@defrex/autobuild 0.11.0 → 0.13.0

package/packages/core/src/config/schema.ts

@@ -12,6 +12,7 @@
  * validated.
  */
 import { z } from 'zod'
+import { normalizeServiceURL } from '../connection'
 import { prImageHostSchema } from '../ontology'
 import { SANDBOX_FORBIDDEN_ENV } from '../ports/workspace/operator-sandbox'
 import {
@@ -60,14 +61,22 @@ function stepSection<T, C>(
   label: string,
   stepsSchema: z.ZodType<string[]>,
   tableSchema: z.ZodType<T>,
-  compose: (steps: string[], stepConfigs: Record<string, T>) => C,
+  compose: (steps: string[], stepConfigs: Record<string, T>, afterReconcile: boolean) => C,
+  allowAfterReconcile = false,
 ) {
   return z
     .unknown()
     .transform((input, ctx): C => {
       const stepConfigs: Record<string, T> = Object.create(null)
       let steps: string[] = []
+      let afterReconcile = true
       for (const [key, raw] of ownEntries(input, label, ctx)) {
+        if (key === 'afterReconcile' && allowAfterReconcile) {
+          const parsed = z.boolean().safeParse(raw)
+          if (parsed.success) afterReconcile = parsed.data
+          else forwardIssues(parsed.error.issues, ctx, [key])
+          continue
+        }
         if (key === 'steps') {
           const parsed = stepsSchema.safeParse(raw)
           if (parsed.success) steps = parsed.data
@@ -77,7 +86,7 @@ function stepSection<T, C>(
         const table = parseEntry(tableSchema, raw, key, ctx)
         if (table.ok) defineEntry(stepConfigs, key, table.value)
       }
-      return compose(steps, stepConfigs)
+      return compose(steps, stepConfigs, afterReconcile)
     })
     .prefault({})
 }
@@ -367,6 +376,7 @@ export const verifyPathGlobSchema = z.string().superRefine((pattern, ctx) => {
 })
 
 const verifyApplicabilityShape = {
+  afterReconcile: z.boolean().optional(),
   /** Any-match positive path selectors; absent means unconditional. */
   paths: z
     .array(verifyPathGlobSchema)
@@ -399,6 +409,7 @@ export const verifyStepConfigSchema = z.discriminatedUnion('kind', [
 export type VerifyStepConfig = z.infer<typeof verifyStepConfigSchema>
 
 export interface VerifyConfig {
+  afterReconcile: boolean
   /** Step order — each entry names a `verify:<step>` phase (§15.2.1). */
   steps: string[]
   /** The [verify.<step>] tables, keyed by step name. */
@@ -406,8 +417,8 @@ export interface VerifyConfig {
 }
 
 /**
- * [verify] mixes one known key (`steps`) with an open set of per-step
- * subtables, so it cannot be a strictObject; instead every non-`steps` key is
+ * [verify] mixes known scalars (`steps`, `afterReconcile`) with per-step
+ * subtables, so it cannot be a strictObject; every other key is
  * validated as a step table — nothing passes through loosely, and no step name
  * is lost to the prototype chain (see `stepSection`).
  */
@@ -415,7 +426,8 @@ export const verifySectionSchema = stepSection(
   '[verify]',
   z.array(z.string().min(1)).default([]),
   verifyStepConfigSchema,
-  (steps, stepConfigs): VerifyConfig => ({ steps, stepConfigs }),
+  (steps, stepConfigs, afterReconcile): VerifyConfig => ({ steps, stepConfigs, afterReconcile }),
+  true,
 )
 
 // ── [finalize.<step>] ────────────────────────────────────────────────────────
@@ -500,6 +512,8 @@ export const policySchema = z.strictObject({
   /** Same-finding survival threshold before auto-escalate (§10, §15.4). */
   stallRounds: z.number().int().positive().default(3),
   maxVerifyAttempts: z.number().int().positive().default(3),
+  /** Consecutive dispatch failures before human intervention is required. */
+  maxDispatchAttempts: z.number().int().positive().default(3),
   /** Consecutive workspace setup failures before human intervention is required. */
   maxSetupAttempts: z.number().int().positive().default(3),
   /** Consecutive provider lifecycle failures before recovery requires a human retry. */
@@ -521,7 +535,8 @@ export type PolicyConfig = z.infer<typeof policySchema>
 // API key comes from the LINEAR_API_KEY environment variable, never from this
 // file.
 
