@defrex/autobuild 0.8.0 → 0.9.0

package/packages/core/src/config/pipeline-source.ts

@@ -0,0 +1,376 @@
+/**
+ * Pipeline-source resolution (SPEC §16.1): where a build's build-owned config
+ * sections come from. A build's pipeline is pinned to its own branch — the
+ * branch head once the build has published commits there, otherwise the
+ * recorded base commit its workspace was cut from. The dispatcher resolves
+ * this once per deposit (launch and reload), records the exact commit in the
+ * effective-config artifact's metadata, and never substitutes a later
+ * base-branch change (the AUT-366 class of failure).
+ */
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import type { AbEvent } from '../events/catalog'
+import type { Forge } from '../ports/types'
+import type { Exec } from '../ports/workspace/git-worktree'
+import type { BuildRecord } from '../store/types'
+import { parseConfig } from './load'
+import type { Config } from './schema'
+
+/** Which fact the pinned pipeline was read from. `legacy-fallback` marks the
+ * no-migration path: no recorded base (or an unreadable one), so the deposit
+ * is the dispatcher's live snapshot exactly as before this change.
+ * `worktree-dirty` marks the checkout-mode worktree read whose git-normalized
+ * content does not match the resolved branch head (uncommitted edits, or a
+ * file never committed): no commit is recorded, because attributing worktree
+ * content to the branch-head commit would be false provenance. */
+export type PipelineSourceRef = 'branch-head' | 'base' | 'legacy-fallback' | 'worktree-dirty'
+
+const PIPELINE_SOURCE_REFS: readonly PipelineSourceRef[] = [
+  'branch-head',
+  'base',
+  'legacy-fallback',
+  'worktree-dirty',
+]
+
+export function isPipelineSourceRef(value: unknown): value is PipelineSourceRef {
+  return typeof value === 'string' && (PIPELINE_SOURCE_REFS as readonly string[]).includes(value)
+}
+
+/** Metadata recorded alongside every deposited effective-config artifact. */
+export interface PipelineSourceMeta {
+  ref: PipelineSourceRef
+  /** Exact commit the pipeline sections were parsed from. Absent for the
+   * legacy fallback (no build-branch/base read was possible) and for
+   * `worktree-dirty` (worktree bytes that no commit claims). */
+  commit?: string
+}
+
+export interface PipelineSource {
+  meta: PipelineSourceMeta
+  /** The parsed build-owned tables. */
+  config: Config
+}
+
+export interface PipelineSourceInput {
+  slug: string
+  record: Pick<BuildRecord, 'branch'>
+  events: readonly AbEvent[]
+  /** 'origin' reads through the forge; 'checkout' reads through git exec in
+   * the dispatcher's checkout (build branches are refs of the shared repo). */
+  mode: 'origin' | 'checkout'
+  /** Origin-mode read capability. Required to read through the forge; absent
+   * degrades to the recorded base / legacy fallback. */
+  forge?: Forge
+  /** Checkout-mode seam: the physical main checkout and exec. */
+  checkout?: string
+  exec?: Exec
+  /** Checkout-mode seam: the open build worktree, whose `autobuild.toml` is
+   * the branch head. Preferred over `git show` when the file exists. */
+  workspacePath?: string
+  /** Optional degradation sink: one failure per read/parse attempt that forced
+   * a fallback, in order. Callers surface the actionable ones as per-build
+   * diagnostics (SPEC §16.1) instead of the resolver throwing. */
+  onFailure?: (failure: PipelineSourceFailure) => void
+}
+
+/** Why a resolution degraded. `unpublished`, `base-source` and `no-base` are
+ * the documented fallback order (a build whose branch is not published yet, a
+ * legacy build with no readable recorded base) — normal operation, quiet.
