@defrex/autobuild 0.8.0 → 0.9.0

package/docs/remote-store-protocol.md

@@ -20,7 +20,7 @@ document and the package's executable contracts together.
   `AB_STORE`; the shipped client appends the routes below.
 - Every `/builds`, `/repos`, and `/sessions` request sends
   `X-Autobuild-Version` with the exact client package version and
-  `X-Autobuild-Protocol-Version` with the remote protocol version (`2` in this
+  `X-Autobuild-Protocol-Version` with the remote protocol version (`3` in this
   distribution). Before authentication,
   body parsing, or resource lookup, the server compares both exact strings.
   Missing or different values receive `409 {"kind":"conflict","error":"…"}`;
@@ -290,7 +290,7 @@ it to exist. An unknown build returns `404 not-found`.
 
 | BuildStore operation | HTTP route | Request | Success |
 |---|---|---|---|
-| `createBuild` | `POST /builds` | `{slug: string, repo: string, repoOrigin?: string, ticket?: TicketRef, branch?: string}`; `slug`, `repo`, and a supplied `branch` are nonempty | `201` + `BuildRecord`; duplicate slug is `409 conflict` |
+| `createBuild` | `POST /builds` | `{slug: string, repo: string, repoOrigin?: string, ticket?: TicketRef, branch?: string, created?: event write}`; `slug`, `repo`, and a supplied `branch` are nonempty. `created`, when present, must be a valid `build.created` write; the server appends it as seq 1 atomically with the record (both exist or neither), and an invalid one is `422` with nothing created | `201` + `BuildRecord`; duplicate slug is `409 conflict` |
 | `listBuilds` | `GET /builds` | none | `200` + `BuildRecord[]`; list order is unspecified |
 | `getBuild` | `GET /builds/{slug}` | none | `200` + `BuildRecord`; absent is `404` (the shipped client maps this to `null`) |
 | `append` | `POST /builds/{slug}/events` | event write | `201` + build event envelope |
@@ -357,7 +357,8 @@ requires. A held request's authentication, token scope, and version-skew rules
 are identical to the immediate form: a `401`, `403`, or `409` identity failure
 is answered immediately, never held.
 
-The parameter is purely additive, so the protocol version stays `2`: a server
+The parameter is purely additive in the version it landed in (protocol `2`,
+where the event-wait rules were introduced): a server
 that ignores `wait` remains conforming — its immediate empty answers only raise
 the client's request rate — and a client that sends `wait` to such a server
 observes no other difference. This is the same reasoning the stream and session
@@ -368,7 +369,11 @@ waits apply. There is no push transport; a held request is the whole mechanism.
 Repository journals are separate resources with independent event sequences,
 artifacts, and leases. `{repo}` is one percent-encoded repository id; encode
 embedded `/` characters. All resource routes authorize and require the
-repository to exist. An unknown repository returns `404 not-found`.
+repository to exist. An unknown repository returns `404 not-found` — with one
+carve-out: the build-digest batch read of this section is keyed to build
+records, not the repository journal record, so it authorizes the repo token
+but answers `200` (possibly empty) even for an unknown repository, a repository
+without a journal record, or a repository without builds.
 
 | BuildStore operation | HTTP route | Request | Success |
 |---|---|---|---|
@@ -376,10 +381,12 @@ repository to exist. An unknown repository returns `404 not-found`.
 | `getRepo` | `GET /repos/{repo}` | none | `200` + `RepositoryRecord`; absent is `404` (the shipped client maps this to `null`) |
 | `appendRepo` | `POST /repos/{repo}/events` | event write | `201` + repository event envelope |
 | `getRepoEvents` | `GET /repos/{repo}/events?since={n}&wait={s}` | optional `since` query value, parsed as in section 3; absence defaults to `0`. Optional `wait` in whole seconds, per the event-wait rules of section 3 | `200` + envelopes with `seq >` parsed `since`, in increasing sequence order |
+| `getRepoStateEvents` | `GET /repos/{repo}/state-events` | none | `200` + the bounded repository-journal subset (AUT-489): every durable event type (`harvest.*`, `orchestrator.sandbox.*`, the three dispatcher setting types) plus, when the journal has one, the tail from the latest `dispatcher.run-started`, in increasing sequence order; served inside the repository-existence gate like `GET events`, so an unknown repository is `404` |
 | `appendRepoWithArtifacts` | `POST /repos/{repo}/deposits` | atomic deposit request | `201` + `{event, artifacts}` using repository shapes |
 | `putRepoArtifact` | `POST /repos/{repo}/artifacts` | artifact input | `201` + repository artifact metadata |
 | `getRepoArtifact` | `GET /repos/{repo}/artifacts?kind={kind}&rev={n}` | required nonempty `kind`; optional `rev` is parsed as in section 3 | `200` + artifact read; latest only when the `rev` parameter is absent; missing kind/revision is `200 null` |
 | `listRepoArtifacts` | `GET /repos/{repo}/artifact-list?kind={kind}` | optional `kind`; absence means all kinds | `200` + metadata ordered by kind and then increasing revision |
+| `getRepoBuildDigests` | `GET /repos/{repo}/build-digests` | none | `200` + `BuildDigest[]`, one entry per build record of the repository (possibly empty), ordered by slug; handled before the repository-existence gate, so an unknown or journal-less repository answers `200 []` |
 | `claimRepoLease` | `POST /repos/{repo}/lease/claim` | claim request | `200 {"ok": boolean}` |
 | `heartbeatRepo` | `POST /repos/{repo}/lease/heartbeat` | holder request | `200 {"ok": boolean}` |
 | `releaseRepoLease` | `POST /repos/{repo}/lease/release` | holder request | `200 {"ok": true}`; a wrong holder is a successful no-op |
@@ -389,10 +396,153 @@ creation operation and must not reset timestamps, events, artifacts, or lease
 state when the repository already exists. Event sequence numbering starts at 1
 for each repository independently of every build and other repository.
 
