@defrex/autobuild 0.10.1 → 0.12.0

package/packages/core/src/config/schema.ts

@@ -12,6 +12,7 @@
  * validated.
  */
 import { z } from 'zod'
+import { normalizeServiceURL } from '../connection'
 import { prImageHostSchema } from '../ontology'
 import { SANDBOX_FORBIDDEN_ENV } from '../ports/workspace/operator-sandbox'
 import {
@@ -60,14 +61,22 @@ function stepSection<T, C>(
   label: string,
   stepsSchema: z.ZodType<string[]>,
   tableSchema: z.ZodType<T>,
-  compose: (steps: string[], stepConfigs: Record<string, T>) => C,
+  compose: (steps: string[], stepConfigs: Record<string, T>, afterReconcile: boolean) => C,
+  allowAfterReconcile = false,
 ) {
   return z
     .unknown()
     .transform((input, ctx): C => {
       const stepConfigs: Record<string, T> = Object.create(null)
       let steps: string[] = []
+      let afterReconcile = true
       for (const [key, raw] of ownEntries(input, label, ctx)) {
+        if (key === 'afterReconcile' && allowAfterReconcile) {
+          const parsed = z.boolean().safeParse(raw)
+          if (parsed.success) afterReconcile = parsed.data
+          else forwardIssues(parsed.error.issues, ctx, [key])
+          continue
+        }
         if (key === 'steps') {
           const parsed = stepsSchema.safeParse(raw)
           if (parsed.success) steps = parsed.data
@@ -77,7 +86,7 @@ function stepSection<T, C>(
         const table = parseEntry(tableSchema, raw, key, ctx)
         if (table.ok) defineEntry(stepConfigs, key, table.value)
       }
-      return compose(steps, stepConfigs)
+      return compose(steps, stepConfigs, afterReconcile)
     })
     .prefault({})
 }
@@ -367,6 +376,7 @@ export const verifyPathGlobSchema = z.string().superRefine((pattern, ctx) => {
 })
 
 const verifyApplicabilityShape = {
+  afterReconcile: z.boolean().optional(),
   /** Any-match positive path selectors; absent means unconditional. */
   paths: z
     .array(verifyPathGlobSchema)
@@ -399,6 +409,7 @@ export const verifyStepConfigSchema = z.discriminatedUnion('kind', [
 export type VerifyStepConfig = z.infer<typeof verifyStepConfigSchema>
 
 export interface VerifyConfig {
+  afterReconcile: boolean
   /** Step order — each entry names a `verify:<step>` phase (§15.2.1). */
   steps: string[]
   /** The [verify.<step>] tables, keyed by step name. */
@@ -406,8 +417,8 @@ export interface VerifyConfig {
 }
 
 /**
- * [verify] mixes one known key (`steps`) with an open set of per-step
- * subtables, so it cannot be a strictObject; instead every non-`steps` key is
+ * [verify] mixes known scalars (`steps`, `afterReconcile`) with per-step
+ * subtables, so it cannot be a strictObject; every other key is
  * validated as a step table — nothing passes through loosely, and no step name
  * is lost to the prototype chain (see `stepSection`).
  */
@@ -415,7 +426,8 @@ export const verifySectionSchema = stepSection(
   '[verify]',
   z.array(z.string().min(1)).default([]),
   verifyStepConfigSchema,
-  (steps, stepConfigs): VerifyConfig => ({ steps, stepConfigs }),
+  (steps, stepConfigs, afterReconcile): VerifyConfig => ({ steps, stepConfigs, afterReconcile }),
+  true,
 )
 
