@edgehero/pi-dispatch 4.3.1 → 5.0.0

package/src/triggers.mjs

@@ -1,3 +1,5 @@
+import { validateAnswerRules, validateStandingAnswers } from "./answerer.mjs";
+import { validateZeroTouchConfig } from "./question-groups.mjs";
 /**
  * Shared trigger-file schema + validator (issue #20). One `triggers.json` of `{ on, run }` entries is
  * the single reviewed source of standing triggers for BOTH services: the worker owns `on.type:"cron"`
@@ -23,9 +25,11 @@
  * Custom: triggers validated inline per config.mjs/schedules.mjs precedent; zod not in deps
  */
 
-import { BACKEND_NAMES, backendFor } from "./backends.mjs";
+import { BACKEND_NAMES, backendFor, servesOf } from "./backends.mjs";
+import { SCHEDULER_JOB_ID_OVERHEAD, SLOT_DIGITS_MAX } from "./bullmq-internals.mjs";
 import { EGRESS_ENV_VARS, WORKER_ONLY_SECRET_VARS, configError } from "./config.mjs";
 import { imageRefProblem } from "./image-ref.mjs";
+import { LEFT_OUT_NAMES_MAX, LOADED_JOB_TOOLS, LOADED_OVERLAY_NAME_RE, LOADED_TOOL_NAME_RE } from "./loaded-record.mjs";
 // SKILL_NAME_RE is the single-sourced skill charset (flow-gate exports it for exactly this reason:
 // materialize.mjs and the admin already import it, and a keep-in-sync copy would drift where a
 // traversal guard cannot). flow-gate's module body is import-inert, so this keeps parseTriggers pure.
@@ -34,10 +38,19 @@ import { FORGE_HOST_VARS, FORGE_KINDS, MINTED_TOKEN_VARS, RECEIVER_ONLY_VARS, RU
 import { findDuplicateKey } from "./json-duplicates.mjs";
 // The server-name rule, from the one module that parses the overlay's list (its body is import-inert).
 import { FORGE_MCP_KINDS, FORGE_MCP_SERVER_NAME, MCP_SERVER_NAME_RE } from "./mcp-config.mjs";
+import { isModelRolesField, validateModelRoles } from "./model-roles.mjs";
+import { isPackageName } from "./package-names.mjs";
 import { validateModelRef } from "./model-ref.mjs";
 import { parseUsdMicros } from "./money.mjs";
+import { validateApprovalConfig } from "./approval-policy.mjs";
+// The project id rule, from its import-free module, so a bundle's `project` is held to the one rule projects.json is.
+import { PROJECT_ID_RE } from "./project-id.mjs";
 import { PROVIDER_STEERING_VARS } from "./provider-steering.mjs";
+import { normalizeWatchSources, normalizeWatchRule, watchDurationMs } from "./watch-contract.mjs";
+import { validateWatchDecision } from "./watch-decision.mjs";
+import { builtinModel } from "./model-catalog.mjs";
 import { CONTAINER_ENV_NAMES, RUNNER_ENV_NAMES } from "./reserved-env.mjs";
+import { neededVersion, underDeclared, valueNeededVersion, valueUnderDeclared, versionProblem } from "./store-version.mjs";
 // The wait grammar's two shared halves (issue #230). `afterInstantMs` is imported rather than restated so
 // the loader and the pickup gate cannot disagree about what a legal instant is: a second spelling here is
 // how a file that loads clean starts holding for an instant nobody wrote. wait-for.mjs is pure and
@@ -46,10 +59,10 @@ import { WAIT_CONDITION_KEYS, WAIT_CONDITION_MAX, afterInstantMs } from "./wait-
 
 // Re-exported so the console checks a provider or model it is about to write with the loader's own
 // grammar, through the subpath it already imports, rather than a copy that could drift.
-export { validateModelRef };
+export { validateModelRef, isModelRolesField };
 
 // EXPORTED for the same reason as PR_ACTIONS: the admin re-states this vocabulary to a MODEL.
-export const ON_TYPES = new Set(["cron", "label", "comment", "pull_request", "issue"]);
+export const ON_TYPES = new Set(["cron", "label", "comment", "pull_request", "issue", "watch"]);
 
 /**
  * The `on.type` a DISARMED one-shot normalizes to (issue #231). Producible only by this validator:
@@ -155,6 +168,21 @@ export const ISSUE_ACTIONS = {
 	forgejo: new Set(["closed"]),
 };
 
+/**
+ * The row of a per-forge action table (`PR_ACTIONS`, `ISSUE_ACTIONS`) for the entry's forge, or a configError naming
+ * the trigger, its type and the forge. `run.kind` is a known forge by the time a normalizer asks, so only a forge
+ * added to FORGES without a row reaches the refusal; a plain index would hand the caller's spread `undefined`, a bare
+ * "allowed is not iterable" that names nothing. An own key, so no name finds a value on the prototype. Azure has no
+ * issue row and is refused by name before the issue normalizer asks, which says why; this says only that a row is
+ * missing.
+ *
+ * EXPORTED so a test can show the refusal for a table missing a row, which no shipped table is.
+ */
+export function forgeActions(table, kind, at, type, path) {
+	if (typeof kind === "string" && Object.hasOwn(table, kind)) return table[kind];
+	throw configError(`${at}: a ${type} trigger has no action list for ${kind}, so this build cannot check its on.action: ${path}`);
+}
+
 /**
  * The verdicts a submitted GitHub review can carry, in the webhook's own (lower-case) spelling, and the
  * vocabulary of the optional `on.reviewState` narrowing (issue #66).
@@ -191,6 +219,12 @@ const REVIEW_ACTION = "review_submitted";
  */
 // EXPORTED for the two pinned-set bolts and for the admin, which states the vocabulary to an operator.
 export const EXCLUDABLE_TOOL_NAMES = new Set(["read", "bash", "powershell", "edit", "write", "grep", "find", "ls"]);
+/**
+ * The built-in tools a job has when nothing narrows them: the pinned pi's `DEFAULT_TOOL_NAMES`, a subset of the set above. The rest
+ * stay off unless an extension turns them on, so taking one of those out of `run.excludeTools` hands a job nothing by itself.
+ * Bolted to the artifact in `worker/test/exclude-tools.pinned.test.mjs`.
+ */
+export const DEFAULT_ON_TOOL_NAMES = new Set(["read", "bash", "edit", "write"]);
 /**
  * The tools a job's MCP brings (REQ-MCP-OPERATOR-SERVERS, image/runner/src/mcp.mjs), excludable only by a trigger that
  * names servers: codemode, tool_search and pi's three resource tools. One server's tools are excluded as a whole by
@@ -219,6 +253,20 @@ export function mcpServerToolPattern(name) {
 // parse; the charset also excludes `:` and the dedicated check names the reason.
 const ID_CHARSET = /^[A-Za-z0-9._-]+$/;
 
+/**
+ * The longest cron `on.id` (issue #737). The id is its scheduler's key, which every admin surface reads back from
+ * Valkey (the panel, the console, the status tool) and bounds there, since anything holding the Valkey's URL can plant
+ * a scheduler and a surface prints the key in running text; and each run the scheduler mints is the job
+ * `repeat:<id>:<slot>`, the slot the run's instant in ms (at most 16 digits), which every reader of a job id takes at
+ * most 200 characters long (`DEFER_ID_RE`, the console's `RUN_ID_RE`). So the id is at most 200 less the run id's
+ * frame (`SCHEDULER_JOB_ID_OVERHEAD`, bullmq-internals.mjs): every run of every legal id is a job id the readers take,
+ * and a longer id, a schedule whose runs no surface could name, is refused here. A surface's bound on a scheduler key
+ * is the wider `SCHEDULER_ID_MAX` (200), so a scheduler an earlier release made for a longer id is still named there.
+ */
+export const CRON_ID_MAX = 200 - SCHEDULER_JOB_ID_OVERHEAD;
+// The 200 characters the readers of a run id take, which the refusal of a longer cron id names: the bound above, read back.
+const RUN_ID_READ_MAX = CRON_ID_MAX + SCHEDULER_JOB_ID_OVERHEAD;
+
 /**
  * The ceiling on `run.replicas` (REQ-REPLICA-RUNS). Three, because `PI_CONCURRENCY` defaults to 3
  * (config.mjs) and replicas above the default concurrency would queue rather than race -- a cap that
@@ -226,7 +274,7 @@ const ID_CHARSET = /^[A-Za-z0-9._-]+$/;
  * concurrency setting: this validator is pure and fs-free, and the operator who raises concurrency to 10
  * is the operator who can raise this line too, in a reviewed commit.
  */
-const REPLICAS_MAX = 3;
+export const REPLICAS_MAX = 3;
 
 /**
  * The ceiling on how many references one trigger may name (issue #225). Not tidiness: the worker resolves
@@ -246,7 +294,7 @@ const SECRETS_MAX = 16;
  * a name is `-e NAME=VALUE` in the docker argv, so `=` would split in the wrong place, and the leading
  * digit is excluded because a shell cannot expand `$1FOO` as that variable.
  */
-const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 /**
  * The env variable names a trigger may NOT bind, and why each set is here.
@@ -267,12 +315,129 @@ function isNonEmptyString(value) {
 	return typeof value === "string" && value.trim() !== "";
 }
 
