@coreplane/switchboard 1.265.0 → 1.266.0

package/dist/assets/.env.example

@@ -33,3 +33,9 @@ E2B_API_KEY=e2b_...
 # GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
 # (b) Fallback: a fine-grained PAT scoped to only the repos the bot may touch.
 # GH_TOKEN=github_pat_...
+
+# Depot CI bridge (optional; bot only). Depot's organization token must NOT be
+# in this file or any container: provision DEPOT_API_TOKEN only on the Worker.
+# Provision a separate internal bearer on that Worker; it forwards this one to
+# the bot. PUBLIC_BASE_URL must be the Worker's HTTPS origin. No Depot CLI needed.
+# DEPOT_CI_BRIDGE_TOKEN=...

package/dist/assets/deploy/cloudflare/depotCi.ts

@@ -0,0 +1,246 @@
+// Depot's organization token belongs to this Worker alone. The bot sends a
+// repo-bound, typed operation; this adapter resolves ownership before spending
+// that credential on logs or a mutation. Nothing here executes repository code.
+import { z } from "zod";
+import { MINUTE_MS } from "../../src/core/budgets.ts";
+import {
+  DEPOT_CI_AUTHORIZATION_PATH,
+  DEPOT_CI_MAX_BYTES,
+  DEPOT_ERRORS,
+  depotCiGrantSchema,
+  depotCiTicketSchema,
+  depotId,
+  depotJson,
+} from "../../src/core/depotCi.ts";
+import { redactSecrets, stripAnsi } from "../../src/core/redact.ts";
+import { sameToken } from "./artifactsCopy.ts";
+import { INTERNAL } from "./shared.ts";
+
+const attemptSchema = z.object({ attemptId: depotId, attempt: z.number().int().positive(), status: z.string() });
+const workflowSchema = z.object({
+  orgId: depotId,
+  runId: depotId,
+  repo: z.string(),
+  workflowId: depotId,
+  headSha: z.string().default(""),
+  sha: z.string().default(""),
+  workflowStatus: z.string(),
+  workflowName: z.string().default(""),
+  workflowPath: z.string().default(""),
+  workflowErrorMessage: z.string().default(""),
+  jobs: z
+    .array(
+      z.object({
+        jobId: depotId,
+        jobKey: z.string(),
+        jobDisplayName: z.string().default(""),
+        status: z.string(),
+        attempts: z.array(attemptSchema).default([]),
+      }),
+    )
+    .default([]),
+});
+const logsSchema = z.object({
+  lines: z.array(z.object({ body: z.string(), stepName: z.string().default("") })).default([]),
+  nextPageToken: z.string().max(8192).default(""),
+});
+const retrySchema = z.object({
+  workflowId: depotId,
+  jobIds: z.array(depotId),
+  jobCount: z.number().int().nonnegative(),
+});
+/** The callback has no caller-controlled origin or path. Worker wiring supplies
+ * the singleton container binding, NOT an Internet fetch or a redirect. */
+export async function depotCiAuthorization(
+  ticket: string,
+  signal: AbortSignal,
+  botFetch: (request: Request) => Promise<Response>,
+): Promise<unknown> {
+  const res = await botFetch(
+    new Request(`${INTERNAL}${DEPOT_CI_AUTHORIZATION_PATH}`, {
+      method: "POST",
+      redirect: "error",
+      signal,
+      headers: { authorization: `Bearer ${ticket}` },
+    }),
+  );
+  if (res.status !== 200) {
+    await res.body?.cancel();
+    return undefined;
+  }
+  return depotJson(res, 16 * 1024);
+}
+const json = (status: number, body: unknown) =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+
+export async function handleDepotCi(
+  request: Request,
+  deps: {
+    depotToken?: string;
+    bridgeToken?: string;
+    authorize?: (ticket: string, signal: AbortSignal) => Promise<unknown>;
+    fetch: typeof fetch;
+  },
+): Promise<Response> {
+  const bearer = /^Bearer\s+(\S+)$/.exec(request.headers.get("authorization") ?? "")?.[1];
+  if (!deps.bridgeToken || !bearer || !sameToken(bearer, deps.bridgeToken))
+    return json(401, { error: "Depot CI bridge bearer refused." });
+  if (request.method !== "POST") return json(405, { error: "Depot CI requires POST." });
+  let raw: unknown;
+  try {
+    raw = await depotJson(new Response(request.body), 16 * 1024);
+  } catch {
+    return json(400, { error: DEPOT_ERRORS.invalid });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return json(400, { error: DEPOT_ERRORS.invalid });
+  const parsed = depotCiTicketSchema.safeParse(raw);
+  if (!parsed.success) return json(400, { error: DEPOT_ERRORS.invalid });
+  const signal = AbortSignal.any([request.signal, AbortSignal.timeout(MINUTE_MS)]);
+  let grant;
+  try {
+    signal.throwIfAborted();
+    grant = depotCiGrantSchema.safeParse(await deps.authorize?.(parsed.data.ticket, signal));
+  } catch {
+    return json(403, { error: DEPOT_ERRORS.unauthorized });
+  }
+  if (!grant.success) return json(403, { error: DEPOT_ERRORS.unauthorized });
+  if (!deps.depotToken) return json(503, { error: DEPOT_ERRORS.unavailable });
+  // Both repo and operation came from a one-use permit the authenticated run's
+  // tool call registered in the bot. Possessing the bridge bearer cannot mint
+  // one, choose another repo, change its head, or replay it.
+  const { repo, operation: op } = grant.data;
+  // Credentials are redacted as exact values too: not every vendor token has a
+  // recognizable prefix. Strip control sequences before either redaction pass.
+  const sanitize = (text: string) =>
+    redactSecrets(
+      stripAnsi(text)
+        .split(deps.depotToken!)
+        .join("[redacted]")