+A `BuildDigest` is the projection of one build's log onto its terminal fact
+and its `observation.recorded` occurrences:
+
+```jsonc
+// BuildDigest
+{
+  "slug": "ab-fix-login-3",
+  "terminal": "done",               // optional: "done" | "aborted", omitted while the log has neither
+  "observations": [                 // ascending-seq pairs for the log's observation.recorded events
+    { "seq": 1, "ts": "2026-07-15T12:00:01.000Z" },
+    { "seq": 4, "ts": "2026-07-15T12:00:04.000Z" }
+  ],
+  "merged": "2026-07-15T12:00:06.000Z" // optional: ts of the log's latest pr.merged, omitted when none
+}
+```
+
+The digest is derived from the event log on every call — the server persists
+nothing and there is no refresh step. Protocol version `3` reshaped the
+digest's `observations` from bare sequence numbers to `{seq, ts}` pairs and
+added the optional `merged` fact, so the harvest pressure gate can evaluate
+launch decisions from digests and the repository journal alone instead of
+reading every build's full history per evaluation. That is a breaking wire
+change, not an additive one: a server that predates it returns the old shape
+and would fail the client's schema parse mid-request, which is why the version
+moved — a stale peer is now rejected at the handshake (`409 conflict`) instead.
+This is the same discipline the transport's exact-match version rules promise:
+wire shapes that independently implemented servers must reproduce update this
+document and the protocol version together.
+
 The build-stream query, artifact, ordering, timestamp, and validation rules
 apply symmetrically to repository journals, including the event-read bounded
 wait of section 3.
 
