@dsh-enhanced/assistant-actions 0.1.32 → 0.1.34

package/lib/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAQnD,OAAO,EAA6D,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAGvG,OAAO,EAAE,MAAM,EAAkG,MAAM,aAAa,CAAA;AAEpI,OAAO,EAAuE,KAAK,kBAAkB,EAAuC,MAAM,0BAA0B,CAAA;AAE5K,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAClK,OAAO,EAA0C,KAAK,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC3G,OAAO,EAAqC,KAAK,eAAe,EAAoD,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AACrM,OAAO,KAAK,EAA8D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAiD,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAmB,MAAM,YAAY,CAAA;AAG9S,OAAO,EAA8L,KAAK,+BAA+B,EAAE,MAAM,mCAAmC,CAAA;AAEpR,OAAO,EAAE,MAAM,EAAE,CAAA;AAKjB,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAShJ,KAAK,kBAAkB,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAW1L,MAAM,WAAW,kBAAkB;IAAG,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE;AA6B1J,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,KAAK,GAAE,kBAAuB,GAAG,SAAS,CAkCrH;AAED,OAAO,QAAQ,qBAAqB,CAAC;IAAE,UAAU,OAAO;QAAG,gBAAgB,EAAE,uBAAuB,CAAA;KAAE;CAAE;AAExG,qFAAqF;AACrF,qBAAa,uBAAwB,SAAQ,OAAO;;IAkBJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAmB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAsB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAjBpK,MAAM,CAAC,MAAM,qDAAS;gBAiBV,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,MAAW,EAAmB,MAAM,wBAAiB,EAAmB,QAAQ;;;;KAAoB,EAAmB,YAAY;;;KAAwB,EAAE,gBAAgB,GAAE,gBAAsC;IAmLtP,IAAI,UAAU,IAAI,iBAAiB,GAAG,kBAAkB,CAAsB;IAC9E,MAAM,QAAO,QAAQ,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,mBAAmB,GAAG,qBAAqB,CAAC,EAAE,CAAA;KAAE,CAAC,CAG7R;IAEF;;;;OAIG;IACH,8BAA8B,GAAU,KAAK,+BAA+B,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,uCAAuC,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CA8CpM;IAkND,uBAAuB,GAAI,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,uBAAuB;;;;;;MAGlF;IAED,6GAA6G;IAC7G,4BAA4B,QAAO,MAAM,CAGxC;IAED,yBAAyB,GAAU,OAAO;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,kBAAkB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAiCrL;IAgUD,GAAG,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,aAAa,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAKvG;IAED,eAAe,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,mBAAmB,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,kBAAkB,CAAC,CAmB/H;IAED,kBAAkB,GAAI,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAG,kBAAkB,GAAG;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAS1I;IA8JD,SAAS,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,aAAa,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAM7G;IAED,cAAc,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,kBAAkB,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAMvH;IAED,UAAU,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,cAAc,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAa/I;CACF"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAQnD,OAAO,EAA6D,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAGvG,OAAO,EAAE,MAAM,EAAkG,MAAM,aAAa,CAAA;AAEpI,OAAO,EAA0G,KAAK,wBAAwB,EAAE,KAAK,kBAAkB,EAAuC,MAAM,0BAA0B,CAAA;AAE9O,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAClK,OAAO,EAA0C,KAAK,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC3G,OAAO,EAAqC,KAAK,eAAe,EAAoD,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AACrM,OAAO,KAAK,EAA8D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAiD,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAmB,MAAM,YAAY,CAAA;AAG9S,OAAO,EAAwO,KAAK,+BAA+B,EAAE,MAAM,mCAAmC,CAAA;AAE9T,OAAO,EAAE,MAAM,EAAE,CAAA;AAKjB,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAShJ,KAAK,kBAAkB,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAW1L,MAAM,WAAW,kBAAkB;IAAG,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE;AA6B1J,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,KAAK,GAAE,kBAAuB,GAAG,SAAS,CAkCrH;AAED,OAAO,QAAQ,qBAAqB,CAAC;IAAE,UAAU,OAAO;QAAG,gBAAgB,EAAE,uBAAuB,CAAA;KAAE;CAAE;AAExG,qFAAqF;AACrF,qBAAa,uBAAwB,SAAQ,OAAO;;IAkBJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAmB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAsB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAjBpK,MAAM,CAAC,MAAM,qDAAS;gBAiBV,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,MAAW,EAAmB,MAAM,wBAAiB,EAAmB,QAAQ;;;;KAAoB,EAAmB,YAAY;;;KAAwB,EAAE,gBAAgB,GAAE,gBAAsC;IAmLtP,IAAI,UAAU,IAAI,iBAAiB,GAAG,kBAAkB,CAAsB;IAC9E,MAAM,QAAO,QAAQ,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,mBAAmB,GAAG,qBAAqB,CAAC,EAAE,CAAA;KAAE,CAAC,CAG7R;IAEF;;;;OAIG;IACH,8BAA8B,GAAU,KAAK,+BAA+B,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,uCAAuC,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAsDpM;IAoND,uBAAuB,GAAI,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,uBAAuB;;;;;;MAGlF;IAED,6GAA6G;IAC7G,4BAA4B,QAAO,MAAM,CAGxC;IAED,yBAAyB,GAAU,OAAO;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,wBAAwB,CAAC,CA8ClN;IA6UD,GAAG,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,aAAa,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAKvG;IAED,eAAe,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,mBAAmB,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,kBAAkB,CAAC,CAmB/H;IAED,kBAAkB,GAAI,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAG,kBAAkB,GAAG;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAS1I;IA8JD,SAAS,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,aAAa,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAM7G;IAED,cAAc,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,kBAAkB,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAMvH;IAED,UAAU,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,cAAc,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAa/I;CACF"}

package/lib/service.js

@@ -6,13 +6,13 @@ import { chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openS
 import { dirname, join } from 'node:path';
 import { Config, commitBytes, normalizeCommit, normalizeCompensation, normalizeVerifiedDelivery, validateConfig } from './config.js';
 import { VerifiedDeliveryRuntime } from './verified-delivery.js';
-import { normalizeRepositoryReadback, validateRepositoryReadbackRequirements } from './repository-readback.js';
+import { normalizeRepositoryCommitReadback, normalizeRepositoryReadback, validateRepositoryReadbackRequirements } from './repository-readback.js';
 import { ActionLedger, normalizeWorkflow } from './ledger.js';
 import { commitOnGitHub, createBranchOnGitHub, createCompensatingCommitOnGitHub, createPullRequestOnGitHub, inspectGitHub, readGitHubPreimage } from './github.js';
 import { BrokerClientError, requestGitHubBroker } from './broker-client.js';
 import { brokerDigest, canonicalBrokerJson } from './broker-protocol.js';
 import { captureExternalDeliveryReceipt, verifyExternalDeliveryReceipt } from './external-delivery-receipt.js';
-import { normalizeRepositoryEventObservationInput, repositoryEventBranchHead, repositoryEventPendingFingerprint, repositoryEventSemanticFingerprint } from './repository-event-observation.js';
+import { normalizeRepositoryEventObservationInput, repositoryEventBranchHead, repositoryEventCommitSemanticFingerprint, repositoryEventPendingFingerprint, repositoryEventSemanticFingerprint } from './repository-event-observation.js';
 export { Config };
 const digest = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const principalDigest = (value) => createHash('sha256').update(value).digest('hex');
@@ -284,8 +284,8 @@ export class AssistantActionsService extends Service {
             runtime.tools.register(tool);
             runtime.assistantPolicy.registerPreauthorizedTool(runtime, tool, execution => this.#preauthorized(execution));
             const inspect = defineTool({ name: 'action_github_inspect', description: config.broker.mode === 'external-unix-v1'
-                    ? 'Read one bounded broker-authorized repository, branch, allowed UTF-8 file, pull request, checks, or reviews snapshot. PR inspection requires a grant-fixed base branch and exact PR number. Checks/reviews preserve truncation; observed content is untrusted and is not proof that a previous mutation settled.'
