@codyswann/lisa 4.71.1 → 4.71.3

package/all/copy-overwrite/scripts/lib/npm-update-cancellation-proof.mjs

@@ -0,0 +1,327 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** A manual cancellation is a third fixed signing purpose, never publication or review authority. */
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required, keys, FILES, OBJECT } from "./npm-update-contract.mjs";
+import {
+  verifiedRole,
+  matchSigningTime,
+  officialResult,
+  sha256,
+} from "./github-attestation-verifier.mjs";
+
+export const CANCELLATION_PREDICATE =
+  "https://lisa.dev/attestations/npm-cancellation/v1";
+const DIGEST = /^[a-f0-9]{64}$/;
+const DECIMAL = /^[1-9]\d*$/;
+const RECORD_KEYS = [
+  "version",
+  "purpose",
+  "repository",
+  "repositoryId",
+  "ownerId",
+  "selectionKey",
+  "workItem",
+  "oldProposalKey",
+  "oldParent",
+  "parent",
+  "proposalKey",
+  "proposalHashes",
+  "originDescriptorSha256",
+  "originCheckpointSha256",
+  "claimCommentId",
+  "claimSha256",
+  "leafBodySha256",
+  "policySha256",
+  "npmPolicySha256",
+  "maintainer",
+  "operatorId",
+  "runId",
+  "runAttempt",
+  "destination",
+];
+
+/** Manual intent comes from the provider's actual run and collaborator, not a comment or environment assertion. */
+export function assertManualCancellation(
+  run,
+  permission,
+  policy,
+  maintainer,
+  proposal,
+  request,
+  invocation
+) {
+  keys(request, ["number", "proposalKey", "parent"]);
+  keys(invocation, ["runId", "runAttempt"]);
+  required(
+    Number.isSafeInteger(request.number) &&
+      request.number > 0 &&
+      typeof request.proposalKey === "string" &&
+      DIGEST.test(request.proposalKey) &&
+      request.parent === proposal.parent &&
+      OBJECT.test(request.parent),
+    "invalid exact cancellation intent"
+  );
+  required(
+    [invocation.runId, invocation.runAttempt].every(
+      value => typeof value === "string" && DECIMAL.test(value)
+    ) &&
+      String(run.id) === invocation.runId &&
+      String(run.run_attempt) === invocation.runAttempt &&
+      run.event === "workflow_dispatch" &&
+      policy.allowedTriggers?.includes("workflow_dispatch") &&
+      run.status === "in_progress" &&
+      run.head_sha === proposal.parent &&
+      run.head_branch === "main" &&
+      run.path === policy.callerWorkflow.slice(policy.repository.length + 1) &&
+      String(run.head_repository?.id) === policy.repositoryId &&
+      Array.isArray(run.referenced_workflows) &&
+      run.referenced_workflows.some(
+        workflow =>
+          workflow.path?.split("@")[0] === policy.signerWorkflow &&
+          workflow.sha === policy.signerDigest
+      ),
+    "cancellation requires the actual manual main invocation"
+  );
+  const actor = run.triggering_actor;
+  required(
+    actor?.type === "User" &&
+      actor.login === maintainer &&
+      [actor.id, permission.user?.id].every(id =>
+        typeof id === "string"
+          ? DECIMAL.test(id)
+          : Number.isSafeInteger(id) && id > 0
+      ) &&
+      permission.user?.type === "User" &&
+      permission.user.login === maintainer &&
+      String(permission.user.id) === String(actor.id) &&
+      ["write", "admin"].includes(permission.permission),
+    "cancellation requires the configured operator's current repository authority"
+  );
+  return String(actor.id);
+}
+
+/** The closed subject preserves one stale origin and one exact replacement, with no published destination. */
+export function validateCancellation(value, expected) {
+  keys(value, RECORD_KEYS);
+  keys(value.proposalHashes, FILES);
+  keys(value.destination, ["branch", "expectedBranchHead", "prNumber"]);
+  required(
+    value.version === 1 &&
+      value.purpose === "cancel-stale-prepublication-npm-proposal" &&
+      typeof value.repository === "string" &&
+      /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(value.repository) &&
+      typeof value.maintainer === "string" &&
+      /^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(value.maintainer) &&
