@defrex/autobuild 0.11.0 → 0.13.0

package/packages/core/src/processes/harvest-child.ts

@@ -1,3 +1,4 @@
+import { ticketGrantRequest } from '../ports/tickets/grants'
 /**
  * Crash-safe repository-scoped harvest workflow: scan -> synthesize <-> review
  * -> file. It reuses `converge` for adversarial review semantics while every
@@ -56,6 +57,20 @@ export async function runHarvestChild(
   workspacePath: string = process.cwd(),
 ): Promise<void> {
   const fullStore: BuildStore = openStore(input.storeRef, env.AB_TOKEN)
+  const ticketAuthority =
+    env.AB_TICKET_URL && env.AB_TICKET_TOKEN
+      ? { url: env.AB_TICKET_URL, token: env.AB_TICKET_TOKEN }
+      : undefined
+  const renewTickets = ticketAuthority
+    ? setInterval(() => {
+        void ticketGrantRequest(ticketAuthority.url, ticketAuthority.token, {
+          action: 'renew',
+          repo: input.repo,
+        }).catch(() => {
+          // Expiry denies subsequent ticket operations; never regain project authority.
+        })
+      }, 60_000)
+    : undefined
   try {
     const config = await loadConfig(join(workspacePath, 'autobuild.toml'))
     // Full build-child composition parity, in the same order: plugins load
@@ -80,7 +95,7 @@ export async function runHarvestChild(
     const { targetRepo, localStateRoot } = guestTicketSourceArgs(input, workspacePath)
     const tickets = await createTicketSource(
       config.tickets,
-      env,
+      { ...env, AB_HARVEST: input.preparedRun?.run ?? input.instance },
       targetRepo,
       localStateRoot,
       plugins,
@@ -97,11 +112,14 @@ export async function runHarvestChild(
       uuids: randomUuids(),
       clock: systemClock,
       instance: input.instance,
+      ...(input.preparedRun ? { preparedRun: input.preparedRun } : {}),
       // Adopted holder: the guest skips its own claim, heartbeats the owning
       // dispatch loop's repository lease, and never releases it.
       ...(input.leaseHolder !== undefined ? { leaseHolder: input.leaseHolder } : {}),
       ...(input.environment !== undefined ? { environment: input.environment } : {}),
       sessionEnv: {
+        ...(env.AB_TICKET_URL ? { AB_TICKET_URL: env.AB_TICKET_URL } : {}),
+        ...(env.AB_TICKET_TOKEN ? { AB_TICKET_TOKEN: env.AB_TICKET_TOKEN } : {}),
         AB_STORE: input.storeRef,
         ...(env.AB_TOKEN !== undefined && env.AB_TOKEN !== '' ? { AB_TOKEN: env.AB_TOKEN } : {}),
       },
@@ -111,10 +129,19 @@ export async function runHarvestChild(
     })
     await runner.run()
   } finally {
+    if (renewTickets) clearInterval(renewTickets)
     try {
-      await fullStore.close()
-    } catch {
-      // Process teardown cannot change the already-durable runner outcome.
+      if (ticketAuthority)
+        await ticketGrantRequest(ticketAuthority.url, ticketAuthority.token, {
+          action: 'revoke',
+          repo: input.repo,
+        })
+    } finally {
+      try {
+        await fullStore.close()
+      } catch {
+        // Process teardown cannot change the already-durable runner outcome.
+      }
     }
   }
 }

package/packages/core/src/processes/harvest-execution-state.ts

@@ -92,9 +92,26 @@ export function classifyHarvestOutcome(
   input: HarvestExecutionClassificationInput,
 ): HarvestRunnerResult {
   const state = reduceHarvest(events)
-  const latestRun = state.runs.at(-1)
+  const started = events.find(
+    (event) =>
+      event.type === 'harvest.execution.started' && event.seq === input.executionStartedSeq,
+  )
+  const authorization =
+    started?.type === 'harvest.execution.started'
+      ? events.find(
+          (event) =>
+            event.type === 'harvest.execution.authorized' &&
+            event.payload.execution === started.payload.execution,
+        )
+      : undefined
+  const selected =
+    authorization?.type === 'harvest.execution.authorized' ? authorization.payload : undefined
+  const latestRun = selected
+    ? state.runs.find((run) => run.run === selected.run)
+    : state.runs.at(-1)
   if (latestRun !== undefined) {
-    const launch = latestRun.startedSeq > input.executionStartedSeq ? 'started' : 'resumed'
+    const launch =
+      selected?.launch ?? (latestRun.startedSeq > input.executionStartedSeq ? 'started' : 'resumed')
     // Recency gate: a terminal outcome counts only if its fact — the run's
     // terminal fact, or for an unresolved failure the failure fact itself
     // (`failureSeq`), which also covers exhaustion via `terminalSeq` —