+/**
+ * The highest triggers file version this build reads (issue #761, `DES-STORE-VERSION-WHEN-NEEDED`): a top-level
+ * `version`, absent meaning 1, which `writeTriggers` owns and writes only when the content needs more than 1, so every
+ * file of today's fields stays byte-identical.
+ */
+export const TRIGGERS_FILE_VERSION = 2;
+
+/**
+ * Each `run` key whose ABSENCE an older build would misread, with the version that introduced it. The raw `run` keys
+ * of an entry are carried by every writer, and an older loader DROPS a key it does not know: harmless for most, a
+ * widened job for a key that narrows one. Every row of `AUTHORED_NARROWING_FIELDS` added after issue #761 must appear
+ * here (and in `JOB_DATA_FIELD_VERSIONS`) at 2 or above; a test holds that.
+ *
+ * `excludeExtensions` and `excludeExtensionTools` (issue #800): an older loader drops either and runs the job with the
+ * extension or the tool the file takes away, on a clean record.
+ */
+export const TRIGGER_RUN_FIELD_VERSIONS = Object.freeze({ excludeExtensions: 2, excludeExtensionTools: 2 });
+
+/** Each top-level block (beside `triggers`) whose absence an older build would misread, as above. Empty until one does. */
+export const TRIGGERS_BLOCK_VERSIONS = Object.freeze({});
+
+/**
+ * Each EXISTING field of a trigger entry whose range a later release widens, as `field -> (value) => version` (the
+ * shared rule, `valueNeededVersion`): a new `on.type`, say, or a new field inside `on`. A key-name table cannot say
+ * this, and an older loader meeting the wider value refuses the whole file as broken (its schedules keep running, and
+ * its next start fails) where a stamp makes it defer. Empty until a value needs one.
+ */
+export const TRIGGER_VALUE_VERSIONS = Object.freeze({});
+
+/**
+ * Each EXISTING `run` key whose range a later release widens (a new `run.waitFor` condition kind, or a new `run.kind`,
+ * say), as above.
+ */
+export const TRIGGER_RUN_VALUE_VERSIONS = Object.freeze({});
+
+/**
+ * Each EXISTING top-level block whose range a later release widens, keyed by the block's name (`secretBundles`,
+ * `modelRoles`, `answerRules`, ...), as above: a new field in a bundle, say, which this loader refuses by name. The rule
+ * is handed the whole block. Empty until a value needs one.
+ */
+export const TRIGGERS_BLOCK_VALUE_VERSIONS = Object.freeze({});
+
+/**
+ * The lowest version a parsed triggers document needs: the raw `run` keys of every entry, the values of every entry's
+ * fields and of its `run` keys, and every top-level key and its value (`version` itself aside). 1 while nothing in it
+ * needs more.
+ */
+export function triggersFileVersionFor(doc, { runTable = TRIGGER_RUN_FIELD_VERSIONS, blockTable = TRIGGERS_BLOCK_VERSIONS, entryValueTable = TRIGGER_VALUE_VERSIONS, runValueTable = TRIGGER_RUN_VALUE_VERSIONS, blockValueTable = TRIGGERS_BLOCK_VALUE_VERSIONS } = {}) {
+	if (doc === null || typeof doc !== "object" || Array.isArray(doc)) return 1;
+	const { version: _version, ...blocks } = doc;
+	let needed = Math.max(neededVersion(Object.keys(blocks), blockTable), valueNeededVersion(blocks, blockValueTable));
+	for (const entry of Array.isArray(doc.triggers) ? doc.triggers : []) {
+		if (entry === null || typeof entry !== "object") continue;
+		const byEntry = valueNeededVersion(entry, entryValueTable);
+		if (byEntry > needed) needed = byEntry;
+		const run = entry.run;
+		if (run === null || typeof run !== "object") continue;
+		const needs = Math.max(neededVersion(Object.keys(run), runTable), valueNeededVersion(run, runValueTable));
+		if (needs > needed) needed = needs;
+	}
+	return needed;
+}
+
+/**
+ * The problem with a parsed triggers document's RAW `version`, or null: `{ newer: true, message }` above this build,
+ * `{ newer: false, message }` when it is not an integer of 1 or more. The one rule every reader of the file asks
+ * through, the loader, the writers and the worker's per-job reads alike.
+ */
+export function triggersFileVersionProblem(doc, { supported = TRIGGERS_FILE_VERSION } = {}) {
+	if (doc === null || typeof doc !== "object" || Array.isArray(doc) || !Object.hasOwn(doc, "version")) return null;
+	return versionProblem(doc.version, { supported, what: "triggers file" });
+}
+
+/**
+ * Whether a triggers file (its text, or the parsed document) was written by a newer pi-dispatch. A text that does not
+ * parse is not newer: it is broken, and each caller keeps its own answer for a broken file. For the worker's per-job
+ * reads, which must DEFER on a newer file rather than fail open: a one-shot's disarm may be written in a shape this
+ * build cannot see, and a narrowing field this build does not know cannot be checked at all.
+ *
+ * A text with a duplicate key is broken too, never newer, the loader's order (`parseTriggersDocument` refuses the
+ * duplicate before it reads `version`): `JSON.parse` keeps the LAST value, so `{"version": 1, "version": 2}` would read
+ * as newer here while the loader calls it broken, and the jobs that read it would wait for an upgrade that changes
+ * nothing. Only the TEXT can show a duplicate, so the per-job readers pass the text; a parsed document is judged on its
+ * `version` alone.
+ */
+export function triggersFileNewer(textOrDoc, { supported = TRIGGERS_FILE_VERSION } = {}) {
+	let doc = textOrDoc;
+	if (typeof textOrDoc === "string") {
+		try {
+			doc = JSON.parse(textOrDoc);
+		} catch {
+			return false;
+		}
+		if (findDuplicateKey(textOrDoc)) return false;
+	}
+	return triggersFileVersionProblem(doc, { supported })?.newer === true;
+}
+
 /**
  * Parse, validate, and normalize the unified triggers file text. Returns an array of normalized
  * `{ on, run }` entries (unknown fields dropped, so consumers only ever read validated fields). Throws
- * `configError` (fail-loud) on any malformed entry. The `path` is for error messages only.
+ * `configError` (fail-loud) on any malformed entry. The `path` is for error messages only. `versions` is
+ * `parseTriggersDocument`'s, for tests.
+ */
+export function parseTriggers(text, path, versions = {}) {
+	return parseTriggersDocument(text, path, versions).triggers;
+}
+
+/**
+ * `parseTriggers`, plus the file's other validated top-level key: `{ triggers, secretBundles }` (issue #704).
+ * `secretBundles` is `{}` when the file has none. One function rather than a second parser, so the worker's
+ * bundle read and every loader judge the file by ONE rule: a file whose `secretBundles` is malformed is
+ * refused WHOLE, by the receiver, the worker's cron loader, doctor and every writer alike, exactly as a
+ * malformed trigger is (see `validateSecretBundles` for why that is the right blast radius).
+ *
+ * The file's `version` (issue #761) is judged right after the duplicate-key check and BEFORE the `triggers` array: a
+ * newer file may have reshaped anything below it, and its true message is "upgrade", not a complaint about a shape.
+ * A newer file throws a configError with `.newer === true`; a broken `version`, or a `run` key, a top-level block or a
+ * block, entry or `run` value that needs a higher version than the file declares, throws the ordinary configError.
+ * `supported`, `runTable`, `blockTable`, `entryValueTable`, `runValueTable` and `blockValueTable` default to this
+ * build's and are injectable for tests.
  */
-export function parseTriggers(text, path) {
+export function parseTriggersDocument(text, path, { supported = TRIGGERS_FILE_VERSION, runTable = TRIGGER_RUN_FIELD_VERSIONS, blockTable = TRIGGERS_BLOCK_VERSIONS, entryValueTable = TRIGGER_VALUE_VERSIONS, runValueTable = TRIGGER_RUN_VALUE_VERSIONS, blockValueTable = TRIGGERS_BLOCK_VALUE_VERSIONS } = {}) {
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -297,13 +462,60 @@ export function parseTriggers(text, path) {
 		);
 	}
 
+	const versionTrouble = triggersFileVersionProblem(parsed, { supported });
+	if (versionTrouble) {
+		const error = configError(`${versionTrouble.message}: ${path}`);
+		if (versionTrouble.newer) error.newer = true;
+		throw error;
+	}
+
 	const entries = parsed?.triggers;
 	if (!Array.isArray(entries)) {
 		throw configError(`triggers file must have a "triggers" array: ${path}`);
 	}
 