+        .split(deps.bridgeToken!)
+        .join("[redacted]")
+        .split(parsed.data.ticket)
+        .join("[redacted]"),
+    );
+  const safeJson = (value: unknown): unknown => {
+    if (typeof value === "string") return sanitize(value);
+    if (Array.isArray(value)) return value.map(safeJson);
+    if (value && typeof value === "object")
+      return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, safeJson(entry)]));
+    return value;
+  };
+  let mutationStarted = false;
+  let upstreamStatus: number | undefined;
+  const rpc = async (method: "GetWorkflow" | "GetJobAttemptLogs" | "RetryFailedJobs", body: object) => {
+    signal.throwIfAborted();
+    if (method === "RetryFailedJobs") mutationStarted = true;
+    const res = await deps.fetch(`https://api.depot.dev/depot.ci.v1.CIService/${method}`, {
+      method: "POST",
+      redirect: "error",
+      signal,
+      headers: {
+        authorization: `Bearer ${deps.depotToken}`,
+        "content-type": "application/json",
+        "connect-protocol-version": "1",
+      },
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+      upstreamStatus = res.status;
+      await res.body?.cancel();
+      throw new Error("upstream refused");
+    }
+    return depotJson(res);
+  };
+  try {
+    const workflow = workflowSchema.parse(await rpc("GetWorkflow", { workflowId: op.workflowId }));
+    if (workflow.repo.toLowerCase() !== repo.toLowerCase() || workflow.workflowId !== op.workflowId)
+      return json(404, { error: DEPOT_ERRORS.notFound });
+    if (op.operation === "inspect") return json(200, safeJson(workflow));
+    if (op.operation === "retry_failed") {
+      const head = workflow.headSha || workflow.sha;
+      if (
+        head.toLowerCase() !== op.expectedHead.toLowerCase() ||
+        !["failed", "cancelled"].includes(workflow.workflowStatus)
+      )
+        return json(409, { error: DEPOT_ERRORS.stale });
+      const answer = retrySchema.parse(await rpc("RetryFailedJobs", { workflowId: op.workflowId }));
+      if (answer.workflowId !== op.workflowId || answer.jobCount !== answer.jobIds.length)
+        throw new Error("inconsistent retry response");
+      return json(200, safeJson(answer));
+    }
+    const jobs = workflow.jobs.filter((j) => j.jobId === op.jobId);
+    if (jobs.length !== 1) return json(404, { error: DEPOT_ERRORS.notFound });
+    const attempts = jobs[0].attempts;
+    const latest = Math.max(...attempts.map((a) => a.attempt));
+    const selected = attempts.filter((a) => (op.attemptId ? a.attemptId === op.attemptId : a.attempt === latest));
+    if (selected.length !== 1) return json(404, { error: DEPOT_ERRORS.notFound });
+    const attemptId = selected[0].attemptId;
+    let pageToken: string | undefined;
+    const seen = new Set<string>();
+    const records: string[] = [];
+    let capturedChars = 0;
+    let complete = false;
+    let truncated = false;
+    const lineLimit = op.lines ?? 200;
+    for (let page = 0; page < 20; page++) {
+      const result = logsSchema.parse(
+        await rpc("GetJobAttemptLogs", { attemptId, ...(pageToken ? { pageToken } : {}) }),
+      );
+      // Keep the finite raw capture until all boundaries can be sanitized.
+      // A separate aggregate ceiling bounds Worker memory, not just each page.
+      const chars = result.lines.reduce((sum, line) => sum + line.body.length + 1, 0);
+      if (capturedChars + chars > 2 * DEPOT_CI_MAX_BYTES) break;
+      for (const line of result.lines) records.push(line.body);
+      capturedChars += chars;
+      if (!result.nextPageToken) {
+        complete = true;
+        break;
+      }
+      if (seen.has(result.nextPageToken)) break;
+      seen.add(result.nextPageToken);
+      pageToken = result.nextPageToken;
+    }
+    // Depot records/pages may split a credential. Compare both interpretations
+    // of their separators BEFORE clipping: if removing newlines changes what is
+    // secret, withhold the capture rather than guessing which fragment is safe.
+    // Partial captures are withheld too: a later page could finish a credential
+    // or a PEM block. This fails closed without retaining unbounded raw logs.
+    const rawText = complete ? records.join("\n") : "";
+    const sanitized = sanitize(rawText);
+    const withheld = !complete
+      ? "incomplete capture"
+      : sanitized.replace(/\n/g, "") !== sanitize(rawText.replace(/\n/g, ""))
+        ? "credential spans log records"
+        : undefined;
+    let text = "";
+    if (!withheld) {
+      const lines = sanitized.split("\n");
+      truncated = lines.length > lineLimit;
+      text = lines.slice(-lineLimit).join("\n");
+      if (text.length > 50_000) {
+        text = text.slice(-50_000);
+        truncated = true;
+      }
+    }
+    return json(200, {
+      workflowId: op.workflowId,
+      jobId: op.jobId,
+      attemptId,
+      complete,
+      truncated: truncated || !!withheld,
+      ...(withheld ? { withheld } : {}),
+      text,
+    });
+  } catch {
+    return json(502, {
+      error: mutationStarted
+        ? DEPOT_ERRORS.unknown
+        : upstreamStatus
+          ? `Depot CI upstream refused (HTTP ${upstreamStatus}).`
+          : DEPOT_ERRORS.failed,
+    });
+  }
+}

