@coreplane/switchboard 1.267.0 → 1.267.2

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.267.0",
+  "version": "1.267.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.267.0",
+      "version": "1.267.2",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21023,7 +21023,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.267.0",
+      "version": "1.267.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",
@@ -21053,7 +21053,7 @@
       "dependencies": {
         "@nuxt/ui": "^4.11.0",
         "@pierre/diffs": "1.4.2",
-        "@vueuse/core": "^14.4.0",
+        "@vueuse/core": "^15.0.0",
         "vue": "^3.5.42",
         "vue-router": "^5.3.1"
       },
@@ -21076,6 +21076,53 @@
       "engines": {
         "node": ">=22"
       }
+    },
+    "web/node_modules/@vueuse/core": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@vueuse/core/-/core-15.0.0.tgz",
+      "integrity": "sha512-Zv67h5mrk7YHDJsRObx+DXaCBz6RKBUpxqLesJ+3xZNPG6yuQs7ja7kg3veFrrouYLWAqydQ7CwGEbLVxB43Ng==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/web-bluetooth": "^0.0.21",
+        "@vueuse/metadata": "15.0.0",
+        "@vueuse/shared": "15.0.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "vue": "^3.5.0"
+      }
+    },
+    "web/node_modules/@vueuse/core/node_modules/@vueuse/shared": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@vueuse/shared/-/shared-15.0.0.tgz",
+      "integrity": "sha512-vbNXhGrbV53xPOMSyOzMHQRvhMgZf7oNDw2RChUetVxwTIEkInQ1joZ9JbT0G3z2n2AJNjvmCWeM9ySYrnvogA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "vue": "^3.5.0"
+      }
+    },
+    "web/node_modules/@vueuse/metadata": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@vueuse/metadata/-/metadata-15.0.0.tgz",
+      "integrity": "sha512-sfWE5LADAKJ0KnjtGliMdSN8Ij/L7uP6rXIZlgPloAI4zvvefbw6H5Lt7KJA6RqQOYgVqWF5Guj50HHMIzygBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
     }
   }
 }

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.267.0",
+  "version": "1.267.2",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.267.0",
-  "commit": "594f06834184ea4ff5559b00a8fc265f33e3db64",
-  "builtAt": "2026-09-28T22:36:17.080Z"
+  "version": "1.267.2",
+  "commit": "08956af1ac05f7f428a07f4e2190b68695623a62",
+  "builtAt": "2026-09-29T01:42:48.486Z"
 }

package/dist/assets/src/core/budgets.ts

@@ -64,6 +64,16 @@ export const QUESTION_TTL_MS = DAY_MS;
  *  that FAILED is never cached — the next read asks again. */
 export const AUTHOR_BINDING_TTL_MS = 15 * MINUTE_MS;
 
+/** Maximum local lifetime of any Git receive-pack forward. The bounded
+ *  request prevents a write connection outliving its run indefinitely after
+ *  revocation. An aborted remote write has an unknown outcome; existing-PR
+ *  writes retain their owned pending intent for authoritative reconciliation. */
+export const GIT_RECEIVE_PACK_FORWARD_TIMEOUT_MS = 5 * MINUTE_MS;
+/** The run's final record waits for that one forwarded report, plus a small
+ *  durable-receipt margin, before sealing. If it still has no answer, the
+ *  pending intent stays as an uncertain write and no retry is authorized. */
+export const GIT_PUBLICATION_SETTLE_TIMEOUT_MS = GIT_RECEIVE_PACK_FORWARD_TIMEOUT_MS + 10 * SECOND_MS;
+
 /** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
  *  resumed run's re-attach to its recorded worktree — waits for the resident
  *  to wake when the Worker typed its refusal as the platform's transient

package/dist/assets/src/core/coordinator/contract.ts

@@ -493,6 +493,15 @@ export interface RoundGate {
   findings: string[];
 }
 
+/** A later human review is evidence to investigate, never typed findings. */
+export interface RecoveryReviewEvidence {
+  id: number;
+  reviewer: { login: string; id: number };
+  headSha: string;
+  submittedAt: number;
+  body: string;
+}
+
 /** The original grant and historically priced children carried through a recovery checkpoint. */
 export interface RecoveryAccounting {
   spendUsd: number;
@@ -506,6 +515,7 @@ export interface RecoveryAccounting {
  * the original instance/unit idempotency namespace. */
 export interface OriginalUnitRecovery {
   kind: "findings" | "review";
+  externalReview?: RecoveryReviewEvidence;
   accounting?: RecoveryAccounting;
   round: number;
   expectedHeadSha: string;
@@ -540,6 +550,7 @@ export interface OriginalUnitRecovery {
 }
 