+ * `capability` and `branch-source` are failures an operator can act on: a
+ * wiring gap, or a build-branch source that resolved but cannot be read or
+ * parsed. */
+export type PipelineSourceFailureKind =
+  | 'capability'
+  | 'unpublished'
+  | 'branch-source'
+  | 'base-source'
+  | 'no-base'
+  | 'store'
+
+export interface PipelineSourceFailure {
+  kind: PipelineSourceFailureKind
+  detail: string
+}
+
+/** The failure kinds worth an operator-facing diagnostic: a wiring gap, a
+ * build-branch source that resolved but cannot be read or parsed, or a store
+ * failure — each something an operator (or the build's author) can fix. */
+export function isActionablePipelineFailure(failure: PipelineSourceFailure): boolean {
+  return (
+    failure.kind === 'capability' || failure.kind === 'branch-source' || failure.kind === 'store'
+  )
+}
+
+/** The recorded base commit of the build's latest workspace. The newest
+ * `workspace.provisioned` wins: a re-provisioned workspace is what the build's
+ * current environment was cut from. */
+export function recordedBaseSha(events: readonly AbEvent[]): string | undefined {
+  let base: string | undefined
+  for (const event of events) {
+    if (event.type === 'workspace.provisioned') base = event.payload.base.sha
+  }
+  return base
+}
+
+function buildBranch(record: Pick<BuildRecord, 'branch'>, slug: string): string {
+  return record.branch ?? `ab/${slug}`
+}
+
+function git(
+  args: string[],
+  cwd: string,
+  exec: Exec,
+): Promise<{ stdout: string; exitCode: number; stderr: string }> {
+  return exec(['git', ...args], { cwd })
+}
+
+async function readCheckoutFile(
+  ref: string,
+  path: string,
+  checkout: string,
+  exec: Exec,
+): Promise<string> {
+  const result = await git(['show', `${ref}:${path}`], checkout, exec)
+  if (result.exitCode !== 0) {
+    throw new Error(`git show ${ref}:${path} failed: ${result.stderr.trim() || '(no output)'}`)
+  }
+  return result.stdout
+}
+
+function message(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+/** Parse a read file into a pipeline source, or `undefined` when the TOML is
+ * malformed. A branch-source parse failure is terminal: the build's own branch
+ * exists but carries an unparseable pipeline, so falling back to the recorded
+ * base would run the build under a pipeline that is not its own — the AUT-366
+ * poisoning by another door. The caller keeps the build's last good deposit
+ * instead (SPEC §16.1). */
+function parsePipeline(
+  commit: string | undefined,
+  ref: PipelineSourceRef,
+  content: string,
+  onFailure: (failure: PipelineSourceFailure) => void,
+): PipelineSource | undefined {
+  const label = commit === undefined ? ref : `${ref}@${commit}`
+  try {
+    return {
+      meta: commit === undefined ? { ref } : { ref, commit },
+      config: parseConfig(content, `autobuild.toml@${label}`),
+    }
+  } catch (error) {
+    onFailure({
+      // `worktree-dirty` is a branch-source failure: the malformed file sits on
+      // the build's own side (its open worktree), so a base fallback would run
+      // the build under a pipeline that is not its own — same as `branch-head`.
+      kind: ref === 'base' ? 'base-source' : 'branch-source',
+      detail: `malformed autobuild.toml at ${label}: ${message(error)}`,
+    })
+    return undefined
+  }
+}
+
+/**
+ * Resolve the pipeline source for one build, or `undefined` for the legacy
+ * fallback. Every failure — missing capability, missing base record, unread
+ * file, malformed TOML — degrades to the fallback instead of failing the
+ * caller: a config deposit is never allowed to fail a dispatcher tick or a
+ * launch.
+ *
+ * The resolution rule (SPEC §16.1): the build's branch head once it resolves
+ * (origin mode: the forge's remote branch; checkout mode: the shared repo's
+ * branch ref), else the workspace's recorded base commit. The caller re-
+ * resolves at every launch, so a build that publishes pipeline changes to its
+ * own branch picks them up at its next launch.
+ */
+export async function resolvePipelineSource(
+  input: PipelineSourceInput,
+): Promise<PipelineSource | undefined> {
+  const { slug, record, events } = input
+  const onFailure = input.onFailure ?? (() => {})
+  const branch = buildBranch(record, slug)
+  const path = 'autobuild.toml'
+
+  if (input.mode === 'origin') {
+    const forge = input.forge
+    if (forge === undefined) {
+      onFailure({ kind: 'capability', detail: 'origin mode with no forge' })
+      return undefined
+    }
+    const { remoteBranchSha, readFile: forgeRead } = forge
+    if (remoteBranchSha === undefined || forgeRead === undefined) {
+      onFailure({
+        kind: 'capability',
+        detail:
+          `forge lacks the ${remoteBranchSha === undefined ? 'remoteBranchSha' : 'readFile'} ` +
+          'capability the pipeline-source read needs',
+      })
+    } else {
+      let head: string | undefined
+      try {
+        head = await remoteBranchSha.call(forge, branch)
+      } catch (error) {
+        // Branch not yet published (or the forge failed): fall through to the
+        // recorded base commit, which is exactly what the workspace was cut
+        // from. Surfaced as `unpublished` either way — the normal order.