package/dist/assets/deploy/cloudflare/worker.ts

@@ -1,3 +1,5 @@
+import { depotCiAuthorization, handleDepotCi } from "./depotCi.ts";
+import { DEPOT_CI_AUTHORIZATION_PATH, DEPOT_CI_PATH } from "../../src/core/depotCi.ts";
 // Cloudflare Containers shim: runs the unchanged Switchboard image as a single
 // always-on container instance — the shape of any long-lived server on
 // Cloudflare Containers (singleton DO, cron keep-alive;
@@ -83,6 +85,8 @@ export interface Env {
   GITHUB_APP_ID?: string;
   GITHUB_APP_INSTALLATION_ID?: string;
   GITHUB_APP_PRIVATE_KEY?: string;
+  DEPOT_API_TOKEN?: string; // Worker-only organization credential: NEVER forwarded to any container
+  DEPOT_CI_BRIDGE_TOKEN?: string; // bot → Worker, narrow repo-bound CI operations only
   PUBLIC_BASE_URL?: string; // live-view: base for /runs/<id>?t=… links on the status card
   ACCESS_TEAM_DOMAIN?: string; // live-view SSO gate: Cloudflare Access team domain (JWKS + iss)
   ACCESS_AUD?: string; // live-view SSO gate: Cloudflare Access application AUD tag
@@ -124,6 +128,7 @@ const FORWARDED_OPTIONAL = [
   "GITHUB_APP_ID",
   "GITHUB_APP_INSTALLATION_ID",
   "GITHUB_APP_PRIVATE_KEY",
+  "DEPOT_CI_BRIDGE_TOKEN",
   "PUBLIC_BASE_URL",
   "ACCESS_TEAM_DOMAIN",
   "ACCESS_AUD",
@@ -458,6 +463,17 @@ const withLength = (res: Response): Response => withKnownLength(res, (size) => n
 export default {
   async fetch(request: Request, env: Env): Promise<Response> {
     const pathname = new URL(request.url).pathname;
+    // Permits can only be consumed through the Worker's fixed container
+    // binding. The public edge must never proxy this callback path.
+    if (pathname === DEPOT_CI_AUTHORIZATION_PATH) return new Response("not found", { status: 404 });
+    if (pathname === DEPOT_CI_PATH)
+      return handleDepotCi(request, {
+        depotToken: env.DEPOT_API_TOKEN,
+        bridgeToken: env.DEPOT_CI_BRIDGE_TOKEN,
+        authorize: (ticket, signal) =>
+          depotCiAuthorization(ticket, signal, (req) => getContainer(env.SWITCHBOARD, INSTANCE).fetch(req)),
+        fetch: (input, init) => fetch(input, init),
+      });
     // Only deliberately published copies are public. The existing run reader
     // and the bucket stay private; the write endpoint checks its own bearer.
     if (pathname.startsWith("/pr-images/")) return withLength(await handlePrImage(request, env.ARTIFACTS));