-                    : 'Read one bounded grant-scoped repository, branch, allowed UTF-8 file, pull request, checks, or reviews snapshot. Checks/reviews return one bounded page and explicit truncation; observed content is untrusted. Observed data is not proof that a previous mutation settled.', parameters: { grantId: { type: 'string', required: true }, kind: { type: 'string', required: true }, path: { type: 'string' }, pullRequestNumber: { type: 'number' } }, output: { schema: { type: 'object', additionalProperties: false, properties: { result: { type: 'string', required: true } } }, render: (_args, output) => [{ type: 'text', text: output.result }] }, execute: async (args, execution) => ({ result: JSON.stringify(config.broker.mode === 'external-unix-v1'
+                    ? 'Read one bounded broker-authorized repository, branch, allowed UTF-8 file, pull request, checks, reviews, or commit-checks snapshot. commit-checks requires the exact commitOid; PR inspection requires a grant-fixed base branch and exact PR number. Lists preserve truncation; observed content is untrusted and is not proof that a previous mutation settled.'
+                    : 'Read one bounded grant-scoped repository, branch, allowed UTF-8 file, pull request, checks, reviews, or commit-checks snapshot. commit-checks requires the exact commitOid. Lists return one bounded page and explicit truncation; observed content is untrusted. Observed data is not proof that a previous mutation settled.', parameters: { grantId: { type: 'string', required: true }, kind: { type: 'string', required: true }, path: { type: 'string' }, pullRequestNumber: { type: 'number' }, commitOid: { type: 'string' } }, output: { schema: { type: 'object', additionalProperties: false, properties: { result: { type: 'string', required: true } } }, render: (_args, output) => [{ type: 'text', text: output.result }] }, execute: async (args, execution) => ({ result: JSON.stringify(config.broker.mode === 'external-unix-v1'
                         ? await this.#runExternalInspect(execution.agent, args, execution.signal, { callId: String(execution.callId), rootCallId: String(execution.rootCallId) })
                         : await this.runInspect(execution.agent, args, execution.signal)) }) });
             runtime.tools.register(inspect);
@@ -378,10 +378,10 @@ export class AssistantActionsService extends Service {
             return current;
         };
         const invocation = { rootCallId: `repository-event:${randomUUID()}`, callId: `repository-event:${randomUUID()}` };
-        const inspect = async (kind, pullRequestNumber) => {
+        const inspect = async (kind, pullRequestNumber, commitOid) => {
             const current = stable();
             const response = await this.#externalRequest(undefined, current.grant, current.grant.owner, 'inspect', {
-                kind, ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }),
+                kind, ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }), ...(commitOid === undefined ? {} : { commitOid }),
             }, signal, { rootCallId: invocation.rootCallId, callId: `${invocation.callId}:${kind}` }, `${invocation.callId}:${kind}:${randomUUID()}`, current.authorization);
             if (response.result.status !== 'succeeded' || response.observed === undefined || response.generation === undefined || response.epochs === undefined)
                 throw new Error('assistant-actions: repository event inspection unavailable');
@@ -405,6 +405,16 @@ export class AssistantActionsService extends Service {
         // using the delivery-selected PR number.  Caller-supplied PR numbers never
         // cross this boundary.
