dispatch. */
+    lastDispatch: v.optional(v.object({
+        /** Index of the dispatched step within the pipeline. */
+        stepIndex: v.number(),
+        /** The step's agent kind (`coder`, `merger`, a custom kind, …). */
+        agentKind: v.string(),
+        /** Resolved model ref `provider:model` (e.g. `anthropic:claude-opus-4-8`); null if unresolved. */
+        model: v.optional(v.nullable(v.string())),
+        /**
+         * Which runner backend the step actually ran on, the datum that distinguishes a native
+         * host-process run from a sandboxed container: `local-native` | `local-container` |
+         * `runner-pool` | `cloudflare-container`. Filled on the first poll (the transport reports
+         * it); absent until then or on an older runtime.
+         */
+        executionBackend: v.optional(v.string()),
+        /** The repo the step operated on. */
+        repo: v.optional(v.object({
+            owner: v.string(),
+            name: v.string(),
+            /** The base branch the work branched from. */
+            baseBranch: v.optional(v.string()),
+            /** VCS provider (`github` | `gitlab`), resolved from the run's repo origin. */
+            provider: v.optional(v.string()),
+        })),
+        /** Epoch ms the dispatch was recorded. */
+        at: v.number(),
+    })),
+    /**
+     * The control-plane (orchestrator) host running the engine, NOT necessarily where the agent
+     * ran (a container step runs elsewhere; see `lastDispatch.executionBackend`). `platform` is the
+     * orchestrator's `process.platform` (e.g. `win32` pins a Windows local deployment, the class
+     * of host that surfaced the native-Windows git-auth break). Best-effort.
+     */
+    host: v.optional(v.object({
+        platform: v.optional(v.string()),
+    })),
+});
+//# sourceMappingURL=run-provenance.js.map

package/dist/run-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-provenance.js","sourceRoot":"","sources":["../src/run-provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,4FAA4F;AAC5F,8FAA8F;AAC9F,gGAAgG;AAChG,+FAA+F;AAC/F,0EAA0E;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;AAGzF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,eAAe,GAAkC;IACrD,EAAE,EAAE,KAAK;IACT,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,KAAK;CAChB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAC/D,OAAO,MAAM,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,IAAI,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAG5D;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAgC;IACvD,OAAO,IAAI,KAAK,SAAS,CAAA;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,0DAA0D;IAC1D,YAAY,EAAE,CAAC,CAAC,QAAQ,CACtB,CAAC,CAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,mEAAmE;QACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,kGAAkG;QAClG,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC;;;;;WAKG;QACH,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACxC,qCAAqC;QACrC,IAAI,EAAE,CAAC,CAAC,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,8CAA8C;YAC9C,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAClC,+EAA+E;YAC/E,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjC,CAAC,CACH;QACD,0CAA0C;QAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;KACf,CAAC,CACH;IACD;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC,CACH;CACF,CAAC,CAAA"}

package/dist/snapshot.d.ts

@@ -1456,7 +1456,7 @@ export declare const workspaceSnapshotSchema: v.ObjectSchema<{
         readonly initiatedBy: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
         readonly initiatedByRole: v.OptionalSchema<v.NullableSchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>, undefined>;
         readonly mode: v.OptionalSchema<v.PicklistSchema<["live", "dry_run"], undefined>, undefined>;
-        readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api"], undefined>, undefined>;
+        readonly intakeOrigin: v.OptionalSchema<v.PicklistSchema<["ui", "public-api", "tracker", "schedule"], undefined>, undefined>;
         readonly createdAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
         readonly rev: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
         readonly diagnostics: v.OptionalSchema<v.ObjectSchema<{

package/dist/tracker.d.ts

@@ -25,9 +25,10 @@ export declare const trackerSettingsSchema: v.ObjectSchema<{
      * issue(s), so the loop is answerable from where the work was requested. Per-task
      * overridable via `Block.trackerQuestionsOnPark`. Default off.
      *
-     * Deliberately scoped to runs whose `ExecutionInstance.intakeOrigin` is `public-api`:
-     * a task started in the SPA has a human overseer in the app and its clarification
-     * surface is unchanged (see `docs/initiatives/headless-clarification-loop.md`).
+     * Deliberately scoped to runs whose `ExecutionInstance.intakeOrigin` is HEADLESS
+     * (`isHeadlessIntake`: a `/api/v1` start or a per-ticket tracker dispatch): a task started
+     * in the SPA has a human overseer in the app and its clarification surface is unchanged
+     * (see `docs/initiatives/headless-clarification-loop.md`).
      */
     readonly writebackQuestionsOnPark: v.BooleanSchema<undefined>;
     readonly updatedAt: v.NumberSchema<undefined>;

package/dist/tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracker.d.ts","sourceRoot":"","sources":["../src/tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAY5B,eAAO,MAAM,iBAAiB,2DAA2C,CAAA;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEjE,oFAAoF;AACpF,eAAO,MAAM,qBAAqB;;IAEhC,mFAAmF;;IAEnF,uEAAuE;;IAEvE;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;;;;;;OASG;;;aAGH,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEzE,iDAAiD;AACjD,eAAO,MAAM,wBAAwB;;;;;;;aAOnC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"tracker.d.ts","sourceRoot":"","sources":["../src/tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAY5B,eAAO,MAAM,iBAAiB,2DAA2C,CAAA;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEjE,oFAAoF;AACpF,eAAO,MAAM,qBAAqB;;IAEhC,mFAAmF;;IAEnF,uEAAuE;;IAEvE;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;;;;;;;OAUG;;;aAGH,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEzE,iDAAiD;AACjD,eAAO,MAAM,wBAAwB;;;;;;;aAOnC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/tracker.js

@@ -33,9 +33,10 @@ export const trackerSettingsSchema = v.object({
      * issue(s), so the loop is answerable from where the work was requested. Per-task
      * overridable via `Block.trackerQuestionsOnPark`. Default off.
      *
-     * Deliberately scoped to runs whose `ExecutionInstance.intakeOrigin` is `public-api`:
-     * a task started in the SPA has a human overseer in the app and its clarification
-     * surface is unchanged (see `docs/initiatives/headless-clarification-loop.md`).
+     * Deliberately scoped to runs whose `ExecutionInstance.intakeOrigin` is HEADLESS
+     * (`isHeadlessIntake`: a `/api/v1` start or a per-ticket tracker dispatch): a task started
+     * in the SPA has a human overseer in the app and its clarification surface is unchanged
+     * (see `docs/initiatives/headless-clarification-loop.md`).
      */
     writebackQuestionsOnPark: v.boolean(),
     updatedAt: v.number(),

package/dist/tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../src/tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,kFAAkF;AAClF,0EAA0E;AAC1E,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AAGzE,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACtC,mFAAmF;IACnF,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtC,uEAAuE;IACvE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC;;;;OAIG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC;;;;;;;;;OASG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAGF,iDAAiD;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,wBAAwB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,uBAAuB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,wBAAwB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClD,CAAC,CAAA"}
+{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../src/tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,kFAAkF;AAClF,0EAA0E;AAC1E,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AAGzE,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACtC,mFAAmF;IACnF,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtC,uEAAuE;IACvE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC;;;;OAIG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC;;;;;;;;;;OAUG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAGF,iDAAiD;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,wBAAwB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,uBAAuB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,wBAAwB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClD,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/contracts",
-  "version": "0.232.0",
+  "version": "0.234.0",
   "description": "Valibot wire contract shared between the Agent Architecture Board frontend and backend.",
   "repository": {
     "type": "git",