@defrex/autobuild 0.11.0 → 0.13.0

package/packages/core/src/operator/tickets.ts

@@ -1,6 +1,9 @@
+import { samplePinnedAssets, preparePinnedAssets } from '../store/ticket-assets'
+import type { TicketRef } from '../ontology'
 import type { Config } from '../config/schema'
 import { reduceBuild } from '../kernel/reducer'
 import {
+  TicketOperationError,
   changeBlockers,
   createTicket,
   moveTicket,
@@ -9,16 +12,19 @@ import {
 } from '../ports/tickets/operations'
 import type { DependencyState, Ticket, TicketSource, TicketUpdate } from '../ports/types'
 import type { BuildStore } from '../store/types'
-import { defaultTriageState } from '../processes/dispatcher'
-import { effectiveConfig, OperatorQueryError } from './query'
+import { ticketLifecycle } from '../ports/tickets/lifecycle'
+import { effectiveConfig } from './query'
 
 export interface OperatorTicketContext {
+  repo: string
+  tickets: Config['tickets']
   teamKey: string
   claimedState?: string
   createState?: string
 }
 
 export interface OperatorTicketBackend {
+  contextFor?(repo: string): Promise<OperatorTicketContext>
   sourceFor(context: OperatorTicketContext): TicketSource | Promise<TicketSource>
   statesFor(context: OperatorTicketContext, source: TicketSource): string[] | Promise<string[]>
 }
@@ -48,14 +54,10 @@ export interface OperatorTicketDetail {
 
 function contextFor(config: Config, repo: string): OperatorTicketContext {
   const tickets = config.tickets
-  if (tickets.teamKey === undefined) {
-    throw new OperatorQueryError(
-      'effective-config-unavailable',
-      `effective config unavailable for repository "${repo}": [tickets].teamKey is required for hosted ticket access`,
-    )
-  }
   return {
-    teamKey: tickets.teamKey,
+    repo,
+    tickets,
+    teamKey: tickets.teamKey ?? '',
     ...(tickets.claimedState !== undefined ? { claimedState: tickets.claimedState } : {}),
     ...(tickets.createState !== undefined ? { createState: tickets.createState } : {}),
   }
@@ -65,10 +67,11 @@ export async function openOperatorTickets(opts: {
   store: BuildStore
   repo: string
   backend: OperatorTicketBackend
-}): Promise<{ config: Config; context: OperatorTicketContext; source: TicketSource }> {
-  const { config } = await effectiveConfig(opts.store, opts.repo)
-  const context = contextFor(config, opts.repo)
-  return { config, context, source: await opts.backend.sourceFor(context) }
+}): Promise<{ context: OperatorTicketContext; source: TicketSource }> {
+  const context = opts.backend.contextFor
+    ? await opts.backend.contextFor(opts.repo)
+    : contextFor((await effectiveConfig(opts.store, opts.repo)).config, opts.repo)
+  return { context, source: await opts.backend.sourceFor(context) }
 }
 