+### Ticket assets
+
+A ticket asset is a named, versioned bundle of files attached to
+a ticket, keyed by `(repo, ticketId, kind, name)`. These routes live under the
+repository but, unlike the journal routes, **do not require a repository
+record**: assets can precede any journal row, so the repository-existence gate
+does not apply. `{repo}` and `{id}` are percent-encoded path segments. Token
+authorization follows the one-matching-repo column of the matrix (a repo token
+for its own repository, or admin); build and session tokens receive `403 auth`.
+The family is additive, so `REMOTE_STORE_PROTOCOL_VERSION` did not change.
+
+A build also reads the assets it froze at its claim through its own build-scoped
+routes, which a build token may use (no ticket-asset authority needed). The
+server reduces the build's events to find the pinned revision, then returns that
+exact revision, so a later replace or removal never changes the answer and a
+finished build still answers:
+
+| BuildStore operation | HTTP route | Request | Success |
+|---|---|---|---|
+| `getPinnedTicketAsset` (manifest) | `GET /builds/{slug}/ticket-assets?kind=&name=[&rev=]` | required `kind` and `name`; optional `rev` | `200` + `TicketAssetMeta` for the latest pinned revision (or the named pinned `rev`), or `200 null` when the build never pinned it |
+| `getPinnedTicketAsset` (one file) | `GET /builds/{slug}/ticket-assets/file?kind=&name=&rev=&path=` | required `kind`, `name`, `path`; optional `rev` | `200` + `{"contentBase64": string}`, or `200 null` when not pinned; `404` when the revision has no such file |
+
+| BuildStore operation | HTTP route | Request | Success |
+|---|---|---|---|
+| `ticketAssetLimits` | `GET /repos/{repo}/ticket-asset-limits` | none | `200` + `{maxBytes, maxEntries, maxRequestBytes?}` — the effective per-revision ceilings and, when the deployment has one, the largest request or response body it can carry. A server without this route answers `404`; clients treat that as the defaults |
+| `putTicketAsset` | `POST /repos/{repo}/tickets/{id}/assets` | `{kind, name, layout, entries}` | `201` + `TicketAssetMeta` (with its manifest) |
+| `getTicketAsset` (manifest) | `GET /repos/{repo}/tickets/{id}/assets?kind=&name=[&rev=]` | required `kind` and `name`; optional `rev` | `200` + `TicketAssetMeta` — **the manifest only, no bytes** — or `200 null` when the asset is absent or removed (latest) or the revision does not exist |
+| `getTicketAsset` (one file) | `GET /repos/{repo}/tickets/{id}/assets/file?kind=&name=&rev=&path=` | required `kind`, `name`, `path`; optional `rev` | `200` + `{"contentBase64": string}`, or `200 null` when the asset is absent; `404` when the revision has no such file |
+| `listTicketAssets` | `GET /repos/{repo}/tickets/{id}/assets/list[?revisions=1]` | optional `revisions=1` | `200` + `TicketAssetSummary[]` ordered by kind, name, revision: the latest live revision per kind and name, or with `revisions=1` every real revision (no tombstones). Summaries carry no manifest |
+| `removeTicketAsset` | `POST /repos/{repo}/tickets/{id}/assets/remove` | `{kind, name}` | `200` + the removed `TicketAssetMeta`, or `200 null` when no live asset exists |
+
+Wire types:
+
+```jsonc
+// put request: entries are files (content as base64) or explicit directories
+{ "kind": "design", "name": "home", "layout": "tree",   // layout: "file" | "tree"
+  "entries": [
+    { "type": "file", "path": "index.html", "contentBase64": "PGgxPg==" },
+    { "type": "dir",  "path": "img/empty" }
+  ] }
+
+// TicketAssetMeta: dir entries carry no size or blobRef
+{ "repo": "…", "ticketId": "AUT-1", "kind": "design", "name": "home",
+  "revision": 0, "layout": "tree", "size": 1234,         // size = total file bytes
+  "entries": [
+    { "type": "file", "path": "index.html", "size": 1234, "blobRef": "<sha256 hex>" },
+    { "type": "dir",  "path": "img/empty" }
+  ],
+  "createdAt": "2026-10-01T12:00:00.000Z" }
+
+// TicketAssetSummary (list): the same without entries
+{ "repo": "…", "ticketId": "AUT-1", "kind": "design", "name": "home",
+  "revision": 0, "layout": "tree", "size": 1234,
+  "fileCount": 1, "dirCount": 1, "createdAt": "…" }
+```
+
+Semantics every server must reproduce:
+
+- **Revisions** are 0-based per `(repo, ticketId, kind, name)`. Putting the same
+  kind and name again creates the next revision; earlier revisions stay readable
+  by explicit `rev`.
+- **Removal is a tombstone** that takes the next revision number with an empty
+  manifest. The latest row decides liveness: a read without `rev` and the
+  default list skip a removed asset, while an explicit earlier `rev` keeps
+  working (a build that pinned that revision still retrieves it). Re-attaching
+  takes the next revision, so numbers may skip the tombstone. `revisions=1`
+  lists real revisions only.
+- **Validation** (`422 validation`, nothing stored). `kind` and `name` match
+  `[A-Za-z0-9._-]+`, at most 64 characters. Paths are relative and
+  `/`-separated, with no empty, `.`, or `..` segment and no NUL, at most 256
+  UTF-8 bytes (128 per segment); paths are unique across files and directories
+  and no file is the ancestor of another entry. `layout: "file"` has exactly one
+  top-level `file` entry and no directory; `layout: "tree"` may hold any number
+  of entries, including zero (an empty folder; its root is implicit). A revision
+  holds at most 1000 entries (files plus directories) and **26214400 bytes (25
+  MiB)** of file bytes; the error names the limit, for example `ticket asset
+  exceeds the 26214400-byte (25 MiB) limit`.
+- File bytes are content-addressed (`blobRef` is the sha256 hex) in the same
+  blob store as artifacts; the database holds only the manifest.
+
+**Deployment ceilings.** A platform may reject oversized request or response
+bodies before any application code runs (Vercel's functions cap them at 4.5
+MB), so validating on the server alone cannot enforce a limit. A server that
+has such a ceiling advertises it as `maxRequestBytes` on the limits route
+together with the effective `maxBytes`, computed from it as follows. Paths and
+entry counts are bounded, so the worst-case wire overhead is a constant:
+`overhead = 1024 + 1000 × 320 = 321024` bytes, and
+`maxBytes = min(26214400, max(0, floor((maxRequestBytes − overhead) × 3 / 4)))`
+(base64 inflates content by 4/3); `maxEntries` stays 1000. The hosted service
+sets `maxRequestBytes` to 4 MiB, giving an effective per-asset limit of 2904960
+bytes (about 2.8 MiB). The formula is a safe lower bound, not the final
+authority:
+
+- The shipped **client** reads the limits once per store handle and, before any
+  upload, validates against `maxBytes` and `maxEntries` and then compares the
+  exact UTF-8 length of the serialized request with `maxRequestBytes`. A bundle
+  that does not fit is refused locally with `ticket asset exceeds this store's
+  N-byte limit (deployment request ceiling M bytes)` and **no upload request is
+  made**.
+- The **server** re-validates every put against its effective limits and checks
+  every ticket-asset body against `maxRequestBytes` itself, answering `413` (a
+  request) or `422` with a limit-naming message where the platform lets the
+  request through.
+- **Downloads never need a bundle-sized response**: the client reads the
+  manifest and then each file by its own request. The manifest, file, and list
+  routes check the exact serialized length of their response against
+  `maxRequestBytes` and fail with a `413 validation` error naming the asset (or
+  the file, its size, and the ceiling) rather than letting the platform reject
+  it. This matters for a revision stored under an older or higher ceiling:
+  its manifest and smaller files remain retrievable; a file that cannot fit can
+  only be fetched from a store with a higher ceiling. Chunked or ranged transfer
+  is not part of the protocol, so a deployment's effective per-asset limit is
+  its advertised `maxBytes`.
+
 ## 5. Operator-session operations
 