 // ── [finalize.<step>] ────────────────────────────────────────────────────────
@@ -500,6 +512,8 @@ export const policySchema = z.strictObject({
   /** Same-finding survival threshold before auto-escalate (§10, §15.4). */
   stallRounds: z.number().int().positive().default(3),
   maxVerifyAttempts: z.number().int().positive().default(3),
+  /** Consecutive dispatch failures before human intervention is required. */
+  maxDispatchAttempts: z.number().int().positive().default(3),
   /** Consecutive workspace setup failures before human intervention is required. */
   maxSetupAttempts: z.number().int().positive().default(3),
   /** Consecutive provider lifecycle failures before recovery requires a human retry. */
@@ -573,15 +587,33 @@ export const ticketsSchema = z.strictObject({
   /** Backend team key (e.g. "ENG") — required for linear and hosted. */
   teamKey: z.string().min(1).optional(),
   /** Workflow state claim() moves an issue to (§12); Linear and hosted. */
-  claimedState: z.string().min(1).optional(),
+  claimedState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
+  /** Hosted project completion state; defaults to Done. */
+  doneState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State create() files new tickets into. Absent = the provider's default
    * (Linear: the team's default state, e.g. Backlog; file: Triage). */
-  createState: z.string().min(1).optional(),
+  createState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State the dispatcher hands tickets back to for human triage — spec-gate
    * bounces (§6.3), aborted builds, closed-unmerged PRs. Absent = the
    * provider's default (Linear: Backlog; file: Triage) — resolved by
    * defaultTriageState in src/processes/dispatcher.ts. */
-  triageState: z.string().min(1).optional(),
+  triageState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State harvest files its synthesized proposals into (§12). Absent = the
    * triage state, which keeps the constitutional grooming gate: a proposal
    * waits for a human before it can be dispatched. Setting it to readyState
@@ -590,7 +622,11 @@ export const ticketsSchema = z.strictObject({
    * does not also redirect spec-gate bounces, aborts, and closed-unmerged PRs
    * into the ready state, where a bounce would re-dispatch itself. Resolved by
    * defaultProposalState in src/processes/dispatcher.ts. */
-  proposalState: z.string().min(1).optional(),
+  proposalState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** Directory of state dirs (`triage/ ready/ doing/ done/`) holding `<id>.md`
    * ticket files; optional — defaults to `.autobuild/tickets`, resolved
    * relative to the repo. Kept schema-optional (not `.default()`) so the
@@ -644,7 +680,7 @@ const ORCHESTRATOR_APPROVAL_ENTRY = /^[a-z][a-z0-9_.]*(:[a-z0-9_-]+)?$/
 /** The attention set a new session's wake settings inherit when the
  * repository does not override `wake`: the build events an operator or agent
  * must wake up for (the same set `ab watch` filters on by default) plus the
- * repository-journal attention events (the same set `ab watch --repository`
+ * repository-journal attention events (the same set `ab watch`
  * follows), spelled as literal globs. Both halves of the attention set can
  * wake a session. */
 export const defaultOrchestratorWakeGlobs: readonly string[] = [
@@ -725,11 +761,23 @@ export type OrchestratorConfig = z.infer<typeof orchestratorSchema>
 
 // ── Whole file ───────────────────────────────────────────────────────────────
 
+export const storeSchema = z.strictObject({
+  url: z.string().transform((value, ctx) => {
+    try {
+      return normalizeServiceURL(value)
+    } catch (error) {
+      ctx.addIssue({ code: 'custom', message: (error as Error).message })
+      return z.NEVER
+    }
+  }),
+})
 const configRootSchema = z.strictObject({
+  store: storeSchema.optional(),
   /** Base branch builds cut from and target (§16.1). */
   baseBranch: z.string().min(1).default('main'),
   /** Concurrent builds for this repository (§16.1). */
   capacity: z.number().int().positive().default(1),
+  ticketScanIntervalSeconds: z.number().int().positive().default(60),
   /** Forge adapter selected from builtins and configured plugins. */
   forge: z
     .string()
@@ -769,7 +817,13 @@ const configRootSchema = z.strictObject({
 })
 
 /** Root metadata keeps strict error prose and documentation coverage honest. */
-export const TOP_LEVEL_SCALARS = ['baseBranch', 'capacity', 'forge', 'plugins'] as const
+export const TOP_LEVEL_SCALARS = [
+  'baseBranch',
+  'capacity',
+  'ticketScanIntervalSeconds',
+  'forge',
+  'plugins',
+] as const
 export const TOP_LEVEL_TABLES = Object.keys(configRootSchema.shape).filter(
   (key) => !(TOP_LEVEL_SCALARS as readonly string[]).includes(key),
 )