package/dist/assets/deploy/secrets.manifest.json

@@ -1,6 +1,18 @@
 {
-  "$comment": "Every Cloudflare Worker secret Switchboard provisions: its name, which Worker(s) hold it, and whether a Worker may go without it (`optional: true` everywhere, or a list of the Workers it is optional on — a shared bearer is required on the Worker that serves the feature and optional on the bot until that feature is configured). This file is the contract — src/core/secretsManifest.test.ts keeps it equal to each worker.ts `Env` interface and to the bot container's forwarding list. WHERE the values live is the deployment profile's `secretsSource` (a directory of <NAME> files, `~/.secrets/switchboard` by default, or a 1Password item `op://Vault/Item` with one field per name); `deploy secrets <worker>` (`npm run secrets` in each deploy/cloudflare*/) puts them, refusing before any upload when a required value is absent. A shared bearer must carry ONE value on every Worker listed for it. Rotation: new value at the source, `deploy secrets` on EVERY listed Worker, then `deploy restart` for the bot (its running container keeps the env it started with). Public config (URLs, ids of no consequence) is a wrangler.jsonc var, not a secret.",
+  "$comment": "Every Cloudflare Worker secret Switchboard provisions: its name, which Worker(s) hold it, and whether a Worker may go without it (`optional: true` everywhere, or a list of the Workers it is optional on — a shared bearer is required on the Worker that serves the feature and optional on the bot until that feature is configured). This file is the contract — src/core/secretsManifest.test.ts keeps it equal to each worker.ts `Env` interface and to the bot container's forwarding list, except the explicitly Worker-only DEPOT_API_TOKEN (which must never be forwarded). WHERE the values live is the deployment profile's `secretsSource` (a directory of <NAME> files, `~/.secrets/switchboard` by default, or a 1Password item `op://Vault/Item` with one field per name); `deploy secrets <worker>` (`npm run secrets` in each deploy/cloudflare*/) puts them, refusing before any upload when a required value is absent. A shared bearer must carry ONE value on every Worker listed for it. Rotation: new value at the source, `deploy secrets` on EVERY listed Worker, then `deploy restart` for the bot (its running container keeps the env it started with). Public config (URLs, ids of no consequence) is a wrangler.jsonc var, not a secret.",
   "secrets": [
+    {
+      "name": "DEPOT_API_TOKEN",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "Depot organization token, held ONLY by the bot Worker edge. Explicitly excluded from bot container forwarding; never put in a bot env, coding container, resident or shell. Used only for repo-verified workflow inspection, logs and failed-only retry. Rotate in Depot organization settings, provision with deploy secrets bot."
+    },
+    {
+      "name": "DEPOT_CI_BRIDGE_TOKEN",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "Separate self-minted internal bearer: trusted bot → its Worker's narrow /internal/depot-ci operation. Forwarded to the bot only, never model containers. This is NOT a Depot credential. Absent disables CI tools; provision with deploy secrets bot and restart the bot."
+    },
     {
       "name": "SLACK_BOT_TOKEN",
       "workers": ["bot"],