+      typeof value.oldParent === "string" &&
+      typeof value.parent === "string" &&
+      OBJECT.test(value.oldParent) &&
+      OBJECT.test(value.parent) &&
+      value.oldParent !== value.parent &&
+      value.oldProposalKey !== value.proposalKey &&
+      typeof value.workItem === "string" &&
+      value.workItem.startsWith(`${value.repository}#`) &&
+      DECIMAL.test(value.workItem.slice(value.repository.length + 1)),
+    "invalid stale cancellation scope"
+  );
+  required(
+    [
+      "repositoryId",
+      "ownerId",
+      "claimCommentId",
+      "operatorId",
+      "runId",
+      "runAttempt",
+    ].every(
+      key => typeof value[key] === "string" && DECIMAL.test(value[key])
+    ) &&
+      [
+        "selectionKey",
+        "oldProposalKey",
+        "proposalKey",
+        "originDescriptorSha256",
+        "originCheckpointSha256",
+        "claimSha256",
+        "leafBodySha256",
+        "policySha256",
+        "npmPolicySha256",
+      ].every(
+        key => typeof value[key] === "string" && DIGEST.test(value[key])
+      ) &&
+      Object.values(value.proposalHashes).every(
+        hash => typeof hash === "string" && DIGEST.test(hash)
+      ),
+    "invalid cancellation identity or digest"
+  );
+  required(
+    value.destination.branch === `lisa/npm-${value.oldProposalKey}` &&
+      value.destination.expectedBranchHead === null &&
+      value.destination.prNumber === null &&
+      canonicalJson(value) === canonicalJson(expected),
+    "cancellation subject or prepublication destination differs"
+  );
+  return value;
+}
+
+/** A durable cancellation still proves its own actual manual operator; completion is not fresh publication authority. */
+export function assertRecordedOperator(run, permission, policy, record) {
+  required(
+    ["in_progress", "completed"].includes(run.status) &&
+      String(run.id) === record.runId &&
+      String(run.run_attempt) === record.runAttempt &&
+      run.event === "workflow_dispatch" &&
+      policy.allowedTriggers?.includes("workflow_dispatch") &&
+      run.head_sha === record.parent &&
+      run.head_branch === "main" &&
+      run.path === policy.callerWorkflow.slice(policy.repository.length + 1) &&
+      String(run.head_repository?.id) === policy.repositoryId &&
+      run.triggering_actor?.type === "User" &&
+      run.triggering_actor.login === record.maintainer &&
+      String(run.triggering_actor.id) === record.operatorId &&
+      permission.user?.type === "User" &&
+      permission.user.login === record.maintainer &&
+      String(permission.user.id) === record.operatorId &&
+      ["write", "admin"].includes(permission.permission) &&
+      Array.isArray(run.referenced_workflows) &&
+      run.referenced_workflows.some(
+        workflow =>
+          workflow.path?.split("@")[0] === policy.signerWorkflow &&
+          workflow.sha === policy.signerDigest
+      ),
+    "recorded cancellation operator or invocation differs"
+  );
+}
+
+/** The same fixed constructor is used before issuance and after independent provider verification. */
+export function cancellationRecord(
+  origin,
+  proposal,
+  config,
+  invocation,
+  operatorId
+) {
+  const authority = config.automationProvenance;
+  return {
+    version: 1,
+    purpose: "cancel-stale-prepublication-npm-proposal",
+    repository: proposal.repository,
+    repositoryId: authority.repositoryId,
+    ownerId: authority.ownerId,
+    selectionKey: proposal.selectionKey,
+    workItem: origin.allocation.workItem,
+    oldProposalKey: origin.proposal.key,
+    oldParent: origin.proposal.parent,
+    parent: proposal.parent,
+    proposalKey: proposal.key,
+    proposalHashes: proposal.hashes,
+    originDescriptorSha256: origin.checkpoint.digest,
+    originCheckpointSha256: sha256(canonicalJson(origin.checkpoint.payload)),
+    claimCommentId: origin.allocation.claimCommentId,
+    claimSha256: origin.allocation.claimSha256,