 export async function listOperatorTickets(opts: {
@@ -78,9 +81,9 @@ export async function listOperatorTickets(opts: {
   state?: string
   labels?: string[]
 }): Promise<OperatorTicketQueue> {
-  const { config, context, source } = await openOperatorTickets(opts)
-  const triageState = defaultTriageState(config)
-  const readyState = config.tickets.readyState
+  const { context, source } = await openOperatorTickets(opts)
+  const triageState = ticketLifecycle(context.tickets).triage
+  const readyState = context.tickets.readyState
   // The operator surface is a grooming queue. Unlike the CLI's ticket list,
   // labels narrow the default state instead of replacing its lifecycle gate.
   const criteria = {
@@ -105,10 +108,36 @@ async function matchingBuild(
   store: BuildStore,
   repo: string,
   id: string,
+  source: TicketSource,
+  configuredSource: string,
 ): Promise<OperatorTicketBuild | null> {
-  const matches = (await store.listBuilds()).filter(
-    (record) => record.repo === repo && record.ticket?.id === id,
+  // The service's database adapter implements the externally named hosted source.
+  const hosted =
+    source.name === 'hosted' || (configuredSource === 'hosted' && source.name === 'database')
+  const candidates = (await store.listBuilds()).filter(
+    (record) =>
+      record.repo === repo &&
+      (record.ticket?.source === source.name || (hosted && record.ticket?.source === 'hosted')),
   )
+  const matches = candidates.filter((record) => record.ticket!.id === id)
+  // The service database store always projects current ids, even when there is
+  // no matching build. Only a hosted client over an unprojected legacy store
+  // needs fallback lookups; failure must not undo a mutation.
+  if (matches.length === 0 && source.name === 'hosted') {
+    const identities = new Map<string, string>()
+    try {
+      for (const record of candidates) {
+        const raw = record.ticket!.id
+        if (!identities.has(raw)) {
+          const ticket = await source.get(raw)
+          identities.set(raw, ticket?.ref.source === source.name ? ticket.ref.id : raw)
+        }
+        if (identities.get(raw) === id) matches.push(record)
+      }
+    } catch {
+      // Build association is optional presentation; keep the successful ticket result.
+    }
+  }
   const projected = await Promise.all(
     matches.map(async (record) => ({
       record,
@@ -138,10 +167,20 @@ export async function getOperatorTicket(opts: {
   backend: OperatorTicketBackend
   id: string
 }): Promise<OperatorTicketDetail> {
-  const { source } = await openOperatorTickets(opts)
+  const { source, context } = await openOperatorTickets(opts)
   const ticket = await requireTicket(source, opts.id)
   const blockers = await source.dependencyStates(ticket.blockedBy ?? [])
-  return { ticket, blockers, build: await matchingBuild(opts.store, opts.repo, opts.id) }
+  return {
+    ticket,
+    blockers,
+    build: await matchingBuild(
+      opts.store,
+      opts.repo,
+      ticket.ref.id,
+      source,
+      context.tickets.source,
+    ),
+  }
 }
 
 export async function mutateOperatorTicket(opts: {
@@ -157,21 +196,90 @@ export async function mutateOperatorTicket(opts: {
         state?: string
         blockedBy?: string[]
       }
-    | { kind: 'update'; id: string; patch: TicketUpdate }
-    | { kind: 'move'; id: string; state: string }
-    | { kind: 'block' | 'unblock'; id: string; blockerIds: string[] }
+    | { kind: 'update'; id: string; patch: TicketUpdate; expectedRevision?: string }
+    | { kind: 'move'; id: string; state: string; expectedRevision?: string }
+    | { kind: 'block' | 'unblock'; id: string; blockerIds: string[]; expectedRevision?: string }
 }): Promise<OperatorTicketDetail> {
-  const { source } = await openOperatorTickets(opts)
+  const { source, context } = await openOperatorTickets(opts)
   const operation = opts.operation
   if (operation.kind === 'update') await requireTicket(source, operation.id)
   const ticket =
     operation.kind === 'create'
       ? await createTicket(source, operation)
       : operation.kind === 'update'
-        ? (await updateTicket(source, operation.id, operation.patch))!
+        ? (await updateTicket(
+            source,
+            operation.id,
+            operation.patch,
+            true,
+            operation.expectedRevision,
+          ))!
         : operation.kind === 'move'
-          ? await moveTicket(source, operation.id, operation.state)
-          : await changeBlockers(source, operation.id, operation.blockerIds, operation.kind)
+          ? await moveTicket(source, operation.id, operation.state, operation.expectedRevision)
+          : await changeBlockers(
+              source,
+              operation.id,
+              operation.blockerIds,
+              operation.kind,
+              operation.expectedRevision,
+            )
   const blockers = await source.dependencyStates(ticket.blockedBy ?? [])
-  return { ticket, blockers, build: await matchingBuild(opts.store, opts.repo, ticket.ref.id) }
+  return {
+    ticket,
+    blockers,
+    build: await matchingBuild(
+      opts.store,
+      opts.repo,
+      ticket.ref.id,
+      source,
+      context.tickets.source,
+    ),
+  }
+}
+
+export async function prepareOperatorTicketAssets(opts: {
+  store: BuildStore
+  repo: string
+  backend?: OperatorTicketBackend
+  ref: TicketRef
+}) {
+  if (!opts.backend) {
+    if (opts.ref.source !== 'hosted') return samplePinnedAssets(opts.store, opts.repo, opts.ref.id)
+    throw new Error('ticket operator backend is not configured')
+  }
+  const { context, source } = await openOperatorTickets({ ...opts, backend: opts.backend })
+  if (context.tickets.source !== opts.ref.source)
+    throw new Error('build ticket source differs from configured source')
+  return preparePinnedAssets(source, opts.store, opts.repo, opts.ref.id)
+}
+
+export async function listOperatorTicketStates(opts: {
+  store: BuildStore
+  repo: string
+  backend: OperatorTicketBackend
+}) {
+  const { source } = await openOperatorTickets(opts)
+  if (!source.listStates)
+    throw new TicketOperationError('refusal', `state discovery is not supported by ${source.name}`)
+  return source.listStates()
+}
+
+export async function createOperatorTicketState(opts: {
+  store: BuildStore
+  repo: string
+  backend: OperatorTicketBackend
+  name: string
+  about?: string
+}) {
+  const { source } = await openOperatorTickets(opts)
+  if (!source.addState)
+    throw new TicketOperationError('refusal', `state creation is not supported by ${source.name}`)
+  try {
+    return await source.addState(opts.name, opts.about === undefined ? {} : { about: opts.about })
+  } catch (error) {
+    throw new TicketOperationError(
+      'refusal',
+      error instanceof Error ? error.message : String(error),
+    )
+  }
 }

