@defrex/autobuild 0.11.0 → 0.12.0

package/packages/core/src/kernel/log-index.ts

@@ -84,6 +84,7 @@ export interface VerifyRecord {
   attempt: number
   outcome: VerifyOutcome
   report?: ArtifactRef
+  skipCause?: 'post-reconcile-policy'
   reason?: string
 }
 
@@ -111,6 +112,12 @@ export interface ReconcileProgressRecord {
 }
 
 export interface LogIndex {
+  /** Latest post-restart policy fact; authoritative only for its originating
+   * reconcile completion, never for a newer review or reconcile cycle. */
+  reconcilePolicy?: {
+    reconcileSeq: number
+    steps: { step: string; enabled: boolean; source: string }[]
+  }
   /** seq of the latest `spec.revised`, else 0 — the restart boundary (§6.3). */
   restartSeq: number
   plan: LoopIndex
@@ -195,6 +202,7 @@ export type LogIndexCandidate =
     }
   | { kind: 'implement-completed'; seq: number }
   | { kind: 'verify-started'; seq: number; attempt: number }
+  | { kind: 'reconcile-policy'; seq: number; policy: NonNullable<LogIndex['reconcilePolicy']> }
   | { kind: 'verify-completed'; record: VerifyRecord }
   | { kind: 'finalize-completed'; seq: number }
   | { kind: 'finalize-step'; seq: number; step: string }
@@ -362,6 +370,9 @@ function foldLogIndex(acc: LogIndexAcc, events: readonly AbEvent[]): void {
         }
         break
       }
+      case 'verify.reconcile-policy-captured':
+        acc.candidates.push({ kind: 'reconcile-policy', seq: event.seq, policy: event.payload })
+        break
       case 'verify.completed': {
         const result = normalizeVerifyCompletion(event.payload)
         acc.maxVerifyAttemptEver = Math.max(acc.maxVerifyAttemptEver, result.attempt)
@@ -374,6 +385,7 @@ function foldLogIndex(acc: LogIndexAcc, events: readonly AbEvent[]): void {
             outcome: result.outcome,
             ...(result.report !== undefined ? { report: result.report } : {}),
             ...(result.reason !== undefined ? { reason: result.reason } : {}),
+            ...(result.skipCause !== undefined ? { skipCause: result.skipCause } : {}),
           },
         })
         break
@@ -451,6 +463,7 @@ function finishLogIndex(acc: LogIndexAcc): LogIndex {
   const verifyCompleted: VerifyRecord[] = []
   const verifyStarted: { seq: number; attempt: number }[] = []
   const finalizeStepsDone = new Set<string>()
+  let reconcilePolicy: LogIndex['reconcilePolicy']
   let lastReconcileCompletedSeq = 0
   let lastImplementCompletedSeq = 0
   let finalizeCompleted = false
@@ -521,6 +534,9 @@ function finishLogIndex(acc: LogIndexAcc): LogIndex {
       case 'verify-started':
         verifyStarted.push({ seq: candidate.seq, attempt: candidate.attempt })
         break
+      case 'reconcile-policy':
+        reconcilePolicy = candidate.policy
+        break
       case 'verify-completed':
         verifyCompleted.push({ ...candidate.record })
         break
@@ -594,6 +610,7 @@ function finishLogIndex(acc: LogIndexAcc): LogIndex {
     verifyCompleted,
     verifyStarted,
     maxVerifyAttemptEver: acc.maxVerifyAttemptEver,
+    reconcilePolicy,
     lastReconcileCompletedSeq,
     lastImplementCompletedSeq,
     finalizeCompleted,

