@defrex/autobuild 0.10.1 → 0.12.0

package/packages/core/src/ports/workspace/create.ts

@@ -1,3 +1,4 @@
+import { delegateCredential } from '../../store/remote/credentials'
 import { resolve } from 'node:path'
 import { SANDBOX_FORBIDDEN_ENV } from './operator-sandbox'
 import type { WorkspaceConfig } from '../../config/schema'
@@ -131,10 +132,18 @@ export async function createWorkspaceProvider(
     // receives through `opts` reach the plugin factory through the context.
     return await factory({
       config: config.config,
-      env: opts.env,
+      env: Object.fromEntries(Object.entries(opts.env).filter(([key]) => key !== 'AB_TOKEN')),
       repoRoot: resolve(opts.repoRoot),
       ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
-      ...(opts.storeToken !== undefined ? { storeToken: opts.storeToken } : {}),
+      ...(opts.storeRef !== undefined && opts.storeToken !== undefined
+        ? {
+            delegateCredential: (
+              _ref: string,
+              _token: string | undefined,
+              target: Parameters<typeof delegateCredential>[2],
+            ) => delegateCredential(opts.storeRef!, opts.storeToken, target),
+          }
+        : {}),
       ...(opts.runtimeReferences !== undefined
         ? { runtimeReferences: opts.runtimeReferences }
         : {}),

package/packages/core/src/ports/workspace/distribution-archive.ts

@@ -18,11 +18,9 @@
  * version in both modes: origin mode's release-asset tag is the running
  * version by construction, and source mode packs `distributionRoot()`, whose
  * package.json is the same file `readDistributionIdentity()` reads. The hosted
- * remote store enforces exact version lockstep — a client whose
- * `x-autobuild-version` or `x-autobuild-protocol-version` differs from the
- * server's is rejected (409) — so guest, store, and dispatcher versions must
- * move together through a release cut (`tools/release.ts`) plus
- * store/dispatcher upgrades; there is no code path that safely mixes versions.
+ * remote store accepts only its published client release-line window and known
+ * protocol identities (409 outside that contract). Upgrade the service before
+ * a dispatcher moves beyond its window; projects can then upgrade independently.
  * Provisioning records the installed distribution's identity stamp
  * (`readDistributionIdentityStamp()`) in the guest's `.distribution-version`
  * marker and reinstalls the archive on a later mismatch, so an upgraded

package/packages/core/src/ports/workspace/harvest-execution.ts

@@ -2,6 +2,7 @@ import type {
   BuildExecutionHandle,
   BuildExecutionIdentity,
   ExecutionObservation,
+  ExecutionLaunchAuth,
 } from './build-execution'
 
 /** Guest environment variable carrying the serialized harvest launch
@@ -23,6 +24,7 @@ export interface HarvestExecutionEnvironment {
  * advisory. Run state, config, and outcomes are obtained only through the
  * repository journal in the Store. */
 export interface HarvestExecutionStart {
+  preparedRun?: { run: string }
   storeRef: string
   /** Repository identity (normalized origin) the guest serves. */
   repo: string
@@ -101,7 +103,7 @@ export function parseHarvestRunnerLaunch(value: unknown): HarvestRunnerLaunch |
  * observation types so supervision semantics (long-poll wait, teardown
  * outcome, provider liveness) are identical to builds. */
 export interface HarvestExecution {
-  start(input: HarvestExecutionStart): Promise<BuildExecutionHandle>
+  start(input: HarvestExecutionStart, auth?: ExecutionLaunchAuth): Promise<BuildExecutionHandle>
   /** Optional liveness observation of a previously recorded execution, from
    * provider state alone. Absent = this provider cannot observe; callers
    * supervise exactly as before ("cannot observe" never means "act"). */

package/packages/core/src/ports/workspace/local-build-execution.ts

@@ -8,6 +8,7 @@ import type {
   BuildExecutionExit,
   BuildExecutionHandle,
   BuildExecutionStart,
+  ExecutionLaunchAuth,
 } from './build-execution'
 
 export const BUILD_RUNNER_OPTIONS_ENV = 'AB_BUILD_RUNNER_OPTIONS'
@@ -34,10 +35,16 @@ export class LocalBuildExecution implements BuildExecution {
     this.spawn = opts.spawn ?? Bun.spawn
   }
 