+    leafBodySha256: sha256(origin.allocation.draft.body),
+    policySha256: sha256(canonicalJson(authority)),
+    npmPolicySha256: proposal.policySha256,
+    maintainer: config.npmUpdater.maintainer,
+    operatorId,
+    runId: invocation.runId,
+    runAttempt: invocation.runAttempt,
+    destination: {
+      branch: `lisa/npm-${origin.proposal.key}`,
+      expectedBranchHead: null,
+      prNumber: null,
+    },
+  };
+}
+
+/** Fresh cancellation always uses its fixed subject, predicate and ordinary expiration. */
+export function assertCancellationAttestation(
+  results,
+  record,
+  digest,
+  policy,
+  now = Date.now()
+) {
+  const result = verifiedRole(
+    results,
+    record,
+    digest,
+    policy,
+    CANCELLATION_PREDICATE,
+    "cancellation.json"
+  );
+  matchSigningTime(result.verifiedTimestamps, policy, now);
+  return result.signature.certificate;
+}
+
+/** A recorded cancellation authenticates historical bytes within the actual provider run chronology. */
+export function assertRecordedCancellation(
+  results,
+  record,
+  digest,
+  policy,
+  run,
+  now = Date.now()
+) {
+  const result = verifiedRole(
+    results,
+    record,
+    digest,
+    policy,
+    CANCELLATION_PREDICATE,
+    "cancellation.json"
+  );
+  const started = Date.parse(run.run_started_at);
+  const updated = Date.parse(run.updated_at);
+  required(
+    [started, updated].every(Number.isFinite) &&
+      started <= updated &&
+      updated <= now + 60_000,
+    "invalid cancellation provider chronology"
+  );
+  matchSigningTime(
+    result.verifiedTimestamps,
+    { ...policy, maxAgeSeconds: Number.MAX_SAFE_INTEGER },
+    now
+  );
+  for (const time of result.verifiedTimestamps) {
+    const signed = Date.parse(time.timestamp);
+    required(
+      signed >= started - 60_000 && signed <= updated + 60_000,
+      "cancellation signed outside provider chronology"
+    );
+  }
+  return result.signature.certificate;
+}
+
+/** Both fixed roles run the same official binary and cancellation-only subject/predicate. */
+function cancellationResult(policy, record, paths) {
+  return officialResult(
+    policy,
+    record,
+    paths.cancellation,
+    paths.cancellationBundle,
+    CANCELLATION_PREDICATE
+  );
+}
+
+/** Verification never substitutes an operator's ambient GH binary for the immutable Linux policy. */
+export function verifyCancellationAttestation(policy, record, paths, digest) {
+  return assertCancellationAttestation(
+    cancellationResult(policy, record, paths),
+    record,
+    digest,
+    policy
+  );
+}
+
+/** This fixed historical entry point grants no current publication authority. */
+export function verifyRecordedCancellation(policy, record, paths, digest, run) {
+  return assertRecordedCancellation(
+    cancellationResult(policy, record, paths),
+    record,
+    digest,
+    policy,
+    run
+  );
+}

package/all/copy-overwrite/scripts/lib/npm-update-cancellation.mjs

@@ -0,0 +1,248 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Explicit hosted manual cancellation preserves the old leaf and issues no publication authority. */
+import { join } from "node:path";
+import { writeFileSync } from "node:fs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required, keys } from "./npm-update-contract.mjs";
+import { readBytes, readJson, writeJson } from "./npm-update-process.mjs";
+import { assertHostedGate } from "./npm-update-hosted-gate.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import { discoverPrior } from "./npm-update-allocate.mjs";
+import { authenticateStaleOrigin } from "./npm-update-cancel-origin.mjs";
+import {
+  recordedCancellation,
+  cancellationDestinationAbsent,
+} from "./npm-update-supersession.mjs";
+import {
+  assertManualCancellation,
+  cancellationRecord,
+  validateCancellation,
+  verifyCancellationAttestation,
+} from "./npm-update-cancellation-proof.mjs";
+import {
+  persistCheckpoint,
+  decodeCheckpoint,
+} from "./npm-update-checkpoint.mjs";
+import { withStage } from "./npm-update-invariants.mjs";