package/packages/core/src/connection.ts

@@ -0,0 +1,86 @@
+import { normalizeGitRemoteUrl } from './kernel/origin'
+/** Public device-approval protocol. Secrets travel only in capability POST bodies. */
+export type ConnectionStatus = 'pending' | 'approved' | 'denied' | 'expired'
+export interface ConnectionProposal {
+  repo: string
+  credentialId: string
+  digest: string
+}
+export interface ConnectionOutcome {
+  repo: string
+  credentialId: string
+  status: ConnectionStatus
+}
+export interface ConnectionStarted extends ConnectionOutcome {
+  id: string
+  capability: string
+  code: string
+  verificationURL: string
+  interval: number
+  expiresAt: string
+}
+export function normalizeServiceURL(raw: string): string {
+  let url: URL
+  try {
+    url = new URL(raw)
+  } catch {
+    throw new Error('store.url must be an absolute HTTPS service URL')
+  }
+  if (
+    !raw.trim() ||
+    raw !== raw.trim() ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    !(
+      url.protocol === 'https:' ||
+      (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
+    )
+  ) {
+    throw new Error(
+      'store.url must be HTTPS (HTTP is allowed on loopback), without credentials, query or fragment',
+    )
+  }
+  return url.href.replace(/\/+$/, '')
+}
+
+export function normalizeConnectionRepository(raw: string): string {
+  const value = raw.trim()
+  // SSH's conventional git user is transport syntax; URL passwords and HTTPS
+  // userinfo are never part of an identity (normalization would discard them).
+  if (/[\s\\?#]/.test(value) || !value || (/^[^/]*:[^/]*@/.test(value) && !value.includes('://')))
+    throw new Error('invalid repository identity')
+  if (value.includes('://')) {
+    let input: URL
+    try {
+      input = new URL(value)
+    } catch {
+      throw new Error('invalid repository identity')
+    }
+    if (input.password || (input.username && !['ssh:', 'git+ssh:'].includes(input.protocol))) {
+      throw new Error('repository identity must not contain credentials')
+    }
+    if (input.search || input.hash) throw new Error('invalid repository identity')
+  }
+  const normalized = normalizeGitRemoteUrl(value)
+  let url: URL
+  try {
+    url = new URL(normalized)
+  } catch {
+    throw new Error('invalid repository identity')
+  }
+  if (
+    url.protocol !== 'https:' ||
+    !url.hostname ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    url.pathname === '/' ||
+    /%|\\/.test(url.pathname)
+  ) {
+    throw new Error('repository identity must be a normalized HTTPS repository origin')
+  }
+  return normalized
+}

package/packages/core/src/events/catalog.ts

@@ -51,6 +51,11 @@ export const allowedActorKinds: Record<EventType, readonly ActorKind[]> = {
   'execution.ended': ['dispatcher'],
   'infrastructure.failed': ['dispatcher'],
   'infrastructure.cleanup-attempted': ['dispatcher'],
+  'pr-summary.requested': ['kernel'],
+  'pr-summary.attempted': ['kernel'],
+  'pr-summary.result': ['kernel'],
+  'pr-summary.settled': ['kernel'],
+  'finalize.step-started': ['kernel'],
   'publication.requested': ['agent', 'kernel'],
   // Only the dispatcher releases workspaces and settles publications (§15.7);
   // the kernel never destroys one, so it never records a loss.
@@ -88,6 +93,7 @@ export const allowedActorKinds: Record<EventType, readonly ActorKind[]> = {
   'code-review.started': ['kernel'],
   'code-review.verdict': ['agent'],
 
+  'verify.reconcile-policy-captured': ['kernel'],
   'verify.started': ['kernel'],
   'verify.completed': ['kernel', 'agent'],
   'finalize.started': ['kernel'],
@@ -177,10 +183,12 @@ export function validateEventWrite(input: {
     const escalation = payloadResult.data as EventPayload<'escalation.raised'>
     if (
       actor.kind === 'dispatcher' &&
-      (escalation.source !== 'policy' || escalation.policyCause !== 'infrastructure-failure-limit')
+      (escalation.source !== 'policy' ||
+        (escalation.policyCause !== 'infrastructure-failure-limit' &&
+          escalation.policyCause !== 'dispatch-failure-limit'))
     ) {
       throw new EventValidationError(
-        'invalid dispatcher escalation: only policy/infrastructure-failure-limit may be raised outside the kernel',
+        'invalid dispatcher escalation: only policy/infrastructure-failure-limit or policy/dispatch-failure-limit may be raised outside the kernel',
       )
     }
     if (escalation.source === 'policy' && escalation.policyCause === undefined) {