 Operator sessions are a third resource kind: durable orchestrator-conversation
@@ -430,6 +580,7 @@ identity is already the actor.
 | `listSessions` | `GET /repos/{repo}/sessions` | none | `200` + `SessionRecord[]`, creation order (`createdAt`, then the store's creation counter for same-millisecond ties) |
 | `getSession` | `GET /sessions/{id}` | none | `200` + `SessionRecord`; absent is `404` (the shipped client maps this to `null`) |
 | `appendSessionEvent` | `POST /sessions/{id}/events` | event write | `201` + session event envelope (same envelope shape with `"session"` in place of `"build"`) |
+| `appendSessionEventIfCurrent` | `POST /sessions/{id}/events/conditional` | `{"expectedSeq": nonnegative integer, "event": event write}` | appended: `201` + session event envelope; session advanced: `200 null` (mirroring section 3's build compare-and-append) |
 | `getSessionEvents` | `GET /sessions/{id}/events?since={n}&wait={s}` | optional `since` query value, parsed as in section 3; absence defaults to `0`. Optional `wait` in whole seconds, per the event-wait rules of section 3 | `200` + session event envelopes with `seq >` parsed `since`, in increasing sequence order |
 | `appendSessionWithArtifacts` | `POST /sessions/{id}/deposits` | atomic deposit request | `201` + `{event, artifacts}` using session shapes; the substitution algorithm of section 8 applies unchanged |
 | `putSessionArtifact` | `POST /sessions/{id}/artifacts` | artifact input | `201` + session artifact metadata |
@@ -599,7 +750,8 @@ by this rule (their retention belongs to the open archival thread), and open
 streams are never pruned. A read of a stream whose chunks were pruned returns
 no chunks, `status: "closed"`, and the artifact reference.
 
-These additions are purely additive: the protocol version stays `2`, and a
+These additions were purely additive in the version they landed in (protocol
+`2`, where the stream routes were introduced), and a
 conforming server implements the stream routes together with this document's
 rules exactly as it does for the event and artifact routes.
 
@@ -675,12 +827,12 @@ resource access; an explicit resource whose id is `"*"` is not admin.
 
 ### Resource authorization matrix
 
-| Token resource | `/builds` create/list | one matching build | `/repos` ensure | one matching repo | `/repos/{repo}/sessions` create/list | one matching session |
-|---|---:|---:|---:|---:|---:|---:|
-| admin (`build: "*"`) | yes | any | yes | any | yes | any |
-| build | no | exact id only | no | no | no | no |
-| repo | no | no | no | exact id only | yes | no |
-| session | no | no | no | no | no | exact id only |
+| Token resource | `/builds` create/list | one matching build | `/repos` ensure | one matching repo | `/repos/{repo}/sessions` create/list | `/repos/{repo}/build-digests` | `/repos/{repo}/state-events` | `/repos/{repo}/tickets/{id}/assets` and `/repos/{repo}/ticket-asset-limits` | one matching session |
+|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|
+| admin (`build: "*"`) | yes | any | yes | any | yes | any | any | any | any |
+| build | no | exact id only | no | no | no | no | no | no | no |
+| repo | no | no | no | exact id only | yes | exact id only | exact id only | exact repo only | no |
+| session | no | no | no | no | no | no | no | no | exact id only |
 