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.265.0",
+  "version": "1.266.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.265.0",
+      "version": "1.266.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.265.0",
+      "version": "1.266.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.265.0",
+  "version": "1.266.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.265.0",
-  "commit": "39607a27b4b5751330311c08f9068a6bc007ca80",
-  "builtAt": "2026-09-26T04:13:47.389Z"
+  "version": "1.266.0",
+  "commit": "9b03a2a996929a0e6f8604a7ea830106b0f37e53",
+  "builtAt": "2026-09-26T17:09:46.306Z"
 }

package/dist/assets/src/core/depotCi.ts

@@ -0,0 +1,72 @@
+// The node-free contract shared by the bot's repo-bound client and the edge.
+// No generic RPC, arbitrary URL or credential can be supplied by a child.
+import { z } from "zod";
+
+export const DEPOT_CI_PATH = "/internal/depot-ci";
+export const DEPOT_CI_AUTHORIZATION_PATH = "/internal/depot-ci/authorization";
+export const depotCiTicketSchema = z.object({ ticket: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
+export const DEPOT_CI_MAX_BYTES = 2 * 1024 * 1024;
+export const depotId = z.string().regex(/^[A-Za-z0-9_-]{1,160}$/);
+const common = { workflowId: depotId };
+export const depotOperationSchema = z.discriminatedUnion("operation", [
+  z.object({ ...common, operation: z.literal("inspect") }).strict(),
+  z
+    .object({
+      ...common,
+      operation: z.literal("logs"),
+      jobId: depotId,
+      attemptId: depotId.optional(),
+      lines: z.number().int().min(1).max(2000).optional(),
+    })
+    .strict(),
+  z
+    .object({ ...common, operation: z.literal("retry_failed"), expectedHead: z.string().regex(/^[a-f0-9]{40}$/i) })
+    .strict(),
+]);
+export type DepotOperation = z.infer<typeof depotOperationSchema>;
+/** Read only from the fixed bot callback, never from the bridge request. */
+export const depotCiGrantSchema = z
+  .object({
+    runId: depotId,
+    repo: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}\/[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/),
+    operation: depotOperationSchema,
+  })
+  .strict();
+export type DepotCiGrant = z.infer<typeof depotCiGrantSchema>;
+export interface DepotCi {
+  call(operation: DepotOperation, signal?: AbortSignal): Promise<Record<string, unknown>>;
+}
+
+/** Fixed messages shared across the bridge; upstream bodies are never errors. */
+export const DEPOT_ERRORS = {
+  invalid: "Depot CI: invalid operation.",
+  unauthorized: "Depot CI: run authorization expired or refused.",
+  unavailable: "Depot CI unavailable: DEPOT_API_TOKEN is not configured at the Worker.",
+  notFound: "Depot CI: workflow, job or attempt not found in the bound repository.",
+  stale: "Depot CI: head mismatch or workflow is not failed/cancelled; inspect before retry.",
+  unknown: "Depot retry outcome unknown; inspect before another request.",
+  failed: "Depot CI upstream response invalid or unavailable.",
+} as const;
+
+/** Read through a byte ceiling, including chunked responses. A partial JSON
+ * response is never parsed or returned. Callers supply the operation deadline. */
+export async function depotJson(response: Response, limit = DEPOT_CI_MAX_BYTES): Promise<unknown> {
+  if (!response.body) throw new Error("empty response");
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let bytes = 0;
+  let text = "";
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > limit) throw new Error("response too large");
+      text += decoder.decode(value, { stream: true });
+    }
+    return JSON.parse(text + decoder.decode()) as unknown;
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}