-	const state = { seenCronIds: new Set(), commentCounts: {} };
-	return entries.map((entry, index) => normalizeTrigger(entry, index, path, state));
+	const watchSources = normalizeWatchSources(parsed.watchSources);
+	const state = { seenCronIds: new Set(), seenWatchIds: new Set(), watchSources, commentCounts: {} };
+	const triggers = entries.map((entry, index) => normalizeTrigger(entry, index, path, state));
+	// AFTER the triggers, so a file broken in both places names the trigger first, the message every operator
+	// of an older file already knows.
+	// A misspelt top-level block (`secret_bundles`, `SecretBundles`, `secretBundle`) would be ignored as an unknown key,
+	// granting nothing while the file reads as granting a project its environment: refused, the sweep's rule.
+	for (const key of Object.keys(parsed)) {
+		if (key !== "secretBundles" && isSecretBundleNearMiss(key)) {
+			throw configError(`triggers file: top-level ${JSON.stringify(key)} is not a key -- did you mean "secretBundles"? A bundle block the loader ignores grants nothing while the file reads as granting it, so a near miss is refused rather than dropped: ${path}`);
+		}
+	}
+	for (const key of Object.keys(parsed)) {
+		const shape = key.toLowerCase().replace(/[_ .-]/g, "");
+		if ((shape.startsWith("answerrule") && key !== "answerRules") || (shape.startsWith("standinganswer") && key !== "standingAnswers")) throw configError("triggers file: use answerRules and standingAnswers exactly");
+	}
+	let answerRules, standingAnswers;
+	try { answerRules = validateAnswerRules(parsed.answerRules); standingAnswers = validateStandingAnswers(parsed.standingAnswers); } catch (error) { throw configError(error.message); }
+	const secretBundles = validateSecretBundles(parsed.secretBundles, path);
+	const modelRoles = validateModelRoles(parsed.modelRoles);
+	for (const key of Object.keys(parsed)) if (key !== "modelRoles" && isModelRolesField(key)) throw configError("triggers file: use modelRoles");
+	let zeroTouch;
+	try { zeroTouch = validateZeroTouchConfig(parsed.zeroTouch); } catch (error) { throw configError(error.message); }
+	// Issue #761: a block, a `run` key or a value that needs a higher version than the file declares, after every other
+	// check so a broken file names its first broken entry as it always did. Such a file was hand-edited or written by a
+	// writer that dropped the stamp, and an older loader would read it without the key, or refuse the value as broken
+	// rather than newer: refused like any malformed entry.
+	const { version: _version, ...blocks } = parsed;
+	const shortBlock = underDeclared(Object.keys(blocks), blockTable, parsed.version);
+	if (shortBlock) throw configError(`triggers file: top-level ${JSON.stringify(shortBlock.field)} needs triggers file version ${shortBlock.needs}, and the file declares ${parsed.version ?? 1}: ${path}`);
+	const shortBlockValue = valueUnderDeclared(blocks, blockValueTable, parsed.version);
+	if (shortBlockValue) throw configError(`triggers file: top-level ${JSON.stringify(shortBlockValue.field)} holds a value that needs triggers file version ${shortBlockValue.needs}, and the file declares ${parsed.version ?? 1}: ${path}`);
+	entries.forEach((entry, index) => {
+		const declared = parsed.version ?? 1;
+		const short = underDeclared(Object.keys(entry.run), runTable, parsed.version);
+		if (short) throw configError(`trigger at index ${index}: run.${short.field} needs triggers file version ${short.needs}, and the file declares ${declared}: ${path}`);
+		const shortEntry = valueUnderDeclared(entry, entryValueTable, parsed.version);
+		if (shortEntry) throw configError(`trigger at index ${index}: ${shortEntry.field} holds a value that needs triggers file version ${shortEntry.needs}, and the file declares ${declared}: ${path}`);
+		const shortRun = valueUnderDeclared(entry.run, runValueTable, parsed.version);
+		if (shortRun) throw configError(`trigger at index ${index}: run.${shortRun.field} holds a value that needs triggers file version ${shortRun.needs}, and the file declares ${declared}: ${path}`);
+	});
+	return { triggers, secretBundles, modelRoles, ...(parsed.answerRules !== undefined ? { answerRules } : {}), ...(parsed.standingAnswers !== undefined ? { standingAnswers } : {}), ...(parsed.zeroTouch !== undefined ? { zeroTouch } : {}), ...(parsed.watchSources !== undefined ? { watchSources } : {}) };
 }
 
 function normalizeTrigger(entry, index, path, state) {
@@ -319,6 +531,7 @@ function normalizeTrigger(entry, index, path, state) {
 	if (run === null || typeof run !== "object") {
 		throw configError(`${at}: "run" must be an object: ${path}`);
 	}
+	try { validateApprovalConfig(run); } catch (error) { throw configError(`${at}: ${error.message}: ${path}`); }
 	// Joined from the set for the joined-vocabulary rule stated over the run.kind check below -- a type
 	// added to the vocabulary can never be
 	// refused by a message that does not mention it. This is also what keeps `DISARMED_TYPE` refused
@@ -334,6 +547,7 @@ function normalizeTrigger(entry, index, path, state) {
 	}
 
 	// The on x run matrix -- the trust boundary, fail-loud (mirrors the old schedules kind:github refusal).
+	if (on.type === "watch") return normalizeWatch(entry, index, path, state);
 	if (on.type === "cron") {
 		if (run.kind !== "local") {
 			throw configError(`${at}: a cron trigger has no webhook delivery, issue/PR number, title, or body; run.kind must be "local" (got ${JSON.stringify(run.kind)}): ${path}`);
@@ -364,6 +578,66 @@ function normalizeTrigger(entry, index, path, state) {
 	return normalized;
 }
 
+function normalizeWatch(entry, index, path, state) {
+	const on = normalizeWatchRule(entry.on, state.watchSources);
+	if (state.seenWatchIds.has(on.id)) throw configError("watch: duplicate trigger id");
+	state.seenWatchIds.add(on.id);
+	const raw = entry.run;
+	const mode = raw.mode ?? "investigate";
+	if (!["investigate", "issue"].includes(mode)) throw configError("watch: mode must be investigate or issue; direct fixes need a human approval");
+	const allowed = new Set(["kind", "mode", "folder", "flow", "task", "excludeTools", "maxCostUsd", "provider", "model", "maxTurns", "models", "image", "backend", "secrets", "secretBundle", "skillsDir", "issue", "queryLogs"]);
+	for (const key of Object.keys(raw)) if (!allowed.has(key)) throw configError("watch: unsupported run field");
+	if (raw.kind !== "local") throw configError("watch: run.kind must be local");
+	let issue;
+	if (raw.issue !== undefined) {
+		const target = raw.issue;
+		if (!target || typeof target !== "object" || Array.isArray(target) || Object.keys(target).some(k => !["kind", "repo", "closeAfter"].includes(k)) || !FORGE_KINDS.includes(target.kind) || typeof target.repo !== "string" || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(target.repo)) throw configError("watch: issue requires a reviewed forge kind and owner/repository target");
+		if (target.closeAfter !== undefined) watchDurationMs(target.closeAfter);
+		issue = { kind: target.kind, repo: target.repo, ...(target.closeAfter !== undefined ? { closeAfter: target.closeAfter } : {}) };
+		if (target.kind === "azure") throw configError("watch: Azure issue mode needs a reviewed project and work-item contract; use github, gitlab or forgejo");
+		if (target.repo.split("/").some(part => part === "." || part === "..")) throw configError("watch: invalid issue repository");
+	}
+	if (mode === "issue") {
+		if (!issue) throw configError("watch: issue mode requires run.issue");
+		if (Object.keys(raw).some(k => !["kind", "mode", "issue"].includes(k))) throw configError("watch: issue mode cannot carry agent execution settings");
+		if (entry.decide !== undefined) throw configError("watch: decide is configured on investigate rules with an issue fallback");
+		return { on, run: { kind: "local", mode, issue } };
+	}
+	if (raw.maxCostUsd === undefined || parseUsdMicros(raw.maxCostUsd) === null) throw configError("watch: investigate requires maxCostUsd");
+	// Reuse the local execution validators with a synthetic schedule that is never returned or installed.
+	// Every admitted field is projected above; webhook-only authority cannot enter through this path.
+	const local = normalizeCron({ type: "cron", id: on.id, pattern: "0 0 * * *" }, { ...raw, packages: false, github: false }, index, path, { seenCronIds: new Set() });
+	if (local.run.model?.startsWith("role:")) throw configError("watch: investigate requires an explicit chat model or the deployment default");
+	if (local.run.backend && !["local", "podman"].includes(local.run.backend)) throw configError("watch: investigate requires a venue with read-only local bind mounts");
+	const excludeTools = [...new Set([...(local.run.excludeTools ?? []), "edit", "write", "bash", "powershell"])];
+	return { on, run: { ...local.run, mode, excludeTools, ...(issue ? { issue } : {}), ...(raw.queryLogs !== undefined ? { queryLogs: normalizeWatchQueries(raw.queryLogs) } : {}) }, ...(entry.decide !== undefined ? { decide: normalizeWatchDecisionConfig(entry.decide, issue) } : {}) };
+}
+
+function normalizeWatchQueries(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length > 16) throw configError("watch: queryLogs must name at most sixteen reviewed queries");
+	const out = {};
+	for (const [id, q] of Object.entries(value)) {
+		if (!/^[a-z][a-z0-9_-]{0,63}$/.test(id) || !q || typeof q !== "object" || Object.keys(q).some(k => !["endpoint", "query", "credentialEnv"].includes(k)) || typeof q.query !== "string" || Buffer.byteLength(q.query) > 4096 || typeof q.endpoint !== "string" || (q.credentialEnv !== undefined && (typeof q.credentialEnv !== "string" || !ENV_NAME.test(q.credentialEnv)))) throw configError("watch: invalid reviewed log query");
+		let url;
+		try { url = new URL(q.endpoint); } catch { throw configError("watch: invalid log query endpoint"); }
+		if (url.protocol !== "https:" || url.username || url.password || url.hash) throw configError("watch: log queries require HTTPS without URL credentials");
+		out[id] = { endpoint: url.href, query: q.query, ...(q.credentialEnv ? { credentialEnv: q.credentialEnv } : {}) };
+	}
+	return out;
+}
+
+function normalizeWatchDecisionConfig(value, issue) {
+	if (!issue) throw configError("watch: decide requires a reviewed run.issue fallback");
+	if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some(k => !["model", "maxCostUsd", "questions", "act", "fields", "shadow"].includes(k))) throw configError("watch: invalid decide block");
+	if (typeof value.model !== "string" || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_./:@~-]+$/.test(value.model) || value.maxCostUsd === undefined) throw configError("watch: decide requires a model and cost cap");
+	parseUsdMicros(value.maxCostUsd);
+	if (value.shadow !== undefined && typeof value.shadow !== "boolean") throw configError("watch: decide.shadow must be boolean");
+	const { shadow = true, ...policy } = value;
+	const checked = validateWatchDecision({ ...policy, maxCostUsd: String(policy.maxCostUsd) }, { resolveModel: ref => { const i = ref.indexOf("/"); return builtinModel(ref.slice(0, i), ref.slice(i + 1)); } });
+	if (!checked.ok) throw configError("watch: decide-refused; require a known input-only classifier and bounded questions");
+	return { ...checked.config, shadow };
+}
+
 function normalizeCron(on, run, index, path, state) {
 	const at = `trigger at index ${index}`;
 