package/packages/core/src/kernel/pr-summary.ts

@@ -0,0 +1,89 @@
+import { defineReducer } from './incremental'
+import type { AbEvent } from '../events/catalog'
+
+/** Latest completed occurrence only: never replay an obsolete publication backlog. */
+export const summaryBoundaryReducer = defineReducer<
+  {
+    occurrence?: number
+    boundary?: number
+    sessions: Record<string, true>
+  },
+  AbEvent,
+  { occurrence: number; boundary: number } | undefined
+>({
+  version: 1,
+  initial: () => ({ sessions: {} }),
+  fold(acc, events) {
+    for (const event of events) {
+      if (
+        [
+          'plan.started',
+          'plan-review.started',
+          'implement.started',
+          'code-review.started',
+          'verify.started',
+          'reconcile.started',
+          'finalize.started',
+          'finalize.step-started',
+        ].includes(event.type)
+      ) {
+        acc.occurrence = event.seq
+        delete acc.boundary
+      }
+      if (event.type === 'session.started') acc.sessions[event.payload.session] = true
+      if (event.type === 'session.ended') delete acc.sessions[event.payload.session]
+      if (
+        acc.occurrence !== undefined &&
+        (event.type === 'session.ended' ||
+          [
+            'plan.completed',
+            'plan-review.verdict',
+            'implement.completed',
+            'code-review.verdict',
+            'verify.completed',
+            'reconcile.completed',
+            'finalize.completed',
+            'finalize.step-completed',
+            'phase.failed',
+            'escalation.raised',
+            'publication.requested',
+          ].includes(event.type))
+      )
+        acc.boundary = event.seq
+    }
+  },
+  finish: (acc) =>
+    acc.occurrence !== undefined &&
+    acc.boundary !== undefined &&
+    Object.keys(acc.sessions).length === 0
+      ? { occurrence: acc.occurrence, boundary: acc.boundary }
+      : undefined,
+})
+
+export function summaryBoundary(events: readonly AbEvent[]) {
+  return summaryBoundaryReducer.reduce(events)
+}
+
+type SummaryRequest = Extract<AbEvent, { type: 'pr-summary.requested' }>
+export const summaryRequestsReducer = defineReducer<
+  {
+    requests: SummaryRequest[]
+    settled: number[]
+  },
+  AbEvent,
+  SummaryRequest[]
+>({
+  version: 1,
+  initial: () => ({ requests: [], settled: [] }),
+  fold(acc, events) {
+    for (const event of events) {
+      if (event.type === 'pr-summary.requested') acc.requests.push(event)
+      if (event.type === 'pr-summary.settled') acc.settled.push(event.payload.request)
+    }
+  },
+  finish: (acc) => acc.requests.filter((event) => !acc.settled.includes(event.seq)),
+})
+
+export function pendingSummaryRequests(events: readonly AbEvent[]) {
+  return summaryRequestsReducer.reduce(events)
+}

package/packages/core/src/kernel/reducer-registry.ts

@@ -1,3 +1,5 @@
+import { summaryBoundaryReducer, summaryRequestsReducer } from './pr-summary'
+import { dispatchFailureBudgetReducer } from '../processes/dispatch-failure-budget'
 import { ticketSourceHealthReducer } from './ticket-source-health'
 /**
  * Every incremental reducer, with its published version and the whole-array
@@ -58,6 +60,8 @@ export interface RegisteredReducer {
 /** Parameterized reducers are registered with representative arguments; the
  * accumulator shape does not depend on them. */
 export const REDUCERS: Record<string, RegisteredReducer> = {
+  summaryBoundary: { reducer: summaryBoundaryReducer, covers: ['summaryBoundary'] },
+  summaryRequests: { reducer: summaryRequestsReducer, covers: ['pendingSummaryRequests'] },
   ticketSourceHealth: { reducer: ticketSourceHealthReducer, covers: ['reduceTicketSourceHealth'] },
   build: { reducer: buildReducer, covers: ['reduceBuild'] },
   harvest: { reducer: harvestReducer, covers: ['reduceHarvest'] },
@@ -97,6 +101,10 @@ export const REDUCERS: Record<string, RegisteredReducer> = {
     covers: ['openHarvestExecutions'],
   },
   openTick: { reducer: openTickReducer('run-a'), covers: ['hasOpenTick'] },
+  dispatchFailureBudget: {
+    reducer: dispatchFailureBudgetReducer(false),
+    covers: ['dispatchFailureBudget'],
+  },
   infrastructureFailureReset: {
     reducer: infrastructureFailureResetReducer,
     covers: ['infrastructureFailureResetSeq'],