+
+/** Native dispatch bytes are checked independently of reusable workflow input forwarding. */
+export function assertDispatchCancellation(event, run, request, authority) {
+  required(
+    event &&
+      ["main", "refs/heads/main"].includes(event.ref) &&
+      event.repository?.full_name === authority.repository &&
+      String(event.repository.id) === authority.repositoryId &&
+      String(event.repository.owner?.id) === authority.ownerId &&
+      event.sender?.type === "User" &&
+      event.sender.id === run.triggering_actor?.id &&
+      event.sender.login === run.triggering_actor.login &&
+      event.inputs?.cancel_issue === String(request.number) &&
+      event.inputs.cancel_proposal_key === request.proposalKey &&
+      event.inputs.cancel_expected_main === request.parent,
+    "native manual dispatch intent differs"
+  );
+}
+
+/** The actual run and repository permission are read through the existing pinned default-token transport. */
+async function manualAuthority(api, proposal, config, request) {
+  assertHostedGate({ policy: config.npmUpdater, proposal, config });
+  const invocation = {
+    runId: process.env.GITHUB_RUN_ID,
+    runAttempt: process.env.GITHUB_RUN_ATTEMPT,
+  };
+  required(
+    Object.values(invocation).every(
+      value => typeof value === "string" && /^[1-9]\d*$/.test(value)
+    ),
+    "native cancellation invocation is absent"
+  );
+  await api.main(proposal.parent);
+  const run = await api.request(
+    `repos/${proposal.repository}/actions/runs/${invocation.runId}/attempts/${invocation.runAttempt}`
+  );
+  const permission = await api.request(
+    `repos/${proposal.repository}/collaborators/${config.npmUpdater.maintainer}/permission`
+  );
+  const operatorId = assertManualCancellation(
+    run,
+    permission,
+    api.policy,
+    config.npmUpdater.maintainer,
+    proposal,
+    request,
+    invocation
+  );
+  const event = JSON.parse(
+    new TextDecoder("utf8", { fatal: true }).decode(
+      readBytes(process.env.GITHUB_EVENT_PATH, 1_048_576, false)
+    )
+  );
+  assertDispatchCancellation(event, run, request, api.policy);
+  return { invocation, operatorId };
+}
+
+/** Named stale origins are never substituted by a closed implementation ticket or another active leaf. */
+async function cancellationState(context) {
+  const { api, cwd, proposal, config, request } = context;
+  const manual = await withStage("cancel-intent", () =>
+    manualAuthority(api, proposal, config, request)
+  );
+  const prior = await discoverPrior(api, proposal, { cwd, config });
+  const issue = await api.issue(request.number);
+  const origin = await withStage("cancel-origin", () =>
+    authenticateStaleOrigin({ api, cwd, issue, proposal, config })
+  );
+  required(
+    origin.proposal.key === request.proposalKey,
+    "named original proposal differs"
+  );
+  await cancellationDestinationAbsent(api, request.proposalKey);
+  const recorded = await recordedCancellation({
+    api,
+    cwd,
+    issue,
+    proposal,
+    config,
+    origin,
+  });
+  if (recorded) {
+    const record = recorded.payload.preview.cancellation;
+    required(
+      record.parent === proposal.parent &&
+        record.proposalKey === proposal.key &&
+        canonicalJson(record.proposalHashes) === canonicalJson(proposal.hashes),
+      "recorded replacement no longer matches"
+    );
+  } else
+    required(
+      issue.state === "open" &&
+        prior.status === "stale-outstanding" &&
+        prior.issue.number === request.number,
+      "only the active stale origin can be cancelled"
+    );
+  return { ...manual, issue, origin, recorded };
+}
+
+/** Preparation writes only a private prospective subject, never a provider lifecycle mutation. */
+export async function prepareCancellation(context) {
+  const { output, proposal, config, request } = context;
+  const state = await cancellationState(context);
+  const record =
+    state.recorded?.payload.preview.cancellation ??