package/packages/core/src/processes/harvest-runner.ts

@@ -1,3 +1,6 @@
+import { ticketIdentity } from '../ports/tickets/identity'
+import { issueTicketGrant } from '../ports/tickets/grants'
+import { delegateCredential } from '../store/remote/credentials'
 /**
  * Crash-safe repository-scoped harvest workflow:
  * scan -> synthesize <-> review -> file. It reuses `converge` for adversarial
@@ -100,11 +103,13 @@ export interface HarvestRunnerDeps {
    * executes in (hosted harvest). Stamped into the run's harvest.started
    * payload so the journal records where it ran; absent on local runs. */
   environment?: { provider: string; environmentId: string; sessionId?: string }
+  preparedRun?: { run: string }
   sessionEnv?: Record<string, string>
   opts?: HarvestRunnerOpts
 }
 
 export type HarvestRunnerResult =
+  | { outcome: 'prepared'; run: string; launch: 'started' | 'resumed' }
   | { outcome: 'idle' }
   | { outcome: 'held' }
   | { outcome: 'parked'; run?: string }
@@ -217,9 +222,9 @@ export class HarvestRunner {
     )
   }
 
-  async run(): Promise<HarvestRunnerResult> {
+  async run(preparationOnly = false): Promise<HarvestRunnerResult> {
     const { store, repo, instance } = this.deps
-    await store.ensureRepo(repo)
+    if (!this.deps.preparedRun) await store.ensureRepo(repo)
     if (
       this.deps.leaseHolder === undefined &&
       !(await store.claimRepoLease(repo, instance, this.leaseTtlMs))
@@ -233,101 +238,116 @@ export class HarvestRunner {
       await this.ensureLease()
       // Bounded read (AUT-489): reduceHarvest and the verdict/failure filters
       // below consume durable types only, so the subset is replay-equivalent.
-      let events = await store.getRepoStateEvents(repo)
-      let state = reduceHarvest(events)
-      run = actionableHarvestRun(state)
-
-      // Settle durable operator control before scanning or resuming work. The
-      // selected run comes from the full journal, so a shadowed failure or
-      // exhaustion barrier is recovered/reported before any later open run.
-      await this.controlBoundary(run?.run)
-      events = await store.getRepoStateEvents(repo)
-      state = reduceHarvest(events)
-      run = openHarvestRun(state)
-
-      if (!run) {
-        await this.controlBoundary()
-        // Flat-cost gate (AUT-521): the pressure trigger is evaluated from
-        // the journal and one repo-scoped digest batch read — no per-build
-        // history reads — so the idle evaluation no longer grows with
-        // accumulated finished builds. Only a tripped gate pays for the full
-        // unclaimed-observation scan, because the packet artifact needs the
-        // observation payloads no bounded source carries.
-        // Bounded read (AUT-489): the gate's journal input is consumed only
-        // through reduceHarvest, so the subset is replay-equivalent here too.
-        const [gateEvents, digests] = await Promise.all([
-          store.getRepoStateEvents(repo),
-          store.getRepoBuildDigests(repo),
-        ])
-        const pressure = evaluateHarvestPressureFromDigests({
-          digests,
-          harvestEvents: gateEvents,
-          policy: this.currentConfig().policy,
-        })
-        if (pressure.trigger === undefined) {
-          // Treat the read's completion as a boundary even when the gate did
-          // not trip, so a request arriving during the read is acknowledged
-          // before this runner returns idle.
+      if (this.deps.preparedRun) {
+        const events = await store.getRepoStateEvents(repo)
+        const authorization = events.find(
+          (event) =>
+            event.type === 'harvest.execution.authorized' &&
+            event.payload.execution === instance &&
+            event.payload.run === this.deps.preparedRun!.run,
+        )
+        if (authorization?.type !== 'harvest.execution.authorized')
+          throw new Error('prepared harvest execution unavailable')
+        run = reduceHarvest(events).runs.find((run) => run.run === this.deps.preparedRun!.run)
+        initial = authorization.payload.launch
+      } else {
+        let events = await store.getRepoStateEvents(repo)
+        let state = reduceHarvest(events)
+        run = actionableHarvestRun(state)
+
+        // Settle durable operator control before scanning or resuming work. The
+        // selected run comes from the full journal, so a shadowed failure or
+        // exhaustion barrier is recovered/reported before any later open run.
+        await this.controlBoundary(run?.run)
+        events = await store.getRepoStateEvents(repo)
+        state = reduceHarvest(events)
+        run = openHarvestRun(state)
+
+        if (!run) {
           await this.controlBoundary()
-          return { outcome: 'idle' }
-        }
-        await this.controlBoundary()
-        const scan = await scanUnclaimedObservations(store, repo)
-        // The trigger came from an earlier read than this scan, and a claim
-        // may have landed in the window. Re-confirm the gate against the
-        // fresh scan (pure, free): an emptied window returns idle exactly as
-        // if the gate had not tripped, so a packet is only ever built from a
-        // scan that itself triggered.