package/packages/core/src/kernel/reducer.ts

@@ -113,6 +113,8 @@ export interface VerifyResult {
   attempt: number
   outcome: VerifyOutcome
   report?: ArtifactRef
+  /** Optional classification on kernel policy skips; historical skips omit it. */
+  skipCause?: 'post-reconcile-policy'
   /** Present exactly when `outcome === "skipped"`. */
   reason?: string
   /** seq of the `verify.completed` event — what `cycleSince` is compared to. */
@@ -457,6 +459,11 @@ function foldBuild(acc: BuildAcc, events: readonly AbEvent[]): void {
         break
       case 'workspace.provisioned':
       case 'workspace.released':
+      case 'pr-summary.requested':
+      case 'pr-summary.attempted':
+      case 'pr-summary.result':
+      case 'pr-summary.settled':
+      case 'finalize.step-started':
       case 'publication.requested':
       // Inert loss fact (AUT-328): the dispatcher released a workspace with a
       // pending publication. Recovery runs through the existing
@@ -689,6 +696,7 @@ function foldBuild(acc: BuildAcc, events: readonly AbEvent[]): void {
           outcome: result.outcome,
           report: result.report,
           ...(result.reason !== undefined ? { reason: result.reason } : {}),
+          ...(result.skipCause !== undefined ? { skipCause: result.skipCause } : {}),
           seq: event.seq,
         })
         if (verify.currentStep === result.step) {

package/packages/core/src/ontology.ts

@@ -108,6 +108,7 @@ export const policyEscalationCauseSchema = z.enum([
   'review-round-limit',
   'verify-failure-limit',
   'reconcile-no-progress',
+  'dispatch-failure-limit',
   'setup-failure-limit',
   'infrastructure-failure-limit',
   'phase-attempt-limit',

package/packages/core/src/operator/index.ts

@@ -125,3 +125,10 @@ export type { HarvestStatusView } from '../cli/harvest'
 export type { RepositoryStatus } from '../cli/repository-status'
 export type { BuildSummary } from '../cli/status'
 export type { SessionRecord } from '../store/types'
+
+export {
+  effectiveConfig,
+  selectEffectiveConfig,
+  findEffectiveConfigRef,
+  decodeEffectiveConfig,
+} from './query'

package/packages/core/src/operator/query.ts

@@ -38,7 +38,7 @@ export type BuildListScope = 'active' | 'queued' | 'all'
 