@@ -377,6 +651,9 @@ function normalizeCron(on, run, index, path, state) {
 	if (!ID_CHARSET.test(id)) {
 		throw configError(`cron trigger "${id}": on.id must match [A-Za-z0-9._-]+: ${path}`);
 	}
+	if (id.length > CRON_ID_MAX) {
+		throw configError(`${at}: cron on.id is ${id.length} characters, more than ${CRON_ID_MAX}: each run's job id is repeat:<id>:<up to ${SLOT_DIGITS_MAX} digits> and must stay within the ${RUN_ID_READ_MAX} characters the readers take, so a longer id would run with no surface naming it: ${path}`);
+	}
 	if (state.seenCronIds.has(id)) {
 		throw configError(`cron trigger "${id}": duplicate on.id (cron ids must be unique): ${path}`);
 	}
@@ -428,6 +705,12 @@ function normalizeCron(on, run, index, path, state) {
 	// Called for its refusal only (issue #625): `true` needs run.resume, which cron refuses, so the returned `run`
 	// grows no `awaitInput` key, exactly as it grows no `replicas` one.
 	validateAwaitInputFlag(run, `cron trigger "${id}"`, path);
+	// Returned: run.progress is legal on cron, and run.statusComment survives only as `false` (issue #644).
+	const { progress, statusComment } = validateProgressFlags(run, `cron trigger "${id}"`, path, { onType: "cron" });
+	// Returned, statusComment's posture (issue #645): `true` is refused on cron, so run.recover survives only as `false`.
+	const recover = validateRecoverFlag(run, `cron trigger "${id}"`, path, { onType: "cron" });
+	// Returned, run.progress's posture (issue #646): steering is legal on cron, an operator can steer a folder job too.
+	const steer = validateSteerFlag(run, `cron trigger "${id}"`, path);
 	// Called and DISCARDED: on a cron trigger this can only refuse, and the refusal is the point. The
 	// returned `run` below deliberately grows no `replicas` key -- a cron entry can never carry one.
 	validateReplicas(run, `cron trigger "${id}"`, path);
@@ -437,6 +720,7 @@ function normalizeCron(on, run, index, path, state) {
 	validateDisarmed(on, `cron trigger "${id}"`, path, { onType: "cron" });
 	const secrets = validateSecrets(run, `cron trigger "${id}"`, path);
 	const secretsProfile = validateSecretsProfile(run, `cron trigger "${id}"`, path);
+	const secretBundle = validateSecretBundleFlag(on, run, `cron trigger "${id}"`, path);
 	const backend = validateBackend(on, run, `cron trigger "${id}"`, path, { localWorkspace: true });
 	// Called for its refusal only: the returned `run` below deliberately grows no `waitFor` key, exactly as
 	// it grows no `replicas` one, because a cron entry can never carry either (issue #230).
@@ -444,6 +728,8 @@ function normalizeCron(on, run, index, path, state) {
 	// A cron job's session narrows like any other: the field selects what the container's agent can do,
 	// which is orthogonal to what triggered it (issue #291).
 	const excludeTools = validateExcludeTools(on, run, `cron trigger "${id}"`, path);
+	const excludeExtensions = validateExcludeExtensions(on, run, `cron trigger "${id}"`, path);
+	const excludeExtensionTools = validateExcludeExtensionTools(on, run, `cron trigger "${id}"`, path);
 	const mcp = validateMcp(on, run, `cron trigger "${id}"`, path, { kind: "local" });
 	// Validated since #502; before it these three were copied untouched, so `run.provider: 7` loaded.
 	const ref = validateRunModel(on, run, `cron trigger "${id}"`, path);
@@ -459,7 +745,7 @@ function normalizeCron(on, run, index, path, state) {
 	// freeze today's default into every stored repeatable.
 	return {
 		on: { type: "cron", id, pattern },
-		run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: ref.provider, model: ref.model, maxTurns: ref.maxTurns, github: run.github, packages, image, resume, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(mcp !== undefined && { mcp }), ...(ref.models !== undefined && { models: ref.models }), ...(ref.maxCostUsd !== undefined && { maxCostUsd: ref.maxCostUsd }), ...(portfolio !== undefined && { portfolio }) },
+		run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: ref.provider, model: ref.model, maxTurns: ref.maxTurns, github: run.github, packages, image, resume, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(secretBundle !== undefined && { secretBundle }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(excludeExtensions !== undefined && { excludeExtensions }), ...(excludeExtensionTools !== undefined && { excludeExtensionTools }), ...(mcp !== undefined && { mcp }), ...(ref.models !== undefined && { models: ref.models }), ...(ref.fallbackModels !== undefined && { fallbackModels: ref.fallbackModels }), ...(ref.maxCostUsd !== undefined && { maxCostUsd: ref.maxCostUsd }), ...(portfolio !== undefined && { portfolio }), ...(progress !== undefined && { progress }), ...(statusComment !== undefined && { statusComment }), ...(recover !== undefined && { recover }), ...(steer !== undefined && { steer }) },
 	};
 }
 
@@ -579,7 +865,91 @@ function validateAwaitInputFlag(run, at, path) {
 	if (run.awaitInput === true && run.resume !== true) {
 		throw configError(`${at}: run.awaitInput needs run.resume: true beside it -- a run that stops to wait for an answer is continued by the next run on the same issue or pull request, and only run.resume keeps the transcript it would continue from: ${path}`);
 	}
-	return run.awaitInput;
+	return run.gates !== undefined ? true : run.awaitInput;
+}
+
+/**
+ * Validate the per-trigger progress flags (issue #644). Strictly boolean, validateAwaitInputFlag's rule and for its
+ * reason: a truthy `"false"` would arm what the operator meant to leave off.
+ *
+ * - `run.progress`: the job is offered the report_progress tool, and the worker reads the phases it reports. Legal on
+ *   every kind: the tool and the reducer need no forge, and a cron job's progress shows in the console like any other.
+ * - `run.statusComment`: the worker posts one comment on the issue or pull request and edits it as the run goes. Only
+ *   where the job has one to post on: a cron trigger has no issue or pull request (`run.github` mints a token, it
+ *   names no target), so `true` there is refused rather than accepted to do nothing. `false` is today's default and
+ *   is carried, `run.resume`'s rule.
+ *
+ * Neither needs the other: a status comment without run.progress shows turns and steps and no phase.
+ * Returns both, each undefined when absent, so an unflagged trigger normalizes byte-identically to today's.
+ * Exported for the admin's trigger tools, which judge the two before the operator's confirm with this message.
+ */
+export function validateProgressFlags(run, at, path, { onType }) {
+	for (const key of ["progress", "statusComment"]) {
+		if (run[key] !== undefined && typeof run[key] !== "boolean") {
+			throw configError(`${at}: run.${key} must be true or false when present: ${path}`);
+		}
+	}
+	if (onType === "cron" && run.statusComment === true) {
+		throw configError(`${at}: run.statusComment is only available on a forge trigger: a cron job has no issue or pull request to post its status on: ${path}`);
+	}
+	return { progress: run.progress, statusComment: run.statusComment };
+}
+
+/**
+ * Validate the per-trigger `run.recover` flag (issue #645, durable runs): whether a run the worker loses mid-flight (a
+ * crash, a restart, a host that went away) is continued from its last checkpoint instead of failing. Strictly boolean,
+ * validateAwaitInputFlag's rule and for its reason: a truthy `"false"` would arm what the operator meant to leave off.
+ *
+ * Two refusals, each a combination that cannot do what it says rather than one that is merely unusual:
+ * - on cron. The checkpoint is a forge job's session, keyed by its issue or pull request; a cron job's /workspace IS
+ *   the operator's folder, edited in place, so a recovery would replay a transcript over a working tree the lost run
+ *   already changed, with nothing to put it back. `run.resume` is refused there for the same missing key.
+ * - beside `run.command`. A recovering run continues the transcript; a command job's prompt is one `/name args` line,
+ *   and replaying it would dispatch the command a second time, which is exactly the side effect a checkpoint exists
+ *   to avoid repeating.
+ *
+ * Deliberately NOT tied to `run.resume`: resume carries a transcript from one run to the NEXT, recovery carries one
+ * run's own checkpoint into its own continuation, and either is useful without the other.
+ *
+ * Returns the flag, undefined when absent, so an unflagged trigger normalizes byte-identically to today's. Exported
+ * for the admin's trigger tools, which judge it before the operator's confirm with this message.
+ */
+export function validateRecoverFlag(run, at, path, { onType }) {
+	if (run.recover !== undefined && typeof run.recover !== "boolean") {
+		throw configError(`${at}: run.recover must be true or false when present: ${path}`);
+	}
+	if (run.recover === true && onType === "cron") {
+		throw configError(`${at}: run.recover is only available on a forge trigger: a cron job's /workspace is the operator's folder, edited in place, so a recovered run would replay over a tree the lost run already changed: ${path}`);
+	}
+	if (run.recover === true && run.command !== undefined) {
+		throw configError(`${at}: run.recover cannot be set beside run.command: a recovering run continues its transcript, and a command job's prompt is the one /name args line, so recovering it would dispatch the command a second time: ${path}`);
+	}
+	return run.recover;
+}
+
+/**
+ * Validate the per-trigger `run.steer` flag (issue #646, steering a running job): whether an operator (and, once comment
+ * routing lands, a collaborator using the trigger phrase) may send messages into the job while it runs. Strictly
+ * boolean, validateRecoverFlag's rule and for its reason: a truthy `"false"` would arm what the operator meant to leave
+ * off.
+ *
+ * Legal on every trigger type, cron included, unlike run.recover: a steering message is delivered into the live
+ * session and needs no issue or pull request to key anything by, so a folder job can be steered by its operator as
+ * well as a forge job can. The one refusal is beside `run.command`: a command job's prompt is one `/name args` line
+ * that dispatches a workflow, and a message pushed into that session would be read by whatever the command started,
+ * not by an agent the operator asked to listen. Refusing the pair says so before anything spends.
+ *
+ * Returns the flag, undefined when absent, so an unflagged trigger normalizes byte-identically to today's. Exported
+ * for the admin's trigger tools, which judge it before the operator's confirm with this message.
+ */
+export function validateSteerFlag(run, at, path) {
+	if (run.steer !== undefined && typeof run.steer !== "boolean") {
+		throw configError(`${at}: run.steer must be true or false when present: ${path}`);
+	}
+	if (run.steer === true && run.command !== undefined) {
+		throw configError(`${at}: run.steer cannot be set beside run.command: a command job's prompt is the one /name args line that dispatches a workflow, so a steering message would reach whatever the command started rather than an agent listening for it: ${path}`);
+	}
+	return run.steer;
 }
 