+        onFailure({
+          kind: 'unpublished',
+          detail: `forge remoteBranchSha(${branch}) failed: ${message(error)}`,
+        })
+      }
+      if (head !== undefined) {
+        let content: string | undefined
+        try {
+          content = await forgeRead.call(forge, path, head)
+        } catch (error) {
+          // The branch resolved but its file did not come back: an actionable
+          // forge failure, not an unpublished branch.
+          onFailure({
+            kind: 'branch-source',
+            detail: `forge readFile(${path}, ${head}) failed: ${message(error)}`,
+          })
+        }
+        if (content !== undefined) {
+          // A malformed build-branch file is terminal: the build's own branch
+          // exists, so the recorded base is not its pipeline either.
+          return parsePipeline(head, 'branch-head', content, onFailure)
+        }
+      }
+    }
+    const baseSha = recordedBaseSha(events)
+    if (baseSha === undefined) {
+      onFailure({ kind: 'no-base', detail: 'no recorded base commit (legacy build)' })
+      return undefined
+    }
+    if (forgeRead === undefined) return undefined
+    let baseContent: string | undefined
+    try {
+      baseContent = await forgeRead.call(forge, path, baseSha)
+    } catch (error) {
+      // Base file unreadable (legacy logs, deleted history): legacy fallback.
+      onFailure({
+        kind: 'base-source',
+        detail: `forge readFile(${path}, base ${baseSha}) failed: ${message(error)}`,
+      })
+      return undefined
+    }
+    return parsePipeline(baseSha, 'base', baseContent, onFailure)
+  }
+
+  const { checkout, exec, workspacePath } = input
+  if (checkout === undefined || exec === undefined) {
+    onFailure({ kind: 'capability', detail: 'checkout mode with no checkout or exec seam' })
+    return undefined
+  }
+  // The build branch is a ref of the shared repository: it exists from
+  // provision time (cut from base) and survives workspace release, so the
+  // committed head is readable at every launch boundary — including the
+  // relaunch after finalize. The recorded commit is the exact sha read.
+  let head: string | undefined
+  try {
+    const resolved = await git(['rev-parse', '--verify', `refs/heads/${branch}`], checkout, exec)
+    if (resolved.exitCode === 0) {
+      head = resolved.stdout.trim()
+    } else {
+      // Unpublished branch: the normal order, resolved from the base next.
+      onFailure({
+        kind: 'unpublished',
+        detail: `git rev-parse refs/heads/${branch} failed: ${
+          resolved.stderr.trim() || '(no output)'
+        }`,
+      })
+    }
+  } catch (error) {
+    // Fall through to the recorded base commit.
+    onFailure({
+      kind: 'unpublished',
+      detail: `git rev-parse refs/heads/${branch} failed: ${message(error)}`,
+    })
+  }
+  if (head !== undefined) {
+    // Checkout mode's primary read is the open build worktree's file — it is
+    // the branch head. The committed ref read is the released-workspace
+    // fallback, and the recorded commit stays the resolved branch head.
+    if (workspacePath !== undefined) {
+      try {
+        const content = await readFile(join(workspacePath, path), 'utf8')
+        // The worktree file may carry uncommitted edits, so it is only the
+        // branch head's when git sees no difference between them. Compare
+        // git-normalized identity, not raw bytes: the stored blob can differ
+        // textually from the worktree file (core.autocrlf, eol attributes)
+        // while carrying the same content, so byte equality against `git show`
+        // output would misclassify a clean worktree as dirty. Hash the
+        // worktree file the way git would store it — `git hash-object` run in
+        // the workspace applies the same clean conversion as check-in — and
+        // compare against the committed blob's oid. Equal → attribute to the
+        // head commit as before; different bytes, a file the head never
+        // carried, or any failed comparison (a non-git workspace, a transient
+        // git error) → `worktree-dirty` with no commit: the provenance
+        // declines to attribute worktree bytes to any commit. A comparison
+        // failure is caught here, not by the committed-ref fallback below —
+        // it degrades to dirty, never to a different source.