package/packages/core/src/plugin-sdk/index.ts

@@ -5,6 +5,7 @@
  */
 export type * from '../ports/types'
 export type * from '../ports/workspace/build-execution'
+export type * from '../ports/workspace/harvest-execution'
 export type * from '../store/types'
 export * from '../store/session-reducer'
 export type {
@@ -151,6 +152,12 @@ export type {
 
 export { FakeTicketSource } from '../ports/tickets/fake'
 export { validateTicketUpdate } from '../ports/tickets/update'
+export {
+  TicketRevisionConflict,
+  TicketRevisionUnsupported,
+  ticketRevision,
+  checkTicketRevision,
+} from '../ports/tickets/revision'
 export { FakeWorkspaceProvider } from '../ports/workspace/fake'
 export { FakeForge } from '../ports/forge/fake'
 // ScriptContext + defaultTurnResult are the scripted fake's own API: the

package/packages/core/src/plugins/manifest.ts

@@ -1,3 +1,4 @@
+import type { delegateCredential } from '../store/remote/credentials'
 import semver from 'semver'
 import { z } from 'zod'
 import { openMap } from '../open-map'
@@ -51,9 +52,10 @@ export interface WorkspaceProviderPluginFactoryContext<Config = Record<string, u
    * `createWorkspaceProvider` refuses construction before the factory runs
    * when either store seam is missing. */
   storeRef?: string
-  /** Scoped store token (`AB_TOKEN`). Guaranteed present under
-   * `capabilities.storeRequirements` for the same reason. */
-  storeToken?: string
+  /** @deprecated Project credentials are never delivered to plugin factories. */
+  storeToken?: never
+  /** Host-only exchange; pass the returned per-resource token at launch. */
+  delegateCredential?: typeof delegateCredential
   /** Host-derived effective runtime routes (the referenced runtimes and their
    * selection provenance). Absent at call sites that reference no runtimes
    * (for example the MCP server), which never construct a workspace. */