 export class OperatorQueryError extends Error {
   constructor(
-    readonly code: 'not-found' | 'effective-config-unavailable',
+    readonly code: 'not-found' | 'effective-config-unavailable' | 'external-ticket-source',
     message: string,
   ) {
     super(message)
@@ -121,48 +121,70 @@ export async function effectiveConfig(
   status: ReturnType<typeof reduceDispatchStatus>
 }> {
   const repositoryEvents = journal ?? (await readRepoEventsIfRecorded(store, repo))
+  const status = selectEffectiveConfig(repositoryEvents, repo)
+  const ref = status.effectiveConfig!
+  const artifact = await store.getRepoArtifact(repo, ref.kind, ref.rev)
+  if (artifact === null) {
+    throw new OperatorQueryError(
+      'effective-config-unavailable',
+      `effective config ${ref.kind}@${ref.rev} is not retrievable`,
+    )
+  }
+  return {
+    config: decodeEffectiveConfig(artifact.content, `${ref.kind}@${ref.rev}`),
+    repositoryEvents,
+    status,
+  }
+}
+
+function latestDispatchConfigStatus(repositoryEvents: RepositoryEvent[]) {
   let latestRun: string | undefined
   for (const event of repositoryEvents) {
     if (event.type === 'dispatcher.run-started') latestRun = event.payload.run
   }
-  if (latestRun === undefined) {
+  return latestRun === undefined ? undefined : reduceDispatchStatus(repositoryEvents, latestRun)
+}
+
+/** Absence is distinct from a selected reference whose bytes cannot be read. */
+export function findEffectiveConfigRef(repositoryEvents: RepositoryEvent[]) {
+  return latestDispatchConfigStatus(repositoryEvents)?.effectiveConfig
+}
+
+export function selectEffectiveConfig(repositoryEvents: RepositoryEvent[], repo: string) {
+  const status = latestDispatchConfigStatus(repositoryEvents)
+  if (status === undefined) {
     throw new OperatorQueryError(
       'effective-config-unavailable',
       `effective config unavailable for repository "${repo}": no dispatcher run is recorded`,
     )
   }
-  const status = reduceDispatchStatus(repositoryEvents, latestRun)
-  const ref = status.effectiveConfig
-  if (ref === undefined) {
+  if (status.effectiveConfig === undefined) {
     throw new OperatorQueryError(
       'effective-config-unavailable',
       `effective config unavailable for repository "${repo}"`,
     )
   }
-  const artifact = await store.getRepoArtifact(repo, ref.kind, ref.rev)
-  if (artifact === null) {
-    throw new OperatorQueryError(
-      'effective-config-unavailable',
-      `effective config ${ref.kind}@${ref.rev} is not retrievable`,
-    )
-  }
+  return status
+}
+
+export function decodeEffectiveConfig(content: Uint8Array, label: string): Config {
   let raw: unknown
   try {
-    raw = JSON.parse(new TextDecoder().decode(artifact.content))
+    raw = JSON.parse(new TextDecoder().decode(content))
   } catch {
     throw new OperatorQueryError(
       'effective-config-unavailable',
-      `effective config ${ref.kind}@${ref.rev} is not valid JSON`,
+      `effective config ${label} is not valid JSON`,
     )
   }
   const parsed = configSchema.safeParse(raw)
   if (!parsed.success) {
     throw new OperatorQueryError(
       'effective-config-unavailable',
-      `effective config ${ref.kind}@${ref.rev} is invalid: ${parsed.error.message}`,
+      `effective config ${label} is invalid: ${parsed.error.message}`,
     )
   }
-  return { config: parsed.data, repositoryEvents, status }
+  return parsed.data
 }
 
 export interface OperatorBuildView {

package/packages/core/src/operator/ticket-source-backend.ts

@@ -39,6 +39,7 @@ export function ticketBackendFromSource(options: {
         tickets.readyState,
         tickets.createState,
         tickets.claimedState,
+        tickets.doneState,
         tickets.proposalState ?? defaultTriageState(options.config),
       ].filter((state): state is string => typeof state === 'string' && state.trim().length > 0)
       return [...new Set(states)]

package/packages/core/src/operator/tickets.ts

@@ -10,9 +10,11 @@ import {
 import type { DependencyState, Ticket, TicketSource, TicketUpdate } from '../ports/types'
 import type { BuildStore } from '../store/types'
 import { defaultTriageState } from '../processes/dispatcher'
-import { effectiveConfig, OperatorQueryError } from './query'
+import { effectiveConfig } from './query'
 
 export interface OperatorTicketContext {
+  repo: string
+  tickets: Config['tickets']
   teamKey: string
   claimedState?: string
   createState?: string
@@ -48,14 +50,10 @@ export interface OperatorTicketDetail {
 
 function contextFor(config: Config, repo: string): OperatorTicketContext {
   const tickets = config.tickets
-  if (tickets.teamKey === undefined) {
-    throw new OperatorQueryError(
-      'effective-config-unavailable',
-      `effective config unavailable for repository "${repo}": [tickets].teamKey is required for hosted ticket access`,
-    )
-  }
   return {
-    teamKey: tickets.teamKey,
+    repo,
+    tickets,
+    teamKey: tickets.teamKey ?? '',
     ...(tickets.claimedState !== undefined ? { claimedState: tickets.claimedState } : {}),
     ...(tickets.createState !== undefined ? { createState: tickets.createState } : {}),
   }

package/packages/core/src/plugin-sdk/index.ts

@@ -5,6 +5,7 @@
  */
 export type * from '../ports/types'
 export type * from '../ports/workspace/build-execution'
+export type * from '../ports/workspace/harvest-execution'
 export type * from '../store/types'
 export * from '../store/session-reducer'
 export type {