-        const confirmed = evaluateHarvestPressure(scan, this.currentConfig().policy)
-        if (confirmed.trigger === undefined) {
+          // Flat-cost gate (AUT-521): the pressure trigger is evaluated from
+          // the journal and one repo-scoped digest batch read — no per-build
+          // history reads — so the idle evaluation no longer grows with
+          // accumulated finished builds. Only a tripped gate pays for the full
+          // unclaimed-observation scan, because the packet artifact needs the
+          // observation payloads no bounded source carries.
+          // Bounded read (AUT-489): the gate's journal input is consumed only
+          // through reduceHarvest, so the subset is replay-equivalent here too.
+          const [gateEvents, digests] = await Promise.all([
+            store.getRepoStateEvents(repo),
+            store.getRepoBuildDigests(repo),
+          ])
+          const pressure = evaluateHarvestPressureFromDigests({
+            digests,
+            harvestEvents: gateEvents,
+            policy: this.currentConfig().policy,
+          })
+          if (pressure.trigger === undefined) {
+            // Treat the read's completion as a boundary even when the gate did
+            // not trip, so a request arriving during the read is acknowledged
+            // before this runner returns idle.
+            await this.controlBoundary()
+            return { outcome: 'idle' }
+          }
+          await this.controlBoundary()
+          const scan = await scanUnclaimedObservations(store, repo)
+          // The trigger came from an earlier read than this scan, and a claim
+          // may have landed in the window. Re-confirm the gate against the
+          // fresh scan (pure, free): an emptied window returns idle exactly as
+          // if the gate had not tripped, so a packet is only ever built from a
+          // scan that itself triggered.
+          const confirmed = evaluateHarvestPressure(scan, this.currentConfig().policy)
+          if (confirmed.trigger === undefined) {
+            await this.controlBoundary()
+            return { outcome: 'idle' }
+          }
+          const runId = this.deps.ids('harvest')
+          const packet = await makeHarvestScanPacket({
+            store,
+            tickets: this.deps.tickets,
+            repo,
+            run: runId,
+            observations: scan.observations,
+            state: scan.state,
+          })
+          // Scan preparation is not a claim. Re-read operator control immediately
+          // before atomically committing the immutable snapshot.
           await this.controlBoundary()
-          return { outcome: 'idle' }
+          initial = 'started'
+          await store.appendRepoWithArtifacts(
+            repo,
+            [
+              {
+                kind: HARVEST_SCAN_ARTIFACT,
+                content: `${JSON.stringify(packet, null, 2)}\n`,
+                metadata: { run: runId, observations: packet.observations.length },
+              },
+            ],
+            (deposited) => ({
+              actor: KERNEL,
+              type: 'harvest.started',
+              payload: {
+                run: runId,
+                observations: packet.observations.map((item) => item.occurrence),
+                scan: artifactRef(deposited[0]!),
+                trigger: confirmed.trigger,
+                ...(this.deps.environment !== undefined
+                  ? { environment: this.deps.environment }
+                  : {}),
+              },
+            }),
+          )
+          // Bounded read (AUT-489): reduceHarvest consumes durable types only.
+          events = await store.getRepoStateEvents(repo)
+          run = reduceHarvest(events).runs.find((candidate) => candidate.run === runId)
+          if (!run) throw new Error(`harvest.started did not reduce run "${runId}"`)
+          // A request racing the claim parks this exact run; its snapshot stays
+          // open and is resumed rather than scanned again.
+          await this.controlBoundary(run.run)
         }
-        const runId = this.deps.ids('harvest')
-        const packet = await makeHarvestScanPacket({
-          store,
-          tickets: this.deps.tickets,
-          repo,
-          run: runId,
-          observations: scan.observations,
-          state: scan.state,
-        })
-        // Scan preparation is not a claim. Re-read operator control immediately
-        // before atomically committing the immutable snapshot.
-        await this.controlBoundary()
-        initial = 'started'
-        await store.appendRepoWithArtifacts(
-          repo,
-          [
-            {
-              kind: HARVEST_SCAN_ARTIFACT,
-              content: `${JSON.stringify(packet, null, 2)}\n`,
-              metadata: { run: runId, observations: packet.observations.length },
-            },
-          ],
-          (deposited) => ({
-            actor: KERNEL,
-            type: 'harvest.started',
-            payload: {
-              run: runId,
-              observations: packet.observations.map((item) => item.occurrence),
-              scan: artifactRef(deposited[0]!),
-              trigger: confirmed.trigger,
-              ...(this.deps.environment !== undefined