package/packages/core/src/plugins/runtimes.ts

@@ -39,7 +39,13 @@ export async function materializePluginRuntimes(
 
   const merged = Object.assign(Object.create(null) as RuntimeRegistry, builtins)
   const config = Object.freeze({})
-  const env = Object.freeze({ ...opts.env })
+  const env = Object.freeze(
+    Object.fromEntries(
+      Object.entries(opts.env).filter(
+        ([key]) => !['AB_TOKEN', 'AB_TICKET_TOKEN', 'AB_TICKET_URL'].includes(key),
+      ),
+    ),
+  )
   const context: PluginFactoryContext = {
     config,
     env,

package/packages/core/src/ports/forge/fake.ts

@@ -1,3 +1,4 @@
+import { findSummaryMarker } from './summary-marker'
 /**
  * FakeForge (SPEC §3.2): in-memory Forge for seam tests. Gate existence and
  * current PR merge state are independent inputs, matching GitHubForge's safety
@@ -514,6 +515,17 @@ export class FakeForge implements Forge {
 
   async commentOnPr(workspacePath: string, number: number, body: string): Promise<void> {
     this.assertPr(number)
-    this.comments.push({ workspacePath, number, body })
+    const marker = findSummaryMarker(body)
+    const existing =
+      marker === undefined
+        ? undefined
+        : this.comments.find(
+            (comment) =>
+              comment.number === number &&
+              comment.workspacePath === workspacePath &&
+              findSummaryMarker(comment.body) === marker,
+          )
+    if (existing !== undefined) existing.body = body
+    else this.comments.push({ workspacePath, number, body })
   }
 }

package/packages/core/src/ports/forge/github-transport.ts

@@ -52,7 +52,12 @@ export class GitHubApiError extends Error {
   readonly status: number
   readonly body?: unknown
 
-  constructor(status: number, message: string, body?: unknown) {
+  constructor(
+    status: number,
+    message: string,
+    body?: unknown,
+    readonly headers: Record<string, string> = {},
+  ) {
     super(message)
     this.name = 'GitHubApiError'
     this.status = status
@@ -225,6 +230,7 @@ export function createGitHubFetchTransport(opts: {
         response.status,
         `${githubErrorMessage(response.status, json, text)}${anonymous}`,
         json,
+        headerMap,
       )
     }
     return {
@@ -361,3 +367,32 @@ export function githubTokenSource(
 ): () => Promise<GitHubCredential> {
   return () => resolveGitHubToken(env, exec)
 }
+
+/** Documented primary and secondary limits; permission failures are ordinary errors. */
+export function githubRateLimitUntil(error: unknown, now: number): string | undefined {
+  if (!(error instanceof GitHubApiError)) return undefined
+  if (
+    error.status !== 429 &&
+    !(
+      error.status === 403 &&
+      (error.headers['x-ratelimit-remaining'] === '0' ||
+        /rate limit|secondary.*limit|content.creation.*limit/i.test(error.message))
+    )
+  )
+    return undefined
+  const retry = error.headers['retry-after']
+  const seconds = retry === undefined ? NaN : Number(retry)
+  const retryAt = Number.isFinite(seconds) ? now + seconds * 1000 : Date.parse(retry ?? '')
+  // The reset describes the primary quota window, even on secondary-limit responses.
+  const reset =
+    error.headers['x-ratelimit-remaining'] === '0'
+      ? Number(error.headers['x-ratelimit-reset']) * 1000
+      : NaN
+  return new Date(
+    Math.max(
+      now + 60_000,
+      Number.isFinite(retryAt) ? retryAt : 0,
+      Number.isFinite(reset) ? reset : 0,
+    ),
+  ).toISOString()
+}