 A valid token used for the wrong resource receives `403 auth`. Resource scope
 gates all operations, including reads, artifact operations, and leases. A
@@ -793,8 +945,8 @@ The shipped server maps failures as follows:
 | `403` | `auth` | Valid token with the wrong resource scope or event-session attribution |
 | `404` | `not-found` | Unknown route, unsupported method, unknown build, unknown repository, unknown session, or an unknown or foreign-scoped stream |
 | `409` | `conflict` | Missing/mismatched package or protocol identity, duplicate build creation, appending to a closed stream (`stream "…" is closed`), or a backing conflict reported as already existing |
-| `413` | `validation` | Decoded artifact or serialized stream batch exceeds the configured ceiling; the message names the ceiling |
-| `422` | `validation` | `EventValidationError` from build, repository, or session catalog validation; its message is preserved verbatim |
+| `413` | `validation` | Decoded artifact or serialized stream batch exceeds the configured ceiling; a ticket-asset request or response exceeds the deployment's request ceiling; the message names the ceiling |
+| `422` | `validation` | `EventValidationError` from build, repository, or session catalog validation, or a ticket-asset validation failure (including the 25 MiB limit); its message is preserved verbatim |
 | `500` | `internal` | Any other unexpected backing or server failure; the thrown error message is returned |
 
 Authentication runs before resource lookup, and session authorization runs
@@ -916,11 +1068,12 @@ Four shipped behaviors do not add `BuildStore` routes:
   store lifecycle; there is no close endpoint.
 - `GET /health` is outside the `BuildStore` interface. It is always open and
   returns exactly `200 {"ok":true,"autobuildVersion":"<package>",
-  "protocolVersion":"2"}`. It reports HTTP-process availability and identity,
+  "protocolVersion":"3"}`. It reports HTTP-process availability and identity,
   not a deeper backing-store transaction or migration check.
 
-There is no push/WebSocket subscription protocol, batch-read route,
-repository listing, artifact deletion, or server deployment API.
+There is no push/WebSocket subscription protocol, repository listing, artifact
+deletion, or server deployment API. The one repo-scoped batch read is the
+build-digest route of section 4; no other batch-read route exists.
 
 ## 12. Conformance
 

package/docs/remote-ticket-protocol.md

@@ -3,7 +3,7 @@
 The hosted ticket protocol exposes the complete `TicketSource` port without
 exposing backend credentials. It shares the Autobuild and remote protocol
 version headers with the remote BuildStore. Both must exactly match the service;
-this release uses remote protocol version `2`.
+this release uses remote protocol version `3`.
 
 ## Authentication and context
 

package/docs/setup.md

@@ -59,7 +59,7 @@ DEBIAN_FRONTEND=noninteractive apt-get install -y chromium""" },
 