 export interface OriginalUnitRecoveryReceipt {
+  externalReview?: RecoveryReviewEvidence;
   accounting?: RecoveryAccounting;
   reviewRunId: string;
   workflowId: string;
@@ -767,7 +778,18 @@ export const isUnitWakeAnswer = (v: unknown): v is UnitWakeAnswer => {
   );
 };
 
+const isPositiveId = (v: unknown): v is number => typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 const isDollars = (v: unknown): v is number => isFinite(v) && v >= 0;
+const isRecoveryReview = (v: unknown): v is RecoveryReviewEvidence =>
+  isObject(v) &&
+  isPositiveId(v.id) &&
+  isObject(v.reviewer) &&
+  isText(v.reviewer.login) &&
+  isPositiveId(v.reviewer.id) &&
+  typeof v.headSha === "string" &&
+  /^[0-9a-f]{40}$/i.test(v.headSha) &&
+  isFinite(v.submittedAt) &&
+  typeof v.body === "string";
 const isRecoveryAccounting = (v: unknown): v is RecoveryAccounting =>
   isObject(v) &&
   isDollars(v.spendUsd) &&
@@ -839,6 +861,12 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
       STEP_NAME_PATTERN.test(r.recovery.step) &&
       isText(r.recovery.reviewRunId) &&
       (r.recovery.accounting === undefined || isRecoveryAccounting(r.recovery.accounting)) &&
+      (r.recovery.externalReview === undefined ||
+        (isRecoveryReview(r.recovery.externalReview) &&
+          r.recovery.kind === "review" &&
+          isRecoveryAccounting(r.recovery.accounting) &&
+          r.recovery.findings === undefined &&
+          r.recovery.findingsRunId === undefined)) &&
       (r.recovery.findingsRunId === undefined || isText(r.recovery.findingsRunId)) &&
       (r.recovery.findingsKey === undefined || isText(r.recovery.findingsKey)) &&
       ((r.recovery.findingsRunId === undefined && r.recovery.findingsKey === undefined) ||
@@ -869,6 +897,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
     r.recoveryReceipt !== undefined &&
     (!isObject(r.recoveryReceipt) ||
       !isText(r.recoveryReceipt.reviewRunId) ||
+      (r.recoveryReceipt.externalReview !== undefined && !isRecoveryReview(r.recoveryReceipt.externalReview)) ||
       (r.recoveryReceipt.accounting !== undefined && !isRecoveryAccounting(r.recoveryReceipt.accounting)) ||
       typeof r.recoveryReceipt.workflowId !== "string" ||
       !INSTANCE_ID_PATTERN.test(r.recoveryReceipt.workflowId) ||

package/dist/assets/src/core/coordinator/driver.ts

@@ -687,6 +687,18 @@ function isOpaqueNotFound(reply: BotReply): boolean {
   }
 }
 
+/** A finished, addressed child whose final record is still being sealed.
+ * Unlike an opaque 404, this answer already establishes the child's identity. */
+function isRecordPending(reply: BotReply): boolean {
+  if (reply.status !== 409) return false;
+  try {
+    const body = JSON.parse(reply.text) as { ok?: unknown; error?: unknown };
+    return body?.ok === false && body.error === "record_pending";
+  } catch {
+    return false;
+  }
+}
+
 async function readRecordStep(
   step: StepRunner,
   bot: CoordinatorBot,
@@ -696,8 +708,9 @@ async function readRecordStep(
   for (let retry = 0; ; retry++) {
     const name = retry === 0 ? action.step : `${action.step}/record-read/${retry}`;
     const reply = await step.do(name, STEP_CONFIG, () => call(bot, "read-record", body, true));
-    if (!isOpaqueNotFound(reply) || action.finishedObserved !== true || retry >= SHIP_RECORD_VISIBILITY.retries)
-      return reply;
+    const pending = isRecordPending(reply);
+    const eventQualifiedMissing = action.finishedObserved === true && isOpaqueNotFound(reply);
+    if ((!pending && !eventQualifiedMissing) || retry >= SHIP_RECORD_VISIBILITY.retries) return reply;
     await step.sleep(`${action.step}/record-visible/${retry + 1}`, SHIP_RECORD_VISIBILITY.retryMs);
   }
 }