package/packages/core/src/plugins/manifest.ts

@@ -1,3 +1,4 @@
+import type { delegateCredential } from '../store/remote/credentials'
 import semver from 'semver'
 import { z } from 'zod'
 import { openMap } from '../open-map'
@@ -51,9 +52,10 @@ export interface WorkspaceProviderPluginFactoryContext<Config = Record<string, u
    * `createWorkspaceProvider` refuses construction before the factory runs
    * when either store seam is missing. */
   storeRef?: string
-  /** Scoped store token (`AB_TOKEN`). Guaranteed present under
-   * `capabilities.storeRequirements` for the same reason. */
-  storeToken?: string
+  /** @deprecated Project credentials are never delivered to plugin factories. */
+  storeToken?: never
+  /** Host-only exchange; pass the returned per-resource token at launch. */
+  delegateCredential?: typeof delegateCredential
   /** Host-derived effective runtime routes (the referenced runtimes and their
    * selection provenance). Absent at call sites that reference no runtimes
    * (for example the MCP server), which never construct a workspace. */

package/packages/core/src/plugins/runtimes.ts

@@ -39,7 +39,9 @@ export async function materializePluginRuntimes(
 
   const merged = Object.assign(Object.create(null) as RuntimeRegistry, builtins)
   const config = Object.freeze({})
-  const env = Object.freeze({ ...opts.env })
+  const env = Object.freeze(
+    Object.fromEntries(Object.entries(opts.env).filter(([key]) => key !== 'AB_TOKEN')),
+  )
   const context: PluginFactoryContext = {
     config,
     env,

package/packages/core/src/ports/forge/fake.ts

@@ -1,3 +1,4 @@
+import { findSummaryMarker } from './summary-marker'
 /**
  * FakeForge (SPEC §3.2): in-memory Forge for seam tests. Gate existence and
  * current PR merge state are independent inputs, matching GitHubForge's safety
@@ -514,6 +515,17 @@ export class FakeForge implements Forge {
 
   async commentOnPr(workspacePath: string, number: number, body: string): Promise<void> {
     this.assertPr(number)
-    this.comments.push({ workspacePath, number, body })
+    const marker = findSummaryMarker(body)
+    const existing =
+      marker === undefined
+        ? undefined
+        : this.comments.find(
+            (comment) =>
+              comment.number === number &&
+              comment.workspacePath === workspacePath &&
+              findSummaryMarker(comment.body) === marker,
+          )
+    if (existing !== undefined) existing.body = body
+    else this.comments.push({ workspacePath, number, body })
   }
 }

package/packages/core/src/ports/forge/github-transport.ts

@@ -52,7 +52,12 @@ export class GitHubApiError extends Error {
   readonly status: number
   readonly body?: unknown
 
-  constructor(status: number, message: string, body?: unknown) {
+  constructor(
+    status: number,
+    message: string,
+    body?: unknown,
+    readonly headers: Record<string, string> = {},
+  ) {
     super(message)
     this.name = 'GitHubApiError'
     this.status = status
@@ -225,6 +230,7 @@ export function createGitHubFetchTransport(opts: {
         response.status,
         `${githubErrorMessage(response.status, json, text)}${anonymous}`,
         json,
+        headerMap,
       )
     }
     return {
@@ -361,3 +367,32 @@ export function githubTokenSource(
 ): () => Promise<GitHubCredential> {
   return () => resolveGitHubToken(env, exec)
 }
+
+/** Documented primary and secondary limits; permission failures are ordinary errors. */
+export function githubRateLimitUntil(error: unknown, now: number): string | undefined {
+  if (!(error instanceof GitHubApiError)) return undefined
+  if (
+    error.status !== 429 &&
+    !(
+      error.status === 403 &&
+      (error.headers['x-ratelimit-remaining'] === '0' ||
+        /rate limit|secondary.*limit|content.creation.*limit/i.test(error.message))
+    )
+  )
+    return undefined
+  const retry = error.headers['retry-after']
+  const seconds = retry === undefined ? NaN : Number(retry)
+  const retryAt = Number.isFinite(seconds) ? now + seconds * 1000 : Date.parse(retry ?? '')
+  // The reset describes the primary quota window, even on secondary-limit responses.
+  const reset =
+    error.headers['x-ratelimit-remaining'] === '0'
+      ? Number(error.headers['x-ratelimit-reset']) * 1000
+      : NaN
+  return new Date(
+    Math.max(
+      now + 60_000,
+      Number.isFinite(retryAt) ? retryAt : 0,
+      Number.isFinite(reset) ? reset : 0,
+    ),
+  ).toISOString()
+}