+        let clean = false
+        try {
+          const [committedBlob, worktreeBlob] = await Promise.all([
+            git(['rev-parse', '--verify', `${head}:${path}`], checkout, exec),
+            exec(['git', 'hash-object', '--', path], { cwd: workspacePath }),
+          ])
+          clean =
+            committedBlob.exitCode === 0 &&
+            worktreeBlob.exitCode === 0 &&
+            committedBlob.stdout.trim() === worktreeBlob.stdout.trim()
+        } catch {
+          clean = false
+        }
+        if (clean) {
+          // A malformed worktree file is terminal: the committed ref carries the
+          // same content, so the recorded base is not the build's pipeline
+          // either. The caller keeps the build's last good deposit.
+          return parsePipeline(head, 'branch-head', content, onFailure)
+        }
+        return parsePipeline(undefined, 'worktree-dirty', content, onFailure)
+      } catch (error) {
+        // Workspace released or unreadable: read the committed branch head.
+        onFailure({
+          kind: 'unpublished',
+          detail: `workspace file ${join(workspacePath, path)} unreadable: ${message(error)}`,
+        })
+      }
+    }
+    let content: string | undefined
+    try {
+      content = await readCheckoutFile(head, path, checkout, exec)
+    } catch (error) {
+      // The ref resolved but its file did not come back: corruption or an
+      // exec failure — actionable, unlike an unpublished branch.
+      onFailure({
+        kind: 'branch-source',
+        detail: `git show ${head}:${path} failed: ${message(error)}`,
+      })
+    }
+    if (content !== undefined) {
+      // Malformed committed branch file: terminal, as above.
+      const parsed = parsePipeline(head, 'branch-head', content, onFailure)
+      if (parsed === undefined) return undefined
+      return parsed
+    }
+  }
+  const baseSha = recordedBaseSha(events)
+  if (baseSha === undefined) {
+    onFailure({ kind: 'no-base', detail: 'no recorded base commit (legacy build)' })
+    return undefined
+  }
+  let baseContent: string | undefined
+  try {
+    baseContent = await readCheckoutFile(baseSha, path, checkout, exec)
+  } catch (error) {
+    // Base file unreadable: legacy fallback.
+    onFailure({
+      kind: 'base-source',
+      detail: `git show ${baseSha}:${path} failed: ${message(error)}`,
+    })
+    return undefined
+  }
+  return parsePipeline(baseSha, 'base', baseContent, onFailure)
+}

package/packages/core/src/config/schema.ts

@@ -14,9 +14,16 @@
 import { z } from 'zod'
 import { prImageHostSchema } from '../ontology'
 import { SANDBOX_FORBIDDEN_ENV } from '../ports/workspace/operator-sandbox'
+import {
+  runtimeProvisioningMap,
+  runtimeProvisioningMissingMessage,
+  sandboxForbiddenEnvMessage,
+} from '../ports/workspace/provider-capabilities'
 import { defineEntry, openMap, ownEntries, parseEntry } from '../open-map'
 import { forwardIssues } from '../zod-issues'
-import { displayName, effectiveRuntimeReferences, tomlKey } from './roles'
+import { compileEventGlobs } from '../events/globs'
+import { REPOSITORY_ATTENTION_EVENTS } from '../events/repository'
+import { effectiveRuntimeReferences } from './roles'
 
 // ── Open maps ────────────────────────────────────────────────────────────────
 
@@ -242,6 +249,70 @@ export const workspaceSchema = z.strictObject({
 })
 export type WorkspaceConfig = z.infer<typeof workspaceSchema>
 
+/**
+ * The parse-time subset of workspace-provider behavior a builtin declares
+ * (AUT-516). This table lives in `config/schema.ts` because the
+ * `[workspace.config]` validation runs inside `configSchema`'s
+ * `superRefine` — at parse time, long before plugins load, in processes that
+ * never touch the registry. The full capability objects (including the
+ * registry-seam declarations) are assembled in
+ * `ports/workspace/builtin-capabilities.ts`, which takes this subset from
+ * here — a parity now enforced by
+ * `ports/workspace/builtin-capabilities.test.ts` (AUT-573), so a builtin
+ * added to only one table fails tests rather than compiling silently. The
+ * construction-site refusal text differs by design from the
+ * parse-site one, so it is NOT copied from this table.