-export const ticketsSchema = z.strictObject({
+export const ticketsInputSchema = z.strictObject({
+  url: z.string().optional(),
   /** Builtin or plugin-registered TicketSource name. Registry membership is
    * validated after configured plugins load. */
   source: z
@@ -555,7 +570,8 @@ export const ticketsSchema = z.strictObject({
     .refine(
       (s) => s.trim().length > 0,
       '[tickets].readyState must not be blank — name the one workflow state a ticket must sit in to be dispatched (e.g. "ready").',
-    ),
+    )
+    .optional(),
   /**
    * Narrows readiness to tickets assigned to one Linear user — a third
    * conjunctive gate beside readyState and readyLabels. `"me"` is the owner of
@@ -573,15 +589,33 @@ export const ticketsSchema = z.strictObject({
   /** Backend team key (e.g. "ENG") — required for linear and hosted. */
   teamKey: z.string().min(1).optional(),
   /** Workflow state claim() moves an issue to (§12); Linear and hosted. */
-  claimedState: z.string().min(1).optional(),
+  claimedState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
+  /** Hosted project completion state; defaults to done. */
+  doneState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State create() files new tickets into. Absent = the provider's default
    * (Linear: the team's default state, e.g. Backlog; file: Triage). */
-  createState: z.string().min(1).optional(),
+  createState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State the dispatcher hands tickets back to for human triage — spec-gate
    * bounces (§6.3), aborted builds, closed-unmerged PRs. Absent = the
    * provider's default (Linear: Backlog; file: Triage) — resolved by
    * defaultTriageState in src/processes/dispatcher.ts. */
-  triageState: z.string().min(1).optional(),
+  triageState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State harvest files its synthesized proposals into (§12). Absent = the
    * triage state, which keeps the constitutional grooming gate: a proposal
    * waits for a human before it can be dispatched. Setting it to readyState
@@ -590,7 +624,11 @@ export const ticketsSchema = z.strictObject({
    * does not also redirect spec-gate bounces, aborts, and closed-unmerged PRs
    * into the ready state, where a bounce would re-dispatch itself. Resolved by
    * defaultProposalState in src/processes/dispatcher.ts. */
-  proposalState: z.string().min(1).optional(),
+  proposalState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** Directory of state dirs (`triage/ ready/ doing/ done/`) holding `<id>.md`
    * ticket files; optional — defaults to `.autobuild/tickets`, resolved
    * relative to the repo. Kept schema-optional (not `.default()`) so the
@@ -598,6 +636,36 @@ export const ticketsSchema = z.strictObject({
    * still tell a defaulted dir from an explicit one. */
   dir: z.string().min(1).optional(),
 })
+export const ticketsSchema = ticketsInputSchema
+  .superRefine((tickets, ctx) => {
+    if (tickets.source === 'hosted' && tickets.url !== undefined) {
+      try {
+        normalizeServiceURL(tickets.url, 'tickets.url')
+      } catch (error) {
+        ctx.addIssue({ code: 'custom', path: ['url'], message: (error as Error).message })
+      }
+    }
+    if (tickets.source !== 'hosted' && tickets.readyState === undefined)
+      ctx.addIssue({
+        code: 'custom',
+        path: ['readyState'],
+        message:
+          '[tickets].readyState is required — name the one workflow state a ticket must sit in to be dispatched (e.g. "ready").',
+      })
+    if (['file', 'linear'].includes(tickets.source) && tickets.url !== undefined)
+      ctx.addIssue({
+        code: 'custom',
+        path: ['url'],
+        message: '[tickets].url applies only to source = "hosted"',
+      })
+  })
+  .transform((tickets) => ({
+    ...tickets,
+    readyState: tickets.readyState ?? 'ready',
+    ...(tickets.source === 'hosted' && tickets.url !== undefined
+      ? { url: normalizeServiceURL(tickets.url, 'tickets.url') }
+      : {}),
+  }))
 export type TicketsConfig = z.infer<typeof ticketsSchema>
 
 // ── [orchestrator] ──────────────────────────────────────────────────────────
@@ -725,7 +793,18 @@ export type OrchestratorConfig = z.infer<typeof orchestratorSchema>
 