package/dist/assets/src/core/publicationPush.ts

@@ -15,14 +15,19 @@ const refName = (s: string): boolean =>
   /^[a-zA-Z0-9_/-]+(?:\.[a-zA-Z0-9_/-]+)*$/.test(s) && !s.includes("..") && !s.startsWith("-");
 const shortRef = (s: string): string => s.replace(/^refs\/heads\//, "");
 
+/** Broad enough to count competing Git config pushes; leasedPushCommand
+ * separately proves whether one selected call is authorized evidence. */
+export const mentionsGitPush = (command: string): boolean => /\bgit(?:\s+-c\s+\S+)*\s+push\b/.test(command);
+
 /** Deliberately not a shell interpreter. Only a standalone literal push can
  * attest its result: pipelines, scripts, substitutions and compound commands
  * cannot prove which operation produced stdout or the successful exit. */
 export function leasedPushCommand(command: string): { ref: string; expectedHeadSha: string } | undefined {
   if (command.length >= COMMAND_CAP) return;
   const literal = command.replace(/[ \t]+2>&1[ \t]*$/, "");
-  if (!/^git push\s/.test(literal) || /[\n\r'"`$;|<>\\&]/.test(literal)) return;
-  const words = literal.trim().split(/\s+/).slice(2);
+  const prefix = /^git(?: -c http\.postBuffer=[0-9]+)? push\s/.exec(literal);
+  if (!prefix || /[\n\r'"`$;|<>\\&]/.test(literal)) return;
+  const words = literal.slice(prefix[0].length).trim().split(/\s+/);
   const leases = words.filter((w) => w.startsWith("--force-with-lease="));
   if (leases.length !== 1) return;
   const lease = /^--force-with-lease=refs\/heads\/([^:]+):([a-f0-9]{40})$/.exec(leases[0]!);
@@ -42,13 +47,14 @@ export function pairedPublicationPush(
   binding: ExistingPrPublicationBinding,
   head: string,
   callId?: string,
+  gitDoorBaseUrl?: string,
 ): PushEvent | undefined {
   if (!fullSha(head) || !fullSha(binding.expectedHeadSha) || head === binding.expectedHeadSha) return;
   const calls = events.filter(
     (e): e is Extract<RunEvent, { type: "tool_call" }> =>
       e.type === "tool_call" &&
       e.tool === "bash" &&
-      (callId === undefined ? /\bgit\s+push\b/.test(e.command ?? e.summary) : e.callId === callId),
+      (callId === undefined ? mentionsGitPush(e.command ?? e.summary) : e.callId === callId),
   );
   if (calls.length !== 1) return;
   const call = calls[0]!;
@@ -76,20 +82,36 @@ export function pairedPublicationPush(
   )
     return;
   let lines = result.output.trim().split(/\r?\n/);
-  const tracking = `branch '${binding.publicationRef}' set up to track 'origin/${binding.publicationRef}'.`;
+  const tracking = [
+    `branch '${binding.publicationRef}' set up to track 'origin/${binding.publicationRef}'.`,
+    `Branch '${binding.publicationRef}' set up to track remote branch '${binding.publicationRef}' from 'origin'.`,
+  ];
   if (
     /(?:^|\s)(?:-u|--set-upstream)(?:\s|$)/.test(call.command) &&
-    lines.filter((line) => line === tracking).length === 1
+    lines.filter((line) => tracking.includes(line)).length === 1
   )
-    lines = lines.filter((line) => line !== tracking);
+    lines = lines.filter((line) => !tracking.includes(line));
   if (lines.length !== 2) return;
-  const remote = /^To (?:https:\/\/github\.com\/|git@github\.com:|github\.com:)([^\s]+?)(?:\.git)?$/.exec(lines[0]!);
+  const githubRemote = /^To (?:https:\/\/github\.com\/|git@github\.com:|github\.com:)([^\s]+?)(?:\.git)?$/.exec(
+    lines[0]!,
+  );
+  let doorRemote: string | undefined;
+  if (gitDoorBaseUrl !== undefined) {
+    try {
+      doorRemote = `${new URL(gitDoorBaseUrl).origin}/git/${binding.repo}`;
+    } catch {
+      return;
+    }
+  }
+  const remoteMatches =
+    doorRemote === undefined
+      ? githubRemote?.[1]?.toLowerCase() === binding.repo.toLowerCase()
+      : lines[0] === `To ${doorRemote}` || lines[0] === `To ${doorRemote}.git`;
   const update = /^\s*\+?\s*([a-f0-9]{7,40})(\.{2,3})([a-f0-9]{7,40})\s+(\S+) -> (\S+)( \(forced update\))?$/.exec(
     lines[1]!,
   );
   if (
-    !remote ||
-    remote[1]!.toLowerCase() !== binding.repo.toLowerCase() ||
+    !remoteMatches ||
     !update ||
     !binding.expectedHeadSha.startsWith(update[1]!) ||
     !head.startsWith(update[3]!) ||