 [workspace.config.runtimeProvisioning.pi]
 install = "npm install --global --ignore-scripts @earendil-works/pi-coding-agent@0.84.4"
-preflight = "test \"$(pi --version)\" = \"0.84.4\""
+preflight = "test \"$(pi --version)\" = \"0.84.4\" && pi update --models"
 ```
 
 Use a `vercel-ai-gateway/...` Pi model with `AI_GATEWAY_API_KEY` in the
@@ -220,14 +220,17 @@ same lockstep window. If the release is cut but the store upgrade lags, guests
 carrying the new distribution fail loudly against the old store (409) rather
 than running silently stale.
 
-Provisioning records the installed distribution's version in the guest's
-`/opt/autobuild/.distribution-version` marker. A reused persistent sandbox
-whose marker disagrees with the version the current system would deliver —
-which includes every guest provisioned before the marker existed — is
-refreshed in place (archive re-fetched, extracted, and production-installed)
-before being reused, so an upgraded dispatcher retrofits its existing guests
-instead of resuming a stale distribution. A refresh failure deletes the
-sandbox so the next provisioning pass rematerializes it from scratch.
+Provisioning records the installed distribution's identity — package version
+and remote-store protocol version — in the guest's
+`/opt/autobuild/.distribution-version` marker. Every path that launches guest
+code in an existing sandbox — provisioning reuse, harvest reuse, the operator
+sandbox, and build execution restart after a lease sweep — compares the marker
+against the identity the current system would deliver and, when they disagree
+(which includes every guest provisioned before the marker existed), refreshes
+it in place (archive re-fetched, extracted, and production-installed) first,
+so an upgraded dispatcher retrofits its existing guests instead of resuming a
+stale distribution the hosted store would reject. A refresh failure deletes
+the sandbox so the next provisioning pass rematerializes it from scratch.
 
 After a lockstep upgrade, confirm a fix-bearing guest from the guest
 perspective:

package/docs/website.md

@@ -0,0 +1,10 @@
+# Website
+
+The marketing site is one static page in `packages/website`, reproduced from the approved design in `design/website/`. The package is private and never published to npm.
+
+- `bun run website:dev` serves it on port 3300 (`PORT` overrides), rebuilding on every request.
+- `bun run website:build` writes `packages/website/dist/` (`index.html`, `site.css`, `site.js`).
+
+`dist/` is plain static files: any static host can serve it with no server runtime, credentials, or environment variables. On Vercel, set the root directory to `packages/website`, the build command to `bun run build`, and the output directory to `dist`.
+
+The page loads one webfont from Google Fonts and makes no other third-party requests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defrex/autobuild",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Agent-driven software delivery from groomed ticket to merged PR",
   "repository": {
     "type": "git",
@@ -37,10 +37,15 @@
       "import": "./packages/core/src/store/remote/index.ts",
       "default": "./packages/core/src/store/remote/index.ts"
     },
-    "./operator-api": {
-      "types": "./packages/core/src/operator/index.ts",
-      "import": "./packages/core/src/operator/index.ts",
-      "default": "./packages/core/src/operator/index.ts"
+    "./hosted-tickets": {
+      "types": "./packages/core/src/ports/tickets/hosted-index.ts",
+      "import": "./packages/core/src/ports/tickets/hosted-index.ts",
+      "default": "./packages/core/src/ports/tickets/hosted-index.ts"
+    },
+    "./testing": {
+      "types": "./packages/core/src/testing/index.ts",
+      "import": "./packages/core/src/testing/index.ts",
+      "default": "./packages/core/src/testing/index.ts"
     },
     "./operator-presentation": {
       "types": "./packages/core/src/operator/presentation.ts",
@@ -52,11 +57,6 @@
       "import": "./packages/core/src/ports/tickets/update.ts",
       "default": "./packages/core/src/ports/tickets/update.ts"
     },
-    "./remote-tickets": {
-      "types": "./packages/core/src/ports/tickets/remote-index.ts",
-      "import": "./packages/core/src/ports/tickets/remote-index.ts",
-      "default": "./packages/core/src/ports/tickets/remote-index.ts"
-    },
     "./origin": {
       "types": "./packages/core/src/kernel/origin.ts",
       "import": "./packages/core/src/kernel/origin.ts",
@@ -76,12 +76,32 @@
       "types": "./packages/core/src/ports/workspace/distribution-archive.ts",
       "import": "./packages/core/src/ports/workspace/distribution-archive.ts",
       "default": "./packages/core/src/ports/workspace/distribution-archive.ts"
+    },
+    "./operator": {
+      "types": "./packages/core/src/operator/index.ts",
+      "import": "./packages/core/src/operator/index.ts",
+      "default": "./packages/core/src/operator/index.ts"
+    },
+    "./operator-sandbox-host": {
+      "types": "./packages/core/src/operator/sandbox-host.ts",
+      "import": "./packages/core/src/operator/sandbox-host.ts",
+      "default": "./packages/core/src/operator/sandbox-host.ts"
     }
   },
   "files": [
     "bin",
     "packages/core/src",
     "!packages/core/src/**/*.test.ts",
+    "!packages/core/src/**/*.test.tsx",
+    "!packages/core/src/**/*.spec.ts",
+    "!packages/core/src/**/*.spec.tsx",
+    "!packages/core/src/testing/store-failures.ts",