-  async start(input: BuildExecutionStart): Promise<BuildExecutionHandle> {
+  async start(
+    input: BuildExecutionStart,
+    auth?: ExecutionLaunchAuth,
+  ): Promise<BuildExecutionHandle> {
+    if (/^https?:/i.test(input.storeRef) && !auth)
+      throw new Error('remote build launch requires delegated authority')
     const child = this.spawn([process.execPath, this.entrypoint], {
       env: {
         ...this.env,
+        AB_TOKEN: auth?.token,
         [BUILD_RUNNER_OPTIONS_ENV]: JSON.stringify({
           ...input,
           supervision: { kind: 'local-parent', parentPid: process.pid },

package/packages/core/src/ports/workspace/vercel-sandbox.ts

@@ -1,3 +1,5 @@
+import { delegateCredential } from '../../store/remote/credentials'
+import type { ExecutionLaunchAuth } from './build-execution'
 import { createHash } from 'node:crypto'
 import { Sandbox, Snapshot, type NetworkPolicy, type SandboxRegion } from '@vercel/sandbox'
 import { displayName, tomlKey, type RuntimeReferenceGroup } from '../../config/roles'
@@ -638,7 +640,9 @@ function runtimeEnvironment(
   env: Record<string, string | undefined>,
 ): Record<string, string> {
   return Object.fromEntries(
-    config.environmentVariables.map((name) => [name, requireVercelEnvironmentValue(env, name)]),
+    config.environmentVariables
+      .filter((name) => name !== 'AB_TOKEN')
+      .map((name) => [name, requireVercelEnvironmentValue(env, name)]),
   )
 }
 
@@ -942,10 +946,9 @@ export async function validateVercelSandbox(
         env: Object.fromEntries([
           ['AB_STORE', options.storeRef],
           ['AB_TOKEN', options.storeToken],
-          ...config.environmentVariables.map((name) => [
-            name,
-            requireVercelEnvironmentValue(options.env, name),
-          ]),
+          ...config.environmentVariables
+            .filter((name) => name !== 'AB_TOKEN')
+            .map((name) => [name, requireVercelEnvironmentValue(options.env, name)]),
         ]),
       }),
     )
@@ -1106,10 +1109,11 @@ async function effectiveArchive(
 }
 
 export interface VercelSandboxProviderOptions {
+  delegateCredential?: typeof delegateCredential
   config: VercelSandboxConfig
   env: Record<string, string | undefined>
   storeRef: string
-  storeToken: string
+  storeToken?: string
   /** Dispatcher-local main checkout, used only for origin discovery and verification.
    * With the injected `origin`/`remoteBranchHead` seams (checkout-less origin
    * mode) it is never touched on the host. */
@@ -1188,18 +1192,21 @@ export class VercelSandboxProvider implements WorkspaceProvider {
   }
 