package/dist/assets/src/core/runRecord.ts

@@ -279,6 +279,17 @@ export interface RunRecord {
    *  last `pushed_head` event's sha winning — the fact a renewal reads to know
    *  the run made progress. Present only on a run that pushed. */
   pushed?: PushedHead[];
+  /** A Git-door write whose remote outcome was still uncertain at seal. The
+   * live ledger row is deleted at finish, so recovery retains this exact
+   * ref transition until head reconciliation. A PR number exists only for a
+   * verified existing-PR publication. */
+  doorPublicationPending?: {
+    id: string;
+    repo: string;
+    pr?: number;
+    owner?: { instanceId: string; unit: string };
+    update: { ref: string; old: string; next: string };
+  };
   /** What the run cost in tokens, per model, summed from its `model.turn`
    *  spans at finish (`usageOfEvents`; docs/reference/specs/costs.md, cost by user).
    *  Every record written since carries it (zero turns included); one written
@@ -1124,6 +1135,27 @@ export function isRunRecord(v: unknown): v is RunRecord {
     )
   )
     return false;
+  if (r.doorPublicationPending !== undefined) {
+    const pending = r.doorPublicationPending;
+    if (typeof pending !== "object" || pending === null) return false;
+    const { id, repo, pr, owner, update } = pending as Record<string, unknown>;
+    if (
+      typeof id !== "string" ||
+      !id ||
+      typeof repo !== "string" ||
+      !repo ||
+      (pr !== undefined && (!Number.isInteger(pr) || (pr as number) < 1))
+    )
+      return false;
+    if (owner !== undefined && (typeof owner !== "object" || owner === null)) return false;
+    if (typeof update !== "object" || update === null) return false;
+    const o = owner as Record<string, unknown> | undefined;
+    const u = update as Record<string, unknown>;
+    if (o !== undefined && (typeof o.instanceId !== "string" || typeof o.unit !== "string")) return false;
+    if (typeof u.ref !== "string" || !u.ref.startsWith("refs/heads/")) return false;
+    if (typeof u.old !== "string" || !/^[0-9a-f]{40}$/.test(u.old)) return false;
+    if (typeof u.next !== "string" || !/^[0-9a-f]{40}$/.test(u.next)) return false;
+  }
   // A parent is named by a run id (item 46): the same shape as the record's own.
   if (r.parentRunId !== undefined && (typeof r.parentRunId !== "string" || !RUN_ID_PATTERN.test(r.parentRunId)))
     return false;

package/dist/assets/src/core/ship/coordinator.ts

@@ -1243,6 +1243,9 @@ type Phase =
        *  must independently prove an open branch and pull request at exactly
        *  `childHead`; neither a push record nor this flag is remote evidence. */
       findingsReady?: true;
+      /** A capped recovery must verify this pushed head before ending, but
+       * missing findings outputs still forbid review or merge-ready success. */
+      findingsIncomplete?: string[];
       /** The coding child died (`failed` or `interrupted`) after it may have
        *  pushed: the pr-check recovers a pushed branch by opening its pull
        *  request; with nothing pushed the unit ends with the child's own reason. */
@@ -1648,7 +1651,7 @@ export function nextAction(s: UnitPipelineState): CoordinatorAction {
       return {
         type: "pr-check",
         step: `${roundStep(s, p.round)}/pr-check`,
-        ...(p.dead !== undefined || p.recover === true || p.findingsReady === true
+        ...(p.dead !== undefined || p.recover === true || p.findingsReady === true || p.findingsIncomplete !== undefined
           ? { recover: { runId: p.runId } }
           : {}),
         // The adopted pull request rides the check so the bot can follow it
@@ -1884,7 +1887,8 @@ function capEnding(s: UnitPipelineState, round?: RoundRef, refused?: Carve): Uni
   };
 }
 