+ */
+export interface WorkspaceProviderConfigDeclaration {
+  /** Strict schema applied to `[workspace.config]`. A builtin declaration
+   * carries EXACTLY ONE of `configSchema` / `configRefusalMessage`: when the
+   * schema is absent, the declaration must carry `configRefusalMessage` for
+   * nonempty provider config to be refused (the neither-key side is pinned by
+   * the AUT-565 test in config.test.ts), and carrying BOTH is forbidden —
+   * `configSchema`'s superRefine checks `configRefusalMessage` first, so the
+   * refusal branch would win and the schema would silently never apply (the
+   * both-keys side is pinned by its sibling test). Providers absent from
+   * `BUILTIN_WORKSPACE_PROVIDER_CONFIG` are plugin-owned pass-throughs and
+   * are never refused here. */
+  configSchema?: z.ZodType
+  /** Parse-site refusal text for a provider that rejects `[workspace.config]`
+   * outright. This is the sole parse-site refusal key: a declaration without
+   * it never refuses `[workspace.config]` here, with or without a schema.
+   * Distinct from the capability's construction-site `configRefusal`. */
+  configRefusalMessage?: string
+  /** Referenced runtimes must have `[workspace.config.runtimeProvisioning]`
+   * entries (checked only once roles, verify, and finalize are all present). */
+  requireRuntimeProvisioning?: boolean
+  /** Names added to the operator-sandbox forbidden-forwarding set beyond
+   * `SANDBOX_FORBIDDEN_ENV`. */
+  sandboxForbiddenEnv?: readonly string[]
+}
+
+/** Parse-time behavior of every builtin workspace provider, keyed by the
+ * provider name an operator writes in `[workspace].provider`. No provider
+ * name appears in any validation branch — every check reads this table. */
+export const BUILTIN_WORKSPACE_PROVIDER_CONFIG: ReadonlyMap<
+  string,
+  WorkspaceProviderConfigDeclaration
+> = new Map([
+  [
+    'git-worktree',
+    {
+      configRefusalMessage:
+        '[workspace.config] is not supported by the builtin "git-worktree" provider — remove it or select a plugin workspace provider',
+    },
+  ],
+  [
+    'vercel-sandbox',
+    {
+      configSchema: vercelSandboxConfigSchema,
+      requireRuntimeProvisioning: true,
+      // Its credentials are already in SANDBOX_FORBIDDEN_ENV.
+      sandboxForbiddenEnv: [],
+    },
+  ],
+])
+
 // ── [commands] ───────────────────────────────────────────────────────────────
 //
 // Open map of deterministic verbs the kernel may run. `setup`, `lint`,
@@ -534,9 +605,107 @@ export const orchestratorSandboxSchema = z.strictObject({
 })
 export type OrchestratorSandboxConfig = z.infer<typeof orchestratorSandboxSchema>
 
+/** The turn runner lives inside the hosted operator route and the dispatcher
+ * tick, both of which run under a Vercel function duration limit the config's
+ * invocation budget can never exceed: a value above this is clamped (not
+ * rejected) at parse time so a mis-set budget degrades to the limit instead of
+ * failing every deploy. The operator route pins `maxDuration` to this same
+ * constant, so one number is cited by the config, the route, and the docs. */
+export const ORCHESTRATOR_ROUTE_LIMIT_SECONDS = 300
+
+/** Turn budget floor for the dispatcher tick's orchestrator step: when less
+ * than this many seconds of tick budget remain, the step skips the pass
+ * entirely (suspension state is durable, so skipping is always safe). */
+export const ORCHESTRATOR_MIN_TURN_SECONDS = 30
+
+/** The turn approval entries' shape: a registry tool name, optionally
+ * qualified by the discriminator field's accepted value (`tool:qualifier`).