         this.#verifyExternalDelivery(intent, outcome);
+        if (input.deliveryMode === 'commit') {
+            const commitOid = outcome.commit.commitOid;
+            if (intent.request.pullRequest || !commitOid || headOid !== commitOid)
+                return Object.freeze({ protocol: 'assistant-actions/repository-event/v1', fingerprint: repositoryEventPendingFingerprint(input, headOid), truthy: true });
+            const checks = await inspect('commit-checks', undefined, commitOid);
+            if (checks.generation !== branch.generation || checks.epochs !== branch.epochs)
+                throw new Error('assistant-actions: repository event broker generation changed');
+            stable();
+            return Object.freeze({ protocol: 'assistant-actions/repository-event/v1', fingerprint: repositoryEventCommitSemanticFingerprint(input, headOid, checks.observed), truthy: true });
+        }
         const pullRequestNumber = outcome.pullRequest?.pullRequestNumber;
         const commitOid = outcome.commit.commitOid;
         if (!Number.isSafeInteger(pullRequestNumber) || !commitOid || headOid !== commitOid)
@@ -425,7 +435,9 @@ export class AssistantActionsService extends Service {
         const grant = this.#externalGrants.get(input.grantId);
         if (!grant || grant.revision !== input.grantRevision || grant.grantDigest !== input.grantDigest || grant.expiresAt <= Date.now()
             || grant.destination.repository !== input.repository || grant.destination.branch !== input.branch || grant.destination.baseBranch !== input.baseBranch
-            || !grant.allowedOperations.includes('inspect') || !['branch', 'pull-request', 'checks', 'reviews'].every(kind => grant.allowedInspectKinds.includes(kind))
+            || !grant.allowedOperations.includes('inspect') || (input.deliveryMode === 'commit'
+            ? grant.allowedOperations.includes('pull-request') || !['branch', 'commit-checks'].every(kind => grant.allowedInspectKinds.includes(kind))
+            : !['branch', 'pull-request', 'checks', 'reviews'].every(kind => grant.allowedInspectKinds.includes(kind)))
             || grant.owner.principalDigest !== principalDigest(input.owner.principalId) || grant.owner.principalRecordId !== input.owner.principalRecordId
             || grant.owner.principalVersion !== input.owner.principalVersion || grant.owner.workspace !== input.owner.workspace || grant.owner.preset !== input.owner.preset
             || grant.expiresAt !== input.owner.expiresAt || grant.verifiedDelivery?.ownerRouteId !== input.owner.ownerRouteId)
@@ -457,7 +469,7 @@ export class AssistantActionsService extends Service {
                 || grant.sessionId !== input.goal.sessionId || !this.#verified)
                 throw new Error('assistant-actions: repository event goal changed');
             const latest = this.#verified.latestForGoal(input.goal, grant.id, { principalRecordId: input.owner.principalRecordId, principalVersion: input.owner.principalVersion }, { workspace: input.owner.workspace, preset: input.owner.preset });
-            if (latest?.state === 'succeeded' && latest.outcome?.commit.status === 'succeeded' && latest.outcome.pullRequest?.status === 'succeeded')
+            if (latest?.state === 'succeeded' && latest.outcome?.commit.status === 'succeeded' && (input.deliveryMode === 'commit' ? !latest.intent.request.pullRequest && !latest.outcome.pullRequest : latest.outcome.pullRequest?.status === 'succeeded'))
                 selected = { intent: latest.intent, outcome: latest.outcome };
         }
         const snapshot = digest({ grant: { id: grant.id, revision: grant.revision, digest: grant.grantDigest, expiresAt: grant.expiresAt, owner: grant.owner, destination: grant.destination }, route,
@@ -587,7 +599,7 @@ export class AssistantActionsService extends Service {
         const { grant, owner, identity } = this.#externalContext(agent, request.grantId);
         if (!this.#allowsExternal(grant, identity, input))
             throw new Error('assistant-actions: request not granted');
-        const payload = { kind: request.kind, ...(request.path === undefined ? {} : { path: request.path }), ...(request.pullRequestNumber === undefined ? {} : { pullRequestNumber: request.pullRequestNumber }) };
+        const payload = { kind: request.kind, ...(request.path === undefined ? {} : { path: request.path }), ...(request.pullRequestNumber === undefined ? {} : { pullRequestNumber: request.pullRequestNumber }), ...(request.commitOid === undefined ? {} : { commitOid: request.commitOid }) };
         const { result, observed } = await this.#externalRequest(agent, grant, owner, 'inspect', payload, signal, invocation, request.idempotencyKey);
         return { result, ...(observed === undefined ? {} : { observed }) };
     }
@@ -702,18 +714,33 @@ export class AssistantActionsService extends Service {
             throw new Error('assistant-actions: repository readback bounds invalid');
         const observedAt = Date.now();
         const deadline = AbortSignal.any([signal, AbortSignal.timeout(initial.authority.timeoutMs)]);
+        if (initial.authority.kind === 'repository-commit-readback') {
+            // Check the receipt's immutable commit first, then fence a moving branch
+            // with the final remote read before issuing an affirmative outcome.