+    cancellationRecord(
+      state.origin,
+      proposal,
+      config,
+      state.invocation,
+      state.operatorId
+    );
+  validateCancellation(record, record);
+  writeJson(join(output, "cancellation.json"), record);
+  const mode = state.recorded ? "recorded" : "fresh";
+  if (state.recorded) {
+    const bytes = Buffer.from(state.recorded.payload.bundle);
+    required(bytes.length <= 1_048_576, "cancellation bundle exceeds bound");
+    writeFileSync(join(output, "cancellation-bundle.json"), bytes, {
+      mode: 0o600,
+      flag: "wx",
+    });
+  }
+  writeJson(join(output, "cancellation-state.json"), { mode, request });
+  return { mode };
+}
+
+/** Each chunk and closure rechecks current operator, main, holds, destination and immutable subject. */
+async function authorizeCancellation(context, record, paths, state) {
+  const current = await cancellationState(context);
+  if (state.mode === "fresh") {
+    validateCancellation(
+      record,
+      cancellationRecord(
+        current.origin,
+        context.proposal,
+        context.config,
+        current.invocation,
+        current.operatorId
+      )
+    );
+    verifyCancellationAttestation(
+      context.api.policy,
+      record,
+      paths,
+      sha256(readBytes(paths.cancellation, 65_536))
+    );
+  } else
+    required(
+      state.mode === "recorded" &&
+        current.recorded &&
+        canonicalJson(current.recorded.payload.preview.cancellation) ===
+          canonicalJson(record),
+      "recorded cancellation authority differs"
+    );
+  return current;
+}
+
+/** Durable proof precedes a not_planned close; interruptions retain all evidence for the next manual run. */
+export async function finalizeCancellation(context) {
+  const { api, output, proposal, request } = context;
+  const state = readJson(join(output, "cancellation-state.json"), 65_536);
+  keys(state, ["mode", "request"]);
+  required(
+    canonicalJson(state.request) === canonicalJson(request),
+    "cancellation intent changed"
+  );
+  const paths = {
+    cancellation: join(output, "cancellation.json"),
+    cancellationBundle: join(output, "cancellation-bundle.json"),
+  };
+  const record = readJson(paths.cancellation, 65_536);
+  const digest = sha256(readBytes(paths.cancellation, 65_536));
+  const current = await authorizeCancellation(context, record, paths, state);
+  const payload = current.recorded?.payload ?? {
+    version: 1,
+    proposal,
+    allocation: current.origin.allocation,
+    preview: { cancellation: record },
+    bundle: readBytes(paths.cancellationBundle, 1_048_576).toString("utf8"),
+  };
+  if (!current.recorded)
+    await withStage("cancel-checkpoint", () =>
+      persistCheckpoint(api, request.number, payload, digest, () =>
+        authorizeCancellation(context, record, paths, state)
+      )
+    );
+  const issue = (await authorizeCancellation(context, record, paths, state))
+    .issue;
+  required(
+    canonicalJson(decodeCheckpoint(issue.comments, digest)) ===
+      canonicalJson(payload),
+    "durable cancellation checkpoint differs"
+  );
+  if (issue.state === "open")
+    await withStage("cancel-close", () =>
+      api.request(
+        `repos/${proposal.repository}/issues/${request.number}`,
+        "PATCH",
+        { state: "closed", state_reason: "not_planned" }
+      )
+    );
+  const closed = await api.issue(request.number);
+  required(
+    closed.state === "closed" &&
+      closed.state_reason === "not_planned" &&
+      closed.closed_by?.type === "Bot" &&
+      String(closed.closed_by.id) === api.policy.claimActorId &&
+      closed.body === issue.body &&
+      closed.title === issue.title,
+    "cancellation closure readback differs"
+  );
+  await api.main(proposal.parent);
+  await cancellationDestinationAbsent(api, request.proposalKey);
+  return {
+    status: "cancelled",
+    number: request.number,
+    cancellationSha256: digest,
+  };
+}

package/all/copy-overwrite/scripts/lib/npm-update-gate.mjs

@@ -42,6 +42,7 @@ import {
   ordinaryGateReceipt,
 } from "./npm-update-publication.mjs";
 import { executeCanonicalHelper } from "./npm-update-controller-factory.mjs";