   constructor(private readonly options: VercelSandboxProviderOptions) {
-    if (!/^https:\/\//i.test(options.storeRef) || options.storeToken === '') {
+    if (
+      !/^https:\/\//i.test(options.storeRef) ||
+      (!options.storeToken && !options.delegateCredential)
+    ) {
       throw new Error('vercel-sandbox requires an HTTPS BuildStore and scoped AB_TOKEN authority')
     }
     this.facade = options.facade ?? createVercelSdkFacade(options.env)
     this.exec = options.exec ?? spawnExec
     this.observeWaitMs = options.observeWaitMs ?? VERCEL_OBSERVE_WAIT_MS
     this.buildExecution = {
-      start: (input) => this.start(input),
+      start: (input, auth) => this.start(input, auth),
       observe: (identity) => this.observeExecution(identity),
     }
     this.harvestExecution = {
-      start: (input) => this.startHarvestExecution(input),
+      start: (input, auth) => this.startHarvestExecution(input, auth),
       observe: (identity) => this.observeExecution(identity),
     }
     this.orchestratorSandbox = {
@@ -1244,6 +1251,11 @@ export class VercelSandboxProvider implements WorkspaceProvider {
     revision?: string
     generation?: number
   }): Promise<WorkspaceProvisionResult> {
+    const scopedToken = await (this.options.delegateCredential ?? delegateCredential)(
+      this.options.storeRef,
+      this.options.storeToken,
+      { kind: 'build-runner', id: opts.branch.replace(/^ab\//, '') },
+    )
     const rawOrigin = await this.origin()
     const origin = cleanGithubOrigin(rawOrigin)
     const name = sandboxName(origin.url, opts.branch, opts.generation)
@@ -1385,7 +1397,7 @@ export class VercelSandboxProvider implements WorkspaceProvider {
         await bootstrapRuntimes(
           sandbox,
           this.options.config,
-          runtimeEnvironment(this.options.config, this.options.env),
+          { ...runtimeEnvironment(this.options.config, this.options.env), AB_TOKEN: scopedToken },
           currentRuntimeReferences(this.options.runtimeReferences),
           true,
         )
@@ -1521,7 +1533,17 @@ export class VercelSandboxProvider implements WorkspaceProvider {
     }
   }
 
-  private async start(input: BuildExecutionStart): Promise<BuildExecutionHandle> {
+  private async start(
+    input: BuildExecutionStart,
+    auth?: ExecutionLaunchAuth,
+  ): Promise<BuildExecutionHandle> {
+    const scopedToken =
+      auth?.token ??
+      (await (this.options.delegateCredential ?? delegateCredential)(
+        this.options.storeRef,
+        this.options.storeToken,
+        { kind: 'build-runner', id: input.slug },
+      ))
     const ref = input.workspaceRef
     if (this.active.has(ref)) throw new Error(`sandbox ${ref} already has a live execution`)
     const sandbox = this.sessions.get(ref) ?? (await this.facade.get(ref, this.operationSignal()))
@@ -1566,21 +1588,21 @@ export class VercelSandboxProvider implements WorkspaceProvider {
     await bootstrapRuntimes(
       sandbox,
       this.options.config,
-      runtimeEnvironment(this.options.config, this.options.env),
+      { ...runtimeEnvironment(this.options.config, this.options.env), AB_TOKEN: scopedToken },
       currentRuntimeReferences(this.options.runtimeReferences),
       false,
     )
     this.sessions.set(ref, sandbox)
     const env: Record<string, string> = {
       AB_STORE: this.options.storeRef,
-      AB_TOKEN: this.options.storeToken,
+      AB_TOKEN: scopedToken,
       [BUILD_RUNNER_OPTIONS_ENV]: JSON.stringify({
         ...input,
         supervision: { kind: 'environment' },
       }),
     }
     for (const name of this.options.config.environmentVariables)
-      env[name] = requireVercelEnvironmentValue(this.options.env, name)
+      if (name !== 'AB_TOKEN') env[name] = requireVercelEnvironmentValue(this.options.env, name)
     const command = (await sandbox.runCommand({
       cmd: 'sh',
       args: [
@@ -1696,7 +1718,12 @@ export class VercelSandboxProvider implements WorkspaceProvider {
    * build execution. Provisioning reuses the module-local build chain so a
    * harvest guest is identical to a build guest; release is the provider's
    * existing reap path (stop, snapshot purge, delete). */
-  private async startHarvestExecution(input: HarvestExecutionStart): Promise<BuildExecutionHandle> {
+  private async startHarvestExecution(
+    input: HarvestExecutionStart,
+    auth?: ExecutionLaunchAuth,
+  ): Promise<BuildExecutionHandle> {
+    if (!auth) throw new Error('harvest launch requires delegated authority')
+    const scopedToken = auth.token
     const origin = cleanGithubOrigin(await this.origin())
     const name = harvestSandboxName(origin.url)
     if (this.active.has(name)) throw new Error(`sandbox ${name} already has a live execution`)
@@ -1824,7 +1851,7 @@ export class VercelSandboxProvider implements WorkspaceProvider {
         await bootstrapRuntimes(
           sandbox,
           this.options.config,
-          runtimeEnvironment(this.options.config, this.options.env),
+          { ...runtimeEnvironment(this.options.config, this.options.env), AB_TOKEN: scopedToken },
           currentRuntimeReferences(this.options.runtimeReferences),
           true,
         )
@@ -1861,7 +1888,7 @@ export class VercelSandboxProvider implements WorkspaceProvider {
     await bootstrapRuntimes(
       sandbox,
       this.options.config,
-      runtimeEnvironment(this.options.config, this.options.env),
+      { ...runtimeEnvironment(this.options.config, this.options.env), AB_TOKEN: scopedToken },
       currentRuntimeReferences(this.options.runtimeReferences),
       false,
     )
@@ -1878,11 +1905,12 @@ export class VercelSandboxProvider implements WorkspaceProvider {
     }
     const env: Record<string, string> = {
       AB_STORE: this.options.storeRef,
-      AB_TOKEN: this.options.storeToken,
+      AB_TOKEN: scopedToken,
       [HARVEST_RUNNER_OPTIONS_ENV]: JSON.stringify(envelope),
     }
     for (const envName of this.options.config.environmentVariables)
-      env[envName] = requireVercelEnvironmentValue(this.options.env, envName)
+      if (envName !== 'AB_TOKEN')
+        env[envName] = requireVercelEnvironmentValue(this.options.env, envName)
     const command = (await sandbox.runCommand({
       cmd: 'sh',
       args: [