package/packages/core/src/ports/forge/github.ts

@@ -1,3 +1,4 @@
+import { findSummaryMarker } from './summary-marker'
 /**
  * GitHubForge (SPEC §3.2): the Forge adapter for GitHub, speaking the GitHub
  * REST API through an injectable transport seam. All remote access is
@@ -1131,11 +1132,34 @@ export class GitHubForge implements Forge {
   /** The build's summary comment (SPEC §7.5) — links into the store. */
   async commentOnPr(_workspacePath: string, number: number, body: string): Promise<void> {
     const { owner, name } = await this.requireCoordinates()
-    await this.request(
-      'POST',
-      `repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/issues/${number}/comments`,
-      { body: { body } },
-    )
+    const root = `repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`
+    const collection = `${root}/issues/${number}/comments`
+    const marker = findSummaryMarker(body)
+    if (marker !== undefined) {
+      const schema = z.array(z.object({ id: z.number().int().positive(), body: z.string() }))
+      // A failed discovery never authorizes creation. Re-scan once if an edit
+      // races deletion; an uncertain POST is rediscovered on the next phase.
+      for (let scan = 0; scan < 2; scan++) {
+        let match: { id: number; body: string } | undefined
+        for (let page = 1; ; page++) {
+          const response = await this.request('GET', collection, {
+            query: { per_page: '100', page: String(page) },
+          })
+          const comments = schema.parse(response.json)
+          match ??= comments.find((comment) => findSummaryMarker(comment.body) === marker)
+          if (comments.length < 100) break
+        }
+        if (match === undefined) break
+        if (match.body === body) return
+        try {
+          await this.request('PATCH', `${root}/issues/comments/${match.id}`, { body: { body } })
+          return
+        } catch (error) {
+          if (!(error instanceof GitHubApiError) || error.status !== 404 || scan !== 0) throw error
+        }
+      }
+    }
+    await this.request('POST', collection, { body: { body } })
   }
 
   // ── Optional capabilities (checkout-less dispatcher) ──────────────────────

package/packages/core/src/ports/forge/local-git.ts

@@ -1,3 +1,4 @@
+import { findSummaryMarker } from './summary-marker'
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -590,9 +591,16 @@ export class LocalGitForge implements Forge {
   }
 
   async commentOnPr(workspacePath: string, number: number, body: string): Promise<void> {
-    await this.updateRecord(workspacePath, number, (record) => ({
-      ...record,
-      comments: record.comments.includes(body) ? record.comments : [...record.comments, body],
-    }))
+    const marker = findSummaryMarker(body)
+    await this.updateRecord(workspacePath, number, (record) => {
+      const index =
+        marker === undefined
+          ? -1
+          : record.comments.findIndex((comment) => findSummaryMarker(comment) === marker)
+      const comments = [...record.comments]
+      if (index >= 0) comments[index] = body
+      else if (!comments.includes(body)) comments.push(body)
+      return { ...record, comments }
+    })
   }
 }

package/packages/core/src/ports/forge/summary-marker.ts

@@ -0,0 +1,8 @@
+/** Stable, injection-safe identity shared by built-in forge adapters. */
+export function summaryMarker(build: string): string {
+  return `<!-- autobuild-summary:v1:${Buffer.from(build).toString('hex')} -->`
+}
+
+export function findSummaryMarker(body: string): string | undefined {
+  return body.split('\n').find((line) => /^<!-- autobuild-summary:v1:[0-9a-f]+ -->$/.test(line))
+}

package/packages/core/src/ports/runner/session-env.ts

@@ -21,6 +21,7 @@ export function sessionEnv(
   for (const [key, value] of Object.entries(ambient)) {
     if (value !== undefined) env[key] = value
   }
+  delete env.AB_TOKEN
   Object.assign(env, scoped)
 