+    "!packages/core/src/testing/packed-install.ts",
+    "!packages/core/src/cli/testkit.ts",
+    "!packages/core/src/cli/store-opening.contract.ts",
+    "!packages/core/src/ports/runner/live-contract-fixture.ts",
+    "!packages/core/src/cli/dashboard/frame-image.ts",
+    "!packages/core/src/markdown.ts",
     "skills",
     "templates",
     "LICENSE",
@@ -90,24 +110,23 @@
     "docs"
   ],
   "scripts": {
-    "dev": "bun run --bun next dev",
     "dev:cli": "bun --hot --no-clear-screen bin/ab-dev.ts",
-    "build": "bun run --bun next build",
-    "deploy:build": "bun packages/hosted-store-service/src/bin.ts pack-distribution && bun run postgres:migrate && bun run build && bun tools/ship-packed-distribution.ts",
-    "start": "bun run --bun next start",
-    "hosted-store": "bun server.ts",
     "capture:dashboard": "bun tools/dashboard-capture.ts",
-    "capture:web-dashboard": "bun tools/web-dashboard-capture.tsx",
+    "capture:web-dashboard": "bun packages/web-dashboard-capture/src/web-dashboard-capture.tsx",
+    "capture:website": "bun tools/website-capture.ts",
+    "website:dev": "bun packages/website/src/dev.ts",
+    "website:build": "bun packages/website/src/build.ts",
     "capture:readme-headline": "bun tools/readme-headline.ts",
     "release": "bun tools/release.ts",
     "postgres:migrate": "bun packages/postgres-store/src/bin.ts migrate",
-    "check": "bun tools/biome-check.ts && bun tools/product-name-check.ts && bun tools/docs-asset-check.ts && bun tools/readme-headline.ts --check && bun tools/workspace-manifest-check.ts",
+    "check": "bun tools/biome-check.ts && bun tools/product-name-check.ts && bun tools/docs-asset-check.ts && bun tools/skill-docs-asset-check.ts && bun tools/readme-headline.ts --check && bun tools/workspace-manifest-check.ts && bun tools/package-boundary-check.ts && bun tools/bin-mode-check.ts && bun tools/publish-contents-check.ts && bun tools/publish-imports-check.ts",
     "format:staged": "git-format-staged --formatter './node_modules/.bin/biome format --stdin-file-path {}' '*.js' '*.jsx' '*.ts' '*.tsx' '*.json' '*.jsonc' '*.css' '*.graphql' '*.gql'",
     "prepare": "husky",
-    "test": "bun test packages/*/src tools bin app",
+    "test": "bun test packages/*/src tools bin packages/hosted-store-service/app",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@ai-sdk/gateway": "4.0.82",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@vercel/sandbox": "^3.1.0",
     "ai": "^7.0.101",
@@ -118,18 +137,19 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.5",
+    "@defrex/autobuild-postgres-store": "0.8.0",
+    "@defrex/autobuild-vercel-sandbox": "0.8.0",
     "@resvg/resvg-js": "2.6.2",
     "@types/bun": "^1.3.14",
     "@types/node": "^24.0.0",
-    "@types/pg": "8.16.0",
-    "@types/react": "19.2.14",
-    "@types/react-dom": "19.2.3",
     "@types/semver": "^7.7.1",
     "dejavu-fonts-ttf": "2.37.0",
     "drizzle-kit": "^0.31.10",
     "git-format-staged": "4.0.1",
     "husky": "9.1.7",
-    "typescript": "5.9.3",
-    "vercel": "^59.11.2"
+    "typescript": "5.9.3"
+  },
+  "patchedDependencies": {
+    "better-auth@1.4.18": "patches/better-auth@1.4.18.patch"
   }
 }

package/packages/core/src/cli/artifact.ts

@@ -9,10 +9,11 @@ import { basename, dirname, resolve } from 'node:path'
 import { agentActor } from '../events/envelope'
 import { prAttachmentSchema } from '../ontology'
 import type { Exec } from '../ports/workspace/git-worktree'
-import type { Artifact, ArtifactMeta, BuildStore } from '../store/types'
+import type { Artifact, ArtifactMeta, BuildStore, RepositoryArtifact } from '../store/types'
 import type { CliEnv } from './env'
-import { buildInRepository } from './repo-state'
-import { withAmbientReadStore, type StoreOpener } from './store-opening'
+import { resolveAmbientReadSession } from './env'
+import { buildInRepository, streamInRepository } from './repo-state'
+import { withAmbientReadStore, withSessionlessStore, type StoreOpener } from './store-opening'
 
 export interface ArtifactDeps {
   store: BuildStore
@@ -174,9 +175,132 @@ export async function artifactDownload(
       )
     }
 
-    const outputPath = resolve(opts.targetRepo, opts.outputPath)
-    await mkdir(dirname(outputPath), { recursive: true })
-    await writeFile(outputPath, artifact.content)
+    const outputPath = await writeArtifactBytes(opts.targetRepo, opts.outputPath, artifact.content)
     return { artifact, outputPath }
   })
 }
+
+/** Shared download tail: exact bytes under the resolved output path (parent
+ * directories created), used by both the build-scoped and stream-addressed
+ * forms so neither can drift on byte handling. */
+async function writeArtifactBytes(
+  targetRepo: string,
+  outputPath: string,
+  content: Uint8Array,
+): Promise<string> {
+  const resolved = resolve(targetRepo, outputPath)
+  await mkdir(dirname(resolved), { recursive: true })
+  await writeFile(resolved, content)
+  return resolved
+}
+
+export interface ArtifactDownloadStreamOpts {
+  /** Current checkout; repository identity resolves to its main worktree. */
+  targetRepo: string
+  env: Record<string, string | undefined>
+  exec: Exec
+  /** `stream:<id>` or `stream:<id>@<rev>`; rev pins the finalized artifact. */
+  spec: string
+  outputPath: string
+  /** Explicit --store; precedence remains flag > AB_STORE > local default. */
+  storeRef?: string
+  /** Adapter seam for local/remote selection tests. */