package/packages/core/src/events/globs.ts

@@ -10,8 +10,9 @@ import { EVENT_TYPES } from './payloads'
 import { REPOSITORY_EVENT_TYPES } from './repository'
 
 export interface CompileEventGlobsOptions {
-  /** Also accept matches in the repository-journal catalog (the `--repository`
-   * behavior of `ab watch`/`ab wait`). */
+  /** Also accept matches in the repository-journal catalog (the no-slug or
+   * explicit `--repository` behavior of `ab watch`; wait remains build-only). */
+  additionalCatalog?: readonly string[]
   repository?: boolean
   usage: string
 }
@@ -35,7 +36,11 @@ export function compileEventGlobs(
     const inBuildCatalog = EVENT_TYPES.some((type) => regex.test(type))
     const inRepositoryCatalog =
       opts.repository === true && REPOSITORY_EVENT_TYPES.some((type) => regex.test(type))
-    if (!inBuildCatalog && !inRepositoryCatalog) {
+    if (
+      !inBuildCatalog &&
+      !inRepositoryCatalog &&
+      !opts.additionalCatalog?.some((type) => regex.test(type))
+    ) {
       throw new Error(
         `--event "${glob}" matches no known event type${
           opts.repository ? ' in the build or repository catalogs' : ' in the build event catalog'

package/packages/core/src/events/payloads.ts

@@ -172,6 +172,7 @@ const verifyCompletedPayloadSchema = z.union([
     z.strictObject({
       ...verifyCompletionBase,
       outcome: z.literal('skipped'),
+      skipCause: z.literal('post-reconcile-policy').optional(),
       reason: z.string().trim().min(1, 'a skipped verification requires a non-blank reason'),
     }),
   ]),
@@ -336,6 +337,26 @@ export const eventPayloadSchemas = {
       })
       .optional(),
   }),
+  /** Optional summary publication identities and durable write budgets. */
+  'pr-summary.requested': z.strictObject({
+    occurrence: z.number().int().positive(),
+    boundary: z.number().int().positive(),
+  }),
+  'pr-summary.attempted': z.strictObject({
+    occurrence: z.number().int().positive(),
+    boundary: z.number().int().positive(),
+    pr: z.number().int().positive(),
+  }),
+  'pr-summary.result': z.strictObject({
+    attempt: z.number().int().positive(),
+    outcome: z.enum(['success', 'failure', 'rate-limited']),
+    eligibleAfter: z.string().datetime().optional(),
+  }),
+  'pr-summary.settled': z.strictObject({
+    request: z.number().int().positive(),
+    disposition: z.enum(['attempted', 'skipped', 'deferred']),
+  }),
+  'finalize.step-started': z.strictObject({ step: z.string().min(1) }),
   /** Remote phases deposit their output and park before trusted publication.
    * The dispatcher settles the request only after the VM session and execution
    * lease are gone, then appends the ordinary phase completion fact. */
@@ -515,6 +536,27 @@ export const eventPayloadSchemas = {
      * starts. */
     feedback: feedbackSchema.optional(),
   }),
+  'verify.reconcile-policy-captured': z.strictObject({
+    reconcileSeq: z.number().int().positive(),
+    steps: z
+      .array(
+        z.strictObject({
+          step: z.string().min(1),
+          enabled: z.boolean(),
+          source: z.string().min(1),
+        }),
+      )
+      .superRefine((steps, ctx) => {
+        if (new Set(steps.map((s) => s.step)).size !== steps.length)
+          ctx.addIssue({ code: 'custom', message: 'duplicate policy step' })
+        for (const s of steps)
+          if (
+            s.source !== 'verify.afterReconcile' &&
+            s.source !== `verify.${s.step}.afterReconcile`
+          )
+            ctx.addIssue({ code: 'custom', message: 'invalid policy source' })
+      }),
+  }),
   'verify.completed': verifyCompletedPayloadSchema,
   'finalize.started': empty,
   'finalize.completed': z.strictObject({
@@ -630,6 +672,7 @@ export interface NormalizedVerifyCompletion {
   outcome: VerifyOutcome
   report?: ArtifactRef
   reason?: string
+  skipCause?: 'post-reconcile-policy'
 }
 