+ * Validation is syntactic only — an entry naming an absent or unknown tool is
+ * inert by design (documented in docs/configuration.md), because the list
+ * is meant to stay stable while the registry grows — e.g. `sandbox.publish`
+ * was named here before its ticket landed, and stays inert in bindings
+ * where no sandbox backend is bound (the hosted default). */
+const ORCHESTRATOR_APPROVAL_ENTRY = /^[a-z][a-z0-9_.]*(:[a-z0-9_-]+)?$/
+
+/** The attention set a new session's wake settings inherit when the
+ * repository does not override `wake`: the build events an operator or agent
+ * must wake up for (the same set `ab watch` filters on by default) plus the
+ * repository-journal attention events (the same set `ab watch --repository`
+ * follows), spelled as literal globs. Both halves of the attention set can
+ * wake a session. */
+export const defaultOrchestratorWakeGlobs: readonly string[] = [
+  'escalation.raised',
+  'phase.failed',
+  'infrastructure.failed',
+  'runner.setup-failed',
+  'dispatch.failed',
+  'publication.lost',
+  'finalize.completed',
+  'pr.conflicted',
+  'pr.merged',
+  'pr.closed',
+  'build.completed',
+  'build.aborted',
+  ...REPOSITORY_ATTENTION_EVENTS,
+]
+
+/** The registry tools a turn asks its operator about before executing.
+ * The maintainer sets this to `[]` for autonomous operation. */
+export const defaultOrchestratorApprovals: readonly string[] = [
+  'builds.control:abort',
+  'builds.control:discard',
+  'builds.answer:revise-spec',
+  'sandbox.publish',
+  'tickets.move:ready',
+]
+
+/** A session's effective wake globs: the configured `wake` when declared
+ * (an explicit `[]` means never wake), else the default attention set. Kept
+ * as a resolver rather than a schema default so `wake`'s absence (inherit)
+ * and emptiness (never wake) stay distinct. */
+export function orchestratorWakeGlobs(config: OrchestratorConfig): string[] {
+  return [...(config.wake ?? defaultOrchestratorWakeGlobs)]
+}
+
 export const orchestratorSchema = z.strictObject({
   enabled: z.boolean().default(false),
   sandbox: orchestratorSandboxSchema.prefault({}),
+  /** Provider-qualified model string for the turn runner, in the same
+   * vocabulary as `[roles]` model strings (nonblank; a leading
+   * `vercel-ai-gateway/` prefix is stripped before the gateway provider).
+   * Resolved through the deployment's gateway credential. Required when
+   * `enabled = true` (cross-validated below); the runner never starts a turn
+   * on a repository whose config omits it. */
+  model: z.string().min(1).optional(),
+  /** Wall-clock budget for one turn invocation, in seconds. Clamped — not
+   * rejected — to ORCHESTRATOR_ROUTE_LIMIT_SECONDS, the hosted function
+   * duration the runner runs under. */
+  invocationBudgetSeconds: z
+    .number()
+    .int()
+    .positive()
+    .default(240)
+    .transform((value) => Math.min(value, ORCHESTRATOR_ROUTE_LIMIT_SECONDS)),
+  /** Registry tool names (optionally `tool:qualifier`) whose calls suspend a
+   * turn until the operator answers. Empty means none. Entries naming an
+   * absent or unknown tool are inert by design, which is what keeps the
+   * default list stable while the registry grows. */
+  approvals: z
+    .array(
+      z
+        .string()
+        .regex(
+          ORCHESTRATOR_APPROVAL_ENTRY,
+          'approval entries look like "tool" or "tool:qualifier"',
+        ),
+    )
+    .default([...defaultOrchestratorApprovals]),
+  /** Wake-filter globs a NEW session inherits. Kept schema-optional (not
+   * `.default()`) so absent ("inherit the default attention set") and `[]`
+   * ("never wake") stay distinct. Each glob must match at least one build
+   * or repository-journal event type — validated below with the shared
+   * `ab watch` compiler. */
+  wake: z.array(z.string().min(1)).optional(),
 })
 export type OrchestratorConfig = z.infer<typeof orchestratorSchema>
 
@@ -614,33 +783,34 @@ export const configSchema = configRootSchema.superRefine((config, ctx) => {
     })
   })
 
-  if (
-    config.workspace.provider === 'git-worktree' &&
-    Object.keys(config.workspace.config).length > 0
-  ) {
-    ctx.addIssue({
-      code: 'custom',
-      path: ['workspace', 'config'],
-      message:
-        '[workspace.config] is not supported by the builtin "git-worktree" provider — remove it or select a plugin workspace provider',
-    })
-  } else if (config.workspace.provider === 'vercel-sandbox') {
-    const parsed = vercelSandboxConfigSchema.safeParse(config.workspace.config)
+  const workspaceDeclaration = BUILTIN_WORKSPACE_PROVIDER_CONFIG.get(config.workspace.provider)
+  // The parse-site refusal fires only for a declaration carrying
+  // `configRefusalMessage`; providers absent from the table are plugin-owned
+  // pass-throughs and are never refused here.