-                ? { environment: this.deps.environment }
-                : {}),
-            },
-          }),
-        )
-        // Bounded read (AUT-489): reduceHarvest consumes durable types only.
-        events = await store.getRepoStateEvents(repo)
-        run = reduceHarvest(events).runs.find((candidate) => candidate.run === runId)
-        if (!run) throw new Error(`harvest.started did not reduce run "${runId}"`)
-        // A request racing the claim parks this exact run; its snapshot stays
-        // open and is resumed rather than scanned again.
-        await this.controlBoundary(run.run)
       }
-
+      if (!run) throw new Error('prepared harvest run unavailable')
+      if (preparationOnly) return { outcome: 'prepared', run: run.run, launch: initial }
       try {
         await this.ensureScanStep(run)
         await this.controlBoundary(run.run)
@@ -691,7 +711,7 @@ export class HarvestRunner {
             live.handle,
             `Revise harvest proposals for round ${spec.round}: run ab harvest context, address .ab/findings.json, then submit.`,
             {
-              env: this.sessionEnv(spec.run, spec.step, spec.round, session),
+              env: await this.sessionEnv(spec.run, spec.step, spec.round, session),
               ...(stream !== undefined ? { stream } : {}),
             },
           )
@@ -702,7 +722,7 @@ export class HarvestRunner {
             workspacePath,
             ...(target.model !== undefined ? { model: target.model } : {}),
             ...(target.args !== undefined ? { args: target.args } : {}),
-            env: this.sessionEnv(spec.run, spec.step, spec.round, session),
+            env: await this.sessionEnv(spec.run, spec.step, spec.round, session),
             ...(stream !== undefined ? { stream } : {}),
           })
           handle = turn.session
@@ -941,7 +961,7 @@ export class HarvestRunner {
           live.handle,
           `Revise harvest proposals for round ${spec.round}: run ab harvest context, address .ab/findings.json, then submit.`,
           {
-            env: this.sessionEnv(spec.run, spec.step, spec.round, session),
+            env: await this.sessionEnv(spec.run, spec.step, spec.round, session),
             ...(stream !== undefined ? { stream } : {}),
           },
         )
@@ -952,7 +972,7 @@ export class HarvestRunner {
           workspacePath,
           ...(resolved.model !== undefined ? { model: resolved.model } : {}),
           ...(resolved.args !== undefined ? { args: resolved.args } : {}),
-          env: this.sessionEnv(spec.run, spec.step, spec.round, session),
+          env: await this.sessionEnv(spec.run, spec.step, spec.round, session),
           ...(stream !== undefined ? { stream } : {}),
         })
         handle = turn.session
@@ -1158,9 +1178,16 @@ export class HarvestRunner {
     )
     const packet = await loadScanPacket(store, repo, current.scan)
     const observations = packet.observations
-    const knownLedger = new Map(
-      packet.ledger.map((entry) => [`${entry.ticket.source}:${entry.ticket.id}`, entry]),
-    )
+    const identity = ticketIdentity(tickets)
+    const knownLedger = new Map<string, (typeof packet.ledger)[number]>()
+    for (const entry of packet.ledger) {
+      const current =
+        entry.ticket.source === tickets.name ? await tickets.get(entry.ticket.id) : null
+      knownLedger.set(await identity(entry.ticket), {
+        ...entry,
+        ticket: current?.ref ?? entry.ticket,
+      })
+    }
     const alreadyFiled = new Map(current.filed.map((entry) => [entry.proposalKey, entry]))
     const reservations = new Map(current.reservations.map((entry) => [entry.proposalKey, entry.id]))
     const dispositions: HarvestDisposition[] = []
@@ -1240,7 +1267,7 @@ export class HarvestRunner {
           ...(filed.blockers !== undefined ? { blockers: filed.blockers } : {}),
         })
       } else if (proposal.action === 'join') {
-        const known = knownLedger.get(`${proposal.ticket.source}:${proposal.ticket.id}`)
+        const known = knownLedger.get(await identity(proposal.ticket))
         if (!known) {
           throw new Error(
             `approved join target ${proposal.ticket.source}:${proposal.ticket.id} is not in the ledger context`,
@@ -1391,6 +1418,7 @@ export class HarvestRunner {
    * give-up before returning. Initial/within-step failures do not spend this
    * outer budget and therefore remain recoverable. */
   private async settleRecoveryExhaustion(run: string): Promise<void> {
+    if (this.deps.preparedRun) return
     await this.ensureLease()
     // Bounded read (AUT-489): reduceHarvest consumes durable types only.
     const state = reduceHarvest(await this.deps.store.getRepoStateEvents(this.deps.repo))
@@ -1459,6 +1487,7 @@ export class HarvestRunner {
       const state = reduceHarvest(await this.deps.store.getRepoStateEvents(this.deps.repo))
       const decision = decideHarvestControl(state, this.maxRecoveryAttempts)
       if (decision.kind === 'proceed') return
+      if (this.deps.preparedRun) throw new HarvestParkedSignal(run)
       if (decision.kind === 'park') {
         throw new HarvestParkedSignal(actionableHarvestRun(state)?.run ?? run)
       }
@@ -1602,15 +1631,37 @@ export class HarvestRunner {
     }
   }
 