-/** A recovered unit keeps its original dollar cap across the checkpoint. */
+/** Recovery cannot buy another child (or claim readiness) after the original
+ * dollar cap is spent. Unknown cost is not zero and never resets that cap. */
 function recoveryCostEnding(s: UnitPipelineState): UnitEnding | undefined {
   const cap = s.input.grant?.costCapUsd;
   if (s.input.recovery === undefined || cap === undefined) return undefined;
@@ -2037,6 +2041,21 @@ function settleCoding(
     if (facts.description !== true) missingOutputs.push("missing updated pull request description");
     const observedHead = fullHead(facts.headSha);
     if (observedHead === undefined) missingOutputs.push("missing final observed commit");
+    if (
+      missingOutputs.length > 0 &&
+      costEnding !== undefined &&
+      observedHead !== undefined &&
+      facts.pushed?.length === 1 &&
+      facts.pushed[0]?.ref === next.input.unit.branch &&
+      facts.pushed[0]?.sha === observedHead
+    )
+      return {
+        state: {
+          ...next,
+          phase: { at: "pr-check", round, runId, childHead: observedHead, findingsIncomplete: missingOutputs },
+        },
+        notes: [],
+      };
     if (missingOutputs.length > 0)
       return end(
         next,
@@ -2656,7 +2675,7 @@ function finishSupersededChild(
     if (phase.round.kind === "findings") {
       const settled = settleCoding(s, phase.round, phase.runId, facts);
       const ready = settled.state.phase;
-      if (ready.at === "pr-check" && ready.findingsReady === true)
+      if (ready.at === "pr-check" && (ready.findingsReady === true || ready.findingsIncomplete !== undefined))
         return settlePrCheck(settled.state, ready, supersession.pullRequest);
       return settled;
     }
@@ -2709,11 +2728,24 @@ export function reconcileTerminalPr(s: UnitPipelineState, pr: PrCheck): UnitPipe
 /** The pull request heading the branch after round 0 or a findings step. */
 function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-check" }>, pr: PrCheck): Transition {
   const { round } = phase;
+  const endIncompleteFindings = (verified: UnitPipelineState): Transition => {
+    const cap = recoveryCostEnding(verified);
+    return end(
+      verified,
+      {
+        kind: "aborted",
+        reason: `${cap?.kind === "aborted" ? `${cap.reason} ` : ""}The completed findings work still lacks required results (${phase.findingsIncomplete?.join("; ")}); no review started.`,
+        round,
+        reviewRounds: verified.reviewRounds,
+      },
+      [roundNote(round, "aborted")],
+    );
+  };
   // A completed findings run is not ready because it says it pushed. It is
   // ready only when this independent read sees the adopted pull request at the
   // exact full observed source head (and, while open, its live branch). Every
   // other remote fact is a resumable stop with no review or merged success.
-  if (phase.findingsReady === true) {
+  if (phase.findingsReady === true || phase.findingsIncomplete !== undefined) {
     const observedHead = fullHead(phase.childHead)!;
     const withPr = pr.state !== "none" ? { ...s, pr: { number: pr.prNumber, url: pr.url } } : s;
     if (pr.state === "merged") {
@@ -2745,6 +2777,8 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
           },
           [roundNote(round, "aborted")],
         );
+      if (phase.findingsIncomplete !== undefined)
+        return endIncompleteFindings({ ...withPr, lastReviewHead: remoteHead });
       return foundMerged(withPr, pr, [roundNote(round, "completed")]);
     }
     if (pr.state !== "open" || pr.headBranchExists === false)
@@ -2788,6 +2822,10 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
         },
         [roundNote(round, "aborted")],
       );
+    const reconciled = { ...withPr, lastReviewHead: remoteHead };
+    if (phase.findingsIncomplete !== undefined) return endIncompleteFindings(reconciled);
+    const costEnding = recoveryCostEnding(reconciled);
+    if (costEnding !== undefined) return end(reconciled, costEnding, [roundNote(round, "aborted")]);
     return roundOnOpenPr(withPr, phase, pr);
   }
   // The merge landed during the round: the child found nothing left to ship
@@ -3845,9 +3883,16 @@ function renderUnitReportWithWake(
   const rounds = `${e.reviewRounds} review round${e.reviewRounds === 1 ? "" : "s"}`;
   const prUrl = s.pr?.url;
   const prLine = prUrl ? ` PR: ${prUrl}` : "";
+  const spentCapAction = (): string | undefined => {
+    const cap = s.input.grant?.costCapUsd;
+    if (cap === undefined || s.spendUsd === null || s.spendUsd < cap) return undefined;
+    return `Next action: $${s.spendUsd.toFixed(2)} spent against the original $${cap.toFixed(2)} cost cap; this unit cannot start another child. Continue ${prUrl ? `the existing pull request (${prUrl})` : "the saved branch"} only under separate authorization, then request review of its exact head.`;
+  };
   const nextAction = (checkpoint?: { branch: string; sha: string }): string => {
     if (durableWake)
       return `The unit remains live; a reply in this thread is recorded as its continuation action${prUrl ? ` from the open pull request (${prUrl})` : " from the saved branch state"}.`;
+    const cappedAction = spentCapAction();
+    if (cappedAction !== undefined) return cappedAction;
     const reconcile = checkpoint
       ? `verify \`${checkpoint.sha.slice(0, 7)}\` is on \`${checkpoint.branch}\`, then reconcile the remote branch and pull request if needed`
       : prUrl
@@ -4129,7 +4174,10 @@ function renderUnitReportWithWake(
       ]);
     case "no_verdict":
       if (!shows(verbosity, "verbose"))
-        return `⚠️ No verdict from review round ${e.round.index} — aborted after ${rounds}.${prLine}`;
+        return join([
+          `⚠️ No verdict from review round ${e.round.index} — aborted after ${rounds}.${prLine}`,
+          spentCapAction(),
+        ]);
       return join([
         `⚠️ Review round ${e.round.index} ended without a submitted verdict (budget, refusal, or stop) — ship never converts that into a request for changes, so no findings step ran.`,
         writeUpPointer(s, e.round.kind, s.reviewRunByRound[e.round.index]),