+            const [checks, branchSnapshot] = [
+                await this.#readRepositoryInspection(context, 'commit-checks', undefined, initial.commitOid, deadline),
+                await this.#readRepositoryInspection(context, 'branch', undefined, undefined, deadline),
+            ];
+            const final = context();
+            if (digest(initial) !== digest(final) || Date.now() - observedAt > final.authority.freshnessMs)
+                throw new Error('assistant-actions: repository readback authority changed');
+            return normalizeRepositoryCommitReadback({ repository: final.authority.repository, branch: final.authority.branch, commitOid: final.commitOid,
+                requirements: final.requirements, checks, branchSnapshot });
+        }
         const pullRequestNumber = initial.pullRequestNumber;
+        if (pullRequestNumber === undefined)
+            throw new Error('assistant-actions: repository delivery receipt invalid');
         const [checks, reviews, pullRequest, branchSnapshot] = [
-            await this.#readRepositoryInspection(context, 'checks', pullRequestNumber, deadline),
-            await this.#readRepositoryInspection(context, 'reviews', pullRequestNumber, deadline),
-            await this.#readRepositoryInspection(context, 'pull-request', pullRequestNumber, deadline),
-            await this.#readRepositoryInspection(context, 'branch', undefined, deadline),
+            await this.#readRepositoryInspection(context, 'checks', pullRequestNumber, undefined, deadline),
+            await this.#readRepositoryInspection(context, 'reviews', pullRequestNumber, undefined, deadline),
+            await this.#readRepositoryInspection(context, 'pull-request', pullRequestNumber, undefined, deadline),
+            await this.#readRepositoryInspection(context, 'branch', undefined, undefined, deadline),
         ];
         const final = context();
         if (digest(initial) !== digest(final) || Date.now() - observedAt > final.authority.freshnessMs)
             throw new Error('assistant-actions: repository readback authority changed');
         const normalized = normalizeRepositoryReadback({ repository: final.authority.repository, branch: final.authority.branch, baseBranch: final.authority.baseBranch,
-            commitOid: final.commitOid, pullRequestNumber: final.pullRequestNumber, requirements: final.requirements, checks, reviews, pullRequest, branchSnapshot });
+            commitOid: final.commitOid, pullRequestNumber, requirements: final.requirements, checks, reviews, pullRequest, branchSnapshot });
         const headConfirmed = normalized.headOid === final.commitOid;
         const ci = !headConfirmed ? 'unknown' : normalized.ci;
         const review = !headConfirmed ? 'unknown' : normalized.review;
@@ -721,7 +748,7 @@ export class AssistantActionsService extends Service {
             ready: ci === 'passed' && review === 'approved' && (normalized.pullRequest === 'open' || normalized.pullRequest === 'merged') });
     };
     #repositoryReadbackContext(contract, authority) {
-        if (!this.#active || !this.#verified || contract.expiresAt <= Date.now() || contract.task.kind !== 'goal-outcome' || authority.kind !== 'repository-readback')
+        if (!this.#active || !this.#verified || contract.expiresAt <= Date.now() || contract.task.kind !== 'goal-outcome' || !['repository-readback', 'repository-commit-readback'].includes(authority.kind))
             throw new Error('assistant-actions: repository readback binding invalid');
         const goal = contract.task.goal;
         const latest = this.#verified.latestForGoal({ id: goal.id, sessionId: goal.sessionId, nativeGoalId: goal.nativeGoalId, definitionVersion: goal.definitionVersion, definitionDigest: goal.definitionDigest }, authority.grantId, contract.owner, contract.scope);