-  private sessionEnv(
+  private async sessionEnv(
     run: string,
     step: 'synthesize' | 'review',
     round: number,
     session: string,
-  ): Record<string, string> {
+  ): Promise<Record<string, string>> {
+    const parent = this.deps.sessionEnv
+    const token =
+      parent?.AB_STORE && /^https?:/i.test(parent.AB_STORE)
+        ? await delegateCredential(parent.AB_STORE, parent.AB_TOKEN, {
+            kind: 'harvest-phase',
+            repo: this.deps.repo,
+            id: run,
+            session,
+          })
+        : undefined
+    const ticketGrant =
+      parent?.AB_TICKET_URL && parent.AB_TICKET_TOKEN
+        ? await issueTicketGrant(
+            parent.AB_TICKET_URL,
+            parent.AB_TICKET_TOKEN,
+            this.deps.repo,
+            this.deps.instance,
+            'phase',
+          )
+        : undefined
     return {
       AB_STORE: 'local',
       ...this.deps.sessionEnv,
+      ...(ticketGrant ? { AB_TICKET_TOKEN: ticketGrant.token } : {}),
+      ...(token ? { AB_TOKEN: token } : {}),
       AB_REPO: this.deps.repo,
       AB_HARVEST: run,
       AB_PHASE: `${step}@${round}`,
@@ -1638,7 +1689,18 @@ export class HarvestRunner {
     const open = target.openSessionStream
     if (open === undefined) return undefined
     const sink = createSessionStreamSink({
-      store: this.deps.store,
+      store: {
+        ...this.deps.store,
+        createStream: (scope, label) =>
+          this.deps.store.createStream(
+            scope,
+            this.deps.preparedRun
+              ? `harvest:${this.deps.preparedRun.run}:${this.deps.instance}:${label}`
+              : label,
+          ),
+        appendStreamParts: (id, parts) => this.deps.store.appendStreamParts(id, parts),
+        closeStream: (id, outcome) => this.deps.store.closeStream(id, outcome),
+      },
       scope: { kind: 'repo', repo: this.deps.repo },
       onDiagnostic: this.onDiagnostic,
     })