package/packages/core/src/processes/build-execution-state.ts

@@ -22,7 +22,7 @@ export function effectiveBuildConfigContent(config: Config): string {
   const { verify, finalize, ...root } = config
   return JSON.stringify({
     ...root,
-    verify: { steps: verify.steps, ...verify.stepConfigs },
+    verify: { steps: verify.steps, afterReconcile: verify.afterReconcile, ...verify.stepConfigs },
     finalize: { steps: finalize.steps, ...finalize.stepConfigs },
   })
 }

package/packages/core/src/processes/build-runner.ts

@@ -1,3 +1,5 @@
+import { delegateCredential } from '../store/remote/credentials'
+import { refreshSummaryBoundary } from '../cli/pr-summary-publication'
 /**
  * The build-runner process (SPEC §3.3): one per build, owns one pipeline
  * execution end to end. The kernel's job reduced to a loop (§8): read the
@@ -170,6 +172,7 @@ export interface BuildRunnerDeps {
   /** Extra AB_* the launcher wants in every session env (e.g. AB_TOKEN,
    * AB_STORE for a remote store) — D8. May override AB_STORE; never the
    * per-session identity keys (AB_BUILD/AB_PHASE/AB_SESSION). */
+  delegateCredential?: typeof delegateCredential
   sessionEnv?: Record<string, string>
   opts?: BuildRunnerOpts
 }
@@ -819,6 +822,26 @@ export class BuildRunner {
     const events = await store.getEvents(slug)
     const decision = decideNext(events, config)
     switch (decision.kind) {
+      case 'capture-reconcile-policy':
+        await store.append(slug, {
+          actor: KERNEL,
+          type: 'verify.reconcile-policy-captured',
+          payload: {
+            reconcileSeq: decision.reconcileSeq,
+            steps: config.verify.steps.map((step) => {
+              const override = config.verify.stepConfigs[step]?.afterReconcile
+              return {
+                step,
+                enabled: override ?? config.verify.afterReconcile,
+                source:
+                  override === undefined
+                    ? 'verify.afterReconcile'
+                    : `verify.${step}.afterReconcile`,
+              }
+            }),
+          },
+        })
+        return decision
       case 'wait':
         return decision
       case 'acknowledge':
@@ -866,12 +889,15 @@ export class BuildRunner {
       }
     }
     try {
+      if (await this.refreshSummary())
+        return reduceBuild(await this.deps.store.getEvents(this.deps.slug))
       if (publicationPending(await this.deps.store.getEvents(this.deps.slug))) {
         return reduceBuild(await this.deps.store.getEvents(this.deps.slug))
       }
       for (;;) {
         await this.ensureLease()
         const decision = await this.step()
+        if (await this.refreshSummary()) break
         if (decision.kind === 'wait') break
         if (publicationPending(await this.deps.store.getEvents(this.deps.slug))) break
       }
@@ -882,6 +908,22 @@ export class BuildRunner {
     }
   }
 