   const inheritedPath = env.PATH

package/packages/core/src/ports/tickets/create.ts

@@ -1,3 +1,7 @@
+import { configuredStore } from '../../cli/configured-store'
+import { projectToken } from '../../cli/project-credentials'
+import { resolveRepoOrigin } from '../../cli/repo-state'
+import { spawnExec } from '../workspace/git-worktree'
 /**
  * TicketSource factory (SPEC §3.2, §13): construct the builtin or plugin source
  * named by [tickets]. Plugin credentials, like LINEAR_API_KEY, come only from
@@ -28,7 +32,7 @@ export async function createTicketSource(
   plugins: PluginRegistry = createPluginRegistry(),
 ): Promise<TicketSource> {
   if (config.source === 'hosted') {
-    const rawUrl = env.AB_STORE?.trim()
+    const rawUrl = env.AB_STORE?.trim() || configuredStore(targetRepo)
     if (!rawUrl) {
       throw new Error(
         'AB_STORE is not set — required when [tickets].source = "hosted"; set it to the hosted service HTTP(S) URL',
@@ -43,10 +47,14 @@ export async function createTicketSource(
     if (serviceUrl.protocol !== 'http:' && serviceUrl.protocol !== 'https:') {
       throw new Error('AB_STORE must be an HTTP(S) URL when [tickets].source = "hosted"')
     }
-    const token = env.AB_TOKEN?.trim()
+    const token = projectToken(
+      rawUrl,
+      (await resolveRepoOrigin(targetRepo, spawnExec)) ?? targetRepo,
+      env,
+    )
     if (!token) {
       throw new Error(
-        'AB_TOKEN is not set — an operator-scope token is required when [tickets].source = "hosted"',
+        'No project credential; run ab connect (or set AB_TOKEN) — a project credential is required when [tickets].source = "hosted"',
       )
     }
     if (config.teamKey === undefined) {

package/packages/core/src/ports/tickets/hosted-index.ts

@@ -9,6 +9,3 @@ export {
   hostedTicketRequestSchemas,
 } from './remote-protocol'
 export type { HostedTicketContext, HostedTicketOperation } from './remote-protocol'
-// The hosted service composes the already live-proven Linear adapter; provider
-// credentials remain server-side.
-export { LinearTicketSource } from './linear'

package/packages/core/src/ports/tickets/remote-protocol.ts

@@ -4,6 +4,7 @@ import { ticketRefSchema } from '../../ontology'
 /** Repository-owned policy sent with every hosted ticket operation. */
 export const hostedTicketContextSchema = z.strictObject({
   teamKey: z.string().min(1),
+  repo: z.string().min(1).optional(),
   claimedState: z.string().min(1).optional(),
   createState: z.string().min(1).optional(),
 })

package/packages/core/src/ports/tickets/remote.ts

@@ -49,6 +49,7 @@ export class HostedTicketSource implements TicketSource {
     this.fetchFn = options.fetchFn ?? fetch
     this.context = {
       teamKey: options.teamKey,
+      ...(options.repo !== undefined ? { repo: options.repo } : {}),
       ...(options.claimedState !== undefined ? { claimedState: options.claimedState } : {}),
       ...(options.createState !== undefined ? { createState: options.createState } : {}),
     }

package/packages/core/src/ports/workspace/build-execution.ts

@@ -114,8 +114,12 @@ export type ExecutionObservation =
  * provider may implement this by starting the fixed build process beside its
  * checkout; the kernel need not know where that is. Every provider owns full
  * teardown of the environment and descendants it starts before completion. */
+export interface ExecutionLaunchAuth {
+  token: string
+}
+
 export interface BuildExecution {
-  start(input: BuildExecutionStart): Promise<BuildExecutionHandle>
+  start(input: BuildExecutionStart, auth?: ExecutionLaunchAuth): Promise<BuildExecutionHandle>
   /** Optional liveness observation of a previously recorded execution, from
    * provider state alone. Absent = this provider cannot observe; callers
    * supervise exactly as before ("cannot observe" never means "act"). */