package/dist/assets/src/core/publicationPush.ts

@@ -0,0 +1,173 @@
+import type { ExistingPrPublicationBinding } from "./coordinator/contract.js";
+import { COMMAND_CAP, TOOL_OUTPUT_CAP, type RunEvent } from "./runEvents.js";
+
+export interface PublicationPushReceipt {
+  callId: string;
+  previousHeadSha: string;
+  repo: string;
+  pr: number;
+  owner: ExistingPrPublicationBinding["owner"];
+}
+
+type PushEvent = Extract<RunEvent, { type: "pushed_head" }>;
+const fullSha = (s: string): boolean => /^[a-f0-9]{40}$/.test(s);
+const refName = (s: string): boolean =>
+  /^[a-zA-Z0-9_/-]+(?:\.[a-zA-Z0-9_/-]+)*$/.test(s) && !s.includes("..") && !s.startsWith("-");
+const shortRef = (s: string): string => s.replace(/^refs\/heads\//, "");
+
+/** Deliberately not a shell interpreter. Only a standalone literal push can
+ * attest its result: pipelines, scripts, substitutions and compound commands
+ * cannot prove which operation produced stdout or the successful exit. */
+export function leasedPushCommand(command: string): { ref: string; expectedHeadSha: string } | undefined {
+  if (command.length >= COMMAND_CAP) return;
+  const literal = command.replace(/[ \t]+2>&1[ \t]*$/, "");
+  if (!/^git push\s/.test(literal) || /[\n\r'"`$;|<>\\&]/.test(literal)) return;
+  const words = literal.trim().split(/\s+/).slice(2);
+  const leases = words.filter((w) => w.startsWith("--force-with-lease="));
+  if (leases.length !== 1) return;
+  const lease = /^--force-with-lease=refs\/heads\/([^:]+):([a-f0-9]{40})$/.exec(leases[0]!);
+  if (!lease || !refName(lease[1]!)) return;
+  const args = words.filter((w) => w !== leases[0] && w !== "-u" && w !== "--set-upstream");
+  if (args.length !== 2 || args[0] !== "origin") return;
+  const refs = args[1]!.split(":");
+  if (refs.length > 2 || shortRef(refs[0]!) !== lease[1] || shortRef(refs[1] ?? refs[0]!) !== lease[1]) return;
+  return { ref: lease[1]!, expectedHeadSha: lease[2]! };
+}
+
+/** A legacy record needs the complete pair, never its display summary, an
+ * assistant's prose or the remote head alone. More than one attempted push is
+ * intentionally ambiguous; historical reconciliation does not choose one. */
+export function pairedPublicationPush(
+  events: readonly RunEvent[],
+  binding: ExistingPrPublicationBinding,
+  head: string,
+  callId?: string,
+): PushEvent | undefined {
+  if (!fullSha(head) || !fullSha(binding.expectedHeadSha) || head === binding.expectedHeadSha) return;
+  const calls = events.filter(
+    (e): e is Extract<RunEvent, { type: "tool_call" }> =>
+      e.type === "tool_call" &&
+      e.tool === "bash" &&
+      (callId === undefined ? /\bgit\s+push\b/.test(e.command ?? e.summary) : e.callId === callId),
+  );
+  if (calls.length !== 1) return;
+  const call = calls[0]!;
+  if (
+    !call.callId ||
+    !call.command ||
+    events.filter((e) => e.type === "tool_call" && e.callId === call.callId).length !== 1
+  )
+    return;
+  const command = leasedPushCommand(call.command);
+  if (command?.ref !== binding.publicationRef || command.expectedHeadSha !== binding.expectedHeadSha) return;
+  const results = events.filter(
+    (e): e is Extract<RunEvent, { type: "tool_result" }> => e.type === "tool_result" && e.callId === call.callId,
+  );
+  if (results.length !== 1) return;
+  const result = results[0]!;
+  if (
+    events.indexOf(result) <= events.indexOf(call) ||
+    result.tool !== "bash" ||
+    !result.ok ||
+    result.exitCode !== 0 ||
+    result.cut ||
+    !result.output ||
+    result.output.length >= TOOL_OUTPUT_CAP
+  )
+    return;
+  let lines = result.output.trim().split(/\r?\n/);
+  const tracking = `branch '${binding.publicationRef}' set up to track 'origin/${binding.publicationRef}'.`;
+  if (
+    /(?:^|\s)(?:-u|--set-upstream)(?:\s|$)/.test(call.command) &&
+    lines.filter((line) => line === tracking).length === 1
+  )
+    lines = lines.filter((line) => line !== tracking);
+  if (lines.length !== 2) return;
+  const remote = /^To (?:https:\/\/github\.com\/|git@github\.com:|github\.com:)([^\s]+?)(?:\.git)?$/.exec(lines[0]!);
+  const update = /^\s*\+?\s*([a-f0-9]{7,40})(\.{2,3})([a-f0-9]{7,40})\s+(\S+) -> (\S+)( \(forced update\))?$/.exec(
+    lines[1]!,
+  );
+  if (
+    !remote ||
+    remote[1]!.toLowerCase() !== binding.repo.toLowerCase() ||
+    !update ||
+    !binding.expectedHeadSha.startsWith(update[1]!) ||
+    !head.startsWith(update[3]!) ||
+    update[1] === update[3] ||
+    shortRef(update[4]!) !== binding.publicationRef ||
+    shortRef(update[5]!) !== binding.publicationRef
+  )
+    return;
+  return {
+    type: "pushed_head",
+    ref: binding.publicationRef,
+    sha: head,
+    by: "push",
+    receipt: {
+      callId: call.callId,
+      previousHeadSha: binding.expectedHeadSha,
+      repo: binding.repo,
+      pr: binding.pr,
+      owner: { ...binding.owner },
+    },
+  };
+}
+
+/** State is stored JSON, not an unchecked cast back into publication authority. */
+export function publicationReceiptsFromState(value: unknown): PushEvent[] {
+  if (!Array.isArray(value)) return [];
+  const valid = value.every((v) => {
+    if (typeof v !== "object" || v === null) return false;
+    const r = v.receipt;
+    return (
+      v.type === "pushed_head" &&
+      v.by === "push" &&
+      typeof v.ref === "string" &&
+      refName(v.ref) &&
+      typeof v.sha === "string" &&
+      fullSha(v.sha) &&
+      typeof r === "object" &&
+      r !== null &&
+      typeof r.callId === "string" &&
+      r.callId.length > 0 &&
+      typeof r.previousHeadSha === "string" &&
+      fullSha(r.previousHeadSha) &&
+      typeof r.repo === "string" &&
+      Number.isSafeInteger(r.pr) &&
+      r.pr > 0 &&
+      typeof r.owner === "object" &&
+      r.owner !== null &&
+      typeof r.owner.instanceId === "string" &&
+      typeof r.owner.unit === "string"
+    );
+  });
+  return valid ? ([...value] as PushEvent[]) : [];
+}
+
+/** Only the run's typed, contiguous leased transitions can move its restart
+ * fence. The caller still verifies the fresh PR and attached workspace. */
+export function restoredPublicationHead(
+  events: readonly RunEvent[],
+  binding: ExistingPrPublicationBinding,
+): string | undefined {
+  let head = binding.expectedHeadSha;
+  const seen = new Set<string>();
+  for (const e of events) {
+    if (e.type !== "pushed_head" || e.receipt === undefined) continue;
+    const r = e.receipt;
+    if (
+      e.ref !== binding.publicationRef ||
+      r.repo !== binding.repo ||
+      r.pr !== binding.pr ||
+      r.owner.instanceId !== binding.owner.instanceId ||
+      r.owner.unit !== binding.owner.unit ||
+      r.previousHeadSha !== head ||
+      !fullSha(e.sha) ||
+      seen.has(r.callId)
+    )
+      return;
+    seen.add(r.callId);
+    head = e.sha;
+  }
+  return head === binding.expectedHeadSha ? undefined : head;
+}