 /**
@@ -1151,6 +1521,202 @@ function validateSecretsProfile(run, at, path) {
 	return profile;
 }
 
+/**
+ * The most variables one bundle may carry (issue #704), and so the most `endpoints` it may name. Sixty-four, four
+ * times `SECRETS_MAX`, and the justification is the one that cap gives, re-measured for one call: a bundle is ONE
+ * resolver call with ONE timeout, so the count multiplies no slot time; what it multiplies is the host argv
+ * (`-e NAME=VALUE` per variable on local and podman, OQ-028) and the redaction set, and 64 x 64 KiB is bounded
+ * anyway by the 256 KiB total the resolver's output may have (`secret-bundles.mjs`). A project with more than 64
+ * variables in one environment is one whose blast radius this feature should not make one grant.
+ */
+export const SECRET_BUNDLE_VARS_MAX = 64;
+
+/** An endpoint's auth scheme: a bearer token, HTTP Basic, or a named header (`header:X-Api-Key`). */
+const BUNDLE_ENDPOINT_AUTH = /^(?:bearer|basic|header:[A-Za-z0-9-]{1,64})$/;
+
+/** A DNS host name, no scheme, no port, no path: the shape a policy endpoint names. */
+const BUNDLE_ENDPOINT_HOST = /^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+
+/** The fields a bundle may carry. Closed: an unknown field refuses the file (see below). */
+const BUNDLE_FIELDS = new Set(["profile", "ref", "project", "forkReviews", "endpoints"]);
+
+/**
+ * The file's top-level `secretBundles` (issue #704, INT-TRIGGERS-FILE-CONTRACT): a project's whole environment,
+ * granted ONCE. `{ "<id>": { profile, ref, project, forkReviews?, endpoints? } }`. Returns a frozen normalized
+ * copy, `{}` when absent. Throws `configError` on anything malformed.
+ *
+ * STRICT, unlike the trigger entries' drop-unknown posture, and on the condition rule's reasoning (an unknown key
+ * inside a condition is refused because it would be a term of a gate that does nothing while the job runs): a
+ * misspelt `forkreviews` or `project_id` here is a narrowing or a binding the operator reads as written and the
+ * worker never applies. This block grants credentials, so a field the code does not read is refused by name.
+ *
+ * REFUSING THE WHOLE FILE is the blast radius, deliberately, rather than dropping the one bad bundle. A dropped
+ * bundle is the silent no-op this project refuses: the project's jobs would run without their environment and
+ * the file would read as granting it. Refusing it is the posture every malformed trigger already has, and each
+ * reader's existing reaction to an invalid file is the right one here too: the receiver keeps its running set
+ * and logs `triggers_reload_invalid` on a reload (and refuses to boot on one), every writer refuses to write it,
+ * doctor fails, and the worker keeps answering from its last good read (and retries a project's jobs while it has
+ * never had one, triggers-file.mjs `makeFindSecretBundle`). An
+ * OLDER receiver ignores the key entirely, which is safe for the same reason it is safe for the worker to be the
+ * only reader that acts on it: the binding is read by the worker from its own file at pickup, never carried on
+ * the job, so a receiver of any version can neither drop nor forge it.
+ *
+ * What this cannot check, because it is pure and fs-free: whether `profile` is declared (PI_SECRET_BUNDLES and
+ * the overlay are host state, refused per job as `secret-bundle-profile-unknown`), whether `project` exists in
+ * projects.json (doctor fails on it), and whether an `endpoints` name is a variable the bundle actually holds
+ * (only knowable once it is read; the openshell venue refuses that at use).
+ */
+function validateSecretBundles(value, path) {
+	if (value === undefined) return Object.freeze({});
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		throw configError(`secretBundles must be an object mapping bundle ids to { profile, ref, project } (got ${JSON.stringify(value)}): ${path}`);
+	}
+	const out = {};
+	const projects = new Map();
+	for (const id of Object.keys(value)) {
+		const at = `secretBundles ${JSON.stringify(id)}`;
+		// The cron-id charset, for its reasons: the id is named in log lines and the run record, and `__proto__` and
+		// friends pass it, so every write below defines an own property rather than assigning one.
+		// 1 to 128 characters: the run record's `bundle.id` holds at most that (run-history.mjs `recordedBundle`), so a
+		// longer id would load here and then void the record's key on every run of the project.
+		if (!ID_CHARSET.test(id) || id.length > 128 || id === "__proto__") {
+			throw configError(`${at}: a bundle id is 1 to 128 letters, digits, dots, dashes and underscores: ${path}`);
+		}
+		const bundle = value[id];
+		if (bundle === null || typeof bundle !== "object" || Array.isArray(bundle)) {
+			throw configError(`${at}: must be an object { profile, ref, project }: ${path}`);
+		}
+		const unknown = Object.keys(bundle).find((k) => !BUNDLE_FIELDS.has(k));
+		if (unknown !== undefined) {
+			throw configError(`${at}: unknown field ${JSON.stringify(unknown)} (a bundle reads only ${[...BUNDLE_FIELDS].join(", ")}): a field the worker does not read is a grant or a narrowing that is not applied: ${path}`);
+		}
+		const { profile, ref, project } = bundle;
+		if (!isNonEmptyString(profile) || !ID_CHARSET.test(profile)) {
+			throw configError(`${at}: profile must name one of the bundle resolvers this deployment declares (PI_SECRET_BUNDLES or the panel), letters, digits, dot, dash and underscore: ${path}`);
+		}
+		// `ref` takes run.secrets' reference rules verbatim, for their reasons: it is the resolver's first argument.
+		if (!isNonEmptyString(ref)) {
+			throw configError(`${at}: ref must be a non-empty string reference for the bundle's resolver to read (got ${JSON.stringify(ref)}): ${path}`);
+		}
+		if (ref !== ref.trim()) {
+			throw configError(`${at}: ref must not have leading or trailing whitespace -- the file is the reviewed artifact and silently trimming it would make the file disagree with what the resolver is asked for: ${path}`);
+		}
+		if (ref.startsWith("-")) {
+			throw configError(`${at}: ref must not start with "-" -- it is passed as the resolver's first argument, where a leading dash parses as a flag: ${path}`);
+		}
+		if (typeof project !== "string" || !PROJECT_ID_RE.test(project)) {
+			throw configError(`${at}: project must be a projects.json id (lowercase letters, digits and "-", 1 to 32 characters): ${path}`);
+		}
+		// ONE bundle per project. Two would need a merge rule, and every merge rule is a variable silently won by one
+		// grant over another; the operator who wants two sources writes one resolver that prints both.
+		if (projects.has(project)) {
+			throw configError(`${at}: project ${JSON.stringify(project)} is already bound by bundle ${JSON.stringify(projects.get(project))} -- a project has at most one bundle: ${path}`);
+		}
+		projects.set(project, id);
+		if (bundle.forkReviews !== undefined && typeof bundle.forkReviews !== "boolean") {
+			throw configError(`${at}: forkReviews must be true or false when present -- a truthy string must not quietly hand a stranger's pull request every project secret: ${path}`);
+		}
+		const endpoints = validateBundleEndpoints(bundle.endpoints, at, path);
+		Object.defineProperty(out, id, {
+			value: Object.freeze({ profile, ref, project, ...(bundle.forkReviews !== undefined && { forkReviews: bundle.forkReviews }), ...(endpoints !== undefined && { endpoints }) }),
+			enumerable: true,
+		});
+	}
+	return Object.freeze(out);
+}
+
+/**
+ * A bundle's `endpoints` (issue #704): `{ NAME: { host, auth } }`, the variables the openshell venue may hold as a
+ * per-job provider key bound to that one host. Shape-checked here on every venue so the file is one file; USED
+ * only on openshell, and on every other venue a named variable goes in plain like the rest, which is what it
+ * would be without the field (OQ-028 says so).
+ */
+function validateBundleEndpoints(endpoints, at, path) {
+	if (endpoints === undefined) return undefined;
+	if (endpoints === null || typeof endpoints !== "object" || Array.isArray(endpoints)) {
+		throw configError(`${at}: endpoints must be an object mapping variable names to { host, auth }: ${path}`);
+	}
+	const names = Object.keys(endpoints);
+	if (names.length > SECRET_BUNDLE_VARS_MAX) {
+		throw configError(`${at}: endpoints names ${names.length} variables, over the ${SECRET_BUNDLE_VARS_MAX} a bundle may carry: ${path}`);
+	}
+	const out = {};
+	for (const name of names) {
+		if (!ENV_NAME.test(name) || name === "__proto__") {
+			throw configError(`${at}: endpoints key ${JSON.stringify(name)} is not an environment variable name (letters, digits and underscore, not starting with a digit): ${path}`);
+		}
+		if (RESERVED_ENV_NAMES.has(name)) {
+			throw configError(`${at}: endpoints key ${JSON.stringify(name)} is reserved: this deployment's own runtime reads or writes it, so a bundle can never carry it: ${path}`);
+		}
+		const entry = endpoints[name];
+		if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+			throw configError(`${at}: endpoints.${name} must be an object { host, auth }: ${path}`);
+		}
+		const extra = Object.keys(entry).find((k) => k !== "host" && k !== "auth");
+		if (extra !== undefined) {
+			throw configError(`${at}: endpoints.${name} has an unknown field ${JSON.stringify(extra)} (only host and auth are read): ${path}`);
+		}
+		if (typeof entry.host !== "string" || !BUNDLE_ENDPOINT_HOST.test(entry.host)) {
+			throw configError(`${at}: endpoints.${name}.host must be a host name with no scheme, port or path (e.g. "api.example.com"): ${path}`);
+		}
+		if (typeof entry.auth !== "string" || !BUNDLE_ENDPOINT_AUTH.test(entry.auth)) {
+			throw configError(`${at}: endpoints.${name}.auth must be "bearer", "basic" or "header:<Name>": ${path}`);
+		}
+		Object.defineProperty(out, name, { value: Object.freeze({ host: entry.host.toLowerCase(), auth: entry.auth }), enumerable: true });
+	}
+	return Object.freeze(out);
+}
+
+/**
+ * Whether `key` is a spelling of `secretBundle` / `secretBundles` (issue #704 review round 2): every case and
+ * separator variant of either, singular or plural, and a non-ASCII key whose surviving letters are an in-order subset
+ * of either (a homoglyph), `validateBackend`'s rule. The caller skips the exact spelling where it is legal.
+ */
+export function isSecretBundleNearMiss(key) {
+	const normalized = String(key).replace(/[^a-z0-9]/gi, "").toLowerCase();
+	const targets = ["secretbundle", "secretbundles"];
+	if (/^[\x20-\x7E]*$/.test(String(key))) return targets.includes(normalized);
+	const isSubsequence = (needle, hay) => {
+		let i = 0;
+		for (const ch of hay) if (i < needle.length && needle[i] === ch) i++;
+		return i === needle.length;
+	};
+	return normalized.length >= 6 && targets.some((t) => isSubsequence(normalized, t));
+}
+
+/**
+ * `run.secretBundle` (issue #704): `false` keeps this trigger's jobs out of their project's bundle. Strictly
+ * boolean, `run.github`'s rule: a truthy `"false"` must not quietly leave a job holding a project's every secret.
+ * `true` is the default and changes nothing. Returned when present, so an unflagged entry normalizes
+ * byte-identically.
+ *
+ * The WORKER reads this from its own triggers file at pickup (triggers-file.mjs `makeFindSecretBundle`), never
+ * from the job data, so no receiver carries it and a receiver older than this field cannot drop it: the
+ * opt-out is a narrowing whose absence would WIDEN the job, the `AUTHORED_NARROWING_FIELDS` class, and reading
+ * it where the binding is read closes that skew without a version floor.
+ */
+function validateSecretBundleFlag(on, run, at, path) {
+	// The near-miss sweep `run.backend` and `run.excludeTools` keep, for the sharpest version of their reason: the
+	// opt-out is a NARROWING, so a misspelt `secret_bundle: false` dropped as an unknown key would hand the trigger's
+	// jobs their project's whole environment while the file reads as keeping them out. On `run` the exact spelling is
+	// the field; on `on` every spelling is wrong, the exact one included.
+	for (const [label, source, exactIsLegal] of [
+		["run", run, true],
+		["on", on, false],
+	]) {
+		for (const key of Object.keys(source ?? {})) {
+			if (exactIsLegal && key === "secretBundle") continue;
+			if (!isSecretBundleNearMiss(key)) continue;
+			throw configError(`${at}: ${label}.${key} is not a field -- did you mean run.secretBundle? An opt-out the loader drops gives the trigger's jobs their project's secret bundle while the file reads as keeping them out, so a near miss is refused rather than dropped: ${path}`);
+		}
+	}
+	if (run.secretBundle === undefined) return undefined;
+	if (typeof run.secretBundle !== "boolean") {
+		throw configError(`${at}: run.secretBundle must be true or false when present (false keeps this trigger's jobs out of their project's secret bundle): ${path}`);
+	}
+	return run.secretBundle;
+}
+
 /**
  * Would running a folder-bound job in this venue be impossible? Exported ONLY so it can be driven.
  *
@@ -1167,7 +1733,9 @@ function validateSecretsProfile(run, at, path) {
  * physics. A test pins that every entry declares it, so both halves have to fail together.
  */
 export function refusesLocalWorkspace(entry, localWorkspace) {
-	return Boolean(localWorkspace) && entry?.remote !== false;
+	// Issue #683: a venue that is on this host and still cannot edit a folder in place, because it COPIES the job's files
+	// (`openshell`): it declares `localFolders` absent, and is refused for the same physics in different words.
+	return Boolean(localWorkspace) && (entry?.remote !== false || entry?.declares?.localFolders === "absent");
 }
 