package/packages/core/src/processes/harvest.ts

@@ -327,12 +327,17 @@ export async function reconcileHarvestLedger(
   )
   if (entries.length === 0) return []
 
-  const ids = entries.map((entry) => entry.ticket.id)
+  const ids = entries
+    .filter((entry) => entry.ticket.source === tickets.name)
+    .map((entry) => entry.ticket.id)
   const states = await tickets.dependencyStates(ids)
+  const byId = new Map(states.map((state) => [state.id, state]))
   const out: HarvestLedgerTicket[] = []
   for (let index = 0; index < entries.length; index += 1) {
     const entry = entries[index]!
-    const dependency = states[index] ?? {
+    const dependency = (entry.ticket.source === tickets.name
+      ? byId.get(entry.ticket.id)
+      : undefined) ?? {
       id: entry.ticket.id,
       exists: false,
       resolved: false,
@@ -341,7 +346,7 @@ export async function reconcileHarvestLedger(
     const current = dependency.exists ? await tickets.get(entry.ticket.id) : null
     out.push({
       proposalKey: entry.proposalKey,
-      ticket: structuredClone(entry.ticket),
+      ticket: structuredClone(current?.ref ?? entry.ticket),
       exists: dependency.exists,
       resolved: dependency.resolved,
       ...(current?.title !== undefined ? { title: current.title } : {}),
@@ -371,15 +376,25 @@ export async function reconcileOriginatingTickets(
   const states = matchingIds.length > 0 ? await tickets.dependencyStates(matchingIds) : []
   const byId = new Map(states.map((state) => [state.id, state]))
 
-  return refs.map((ticket) => {
-    const sourceMatches = ticket.source === tickets.name
-    const state = sourceMatches ? byId.get(ticket.id) : undefined
-    return {
-      ticket,
-      sourceMatches,
-      exists: state?.exists ?? false,
-      resolved: state?.resolved ?? false,
-    }
+  const identity = new Set<string>()
+  const projected = await Promise.all(
+    refs.map(async (ticket) => {
+      const sourceMatches = ticket.source === tickets.name
+      const state = sourceMatches ? byId.get(ticket.id) : undefined
+      const current = sourceMatches && state?.exists ? await tickets.get(ticket.id) : null
+      return {
+        ticket: current?.ref ?? ticket,
+        sourceMatches,
+        exists: state?.exists ?? false,
+        resolved: state?.resolved ?? false,
+      }
+    }),
+  )
+  return projected.filter((entry) => {
+    const key = `${entry.ticket.source}:${entry.ticket.id}`
+    if (identity.has(key)) return false
+    identity.add(key)
+    return true
   })
 }
 
@@ -536,9 +551,14 @@ export async function resolveHarvestCreateBlockers(
     const state = byId.get(id)
     return state?.exists === true && !state.resolved
   })
+  const canonical = new Map<string, string>()
+  for (const id of candidates) {
+    if (byId.get(id)?.exists) canonical.set(id, (await tickets.get(id))?.ref.id ?? id)
+  }
+  const project = (ids: string[]) => [...new Set(ids.map((id) => canonical.get(id) ?? id))]
   return {
-    blockedBy: [...new Set([...declared, ...derived])],
-    provenance: { declared, derived },
+    blockedBy: project([...declared, ...derived]),
+    provenance: { declared: project(declared), derived: project(derived) },
   }
 }
 

package/packages/core/src/processes/phase-failure-budget.ts

@@ -11,6 +11,8 @@ export const POLICY_PHASE_FAILURE_RESET_SCOPES = {
   'review-round-limit': 'matching-round',
   'verify-failure-limit': 'all-phase-rounds',
   'reconcile-no-progress': 'none',
+  'dispatch-failure-limit': 'none',
+  'execution-no-progress': 'none',
   'setup-failure-limit': 'none',
   'infrastructure-failure-limit': 'none',
   'phase-attempt-limit': 'matching-round',