 // ── Whole file ───────────────────────────────────────────────────────────────
 
+export const storeSchema = z.strictObject({
+  url: z.string().transform((value, ctx) => {
+    try {
+      return normalizeServiceURL(value)
+    } catch (error) {
+      ctx.addIssue({ code: 'custom', message: (error as Error).message })
+      return z.NEVER
+    }
+  }),
+})
 const configRootSchema = z.strictObject({
+  store: storeSchema.optional(),
   /** Base branch builds cut from and target (§16.1). */
   baseBranch: z.string().min(1).default('main'),
   /** Concurrent builds for this repository (§16.1). */

package/packages/core/src/connection.ts

@@ -0,0 +1,86 @@
+import { normalizeGitRemoteUrl } from './kernel/origin'
+/** Public device-approval protocol. Secrets travel only in capability POST bodies. */
+export type ConnectionStatus = 'pending' | 'approved' | 'denied' | 'expired'
+export interface ConnectionProposal {
+  repo: string
+  credentialId: string
+  digest: string
+}
+export interface ConnectionOutcome {
+  repo: string
+  credentialId: string
+  status: ConnectionStatus
+}
+export interface ConnectionStarted extends ConnectionOutcome {
+  id: string
+  capability: string
+  code: string
+  verificationURL: string
+  interval: number
+  expiresAt: string
+}
+export function normalizeServiceURL(raw: string, setting = 'store.url'): string {
+  let url: URL
+  try {
+    url = new URL(raw)
+  } catch {
+    throw new Error(`${setting} must be an absolute HTTPS service URL`)
+  }
+  if (
+    !raw.trim() ||
+    raw !== raw.trim() ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    !(
+      url.protocol === 'https:' ||
+      (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
+    )
+  ) {
+    throw new Error(
+      `${setting} must be HTTPS (HTTP is allowed on loopback), without credentials, query or fragment`,
+    )
+  }
+  return url.href.replace(/\/+$/, '')
+}
+
+export function normalizeConnectionRepository(raw: string): string {
+  const value = raw.trim()
+  // SSH's conventional git user is transport syntax; URL passwords and HTTPS
+  // userinfo are never part of an identity (normalization would discard them).
+  if (/[\s\\?#]/.test(value) || !value || (/^[^/]*:[^/]*@/.test(value) && !value.includes('://')))
+    throw new Error('invalid repository identity')
+  if (value.includes('://')) {
+    let input: URL
+    try {
+      input = new URL(value)
+    } catch {
+      throw new Error('invalid repository identity')
+    }
+    if (input.password || (input.username && !['ssh:', 'git+ssh:'].includes(input.protocol))) {
+      throw new Error('repository identity must not contain credentials')
+    }
+    if (input.search || input.hash) throw new Error('invalid repository identity')
+  }
+  const normalized = normalizeGitRemoteUrl(value)
+  let url: URL
+  try {
+    url = new URL(normalized)
+  } catch {
+    throw new Error('invalid repository identity')
+  }
+  if (
+    url.protocol !== 'https:' ||
+    !url.hostname ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    url.pathname === '/' ||
+    /%|\\/.test(url.pathname)
+  ) {
+    throw new Error('repository identity must be a normalized HTTPS repository origin')
+  }
+  return normalized
+}

package/packages/core/src/events/catalog.ts

@@ -51,6 +51,11 @@ export const allowedActorKinds: Record<EventType, readonly ActorKind[]> = {
   'execution.ended': ['dispatcher'],
   'infrastructure.failed': ['dispatcher'],
   'infrastructure.cleanup-attempted': ['dispatcher'],
+  'pr-summary.requested': ['kernel'],
+  'pr-summary.attempted': ['kernel'],
+  'pr-summary.result': ['kernel'],
+  'pr-summary.settled': ['kernel'],
+  'finalize.step-started': ['kernel'],
   'publication.requested': ['agent', 'kernel'],
   // Only the dispatcher releases workspaces and settles publications (§15.7);
   // the kernel never destroys one, so it never records a loss.
@@ -88,6 +93,7 @@ export const allowedActorKinds: Record<EventType, readonly ActorKind[]> = {
   'code-review.started': ['kernel'],
   'code-review.verdict': ['agent'],
 
+  'verify.reconcile-policy-captured': ['kernel'],
   'verify.started': ['kernel'],
   'verify.completed': ['kernel', 'agent'],
   'finalize.started': ['kernel'],
@@ -177,10 +183,13 @@ export function validateEventWrite(input: {
     const escalation = payloadResult.data as EventPayload<'escalation.raised'>
     if (
       actor.kind === 'dispatcher' &&
-      (escalation.source !== 'policy' || escalation.policyCause !== 'infrastructure-failure-limit')
+      (escalation.source !== 'policy' ||
+        (escalation.policyCause !== 'infrastructure-failure-limit' &&
+          escalation.policyCause !== 'dispatch-failure-limit' &&
+          escalation.policyCause !== 'execution-no-progress'))
     ) {
       throw new EventValidationError(
-        'invalid dispatcher escalation: only policy/infrastructure-failure-limit may be raised outside the kernel',
+        'invalid dispatcher escalation: only policy/infrastructure-failure-limit or policy/dispatch-failure-limit or policy/execution-no-progress may be raised outside the kernel',
       )
     }
     if (escalation.source === 'policy' && escalation.policyCause === undefined) {