@@ -737,6 +764,17 @@ export class AssistantActionsService extends Service {
             throw new Error('assistant-actions: repository grant changed');
         const outcome = latest.outcome;
         const commitOid = outcome.commit.commitOid, pullRequestOutcome = outcome.pullRequest, pullRequestNumber = pullRequestOutcome?.pullRequestNumber;
+        const direct = authority.kind === 'repository-commit-readback';
+        if (direct && latest.intent.request.pullRequest)
+            throw new Error('assistant-actions: repository direct delivery unexpectedly opened a pull request');
+        if (!direct && !latest.intent.request.pullRequest)
+            throw new Error('assistant-actions: repository pull request delivery missing');
+        if (direct && this.#mode === 'external-unix-v1') {
+            const external = this.#externalGrants.get(authority.grantId);
+            if (!external || external.allowedOperations.includes('pull-request') || !external.allowedOperations.includes('inspect')
+                || !external.allowedInspectKinds.includes('branch') || !external.allowedInspectKinds.includes('commit-checks'))
+                throw new Error('assistant-actions: repository direct grant changed');
+        }
         if (this.#mode === 'external-unix-v1')
             this.#verifyExternalDelivery(latest.intent, outcome);
         else {
@@ -744,11 +782,11 @@ export class AssistantActionsService extends Service {
             const pullRequest = pullRequestOutcome && this.#ledger.get(pullRequestOutcome.actionId);
             if (outcome.commit.status !== 'succeeded' || !commitOid || !commit || commit.kind !== 'commit' || commit.status !== 'succeeded' || digest(commit.result) !== digest(outcome.commit)
                 || commit.grantId !== grant.id || commit.grantRevision !== grant.revision || commit.sessionId !== security.sessionId || digest(commit.identity) !== digest(security.identity)
-                || !pullRequestOutcome || pullRequestOutcome.status !== 'succeeded' || !pullRequestNumber || !pullRequest || pullRequest.kind !== 'pull-request' || pullRequest.status !== 'succeeded' || digest(pullRequest.result) !== digest(pullRequestOutcome)
-                || pullRequest.grantId !== grant.id || pullRequest.grantRevision !== grant.revision || pullRequest.sessionId !== security.sessionId || digest(pullRequest.identity) !== digest(security.identity))
+                || !direct && (!pullRequestOutcome || pullRequestOutcome.status !== 'succeeded' || !pullRequestNumber || !pullRequest || pullRequest.kind !== 'pull-request' || pullRequest.status !== 'succeeded' || digest(pullRequest.result) !== digest(pullRequestOutcome)
+                    || pullRequest.grantId !== grant.id || pullRequest.grantRevision !== grant.revision || pullRequest.sessionId !== security.sessionId || digest(pullRequest.identity) !== digest(security.identity)))
                 throw new Error('assistant-actions: repository delivery receipt invalid');
         }
-        if (outcome.commit.status !== 'succeeded' || !commitOid || pullRequestOutcome?.status !== 'succeeded' || !pullRequestNumber)
+        if (outcome.commit.status !== 'succeeded' || !commitOid || !direct && (pullRequestOutcome?.status !== 'succeeded' || !pullRequestNumber))
             throw new Error('assistant-actions: repository delivery receipt invalid');
         this.#deliveryIdentity(security);
         const goals = this.ctx.get('assistantGoals', false);
@@ -778,10 +816,10 @@ export class AssistantActionsService extends Service {
             || digest(sourceContract.scope) !== digest(contract.scope) || sourceReceipt.objectiveStatus !== 'achieved')
             throw new Error('assistant-actions: repository source acceptance changed');
         const evidenceDigest = digest({ source, assessment, assessmentRun, acceptedSource });