package/packages/core/src/processes/publication-loss.ts

@@ -1,3 +1,5 @@
+import { summaryBoundary } from '../kernel/pr-summary'
+import { isRemoteWorkspace } from '../events/workspace-remote'
 /**
  * Last-chance publication settlement at the workspace-release boundary
  * (AUT-328). A pending `publication.requested` whose workspace is destroyed
@@ -37,7 +39,22 @@ export async function settlePublicationBeforeRelease(
   reason: string,
 ): Promise<AbEvent[]> {
   const request = latestUncompletedPublicationRequest(events)
-  if (request === undefined) return events
+  if (request === undefined) {
+    const workspace = events.findLast((event) => event.type === 'workspace.provisioned')
+    if (
+      workspace?.type === 'workspace.provisioned' &&
+      isRemoteWorkspace(workspace.payload) &&
+      summaryBoundary(events) !== undefined
+    ) {
+      try {
+        await deps.settlePublication?.(slug)
+      } catch {
+        /* Summary is best effort. */
+      }
+      return deps.store.getEvents(slug)
+    }
+    return events
+  }
   try {
     await deps.settlePublication?.(slug)
   } catch {

package/packages/core/src/processes/repo-view.ts

@@ -1,3 +1,4 @@
+import { executionNoProgressReducer } from './execution-no-progress'
 /**
  * The dispatcher's in-process repository view (AUT-647): a `BuildStore`
  * decorator that builds the state a tick needs once, at the first refresh, and
@@ -154,6 +155,7 @@ const EXTRA_REDUCERS = {
     finish: buildDigestReducer.finish,
   },
   logIndex: logIndexReducer,
+  executionNoProgress: executionNoProgressReducer,
   openExecution: openExecutionReducer,
   openBuildWorkspace: openBuildWorkspaceReducer,
   publicationState: publicationStateReducer,
@@ -186,6 +188,7 @@ const WORK_BUNDLE_REDUCER = { version: WORK_BUNDLE_VERSION }
 /** The facts a quiet-path stage needs about one build, without its event array. */
 export interface BuildFacts {
   state: BuildState
+  executionNoProgress: ReturnType<typeof executionNoProgressReducer.finish>
   log: LogIndex
   open: OpenExecution | null
   /** The open workspace (the latest provisioned, not yet released). */
@@ -279,6 +282,37 @@ function retainedShape(retained: unknown[], cursor: number): boolean {
 /** Structural checks on the small accumulators a later fold dereferences. */
 function extraAccsShape(extra: ExtraAccs): boolean {
   const field = (acc: unknown, key: string): unknown => (isObject(acc) ? acc[key] : undefined)
+  const emptyCount = field(extra.executionNoProgress, 'count')
+  const emptyOpen = field(extra.executionNoProgress, 'open')
+  if (
+    typeof emptyCount !== 'number' ||
+    !Number.isSafeInteger(emptyCount) ||
+    emptyCount < 0 ||
+    !Array.isArray(emptyOpen) ||
+    !emptyOpen.every((id) => typeof id === 'string')
+  )
+    return false
+  const emptyLatest = field(extra.executionNoProgress, 'latest')
+  if (
+    emptyLatest !== null &&
+    !(
+      isObject(emptyLatest) &&
+      typeof emptyLatest.instance === 'string' &&
+      typeof emptyLatest.seq === 'number'
+    )
+  )
+    return false
+  const active = field(extra.executionNoProgress, 'active')
+  if (
+    active !== null &&
+    !(
+      isObject(active) &&
+      typeof active.instance === 'string' &&
+      typeof active.seq === 'number' &&
+      typeof active.eligible === 'boolean'
+    )
+  )
+    return false
   const open = field(extra.openExecution, 'open')
   if (open !== null && !(isObject(open) && typeof open.instance === 'string')) return false
   const workspace = field(extra.openBuildWorkspace, 'open')
@@ -914,6 +948,7 @@ export class RepoViewStore implements BuildStore {
       const extra = log.extra!
       return {
         state: buildReducer.finish(log.acc!),
+        executionNoProgress: executionNoProgressReducer.finish(extra.executionNoProgress as never),
         log: logIndexReducer.finish(extra.logIndex as never),
         open: openExecutionReducer.finish(extra.openExecution as never),
         workspace: openBuildWorkspaceReducer.finish(extra.openBuildWorkspace as never),