+import { withStage } from "./npm-update-invariants.mjs";
 
 const BOT = "github-actions[bot]";
 const MAIL = "41898282+github-actions[bot]@users.noreply.github.com";
@@ -143,7 +144,7 @@ export async function descriptorFor({
 async function stageProposal(context, env) {
   const { cwd, proposal } = context;
   const command = args => git(cwd, env, args, undefined, context.deadline);
-  await baseline(cwd, env, proposal);
+  await withStage("gate-baseline", () => baseline(cwd, env, proposal));
   const parent = (await command(["rev-parse", "HEAD"])).stdout
     .toString()
     .trim();
@@ -154,8 +155,12 @@ async function stageProposal(context, env) {
   );
   const branch = `lisa/npm-${proposal.key}`;
   await command(["checkout", "-b", branch]);
-  await executeCanonicalHelper(context, "stage-read", "link");
-  await executeCanonicalHelper(context, "stage-read", "attach-branch");
+  await withStage("gate-link", () =>
+    executeCanonicalHelper(context, "stage-read", "link")
+  );
+  await withStage("gate-attach", () =>
+    executeCanonicalHelper(context, "stage-read", "attach-branch")
+  );
   for (const file of FILES)
     writeFileSync(join(cwd, file), proposal.files[file]);
   await command(["add", "--", ...FILES]);
@@ -263,38 +268,50 @@ async function pushProposal(context, env, branch, object) {
 export async function gateProposal(context) {
   const scoped = { ...context, deadline: Date.now() + 1_800_000 };
   const { proposal, policy, token, preview } = context;
-  validateProposal(proposal, policy);
-  assertHostedGate(context);
-  validateGateProof(context);
-  required(
-    typeof token === "string" && token.length > 0,
-    "readonly gate token is absent"
-  );
-  return withPrivateRoot(async root => {
-    const env = {
-      ...candidateEnvironment(root),
-      GIT_AUTHOR_NAME: BOT,
-      GIT_AUTHOR_EMAIL: MAIL,
-      GIT_COMMITTER_NAME: BOT,
-      GIT_COMMITTER_EMAIL: MAIL,
-      GIT_AUTHOR_DATE: `${preview.epoch} +0000`,
-      GIT_COMMITTER_DATE: `${preview.epoch} +0000`,
-    };
-    const branch = await stageProposal(scoped, env);
-    const message = await installGateProof(context, root, args =>
-      git(context.cwd, env, args, undefined, scoped.deadline)
+  await withStage("gate-validate", () => {
+    validateProposal(proposal, policy);
+    assertHostedGate(context);
+    validateGateProof(context);
+    required(
+      typeof token === "string" && token.length > 0,
+      "readonly gate token is absent"
     );
-    const hosted = await createHostedGate(scoped, root, env);
-    try {
-      const gated = { ...scoped, hookInstallation: hosted.installation };
-      const object = await committedProposal(
-        gated,
-        { ...hosted.env, LISA_NPM_HOOK_ROLE: "commit" },
-        message
-      );
-      return await pushProposal(gated, hosted.env, branch, object);
-    } finally {
-      await hosted.close();
-    }
   });
+  return withStage("gate-scratch", () =>
+    withPrivateRoot(async root => {
+      const env = {
+        ...candidateEnvironment(root),
+        GIT_AUTHOR_NAME: BOT,
+        GIT_AUTHOR_EMAIL: MAIL,
+        GIT_COMMITTER_NAME: BOT,
+        GIT_COMMITTER_EMAIL: MAIL,
+        GIT_AUTHOR_DATE: `${preview.epoch} +0000`,
+        GIT_COMMITTER_DATE: `${preview.epoch} +0000`,
+      };
+      const branch = await withStage("gate-stage", () =>
+        stageProposal(scoped, env)
+      );
+      const proofGit = args =>
+        git(context.cwd, env, args, undefined, scoped.deadline);
+      const message = await withStage("gate-proof", () =>
+        installGateProof(context, root, proofGit)
+      );
+      const hosted = await createHostedGate(scoped, root, env);
+      try {
+        const gated = { ...scoped, hookInstallation: hosted.installation };
+        const object = await withStage("gate-commit", () =>
+          committedProposal(
+            gated,
+            { ...hosted.env, LISA_NPM_HOOK_ROLE: "commit" },
+            message
+          )
+        );
+        return await withStage("gate-push", () =>
+          pushProposal(gated, hosted.env, branch, object)
+        );
+      } finally {
+        await withStage("gate-close", () => hosted.close());
+      }
+    })
+  );
 }