package/dist/assets/src/core/refusal.ts

@@ -45,6 +45,7 @@ const CAUSE_OF = {
   repo_not_visible: "policy",
   repo_unverified: "system",
   repo_not_onboarded: "request",
+  pr_target_conflict: "request",
   repo_access: "policy",
   pr_head_unknown: "system",
   workspace_head_mismatch: "system",

package/dist/assets/src/core/runEvents.ts

@@ -944,12 +944,23 @@ export type RunEvent =
       ref: string;
       sha: string;
       by: "push" | "salvage";
+      /** Exact leased tool result, retained before any post-step can refuse. */
+      receipt?: import("./publicationPush.js").PublicationPushReceipt;
       /** No uncommitted or unpushed work at the push (record 0064): the fact
        *  the plane's soft stop reads. Absent where the measure was missing. */
       clean?: boolean;
       seq?: number;
       at?: number;
     }
+  /** The server gate admitted this exact leased push, not a child's claim. */
+  | {
+      type: "publication_push_authorized";
+      callId: string;
+      ref: string;
+      expectedHeadSha: string;
+      seq?: number;
+      at?: number;
+    }
   /** The coordinator tag as a fact of the run (docs/reference/specs/run-history.md
    *  item 48a): the instance the run is a child of, the unit its idempotency
    *  key named, and the base branch its pull request targets — published by