 /**
@@ -653,6 +696,7 @@ export function normalizeVerifyCompletion(
       attempt: payload.attempt,
       outcome: 'skipped',
       reason: payload.reason,
+      ...(payload.skipCause !== undefined ? { skipCause: payload.skipCause } : {}),
     }
   }
   return {

package/packages/core/src/events/repository.ts

@@ -64,6 +64,7 @@ const tickCountersSchema = z.strictObject({
   /** Added in plugin/API-era 1.4; optional so historical tick facts replay. */
   creationWithheld: z.number().int().nonnegative().optional(),
   dependencyBlocked: z.number().int().nonnegative(),
+  dependencyCheckFailed: z.number().int().nonnegative().optional(),
   /** Foreign executions settled from durable facts plus provider liveness.
    * Added with durable supervision; optional so historical tick facts replay. */
   settled: z.number().int().nonnegative().optional(),
@@ -89,6 +90,7 @@ const tickCountersSchema = z.strictObject({
 const restartRequiredConfigPathSchema = z.enum([
   'forge',
   'plugins',
+  'store',
   'workspace.provider',
   'workspace.config',
   'tickets.source',
@@ -153,6 +155,16 @@ export const harvestEventPayloadSchemas = {
    * command supervising the guest runner. Written as soon as the launch
    * succeeds so a later process can re-observe the execution without
    * process memory. */
+  'harvest.execution.authorized': z.strictObject({
+    execution: z.string().min(1),
+    run: z.string().min(1),
+    launch: z.enum(['started', 'resumed']),
+    leaseHolder: z.string().min(1),
+  }),
+  'harvest.execution.ended': z.strictObject({
+    execution: z.string().min(1),
+    run: z.string().min(1),
+  }),
   'harvest.execution.started': z.strictObject({
     execution: z.string().min(1),
     provider: z.string().min(1),
@@ -353,14 +365,30 @@ export const orchestratorSandboxEventPayloadSchemas = {
 } as const
 
 export const dispatcherStatusEventPayloadSchemas = {
+  /** Completed ticket-source measurement, independent of dispatcher runs. */
+  'dispatcher.ticket-scan-completed': z.strictObject({
+    startedAt: z.iso.datetime(),
+    readinessFingerprint: z.string().min(1),
+    criteriaFingerprint: z.string().min(1),
+    mode: z.enum(['admission', 'observation']),
+    queued: z.number().int().nonnegative(),
+    invalidTickets: z.number().int().nonnegative(),
+    ticketDiagnostics: boundedDiagnostics,
+    dependencyBlocked: z.number().int().nonnegative(),
+    dependencyDiagnostics: boundedDiagnostics,
+    creationWithheld: z.number().int().nonnegative(),
+    creationDiagnostics: boundedDiagnostics,
+  }),
   /** A terminal frontend follows exactly one run. The referenced artifact is
    * the composed Config the kernel is actually using, never an on-disk guess. */
   'dispatcher.run-started': z.strictObject({
     run: dispatchRun,
     pid: z.number().int().positive(),
+    host: z.string().trim().min(1).optional(),
     effectiveConfig: artifactRefSchema,
     roleWarnings: boundedDiagnostics,
   }),
+  'dispatcher.stop-requested': z.strictObject({ run: dispatchRun, signal: z.string().min(1) }),
   'dispatcher.run-stopped': z.strictObject({
     run: dispatchRun,
     outcome: z.enum(['normal', 'abnormal', 'forced']),
@@ -449,7 +477,32 @@ export const dispatcherSettingEventPayloadSchemas = {
   'dispatcher.auto-merge-default-set': dispatcherSetting,
 } as const
 