-        return Object.freeze({ authority: Object.freeze({ grantId: authority.grantId, grantRevision: authority.grantRevision, repository: authority.repository, branch: authority.branch, baseBranch: authority.baseBranch, timeoutMs: authority.timeoutMs, freshnessMs: authority.freshnessMs }),
-            evidenceDigest, requirements: validateRepositoryReadbackRequirements({ requiredChecks: authority.requiredChecks, reviewerIds: authority.reviewerIds, minApprovals: authority.minApprovals }), security, intent: latest.intent, commitOid, pullRequestNumber });
+        return Object.freeze({ authority: Object.freeze({ kind: authority.kind, grantId: authority.grantId, grantRevision: authority.grantRevision, repository: authority.repository, branch: authority.branch, baseBranch: authority.baseBranch, timeoutMs: authority.timeoutMs, freshnessMs: authority.freshnessMs }),
+            evidenceDigest, requirements: validateRepositoryReadbackRequirements({ requiredChecks: authority.requiredChecks, reviewerIds: direct ? [] : authority.reviewerIds, minApprovals: direct ? 0 : authority.minApprovals }), security, intent: latest.intent, commitOid, ...(direct ? {} : { pullRequestNumber: pullRequestNumber }) });
     }
-    async #readRepositoryInspection(context, kind, pullRequestNumber, signal) {
+    async #readRepositoryInspection(context, kind, pullRequestNumber, commitOid, signal) {
         let observed;
         const start = context();
         if (this.#mode === 'external-unix-v1') {
@@ -793,13 +831,13 @@ export class AssistantActionsService extends Service {
             authorization.current = () => { current(); if (digest(context()) !== digest(start))
                 throw new Error('assistant-actions: repository readback changed'); };
             const generation = this.#externalObservedGeneration, epochs = this.#externalObservedEpochs, callId = `readback:${randomUUID()}`;
-            const response = await this.#externalRequest(undefined, grant, grant.owner, 'inspect', { kind, ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }) }, signal, { callId, rootCallId: start.intent.id }, callId, authorization);
+            const response = await this.#externalRequest(undefined, grant, grant.owner, 'inspect', { kind, ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }), ...(commitOid === undefined ? {} : { commitOid }) }, signal, { callId, rootCallId: start.intent.id }, callId, authorization);
             if (response.result.status !== 'succeeded' || response.observed === undefined || generation !== undefined && generation !== response.generation || epochs !== undefined && epochs !== this.#externalObservedEpochs)
                 throw new Error('assistant-actions: repository inspection unavailable or broker changed');
             authorization.current();
             return response.observed;
         }
-        const request = normalizeWorkflow({ grantId: start.authority.grantId, operation: 'inspect', idempotencyKey: randomUUID(), kind, ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }) });
+        const request = normalizeWorkflow({ grantId: start.authority.grantId, operation: 'inspect', idempotencyKey: randomUUID(), kind, ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }), ...(commitOid === undefined ? {} : { commitOid }) });
         if (!('operation' in request))
             throw new Error('assistant-actions: repository inspection invalid');
         const authorization = { sessionId: start.security.sessionId,
@@ -807,7 +845,7 @@ export class AssistantActionsService extends Service {
                 throw new Error('assistant-actions: repository readback changed'); return current.security.identity; },
             authorize: record => this.ctx.get('assistantPolicy')?.authorize(this.#deliveryPolicy(start.security), { idempotencyKey: `action:${record.id}` }).effect === 'allow' };