package/dist/assets/src/execution/githubMintScope.ts

@@ -0,0 +1,49 @@
+/** Permissions for the trusted Git door's receive-pack operation. GitHub
+ * also requires Workflows when a pushed commit edits .github/workflows. */
+export const DOOR_PUSH_PERMISSIONS = {
+  contents: "write",
+  workflows: "write",
+  metadata: "read",
+} as const;
+
+/** The resident's root-owned token only clones/fetches its mirror and reads
+ * pull request state for worktree reclamation. */
+export const RESIDENT_MIRROR_PERMISSIONS = {
+  contents: "read",
+  pull_requests: "read",
+  metadata: "read",
+} as const;
+
+type Permission = "read" | "write";
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Check GitHub's effective scope before a token enters either cache. GitHub
+ * may omit its implicit Metadata read grant from the response. Errors contain
+ * only a fixed reason; they never serialize a response or bearer. */
+export function verifyGithubMintScope(
+  response: unknown,
+  repo: string,
+  requested: Readonly<Record<string, Permission>>,
+): void {
+  if (!record(response) || !record(response.permissions)) throw new Error("GitHub token scope mismatch");
+  const actual = response.permissions;
+  if (
+    Object.entries(actual).some(([name, value]) => requested[name] !== value) ||
+    Object.keys(requested).some((name) => !(name in actual) && !(name === "metadata" && requested[name] === "read"))
+  ) {
+    throw new Error("GitHub token scope mismatch");
+  }
+  if (
+    response.repository_selection !== "selected" ||
+    !Array.isArray(response.repositories) ||
+    response.repositories.length !== 1 ||
+    !record(response.repositories[0]) ||
+    typeof response.repositories[0].full_name !== "string" ||
+    response.repositories[0].full_name.toLowerCase() !== repo.toLowerCase()
+  ) {
+    throw new Error("GitHub token scope mismatch");
+  }
+}