+  private async refreshSummary(): Promise<boolean> {
+    try {
+      await this.ensureLease()
+    } catch {
+      return false
+    }
+    return refreshSummaryBoundary({
+      store: this.deps.store,
+      forge: this.deps.forge,
+      slug: this.deps.slug,
+      workspacePath: this.deps.workspacePath,
+      storeRef: this.deps.sessionEnv?.AB_STORE ?? 'local',
+      clock: this.deps.clock,
+    })
+  }
+
   /**
    * §7.4 exclusivity, holder side: a lapsed lease means the sweep may already
    * have launched a replacement, so this runner must re-claim before doing
@@ -1146,6 +1188,7 @@ export class BuildRunner {
         attempt: decision.attempt,
         outcome: 'skipped',
         reason: decision.reason,
+        ...(decision.skipCause !== undefined ? { skipCause: decision.skipCause } : {}),
       },
     } satisfies EventWrite<'verify.completed'>)
   }
@@ -1254,6 +1297,11 @@ export class BuildRunner {
     events: AbEvent[],
   ): Promise<void> {
     const { step, action } = decision
+    await this.deps.store.append(this.deps.slug, {
+      actor: KERNEL,
+      type: 'finalize.step-started',
+      payload: { step },
+    })
     let actor: Actor = KERNEL
     let durableHead: string | undefined
     let failureNote: string | undefined
@@ -1383,7 +1431,7 @@ export class BuildRunner {
       const turn = await this.runBudgetedTurn(
         started.seq,
         resolved.sessionBudgetSeconds,
-        (signal) =>
+        async (signal) =>
           target.runner.start({
             skill,
             invocation: slug,
@@ -1391,7 +1439,7 @@ export class BuildRunner {
             workspacePath,
             ...(target.model !== undefined ? { model: target.model } : {}),
             ...(target.args !== undefined ? { args: target.args } : {}),
-            env: this.sessionEnvFor('finalize@1', session),
+            env: await this.sessionEnvFor('finalize@1', session),
             signal,
             ...(stream !== undefined ? { stream } : {}),
           }),
@@ -1523,7 +1571,7 @@ export class BuildRunner {
 