 /**
@@ -1255,12 +1823,34 @@ function validateBackend(on, run, at, path, { localWorkspace }) {
 	// world imposes, and discovering it per job would burn a pickup for an answer the file already had.
 	// The decision itself is `refusesLocalWorkspace` above, so it can be driven; see its comment.
 	if (refusesLocalWorkspace(entry, localWorkspace)) {
-		throw configError(`${at}: run.backend ${JSON.stringify(backend)} is remote, and this trigger runs against a folder on THIS machine that has to be bind-mounted and edited in place -- there is no volume to hide behind (DES-WORKER-ON-HOST): ${path}`);
+		const why = entry?.remote !== false ? "is remote" : "copies a job's files into its sandbox instead of mounting them (DES-OPENSHELL-VENUE)";
+		throw configError(`${at}: run.backend ${JSON.stringify(backend)} ${why}, and this trigger runs against a folder on THIS machine that has to be bind-mounted and edited in place -- there is no volume to hide behind (DES-WORKER-ON-HOST): ${path}`);
 	}
 
+	// Issue #712: `run.recover` on a venue that does not serve recovery (`serves.recovery: "no"`, the `openshell` copy
+	// mode) is refused before spend on EVERY delivery (`openshell-recover-unsupported`), so the file already knows the
+	// answer and is refused at load and write, refusesLocalWorkspace's reasoning. Only for an EXPLICIT venue: a trigger
+	// that names none runs on PI_BACKENDS[0], which is the deployment's and not the file's, so that pairing stays the
+	// processor's pre-spend refusal (the admin's trigger tools also judge it against PI_BACKENDS[0] before the confirm).
+	const recoverRefused = run.recover === true ? recoverVenueProblem(backend) : null;
+	if (recoverRefused !== null) throw configError(`${at}: ${recoverRefused}: ${path}`);
+
 	return backend;
 }
 
+/**
+ * Why `run.recover` cannot be armed on a trigger whose jobs run in `venue`, or null (issue #712): the venue's
+ * `serves.recovery` is `no`. One sentence, so the loader (`validateBackend`, explicit venues) and the admin's trigger tools
+ * (which also judge a trigger naming no venue against PI_BACKENDS[0]) refuse in the same words. A name the table does not
+ * hold is null here: the loader's own unknown-venue refusal says that.
+ */
+export function recoverVenueProblem(venue) {
+	if (servesOf(venue)?.recovery !== "no") return null;
+	// The venues that do serve it come from the same table, so a new venue changes this sentence without an edit here.
+	const serving = BACKEND_NAMES.filter((name) => servesOf(name)?.recovery === "yes");
+	return `run.recover cannot be armed on a trigger whose jobs run in the ${venue} venue: that venue does not serve recovery, so every delivery would be refused before it spends. Remove run.recover, or name a venue that serves it (${serving.join(", ")})`;
+}
+
 /**
  * The `run` field a key spells or nearly spells (`run.provider`, `run.model`, `run.models`, `run.maxTurns`,
  * `run.maxCostUsd`), or null. The exact field names match too: the CALLER decides whether an exact name is legal
@@ -1297,6 +1887,7 @@ const RUN_MODEL_NEAR_MISS_TARGETS = Object.freeze({
 	provider: "run.provider", providers: "run.provider", providerid: "run.provider", providerids: "run.provider", providername: "run.provider",
 	model: "run.model", modelid: "run.model", modelname: "run.model",
 	models: "run.models", modelids: "run.models", modelnames: "run.models", allowedmodels: "run.models", allowedmodel: "run.models",
+	fallbackmodels: "run.fallbackModels", fallbackmodel: "run.fallbackModels", fallbackmodelid: "run.fallbackModels", fallbackmodelids: "run.fallbackModels", fallbackmodelname: "run.fallbackModels", fallbackmodelnames: "run.fallbackModels",
 	maxturns: "run.maxTurns", maxturn: "run.maxTurns",
 	maxcostusd: "run.maxCostUsd", maxcost: "run.maxCostUsd",
 });
@@ -1322,7 +1913,7 @@ const RUN_MODEL_NEAR_MISS_TARGETS = Object.freeze({
  * were refused here before it was.
  */
 function validateRunModel(on, run, at, path) {
-	const exact = new Set(["provider", "model", "maxTurns", "models", "maxCostUsd"]);
+	const exact = new Set(["provider", "model", "maxTurns", "models", "fallbackModels", "maxCostUsd"]);
 	for (const [label, source, exactIsLegal] of [
 		["run", run, true],
 		["on", on, false],
@@ -1349,6 +1940,150 @@ function validateMaxCostUsd(run, at, path) {
 	return { maxCostUsd: run.maxCostUsd };
 }
 