         const result = await this.#runAuthorized(authorization, request, signal, async (actionId, grant, token, combined) => {
-            const reply = await this.workflow.inspect({ grant, kind: request.kind, ...(request.pullRequestNumber === undefined ? {} : { pullRequestNumber: request.pullRequestNumber }), token, signal: combined });
+            const reply = await this.workflow.inspect({ grant, kind: request.kind, ...(request.pullRequestNumber === undefined ? {} : { pullRequestNumber: request.pullRequestNumber }), ...(request.commitOid === undefined ? {} : { commitOid: request.commitOid }), token, signal: combined });
             observed = reply?.observed;
             return reply ? { actionId, status: 'succeeded' } : { actionId, status: 'failed', reason: 'github-inspect-failed' };
         });
@@ -971,16 +1009,24 @@ export class AssistantActionsService extends Service {
         this.#deliveryIdentity(intent.security);
         const grant = this.#externalGrants.get(intent.security.grantId), receipts = outcome.brokerReceipts;
         const snapshot = this.#inspectDelivery(intent, true);
-        if (!receipts?.commit || !receipts.pullRequest || !snapshot || !intent.request.pullRequest || !outcome.commit.commitOid || !outcome.pullRequest)
+        if (!receipts?.commit || !snapshot || !outcome.commit.commitOid)
             throw new Error('assistant-actions: external delivery receipt unavailable');
         const destination = { classification: 'github-repository', repository: grant.destination.repository, branch: grant.destination.branch,
             ...(grant.destination.baseBranch === undefined ? {} : { baseBranch: grant.destination.baseBranch }) };
         const common = { grantId: grant.id, grantRevision: grant.revision, grantDigest: grant.grantDigest, owner: grant.owner, sessionId: intent.security.sessionId, source: grant.source, destination };
         const commit = verifyExternalDeliveryReceipt(receipts.commit, { expectedHeadOid: intent.request.expectedHeadOid, headline: intent.request.headline,
             files: snapshot.files.map(file => ({ path: file.path, content: file.content })) }, { ...common, operation: 'commit', actionId: this.#externalActionId(grant, intent.security.sessionId, 'commit', `${intent.id}:commit`) }, this.#external());
+        if (commit.result?.operation !== 'commit' || commit.actionId !== outcome.commit.actionId || commit.result.commitOid !== outcome.commit.commitOid)
+            throw new Error('assistant-actions: external delivery receipt changed');
+        if (!intent.request.pullRequest) {
+            if (outcome.pullRequest || receipts.pullRequest)
+                throw new Error('assistant-actions: external delivery receipt changed');
+            return;
+        }
+        if (!receipts.pullRequest || !outcome.pullRequest)
+            throw new Error('assistant-actions: external delivery receipt unavailable');
         const pr = verifyExternalDeliveryReceipt(receipts.pullRequest, { expectedHeadOid: outcome.commit.commitOid, ...intent.request.pullRequest }, { ...common, operation: 'pull-request', actionId: this.#externalActionId(grant, intent.security.sessionId, 'pull-request', `${intent.id}:pr`) }, this.#external());
-        if (commit.result?.operation !== 'commit' || pr.result?.operation !== 'pull-request' || commit.actionId !== outcome.commit.actionId || pr.actionId !== outcome.pullRequest.actionId
-            || commit.result.commitOid !== outcome.commit.commitOid || pr.result.pullRequestNumber !== outcome.pullRequest.pullRequestNumber)
+        if (pr.result?.operation !== 'pull-request' || pr.actionId !== outcome.pullRequest.actionId || pr.result.pullRequestNumber !== outcome.pullRequest.pullRequestNumber)
             throw new Error('assistant-actions: external delivery receipt changed');
     }
     async #deliverVerified(intent, snapshot, signal) {