     let handle: AgentSessionHandle | undefined
     let failureNote: string | undefined
-    const turn = await this.runBudgetedTurn(started.seq, sessionBudgetSeconds, (signal) =>
+    const turn = await this.runBudgetedTurn(started.seq, sessionBudgetSeconds, async (signal) =>
       runner.start({
         skill,
         invocation: slug,
@@ -1531,7 +1579,7 @@ export class BuildRunner {
         workspacePath,
         ...(model !== undefined ? { model } : {}),
         ...(args !== undefined ? { args } : {}),
-        env: this.sessionEnvFor('finalize@1', session),
+        env: await this.sessionEnvFor('finalize@1', session),
         signal,
         ...(stream !== undefined ? { stream } : {}),
       }),
@@ -1907,26 +1955,29 @@ export class BuildRunner {
       let handle: AgentSessionHandle | undefined = live?.handle
       let result: AgentTurnResult | undefined
       let turnError: unknown
-      const turn = await this.runBudgetedTurn(preSeq, primary.sessionBudgetSeconds, (signal) =>
-        live !== undefined
-          ? live.runner
-              .continue(live.handle, continueMessage(spec), {
-                env: this.sessionEnvFor(spec.abPhase, session),
+      const turn = await this.runBudgetedTurn(
+        preSeq,
+        primary.sessionBudgetSeconds,
+        async (signal) =>
+          live !== undefined
+            ? live.runner
+                .continue(live.handle, continueMessage(spec), {
+                  env: await this.sessionEnvFor(spec.abPhase, session),
+                  signal,
+                  ...(stream !== undefined ? { stream } : {}),
+                })
+                .then((continued) => ({ session: live.handle, result: continued }))
+            : target.runner.start({
+                skill: spec.skill,
+                invocation: slug,
+                buildSlug: slug,
+                workspacePath,
+                ...(target.model !== undefined ? { model: target.model } : {}),
+                ...(target.args !== undefined ? { args: target.args } : {}),
+                env: await this.sessionEnvFor(spec.abPhase, session),
                 signal,
                 ...(stream !== undefined ? { stream } : {}),
-              })
-              .then((continued) => ({ session: live.handle, result: continued }))
-          : target.runner.start({
-              skill: spec.skill,
-              invocation: slug,
-              buildSlug: slug,
-              workspacePath,
-              ...(target.model !== undefined ? { model: target.model } : {}),
-              ...(target.args !== undefined ? { args: target.args } : {}),
-              env: this.sessionEnvFor(spec.abPhase, session),
-              signal,
-              ...(stream !== undefined ? { stream } : {}),
-            }),
+              }),
       )
       if (turn.settlement.kind === 'value') {
         handle = turn.settlement.value.session
@@ -2192,7 +2243,7 @@ export class BuildRunner {
     let handle: AgentSessionHandle | undefined = live?.handle
     let result: AgentTurnResult | undefined
     let turnError: unknown
-    const turn = await this.runBudgetedTurn(preSeq, sessionBudgetSeconds, (signal) => {
+    const turn = await this.runBudgetedTurn(preSeq, sessionBudgetSeconds, async (signal) => {
       if (live !== undefined) {
         // §10: the producer continues its session; the feedback message
         // points at the .ab/ inputs — `ab context` is the real carrier. The
@@ -2202,7 +2253,7 @@ export class BuildRunner {
         // 1's second terminal (§8.4 D5).
         return live.runner
           .continue(live.handle, continueMessage(spec), {
-            env: this.sessionEnvFor(spec.abPhase, session),
+            env: await this.sessionEnvFor(spec.abPhase, session),
             signal,
             ...(stream !== undefined ? { stream } : {}),
           })
@@ -2215,7 +2266,7 @@ export class BuildRunner {
         workspacePath,
         ...(model !== undefined ? { model } : {}),
         ...(args !== undefined ? { args } : {}),
-        env: this.sessionEnvFor(spec.abPhase, session),
+        env: await this.sessionEnvFor(spec.abPhase, session),
         signal,
         ...(stream !== undefined ? { stream } : {}),
       })
@@ -2560,10 +2611,20 @@ export class BuildRunner {
 