+const ticketSourceCondition = {
+  source: z.string().min(1),
+  operation: z.enum(['ready-scan', 'dependency-check']),
+  message: z.string().min(1),
+}
+export const ticketSourceHealthEventPayloadSchemas = {
+  /** An existing listing-limit episode also encountered a limited dependency
+   * read. Strengthens recovery evidence without closing or reopening it. */
+  'dispatcher.ticket-source-dependency-limited': z.strictObject({ source: z.string().min(1) }),
+  'dispatcher.ticket-source-degraded': z.discriminatedUnion('cause', [
+    z.strictObject({
+      ...ticketSourceCondition,
+      cause: z.literal('rate-limited'),
+      resetAt: z.iso.datetime(),
+    }),
+    z.strictObject({ ...ticketSourceCondition, cause: z.literal('ready-scan-failed') }),
+  ]),
+  'dispatcher.ticket-source-recovered': z.strictObject({
+    source: z.string().min(1),
+    cause: z.enum(['rate-limited', 'ready-scan-failed']),
+    operation: z.enum(['ready-scan', 'dependency-check']),
+  }),
+} as const
+
 export const repositoryEventPayloadSchemas = {
+  ...ticketSourceHealthEventPayloadSchemas,
   ...harvestEventPayloadSchemas,
   ...orchestratorSandboxEventPayloadSchemas,
   ...dispatcherStatusEventPayloadSchemas,
@@ -461,11 +514,13 @@ export const REPOSITORY_EVENT_TYPES = Object.keys(
   repositoryEventPayloadSchemas,
 ) as RepositoryEventType[]
 
-/** The repository-journal attention set, followed only under `--repository`
- * by `ab watch` and scanned by the orchestrator wake pass. */
+/** Repository attention followed by `ab watch` with no slugs or explicit
+ * `--repository`, and scanned by the orchestrator wake pass. */
 export const REPOSITORY_ATTENTION_EVENTS = [
   'harvest.escalated',
   'harvest.failed',
+  'dispatcher.ticket-source-degraded',
+  'dispatcher.ticket-source-recovered',
   'dispatcher.tick-failed',
   'dispatcher.config-rejected',
   'dispatcher.harvest-runner-failed',
@@ -513,6 +568,8 @@ const allowedActorKinds: Record<RepositoryEventType, readonly ActorKind[]> = {
   'harvest.recovery-requested': ['kernel'],
   'harvest.recovery-exhausted': ['kernel'],
   'harvest.started': ['dispatcher', 'kernel'],
+  'harvest.execution.authorized': ['dispatcher'],
+  'harvest.execution.ended': ['dispatcher'],
   'harvest.execution.started': ['dispatcher'],
   'harvest.execution.released': ['dispatcher'],
   'harvest.step.started': ['kernel'],
@@ -539,12 +596,17 @@ const allowedActorKinds: Record<RepositoryEventType, readonly ActorKind[]> = {
   'orchestrator.sandbox.published': ['human'],
   'orchestrator.sandbox.publish-failed': ['human'],
   'dispatcher.run-started': ['dispatcher'],
+  'dispatcher.stop-requested': ['dispatcher'],
   'dispatcher.run-stopped': ['dispatcher'],
   'dispatcher.tick-yielded': ['dispatcher'],
   'dispatcher.config-rejected': ['dispatcher'],
   'dispatcher.config-publication-failed': ['dispatcher'],
   'dispatcher.tick-started': ['dispatcher'],
   'dispatcher.tick-completed': ['dispatcher'],
+  'dispatcher.ticket-scan-completed': ['dispatcher'],
+  'dispatcher.ticket-source-dependency-limited': ['dispatcher'],
+  'dispatcher.ticket-source-degraded': ['dispatcher'],
+  'dispatcher.ticket-source-recovered': ['dispatcher'],
   'dispatcher.tick-failed': ['dispatcher'],
   'dispatcher.runner-settled': ['dispatcher'],
   'dispatcher.harvest-runner-failed': ['dispatcher'],

package/packages/core/src/integration/harness.ts

@@ -124,6 +124,7 @@ export function readyTicket(id: string, over: Partial<Omit<Ticket, 'ref'>> = {})
     title,
     body: over.body ?? CONFORMING_BODY,
     state: over.state ?? 'Ready',
+    resolved: false,
     labels: over.labels ?? ['autobuild'],
   }
 }
@@ -369,7 +370,7 @@ export async function assertSnapshotEquivalence(store: BuildStore, repo: string)
       dashboard: await attempt(() =>
         getOperatorDashboard({ store: target, repo, clock: () => at }),
       ),
-      status: await attempt(() => getRepositoryStatus(target, repo)),
+      status: await attempt(() => getRepositoryStatus(target, repo, at)),
       harvest: await attempt(() => getHarvestStatus(target, repo)),
       lists: await Promise.all(
         (['active', 'queued', 'all'] as const).map((scope) =>