+/**
+ * Whether `key` spells `run.excludeTools` or nearly does, the exact name included: the CALLER decides whether an exact name
+ * is legal where it found it, `runModelFieldNearMiss`'s rule (the loader allows it under `run`, never under `on`; the
+ * console's trigger tools refuse it in any spelling, issue #800). One sweep, so the two cannot disagree on what a near miss is.
+ *
+ * Three targets. The first catches every case and separator variant (exclude_tools, exclude-tools, EXCLUDETOOLS). The
+ * SINGULAR is the likeliest miss of all: an operator removing one tool writes `excludeTool` the way English does, and unlike
+ * `backend` there is no env-var mnemonic anchoring the right form. The past participle is how the field reads back in prose
+ * ("the excluded tools"), one grammatical step with no other plausible meaning. Deliberately NOT a synonym hunt (denyTools,
+ * toolsOff): that is the general unknown-key sweep this file's forward-compatibility posture rejects.
+ */
+export function excludeToolsNearMiss(key) {
+	return nearMissOf(["excludetools", "excludetool", "excludedtools"], key);
+}
+
+/** Whether `a` becomes `b` in at most `limit` single edits. */
+function withinEdits(a, b, limit) {
+	let previous = Array.from({ length: b.length + 1 }, (_, j) => j);
+	for (let i = 1; i <= a.length; i++) {
+		const row = [i];
+		for (let j = 1; j <= b.length; j++) row[j] = Math.min(previous[j] + 1, row[j - 1] + 1, previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+		previous = row;
+	}
+	return previous[b.length] <= limit;
+}
+
+/**
+ * The one body of every exclusion key's sweep: a case or separator variant of a target, or a key outside plain ASCII whose letters
+ * are a target's in order, which can be drawn exactly like it. `slips` adds a key that many edits from a target. Only on a key new enough
+ * that no file holds one: `excludeToolz` stays a key the loader ignores, as it was, since refusing it now would stop a service on a
+ * file it read yesterday.
+ */
+function nearMissOf(targets, key, { slips = 0 } = {}) {
+	const normalized = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
+	const isSubsequence = (needle, hay) => {
+		let i = 0;
+		for (const ch of hay) if (i < needle.length && needle[i] === ch) i++;
+		return i === needle.length;
+	};
+	if (!/^[\x20-\x7E]*$/.test(key)) return normalized.length >= 4 && targets.some((t) => isSubsequence(normalized, t));
+	return targets.some((t) => t === normalized || (slips > 0 && withinEdits(normalized, t, slips)));
+}
+
+/**
+ * How far a spelling of these two keys may be from the name and still mean it. Two: a key this long holds a slip in each of its words
+ * (`exludeExtentions`), and a participle comes with a plural (`excludedExtension`, `excludeExtensionsTools`), where a list of each word's forms
+ * would be a list of misspellings. Nothing else the loader reads comes within two; a test holds every key against that.
+ */
+const EXTENSION_KEY_SLIPS = 2;
+
+/** Whether `key` spells `run.excludeExtensions` or nearly does, the exact name and the word cut short (`excludeExt`) included: the caller decides where an exact name is legal, `excludeToolsNearMiss`'s rule. */
+export function excludeExtensionsNearMiss(key) {
+	return nearMissOf(["excludeextensions", "excludeext"], key, { slips: EXTENSION_KEY_SLIPS });
+}
+
+/** Whether `key` spells `run.excludeExtensionTools` or nearly does, the exact name and the word cut short (`excludeExtTools`) included: the caller decides where an exact name is legal, `excludeToolsNearMiss`'s rule. */
+export function excludeExtensionToolsNearMiss(key) {
+	return nearMissOf(["excludeextensiontools", "excludeexttools"], key, { slips: EXTENSION_KEY_SLIPS });
+}
+
+/**
+ * Refuses a near miss of a list key under `run` or `on` (an exact spelling is the field under `run` and wrong under `on`), and
+ * the list's own shape: a non-empty array of distinct strings, each passing `check`, which names what is wrong with one or says
+ * nothing. A dropped or empty exclusion runs the job WITH what the file reads as gone, so none of this is left to drop silently.
+ */
+function validateNameList({ field, nearMiss, check, what }, on, run, at, path) {
+	for (const [label, source, exactIsLegal] of [
+		["run", run, true],
+		["on", on, false],
+	]) {
+		for (const key of Object.keys(source ?? {})) {
+			if (exactIsLegal && key === field) continue;
+			if (!nearMiss(key)) continue;
+			throw configError(`${at}: ${label}.${key} is not a field -- did you mean run.${field}? An exclusion the loader drops runs the job WITH what the file reads as gone, so a near miss is refused rather than dropped: ${path}`);
+		}
+	}
+	const list = run?.[field];
+	if (list === undefined) return undefined;
+	if (!Array.isArray(list) || list.length === 0) throw configError(`${at}: run.${field} must be a non-empty array of ${what} when present (got ${JSON.stringify(list)}): ${path}`);
+	if (list.length > LEFT_OUT_NAMES_MAX) throw configError(`${at}: run.${field} names ${list.length}, and it takes at most ${LEFT_OUT_NAMES_MAX}, what a run's record holds: ${path}`);
+	const seen = new Set();
+	for (let i = 0; i < list.length; i++) {
+		const name = list[i];
+		if (typeof name !== "string") throw configError(`${at}: run.${field}[${i}] must be a string naming ${what} (got ${JSON.stringify(name)}): ${path}`);
+		const wrong = check(name);
+		if (wrong) throw configError(`${at}: run.${field}[${i}] ${JSON.stringify(name)} ${wrong}: ${path}`);
+		if (seen.has(name)) throw configError(`${at}: run.${field} names ${JSON.stringify(name)} twice -- the entries are a removal set, so the second can never change the answer: ${path}`);
+		seen.add(name);
+	}
+	return list;
+}
+
+/**
+ * `run.excludeExtensions` (issue #800): extensions this trigger's jobs do not load, each named by what a person reads on a host:
+ * a staged package's manifest name, or an overlay entry's file stem or folder name. A name means every extension of that name,
+ * so one that is both takes out both. The worker omits a package's path and the runner filters the overlay's entries before any
+ * factory runs (`DES-PER-TRIGGER-LOAD-EXCLUSIONS`). Excluding a package also removes its skills, prompts and themes.
+ *
+ * NOT MEMBERSHIP-CHECKED, the one thing `run.excludeTools` is for: what a host holds is that host's, and the file is shared, so a
+ * name no host here holds is not knowable at load. A name not on a host is no refusal there: its record says so and doctor warns.
+ * A shape, so the list stays comma-safe in the container's environment and a record can hold it.
+ */
+export function validateExcludeExtensions(on, run, at, path) {
+	return validateNameList({
+		field: "excludeExtensions",
+		nearMiss: excludeExtensionsNearMiss,
+		what: "extension names",
+		check: (name) => (isPackageName(name) || LOADED_OVERLAY_NAME_RE.test(name) ? null : "is neither a package's manifest name nor an overlay extension's file stem or folder name"),
+	}, on, run, at, path);
+}
+
+/**
+ * `run.excludeExtensionTools` (issue #800): tools an extension brings, which this trigger's sessions must not have. Its own key, and
+ * `run.excludeTools` stays closed: that list is checked against the pinned pi, which is what makes a typo in it a refusal at load,
+ * and this one cannot be, since an extension's tools are known only once it runs. The runner stops a job on a name no staged package
+ * or overlay extension registered, where it can tell (`exclude-tool-not-loaded`). Refused here is a name this key would mistake: pi's own
+ * tools and a server's are `run.excludeTools`', and a tool pi-dispatch gives some jobs (`LOADED_JOB_TOOLS`) is theirs: a run field arms some, a role map or a label trigger's draft
+ * others, and taking one away could leave `run.progress` or `run.awaitInput` armed with nothing to call. Each compared with the name's case folded:
+ * `run.excludeTools` refuses `Bash` by membership, and here it would load, match nothing and read as though the shell were gone. A staged
+ * package's or an overlay extension's real tool that differs from one of those only in case is reached by excluding it; a repository extension's is not. REJECTED: a `*` pattern,
+ * which pi takes and which would match tools no person named.
+ */
+const EXTENSION_TOOL_WAY_OUT = "to remove a staged package's or an overlay extension's tool of that name, put that package's or extension's name in run.excludeExtensions";
+export function validateExcludeExtensionTools(on, run, at, path) {
+	return validateNameList({
+		field: "excludeExtensionTools",
+		nearMiss: excludeExtensionToolsNearMiss,
+		what: "tool names",
+		check: (name) => {
+			if (!LOADED_TOOL_NAME_RE.test(name)) return "is not a tool's name (a letter, then letters, digits, _ or -, at most 48, and no pattern)";
+			const folded = name.toLowerCase();
+			// The spelling that list takes: it holds names by exact membership, so sending `BASH` there as written is a second refusal. That list removes pi's `bash` and leaves an overlay's `BASH`, so each refusal also names the way out for an extension's.
+			if (EXCLUDABLE_TOOL_NAMES.has(folded)) return `matches, ignoring case, one of pi's own tools, which this key does not take: run.excludeTools removes pi's, spelled ${JSON.stringify(folded)}; ${EXTENSION_TOOL_WAY_OUT}`;
+			// REJECTED: "is not an extension's tool", since an overlay extension can register any of these names, and a bare "it belongs on run.excludeTools", which refuses these on a trigger with no run.mcp.
+			if (MCP_EXCLUDABLE_TOOL_NAMES.has(folded)) return `matches, ignoring case, one of the MCP tools, which this key does not take: on a trigger with run.mcp, run.excludeTools removes those, spelled ${JSON.stringify(folded)}; ${EXTENSION_TOOL_WAY_OUT}`;
+			// REJECTED: "is a server's tool", false of `MCP__X__Y`, which no server can bring, since a server's name is lower case.
+			if (folded.startsWith("mcp__")) return `starts, ignoring case, like a server's tool, which this key does not take: on a trigger whose run.mcp names that server, run.excludeTools removes its tools all at once, as mcp__<server>__*; ${EXTENSION_TOOL_WAY_OUT}`;
+			// REJECTED: "another run field arms it; turn that field off", which is false of `subagent` (a role map arms it) and of `decide` and `read_repository` on a label trigger. REJECTED: "a tool the job itself offers", false of a plain job, which offers none of these and does offer an overlay extension's tool of such a name.
+			if (LOADED_JOB_TOOLS.includes(folded)) return `matches, ignoring case, the name of a tool pi-dispatch gives some jobs, which this key does not take; ${EXTENSION_TOOL_WAY_OUT}`;
+			return null;
+		},
+	}, on, run, at, path);
+}
+
 /**
  * `run.excludeTools` -- pi tool names this trigger's session must NOT have (issue #291).
  *
@@ -1379,24 +2114,7 @@ function validateExcludeTools(on, run, at, path) {
 	]) {
 		for (const key of Object.keys(source ?? {})) {
 			if (exactIsLegal && key === "excludeTools") continue;
-			// Three targets. The first catches every case and separator variant (exclude_tools,
-			// exclude-tools, EXCLUDETOOLS). The SINGULAR is the likeliest miss of all: an operator
-			// removing one tool writes `excludeTool` the way English does, and unlike `backend` there is
-			// no env-var mnemonic anchoring the right form. The past participle is how the field reads
-			// back in prose ("the excluded tools"), one grammatical step with no other plausible meaning.
-			// Deliberately NOT a synonym hunt (denyTools, toolsOff): that is the general unknown-key
-			// sweep this file's forward-compatibility posture rejects.
-			const normalized = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
-			const targets = ["excludetools", "excludetool", "excludedtools"];
-			const isSubsequence = (needle, hay) => {
-				let i = 0;
-				for (const ch of hay) if (i < needle.length && needle[i] === ch) i++;
-				return i === needle.length;
-			};
-			const suspicious = /^[\x20-\x7E]*$/.test(key)
-				? targets.includes(normalized)
-				: normalized.length >= 4 && targets.some((t) => isSubsequence(normalized, t));
-			if (!suspicious) continue;
+			if (!excludeToolsNearMiss(key)) continue;
 			throw configError(`${at}: ${label}.${key} is not a field -- did you mean run.excludeTools? An exclusion the loader drops runs the job WITH the tool while the file reads as though it was off, so a near miss is refused rather than dropped: ${path}`);
 		}
 	}
@@ -1675,18 +2393,24 @@ function normalizeLabel(on, run, index, path) {
 	const instructions = validateInstructions(run, at, path);
 	const resume = validateResumeFlag(run, at, path);
 	const awaitInput = validateAwaitInputFlag(run, at, path);
+	const { progress, statusComment } = validateProgressFlags(run, at, path, { onType: on.type });
+	const recover = validateRecoverFlag(run, at, path, { onType: on.type });
+	const steer = validateSteerFlag(run, at, path);
 	const repository = validateRepository(run, "label", at, path);
 	const replicas = validateReplicas(run, at, path);
 	const secrets = validateSecrets(run, at, path);
 	const secretsProfile = validateSecretsProfile(run, at, path);
+	const secretBundle = validateSecretBundleFlag(on, run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const excludeExtensions = validateExcludeExtensions(on, run, at, path);
+	const excludeExtensionTools = validateExcludeExtensionTools(on, run, at, path);
 	const mcp = validateMcp(on, run, at, path, { kind: run.kind });
 	const ref = validateRunModel(on, run, at, path);
 	return {
 		on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none },
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(mcp !== undefined && { mcp }), ...ref },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...validateApprovalConfig(run), ...(progress !== undefined && { progress }), ...(statusComment !== undefined && { statusComment }), ...(recover !== undefined && { recover }), ...(steer !== undefined && { steer }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(secretBundle !== undefined && { secretBundle }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(excludeExtensions !== undefined && { excludeExtensions }), ...(excludeExtensionTools !== undefined && { excludeExtensionTools }), ...(mcp !== undefined && { mcp }), ...ref },
 	};
 }
 