   /** D8 ambient auth: sessionEnv may override AB_STORE (remote stores) and
    * add AB_TOKEN, but never the per-session identity keys. */
-  private sessionEnvFor(abPhase: string, session: string): Record<string, string> {
+  private async sessionEnvFor(abPhase: string, session: string): Promise<Record<string, string>> {
+    const parent = this.deps.sessionEnv
+    const token =
+      parent?.AB_STORE && /^https?:/i.test(parent.AB_STORE)
+        ? await (this.deps.delegateCredential ?? delegateCredential)(
+            parent.AB_STORE,
+            parent.AB_TOKEN,
+            { kind: 'build-phase', id: this.deps.slug, session },
+          )
+        : undefined
     return {
       AB_STORE: 'local',
       ...this.deps.sessionEnv,
+      ...(token ? { AB_TOKEN: token } : {}),
       AB_BUILD: this.deps.slug,
       AB_PHASE: abPhase,
       AB_SESSION: session,

package/packages/core/src/processes/dispatch-failure-budget.ts

@@ -0,0 +1,83 @@
+import type { AbEvent } from '../events/catalog'
+import { DISPATCHER } from '../events/envelope'
+import type { IdSource } from '../ids'
+import { defineReducer } from '../kernel/incremental'
+import type { BuildStore } from '../store/types'
+
+interface DispatchBudgetAccumulator {
+  failures: Extract<AbEvent, { type: 'dispatch.failed' }>[]
+  open: string[]
+  aborted: boolean
+}
+
+export function dispatchFailureBudgetReducer(infrastructureOwnsWorkspace: boolean) {
+  return defineReducer({
+    version: 1,
+    initial: (): DispatchBudgetAccumulator => ({ failures: [], open: [], aborted: false }),
+    fold(acc, events: readonly AbEvent[]) {
+      for (const event of events) {
+        if (event.type === 'runner.attached') {
+          acc.failures = []
+        } else if (
+          event.type === 'escalation.raised' &&
+          event.payload.source === 'policy' &&
+          event.payload.policyCause === 'dispatch-failure-limit'
+        ) {
+          if (!acc.open.includes(event.payload.id)) acc.open.push(event.payload.id)
+        } else if (event.type === 'escalation.answered' && acc.open.includes(event.payload.id)) {
+          acc.open = acc.open.filter((id) => id !== event.payload.id)
+          if (event.payload.resolution !== 'abort') acc.failures = []
+          else acc.aborted = true
+        } else if (
+          event.type === 'dispatch.failed' &&
+          !(infrastructureOwnsWorkspace && event.payload.stage === 'workspace')
+        ) {
+          acc.failures.push(event)
+        }
+      }
+    },
+    finish: (acc) => ({
+      count: acc.failures.length,
+      latest: acc.failures.at(-1),
+      parked: acc.aborted || acc.open.length > 0,
+    }),
+  })
+}
+
+/** Lifetime diagnostic attempt numbers are deliberately independent of this epoch. */
+export function dispatchFailureBudget(
+  events: readonly AbEvent[],
+  infrastructureOwnsWorkspace: boolean,
+) {
+  return dispatchFailureBudgetReducer(infrastructureOwnsWorkspace).reduce(events)
+}
+
+/** Repair the failure/raise crash gap before allowing another provider call. */
+export async function ensureDispatchBudget(
+  store: Pick<BuildStore, 'getEvents' | 'appendIfCurrent'>,
+  ids: IdSource,
+  slug: string,
+  maxAttempts: number,
+  infrastructureOwnsWorkspace: boolean,
+): Promise<boolean> {
+  for (;;) {
+    const events = await store.getEvents(slug)
+    const budget = dispatchFailureBudget(events, infrastructureOwnsWorkspace)
+    if (budget.parked) return false
+    if (budget.count < maxAttempts || budget.latest === undefined) return true
+    const failure = budget.latest.payload
+    const raised = await store.appendIfCurrent(slug, events.at(-1)?.seq ?? 0, {
+      actor: DISPATCHER,
+      type: 'escalation.raised',
+      payload: {
+        id: ids('esc'),
+        phase: 'setup',
+        source: 'policy',
+        policyCause: 'dispatch-failure-limit',
+        question: `maxDispatchAttempts (${maxAttempts}) exhausted during ${failure.stage}: ${failure.error}`,
+        refs: [],
+      },
+    })
+    if (raised !== null) return false
+  }
+}