+  if (workspaceDeclaration?.configRefusalMessage !== undefined) {
+    if (Object.keys(config.workspace.config).length > 0) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['workspace', 'config'],
+        message: workspaceDeclaration.configRefusalMessage,
+      })
+    }
+  } else if (workspaceDeclaration?.configSchema !== undefined) {
+    const parsed = workspaceDeclaration.configSchema.safeParse(config.workspace.config)
     if (!parsed.success) {
       forwardIssues(parsed.error.issues, ctx, ['workspace', 'config'])
     } else if (
+      workspaceDeclaration.requireRuntimeProvisioning === true &&
       config.roles !== undefined &&
       config.verify !== undefined &&
       config.finalize !== undefined
     ) {
       for (const group of effectiveRuntimeReferences(config)) {
-        if (Object.hasOwn(parsed.data.runtimeProvisioning, group.runtime)) continue
+        if (Object.hasOwn(runtimeProvisioningMap(parsed.data), group.runtime)) continue
         ctx.addIssue({
           code: 'custom',
           path: ['workspace', 'config', 'runtimeProvisioning', group.runtime],
-          message:
-            `runtime ${displayName(group.runtime)} is selected by ${group.references.join(', ')} but has no sandbox provisioning; add ` +
-            `[workspace.config.runtimeProvisioning.${tomlKey(group.runtime)}] with nonblank install and preflight commands`,
+          message: runtimeProvisioningMissingMessage(group),
         })
       }
     }
@@ -758,13 +928,54 @@ export const configSchema = configRootSchema.superRefine((config, ctx) => {
 
   // The credential-free sandbox rule (AUT-340): a forwarded variable name may
   // never name a store, forge, ticket-provider, model, or Vercel credential.
+  // A workspace provider can declare additional forbidden names beyond the
+  // shared set. This check is deliberately builtin-only: plugins are not
+  // loaded when config is parsed, so a plugin provider's declared names cannot
+  // be seen here (AUT-536). The deferral is accepted, not an oversight — the
+  // declared extras are enforced at the registry-aware seams instead,
+  // `createWorkspaceProvider` (construction) and `validateInitReadiness`
+  // (init validation), both of which run after plugin load; no site loads
+  // plugins earlier to widen parse-time coverage.
+  // Wake globs are validated with the same compiler `ab watch` uses, over the
+  // build AND repository-journal catalogs — the wake pass scans both — so a
+  // typo'd glob fails at parse time instead of silently matching nothing —
+  // regardless of `enabled`, since a later enablement would inherit the
+  // already-broken value.
+  if (config.orchestrator.wake !== undefined) {
+    try {
+      compileEventGlobs(config.orchestrator.wake, {
+        repository: true,
+        usage: '[orchestrator].wake',
+      })
+    } catch (error) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['orchestrator', 'wake'],
+        message: error instanceof Error ? error.message : String(error),
+      })
+    }
+  }
+
   if (config.orchestrator.enabled) {
+    // The turn runner's model is not optional when the orchestrator is on:
+    // an enabled table without one would fail at first turn start, far from
+    // the edit that caused it.
+    if (config.orchestrator.model === undefined) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['orchestrator', 'model'],
+        message:
+          '[orchestrator].enabled = true requires [orchestrator].model — name the provider-qualified model string the turn runner uses (same vocabulary as [roles], resolved through the deployment gateway credential)',
+      })
+    }
+    const providerForbidden =
+      BUILTIN_WORKSPACE_PROVIDER_CONFIG.get(config.workspace.provider)?.sandboxForbiddenEnv ?? []
     config.orchestrator.sandbox.environmentVariables.forEach((name, index) => {
-      if (SANDBOX_FORBIDDEN_ENV.includes(name)) {
+      if (SANDBOX_FORBIDDEN_ENV.includes(name) || providerForbidden.includes(name)) {
         ctx.addIssue({
           code: 'custom',
           path: ['orchestrator', 'sandbox', 'environmentVariables', index],
-          message: `environment variable ${JSON.stringify(name)} is a store, forge, ticket-provider, model, or Vercel credential and may never be forwarded into an operator sandbox`,
+          message: sandboxForbiddenEnvMessage(name),
         })
       }
     })