package/packages/core/src/ports/forge/github.ts

@@ -1,3 +1,4 @@
+import { findSummaryMarker } from './summary-marker'
 /**
  * GitHubForge (SPEC §3.2): the Forge adapter for GitHub, speaking the GitHub
  * REST API through an injectable transport seam. All remote access is
@@ -1131,11 +1132,34 @@ export class GitHubForge implements Forge {
   /** The build's summary comment (SPEC §7.5) — links into the store. */
   async commentOnPr(_workspacePath: string, number: number, body: string): Promise<void> {
     const { owner, name } = await this.requireCoordinates()
-    await this.request(
-      'POST',
-      `repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/issues/${number}/comments`,
-      { body: { body } },
-    )
+    const root = `repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`
+    const collection = `${root}/issues/${number}/comments`
+    const marker = findSummaryMarker(body)
+    if (marker !== undefined) {
+      const schema = z.array(z.object({ id: z.number().int().positive(), body: z.string() }))
+      // A failed discovery never authorizes creation. Re-scan once if an edit
+      // races deletion; an uncertain POST is rediscovered on the next phase.
+      for (let scan = 0; scan < 2; scan++) {
+        let match: { id: number; body: string } | undefined
+        for (let page = 1; ; page++) {
+          const response = await this.request('GET', collection, {
+            query: { per_page: '100', page: String(page) },
+          })
+          const comments = schema.parse(response.json)
+          match ??= comments.find((comment) => findSummaryMarker(comment.body) === marker)
+          if (comments.length < 100) break
+        }
+        if (match === undefined) break
+        if (match.body === body) return
+        try {
+          await this.request('PATCH', `${root}/issues/comments/${match.id}`, { body: { body } })
+          return
+        } catch (error) {
+          if (!(error instanceof GitHubApiError) || error.status !== 404 || scan !== 0) throw error
+        }
+      }
+    }
+    await this.request('POST', collection, { body: { body } })
   }
 
   // ── Optional capabilities (checkout-less dispatcher) ──────────────────────

package/packages/core/src/ports/forge/local-git.ts

@@ -1,3 +1,4 @@
+import { findSummaryMarker } from './summary-marker'
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -590,9 +591,16 @@ export class LocalGitForge implements Forge {
   }
 
   async commentOnPr(workspacePath: string, number: number, body: string): Promise<void> {
-    await this.updateRecord(workspacePath, number, (record) => ({
-      ...record,
-      comments: record.comments.includes(body) ? record.comments : [...record.comments, body],
-    }))
+    const marker = findSummaryMarker(body)
+    await this.updateRecord(workspacePath, number, (record) => {
+      const index =
+        marker === undefined
+          ? -1
+          : record.comments.findIndex((comment) => findSummaryMarker(comment) === marker)
+      const comments = [...record.comments]
+      if (index >= 0) comments[index] = body
+      else if (!comments.includes(body)) comments.push(body)
+      return { ...record, comments }
+    })
   }
 }

package/packages/core/src/ports/forge/summary-marker.ts

@@ -0,0 +1,8 @@
+/** Stable, injection-safe identity shared by built-in forge adapters. */
+export function summaryMarker(build: string): string {
+  return `<!-- autobuild-summary:v1:${Buffer.from(build).toString('hex')} -->`
+}
+
+export function findSummaryMarker(body: string): string | undefined {
+  return body.split('\n').find((line) => /^<!-- autobuild-summary:v1:[0-9a-f]+ -->$/.test(line))
+}

package/packages/core/src/ports/runner/session-env.ts

@@ -21,6 +21,9 @@ export function sessionEnv(
   for (const [key, value] of Object.entries(ambient)) {
     if (value !== undefined) env[key] = value
   }
+  delete env.AB_TICKET_TOKEN
+  delete env.AB_TICKET_URL
+  delete env.AB_TOKEN
   Object.assign(env, scoped)
 