package/dist/assets/src/execution/residentCredentials.ts

@@ -1,45 +1,17 @@
-/** The per-exec credential-refresh decision of the execution layer, kept pure
- *  and dependency-free so it is unit-testable from src/ and imported across
- *  packages by the Worker (like residentDetach/shellQuote) — the tested code
- *  IS the shipped code. Two callers share it — the ONE credential refresher:
- *  the resident Worker before every writable `/exec`
- *  (deploy/cloudflare-resident/worker.ts `execThreadImpl`), and the sandbox
- *  executor before every `/exec` it sends
- *  (src/execution/sandboxCredentials.ts, issue 1915).
- *
- *  Background: attach writes a 1-hour GitHub App installation token
- *  into `<worktree>/.git/github-credentials` and points git's `store` helper
- *  at it. Nothing used to refresh it during a run, so a push more than ~60
- *  minutes after attach got 401 — and git's `store` helper ERASES a rejected
- *  credential from its file, leaving the agent staring at an empty file. The
- *  Worker now asks this function before every writable `/exec` and re-mints
- *  (cached per slug) + rewrites the file when it says so.
- *
- *  The refresh is driven by the TOKEN'S OWN EXPIRY, not the file's age.
- *  `mintRepoScopedToken` caches per repository slug, so a token minted for an
- *  earlier thread — with only a few minutes of life left — could be written
- *  for a brand-new attach and, keyed on file age alone, read "fresh" for ~45
- *  minutes while every writable exec in between ran on a dead token (the first
- *  git write 401s, `store` blanks the file, and only the NEXT exec refreshed).
- *  Now the binding records the token's `expiresAtMs`, and this predicate
- *  refreshes once the token is within `CREDENTIAL_EXPIRY_MARGIN_MS` of expiry
- *  — so a writable exec never starts on a token that cannot outlive it. */
+/** The pure expiry decision retained for the optional legacy sandbox
+ *  credential refresher. The production executor factory does not supply
+ *  that credential source: model workspaces use a revocable Git-door run
+ *  bearer, and the resident never refreshes a model-visible App token.
+ *  The resident imports only the expiry margin for its root-owned mirror
+ *  credential cache. */
 
 import { BASH_TIMEOUT_MAX_MS } from "./bashTimeout.js";
 
-/** Backstop for bindings that predate `tokenExpiresAtMs`: re-mint
- *  this long after the file was written when the token's real expiry is
- *  unknown — comfortably before the 60-minute token expiry. New bindings carry
- *  the expiry and take the margin path below instead. */
+/** Legacy refresher backstop when the stored token's expiry is unknown. */
 export const CREDENTIAL_REFRESH_AFTER_MS = 45 * 60_000;
 
-/** Refresh once the token is within this much of expiry, so a writable exec
- *  never starts on a token that cannot outlive the command it is about to run.
- *  Sized like the sandbox's per-command credential margin: the longest
- *  single exec is `BASH_TIMEOUT_MAX_MS` (20 min), plus slack for the mint +
- *  file write and clock skew ⇒ 25 min. This is also `mintRepoScopedToken`'s
- *  cache serve threshold, so the cache and this predicate agree: a token the
- *  cache would still hand out is a token this predicate would not refresh. */
+/** Legacy refresh and root-mirror cache margin: the longest exec is
+ *  `BASH_TIMEOUT_MAX_MS` (20 min), plus five minutes for mint and clock skew. */
 export const CREDENTIAL_EXPIRY_MARGIN_MS = BASH_TIMEOUT_MAX_MS + 5 * 60_000;
 
 export type CredentialRefreshReason =

package/dist/assets/src/execution/residentDestroyGate.ts

@@ -0,0 +1,12 @@
+/** Persist uncertainty before asking the platform to destroy a resident VM.
+ * A rejected or interrupted destroy leaves the fence in storage: callers may
+ * retry destruction, but may not provision or assign a pool user on the old
+ * disk. A failed clear is conservative too, even if the VM was destroyed. */
+export async function destroyWithPersistentFence(
+  fence: { mark(): Promise<void>; clear(): Promise<void> },
+  destroy: () => Promise<void>,
+): Promise<void> {
+  await fence.mark();
+  await destroy();
+  await fence.clear();
+}