package/packages/core/src/events/payloads.ts

@@ -172,6 +172,7 @@ const verifyCompletedPayloadSchema = z.union([
     z.strictObject({
       ...verifyCompletionBase,
       outcome: z.literal('skipped'),
+      skipCause: z.literal('post-reconcile-policy').optional(),
       reason: z.string().trim().min(1, 'a skipped verification requires a non-blank reason'),
     }),
   ]),
@@ -195,6 +196,12 @@ const finalizeStepCompletedPayloadSchema = z.discriminatedUnion('ok', [
 /** One ticket asset revision a build froze (SPEC §6.3): the identity and
  * shape of what `listTicketAssets` returned at the pinning moment. */
 export const pinnedAssetSchema = z.strictObject({
+  snapshot: z
+    .strictObject({
+      kind: z.string().regex(/^ticket-snapshot-[a-f0-9-]+$/),
+      revision: z.number().int().nonnegative(),
+    })
+    .optional(),
   kind: z.string().min(1),
   name: z.string().min(1),
   revision: z.number().int().nonnegative(),
@@ -336,6 +343,26 @@ export const eventPayloadSchemas = {
       })
       .optional(),
   }),
+  /** Optional summary publication identities and durable write budgets. */
+  'pr-summary.requested': z.strictObject({
+    occurrence: z.number().int().positive(),
+    boundary: z.number().int().positive(),
+  }),
+  'pr-summary.attempted': z.strictObject({
+    occurrence: z.number().int().positive(),
+    boundary: z.number().int().positive(),
+    pr: z.number().int().positive(),
+  }),
+  'pr-summary.result': z.strictObject({
+    attempt: z.number().int().positive(),
+    outcome: z.enum(['success', 'failure', 'rate-limited']),
+    eligibleAfter: z.string().datetime().optional(),
+  }),
+  'pr-summary.settled': z.strictObject({
+    request: z.number().int().positive(),
+    disposition: z.enum(['attempted', 'skipped', 'deferred']),
+  }),
+  'finalize.step-started': z.strictObject({ step: z.string().min(1) }),
   /** Remote phases deposit their output and park before trusted publication.
    * The dispatcher settles the request only after the VM session and execution
    * lease are gone, then appends the ordinary phase completion fact. */
@@ -515,6 +542,27 @@ export const eventPayloadSchemas = {
      * starts. */
     feedback: feedbackSchema.optional(),
   }),
+  'verify.reconcile-policy-captured': z.strictObject({
+    reconcileSeq: z.number().int().positive(),
+    steps: z
+      .array(
+        z.strictObject({
+          step: z.string().min(1),
+          enabled: z.boolean(),
+          source: z.string().min(1),
+        }),
+      )
+      .superRefine((steps, ctx) => {
+        if (new Set(steps.map((s) => s.step)).size !== steps.length)
+          ctx.addIssue({ code: 'custom', message: 'duplicate policy step' })
+        for (const s of steps)
+          if (
+            s.source !== 'verify.afterReconcile' &&
+            s.source !== `verify.${s.step}.afterReconcile`
+          )
+            ctx.addIssue({ code: 'custom', message: 'invalid policy source' })
+      }),
+  }),
   'verify.completed': verifyCompletedPayloadSchema,
   'finalize.started': empty,
   'finalize.completed': z.strictObject({
@@ -630,6 +678,7 @@ export interface NormalizedVerifyCompletion {
   outcome: VerifyOutcome
   report?: ArtifactRef
   reason?: string
+  skipCause?: 'post-reconcile-policy'
 }
 
 /**
@@ -653,6 +702,7 @@ export function normalizeVerifyCompletion(
       attempt: payload.attempt,
       outcome: 'skipped',
       reason: payload.reason,
+      ...(payload.skipCause !== undefined ? { skipCause: payload.skipCause } : {}),
     }
   }
   return {