   const inheritedPath = env.PATH

package/packages/core/src/ports/tickets/contract.ts

@@ -1,3 +1,4 @@
+import { updateTicket, moveTicket, changeBlockers } from './operations'
 import { describe, expect, test } from 'bun:test'
 import type {
   DependencyState,
@@ -116,6 +117,64 @@ export function describeTicketSourceContract(
   factory: TicketSourceContractFactory,
 ): void {
   describe(`TicketSource contract: ${name}`, () => {
+    test('revisions cover mutable content and guarded writes fail closed', async () => {
+      await withTicketSource(factory, async (harness) => {
+        const source = harness.source
+        const created = await createTracked(
+          harness,
+          { title: contractTicketTitle('revisions'), body: CONTRACT_TICKET_BODY },
+          { state: harness.states.ready },
+        )
+        const id = created.ref.id
+        expect(created.revision.trim()).not.toBe('')
+        expect((await source.get(id))?.revision).toBe(created.revision)
+        expect(
+          (await source.listReady({ state: harness.states.ready })).tickets.find(
+            (t) => t.ref.id === id,
+          )?.revision,
+        ).toBe(created.revision)
+        if (!source.mutateIfRevision) {
+          await expect(
+            updateTicket(source, id, { title: 'Never written' }, false, created.revision),
+          ).rejects.toThrow('does not support')
+          expect((await source.get(id))?.revision).toBe(created.revision)
+          return
+        }
+        let current = created
+        for (const patch of [
+          { title: contractTicketTitle('renamed') },
+          { body: 'Changed body' },
+          { labels: [harness.editableLabel] },
+        ]) {
+          await updateTicket(source, id, patch, false, current.revision)
+          const next = (await source.get(id))!
+          expect(next.revision).not.toBe(current.revision)
+          await expect(updateTicket(source, id, patch, false, current.revision)).rejects.toThrow(
+            'current revision',
+          )
+          expect(await source.get(id)).toEqual(next)
+          current = next
+        }
+        await moveTicket(source, id, harness.states.completed, current.revision)
+        const moved = (await source.get(id))!
+        expect(moved.revision).not.toBe(current.revision)
+        await expect(
+          moveTicket(source, id, harness.states.ready, current.revision),
+        ).rejects.toThrow('current revision')
+        const blocker = await createTracked(harness, {
+          title: contractTicketTitle('blocker'),
+          body: CONTRACT_TICKET_BODY,
+        })
+        await changeBlockers(source, id, [blocker.ref.id], 'block', moved.revision)
+        const blocked = (await source.get(id))!
+        expect(blocked.revision).not.toBe(moved.revision)
+        await expect(
+          changeBlockers(source, id, [blocker.ref.id], 'unblock', moved.revision),
+        ).rejects.toThrow('current revision')
+        await changeBlockers(source, id, [blocker.ref.id], 'unblock', blocked.revision)
+        expect((await source.get(id))?.revision).not.toBe(blocked.revision)
+      })
+    })
     test('completion projections agree across create, get, listing, and transitions', async () => {
       await withTicketSource(factory, async (harness) => {
         const created = await createTracked(
@@ -156,7 +215,13 @@ export function describeTicketSourceContract(
           state: harness.states.ready,
           labels: [],
         })
-        expect(await harness.source.get(created.ref.id)).toEqual(created)
+        const detail = await harness.source.get(created.ref.id)
+        expect(detail).not.toBeNull()
+        // Detail reads may expose structured history absent from write responses.
+        const { comments, ...record } = detail!
+        const { comments: createdComments, ...createdRecord } = created
+        expect(record).toEqual(createdRecord)
+        if (comments !== undefined) expect(comments).toEqual(createdComments ?? [])
       })
     })
 

package/packages/core/src/ports/tickets/create.ts

@@ -1,3 +1,7 @@
+import { configuredStore } from '../../cli/configured-store'
+import { projectToken } from '../../cli/project-credentials'
+import { resolveRepoOrigin } from '../../cli/repo-state'
+import { spawnExec } from '../workspace/git-worktree'
 /**
  * TicketSource factory (SPEC §3.2, §13): construct the builtin or plugin source
  * named by [tickets]. Plugin credentials, like LINEAR_API_KEY, come only from
@@ -12,6 +16,8 @@ import type { TicketSource } from '../types'
 import { DEFAULT_TICKETS_DIR, FileTicketSource } from './file'
 import { LinearTicketSource } from './linear'
 import { HostedTicketSource } from './remote'
+import { ticketLifecycle } from './lifecycle'
+import { normalizeServiceURL } from '../../connection'
 