+  openStore?: StoreOpener
+}
+
+export interface ArtifactDownloadStreamResult {
+  artifact: RepositoryArtifact
+  outputPath: string
+}
+
+/** Operator retrieval of a finalized, repo-scoped stream artifact (the harvest
+ * session analog of the build-scoped form). A stream id is store-assigned and
+ * globally unique, so no build or repo argument is needed: the command reads
+ * the stream record, checks its scope, then fetches the close-deposited
+ * repository artifact.
+ *
+ * Authorization is the operator-wide read rule only (§8.2): this form requires
+ * a sessionless invocation and fails closed under any complete ambient phase
+ * identity — repository-scoped targets are never reachable by ambient
+ * own-build or own-harvest authority. The check runs here, before any store
+ * call, because local harvest-ambient handles would permit own-repo
+ * `getRepoArtifact` while remote handles rely on the core to enforce scope. */
+export async function artifactDownloadStream(
+  opts: ArtifactDownloadStreamOpts,
+): Promise<ArtifactDownloadStreamResult> {
+  const ambient = resolveAmbientReadSession(opts.env)
+  if (ambient !== undefined) {
+    throw new Error(
+      'repo-scoped stream downloads are operator reads (§8.2): ambient phase ' +
+        'identity (build or Harvest) never extends to repository-scoped targets — ' +
+        'run this command without agent identity markers',
+    )
+  }
+  const { kind, rev } = parseArtifactSpec(opts.spec)
+  const streamId = kind.startsWith('stream:') ? kind.slice('stream:'.length) : ''
+  if (streamId.trim() === '') {
+    throw new Error(
+      `invalid stream ref "${opts.spec}" — expected 'stream:<id>' or 'stream:<id>@<rev>'`,
+    )
+  }
+  return withSessionlessStore(
+    {
+      targetRepo: opts.targetRepo,
+      env: opts.env,
+      exec: opts.exec,
+      ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
+      ...(opts.openStore !== undefined ? { openStore: opts.openStore } : {}),
+    },
+    async (context) => {
+      const record = await context.store.getStream(streamId)
+      if (record === null) {
+        throw new Error(
+          `no stream "${streamId}" in this store — run 'ab harvest status' to find ` +
+            'session stream ids, or pass --store <ref>',
+        )
+      }
+      if (record.scope.kind === 'build') {
+        throw new Error(
+          `stream "${streamId}" is build-scoped — download it with ` +
+            `'ab artifact download ${record.scope.build} stream:${streamId}'`,
+        )
+      }
+      if (record.scope.kind === 'session') {
+        throw new Error(
+          `stream "${streamId}" is session-scoped — read it through the operator ` +
+            `session stream surface (GET /sessions/${record.scope.session}/streams/${streamId})`,
+        )
+      }
+      // Origin-aware membership, mirroring the build-scoped path above.
+      // Unlike a BuildRecord, StreamScope carries no `repoOrigin`, so a legacy
+      // physical-path scope.repo stays rejected here (see
+      // `streamInRepository` for the documented AUT-314-class divergence).
+      if (!streamInRepository(record.scope.repo, context.repo)) {
+        throw new Error(
+          `stream "${streamId}" belongs to repository "${record.scope.repo}", not "${context.repo}"`,
+        )
+      }
+      if (record.status === 'open') {
+        throw new Error(
+          `stream "${streamId}" is open — its finalized artifact exists only after ` +
+            'the stream closes (§7.6)',
+        )
+      }
+      const artifact = await context.store.getRepoArtifact(record.scope.repo, kind, rev)
+      if (artifact === null) {
+        const available = await context.store.listRepoArtifacts(record.scope.repo, kind)
+        const refs = available.map((meta) => `${meta.kind}@${meta.revision}`)
+        throw new Error(
+          `no "${kind}" artifact${rev !== undefined ? ` at rev ${rev}` : ''} in ` +
+            `repository "${record.scope.repo}" — available refs: ${refs.join(', ') || '(none)'}`,
+        )
+      }
+      const outputPath = await writeArtifactBytes(
+        opts.targetRepo,
+        opts.outputPath,
+        artifact.content,
+      )
+      return { artifact, outputPath }
+    },
+  )
+}

package/packages/core/src/cli/binary.ts

@@ -165,12 +165,20 @@ export async function runBinary(
   // A scoped phase process is composed from the build worktree's immutable
   // configuration just like dispatch. Load and select the forge before opening
   // the store so plugin failures cannot partially execute terminal plumbing.
+  // Guest tolerance (AUT-517), always on here: in checkout mode `ab dispatch`
+  // already failed startup if a configured plugin did not resolve, and
+  // origin-mode phase processes only run inside guests — so an unresolvable
+  // bare specifier here can only be the provider-plugin case, which a phase
+  // process (never constructing workspace providers) may skip.
   let forge: Awaited<ReturnType<typeof createForge>>
   try {
     const repoRoot = process.cwd()
     const packageRoot = await resolveMainRepo(repoRoot, spawnExec)
     const config = await loadConfig(join(repoRoot, 'autobuild.toml'))
-    const plugins = await loadPlugins(config.plugins, repoRoot, { packageRoot })
+    const plugins = await loadPlugins(config.plugins, repoRoot, {
+      packageRoot,
+      guest: true,
+    })
     forge = await createForge({
       name: config.forge,
       registry: plugins,