package/packages/core/src/events/repository.ts

@@ -90,6 +90,7 @@ const tickCountersSchema = z.strictObject({
 const restartRequiredConfigPathSchema = z.enum([
   'forge',
   'plugins',
+  'store',
   'workspace.provider',
   'workspace.config',
   'tickets.source',
@@ -154,6 +155,16 @@ export const harvestEventPayloadSchemas = {
    * command supervising the guest runner. Written as soon as the launch
    * succeeds so a later process can re-observe the execution without
    * process memory. */
+  'harvest.execution.authorized': z.strictObject({
+    execution: z.string().min(1),
+    run: z.string().min(1),
+    launch: z.enum(['started', 'resumed']),
+    leaseHolder: z.string().min(1),
+  }),
+  'harvest.execution.ended': z.strictObject({
+    execution: z.string().min(1),
+    run: z.string().min(1),
+  }),
   'harvest.execution.started': z.strictObject({
     execution: z.string().min(1),
     provider: z.string().min(1),
@@ -557,6 +568,8 @@ const allowedActorKinds: Record<RepositoryEventType, readonly ActorKind[]> = {
   'harvest.recovery-requested': ['kernel'],
   'harvest.recovery-exhausted': ['kernel'],
   'harvest.started': ['dispatcher', 'kernel'],
+  'harvest.execution.authorized': ['dispatcher'],
+  'harvest.execution.ended': ['dispatcher'],
   'harvest.execution.started': ['dispatcher'],
   'harvest.execution.released': ['dispatcher'],
   'harvest.step.started': ['kernel'],

package/packages/core/src/integration/harness.ts

@@ -57,7 +57,13 @@ import type {
 import { GitWorktreeProvider, spawnExec } from '../ports/workspace/git-worktree'
 import { InProcessBuildExecution } from '../ports/workspace/in-process-build-execution'
 import { BuildRunner, LeaseHeldError, SetupFailureError } from '../processes/build-runner'
-import { diagnosticArtifact } from '../processes/build-execution-state'
+import {
+  diagnosticArtifact,
+  BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+  effectiveBuildConfigContent,
+  parseEffectiveBuildConfig,
+} from '../processes/build-execution-state'
+import { composeBuildConfig } from '../config/live'
 import { Dispatcher, type LaunchRunnerResult } from '../processes/dispatcher'
 import {
   getHarvestStatus,
@@ -120,6 +126,7 @@ export const CONFORMING_BODY = [
 export function readyTicket(id: string, over: Partial<Omit<Ticket, 'ref'>> = {}): Ticket {
   const title = over.title ?? 'Add rate limiting'
   return {
+    revision: 'fixture',
     ref: { source: 'fake', id, title },
     title,
     body: over.body ?? CONFORMING_BODY,
@@ -398,6 +405,10 @@ export async function makeHarness(opts: {
    * CONFIG_TOML, so every existing scenario is untouched; a scenario proving
    * two-axis routing (§9) supplies its own `[roles.default]`/phase roles. */
   configToml?: string
+  /** Force a routing disagreement while retaining the runner's branch config. */
+  dispatcherConfig?: (config: Config) => Config
+  pinnedConfig?: boolean
+  getConfig?: () => Config
   /** Forge gate existence is independent from current PR mergeability. */
   gatePresence?: 'present' | 'absent'
   /** Optional adapter-level runtime composition for focused integration tests.
@@ -602,6 +613,20 @@ export async function makeHarness(opts: {
       runner: new BuildRunner({
         store: activeStore.scopeBuild(slug),
         config,
+        ...(opts.pinnedConfig
+          ? {
+              getConfig: async () => {
+                const artifact = await activeStore.getArtifact(
+                  slug,
+                  BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+                )
+                return composeBuildConfig(
+                  artifact === null ? config : parseEffectiveBuildConfig(artifact),
+                  opts.getConfig?.() ?? config,
+                )
+              },
+            }
+          : {}),
         // Two-axis registry (§9): every runtime is backed by the SAME scripted
         // runner instance, so the `s_1…s_N` session numbering scenarios rely on
         // is preserved regardless of which runtime a role selects. `scripted`
@@ -629,6 +654,15 @@ export async function makeHarness(opts: {
     }
   }
   const launchRunner = async (slug: string): Promise<LaunchRunnerResult> => {
+    if (
+      opts.pinnedConfig &&
+      (await activeStore.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)) === null
+    ) {
+      await activeStore.putArtifact(slug, {
+        kind: BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+        content: effectiveBuildConfigContent(config),
+      })
+    }
     launched.push({ slug, ...(await makeRunner(slug)) })
     return 'scheduled'
   }
@@ -638,10 +672,11 @@ export async function makeHarness(opts: {
     tickets: ticketSource,
     workspaces,
     forge: selectedForge,
-    config,
+    config: opts.dispatcherConfig?.(structuredClone(config)) ?? config,
     repo: origin,
     exec: spawnExec,
     launchRunner,
+    ...(opts.getConfig ? { getConfig: opts.getConfig } : {}),
     ids,
     clock,
   })