@@ -1719,18 +2443,24 @@ function normalizeComment(on, run, index, path, state) {
 	const instructions = validateInstructions(run, at, path);
 	const resume = validateResumeFlag(run, at, path);
 	const awaitInput = validateAwaitInputFlag(run, at, path);
+	const { progress, statusComment } = validateProgressFlags(run, at, path, { onType: on.type });
+	const recover = validateRecoverFlag(run, at, path, { onType: on.type });
+	const steer = validateSteerFlag(run, at, path);
 	const repository = validateRepository(run, "comment", at, path);
 	const replicas = validateReplicas(run, at, path);
 	const secrets = validateSecrets(run, at, path);
 	const secretsProfile = validateSecretsProfile(run, at, path);
+	const secretBundle = validateSecretBundleFlag(on, run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const excludeExtensions = validateExcludeExtensions(on, run, at, path);
+	const excludeExtensionTools = validateExcludeExtensionTools(on, run, at, path);
 	const mcp = validateMcp(on, run, at, path, { kind: run.kind });
 	const ref = validateRunModel(on, run, at, path);
 	return {
 		on: { type: "comment", phrase: on.phrase },
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(mcp !== undefined && { mcp }), ...ref },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...validateApprovalConfig(run), ...(progress !== undefined && { progress }), ...(statusComment !== undefined && { statusComment }), ...(recover !== undefined && { recover }), ...(steer !== undefined && { steer }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(secretBundle !== undefined && { secretBundle }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(excludeExtensions !== undefined && { excludeExtensions }), ...(excludeExtensionTools !== undefined && { excludeExtensionTools }), ...(mcp !== undefined && { mcp }), ...ref },
 	};
 }
 
@@ -1760,7 +2490,7 @@ function normalizeIssue(on, run, index, path) {
 		throw configError(`${at}: issue on.action must be a non-empty array: ${path}`);
 	}
 	// Validated against THIS entry's forge, in that forge's own words -- normalizePullRequest's rule.
-	const allowed = ISSUE_ACTIONS[run.kind];
+	const allowed = forgeActions(ISSUE_ACTIONS, run.kind, at, "issue", path);
 	const expected = [...allowed].join("|");
 	for (const a of actions) {
 		if (!allowed.has(a)) {
@@ -1790,13 +2520,19 @@ function normalizeIssue(on, run, index, path) {
 	const instructions = validateInstructions(run, at, path);
 	const resume = validateResumeFlag(run, at, path);
 	const awaitInput = validateAwaitInputFlag(run, at, path);
+	const { progress, statusComment } = validateProgressFlags(run, at, path, { onType: on.type });
+	const recover = validateRecoverFlag(run, at, path, { onType: on.type });
+	const steer = validateSteerFlag(run, at, path);
 	validateRepository(run, "issue", at, path);
 	const replicas = validateReplicas(run, at, path);
 	const secrets = validateSecrets(run, at, path);
 	const secretsProfile = validateSecretsProfile(run, at, path);
+	const secretBundle = validateSecretBundleFlag(on, run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const excludeExtensions = validateExcludeExtensions(on, run, at, path);
+	const excludeExtensionTools = validateExcludeExtensionTools(on, run, at, path);
 	const mcp = validateMcp(on, run, at, path, { kind: run.kind });
 	const ref = validateRunModel(on, run, at, path);
 	return {
@@ -1808,7 +2544,7 @@ function normalizeIssue(on, run, index, path) {
 			...(number !== undefined && { number }),
 			...(once !== undefined && { once }),
 		},
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(mcp !== undefined && { mcp }), ...ref },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...validateApprovalConfig(run), ...(progress !== undefined && { progress }), ...(statusComment !== undefined && { statusComment }), ...(recover !== undefined && { recover }), ...(steer !== undefined && { steer }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(secretBundle !== undefined && { secretBundle }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(excludeExtensions !== undefined && { excludeExtensions }), ...(excludeExtensionTools !== undefined && { excludeExtensionTools }), ...(mcp !== undefined && { mcp }), ...ref },
 	};
 }
 
@@ -1821,7 +2557,7 @@ function normalizePullRequest(on, run, index, path) {
 	}
 	// Validated against THIS entry's forge, in that forge's own words. A GitHub word on a GitLab trigger
 	// (or the reverse) is refused here rather than left to never match at run time.
-	const allowed = PR_ACTIONS[run.kind];
+	const allowed = forgeActions(PR_ACTIONS, run.kind, at, "pull_request", path);
 	const expected = [...allowed].join("|");
 	for (const a of actions) {
 		if (!allowed.has(a)) {
@@ -1879,13 +2615,19 @@ function normalizePullRequest(on, run, index, path) {
 	const instructions = validateInstructions(run, at, path);
 	const resume = validateResumeFlag(run, at, path);
 	const awaitInput = validateAwaitInputFlag(run, at, path);
+	const { progress, statusComment } = validateProgressFlags(run, at, path, { onType: on.type });
+	const recover = validateRecoverFlag(run, at, path, { onType: on.type });
+	const steer = validateSteerFlag(run, at, path);
 	validateRepository(run, "pull_request", at, path);
 	const replicas = validateReplicas(run, at, path);
 	const secrets = validateSecrets(run, at, path);
 	const secretsProfile = validateSecretsProfile(run, at, path);
+	const secretBundle = validateSecretBundleFlag(on, run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const excludeExtensions = validateExcludeExtensions(on, run, at, path);
+	const excludeExtensionTools = validateExcludeExtensionTools(on, run, at, path);
 	const mcp = validateMcp(on, run, at, path, { kind: run.kind });
 	const ref = validateRunModel(on, run, at, path);
 	return {
@@ -1902,7 +2644,7 @@ function normalizePullRequest(on, run, index, path) {
 			...(number !== undefined && { number }),
 			...(once !== undefined && { once }),
 		},
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(mcp !== undefined && { mcp }), ...ref },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(awaitInput !== undefined && { awaitInput }), ...validateApprovalConfig(run), ...(progress !== undefined && { progress }), ...(statusComment !== undefined && { statusComment }), ...(recover !== undefined && { recover }), ...(steer !== undefined && { steer }), ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(secretBundle !== undefined && { secretBundle }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(excludeExtensions !== undefined && { excludeExtensions }), ...(excludeExtensionTools !== undefined && { excludeExtensionTools }), ...(mcp !== undefined && { mcp }), ...ref },
 	};
 }