 function reason(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
@@ -28,37 +34,75 @@ export async function createTicketSource(
   plugins: PluginRegistry = createPluginRegistry(),
 ): Promise<TicketSource> {
   if (config.source === 'hosted') {
-    const rawUrl = env.AB_STORE?.trim()
+    const buildUrl = env.AB_STORE?.trim() || configuredStore(targetRepo)
+    const rawUrl = config.url ?? buildUrl
     if (!rawUrl) {
       throw new Error(
-        'AB_STORE is not set — required when [tickets].source = "hosted"; set it to the hosted service HTTP(S) URL',
+        'Hosted tickets require [tickets] url when builds are local; alternatively set [store] url or AB_STORE to a service',
       )
     }
     let serviceUrl: URL
     try {
-      serviceUrl = new URL(rawUrl)
+      serviceUrl = new URL(normalizeServiceURL(rawUrl, 'tickets.url'))
     } catch {
-      throw new Error('AB_STORE must be a valid HTTP(S) URL when [tickets].source = "hosted"')
-    }
-    if (serviceUrl.protocol !== 'http:' && serviceUrl.protocol !== 'https:') {
-      throw new Error('AB_STORE must be an HTTP(S) URL when [tickets].source = "hosted"')
+      throw new Error(
+        'Hosted tickets require [tickets] url when [store] url / AB_STORE selects local builds',
+      )
     }
-    const token = env.AB_TOKEN?.trim()
+    const ticketSession = env.AB_TICKET_TOKEN !== undefined || env.AB_TICKET_URL !== undefined
+    if (
+      ticketSession &&
+      (!env.AB_TICKET_TOKEN ||
+        !env.AB_TICKET_URL ||
+        normalizeServiceURL(env.AB_TICKET_URL) !== normalizeServiceURL(rawUrl))
+    )
+      throw new Error('Ticket session credential does not match the selected ticket service')
+    const token = ticketSession
+      ? env.AB_TICKET_TOKEN
+      : projectToken(
+          rawUrl,
+          (await resolveRepoOrigin(targetRepo, spawnExec)) ?? targetRepo,
+          config.url &&
+            (!buildUrl ||
+              !/^https?:/.test(buildUrl) ||
+              normalizeServiceURL(config.url) !== normalizeServiceURL(buildUrl))
+            ? { ...env, AB_TOKEN: undefined }
+            : env,
+        )
     if (!token) {
       throw new Error(
-        'AB_TOKEN is not set — an operator-scope token is required when [tickets].source = "hosted"',
+        'No project credential; run ab connect (or set AB_TOKEN) — a project credential is required when [tickets].source = "hosted"',
       )
     }
     if (config.teamKey === undefined) {
       throw new Error('[tickets].source = "hosted" requires teamKey')
     }
-    return new HostedTicketSource({
+    const source = new HostedTicketSource({
       url: serviceUrl.toString(),
       token,
       teamKey: config.teamKey,
       ...(config.claimedState !== undefined ? { claimedState: config.claimedState } : {}),
       ...(config.createState !== undefined ? { createState: config.createState } : {}),
     })
+    // Delegated sessions may read policy, but never redefine project authority.
+    if (!ticketSession && !env.AB_HARVEST && !env.AB_PHASE) {
+      const lifecycle = ticketLifecycle(config)
+      await source.synchronizePolicy({
+        version: 1,
+        tickets: {
+          source: 'hosted',
+          teamKey: config.teamKey,
+          readyState: lifecycle.ready,
+          triageState: lifecycle.triage,
+          claimedState: lifecycle.doing,
+          doneState: lifecycle.done,
+          createState: lifecycle.create,
+          proposalState: lifecycle.proposal,
+          ...(config.readyLabels !== undefined ? { readyLabels: config.readyLabels } : {}),
+        },
+      })
+    }
+    return source
   }
 
   if (config.source === 'linear') {