@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/self_repair_cli.ts

@@ -3,9 +3,10 @@
  * Self-repair CLI — the queue reader and the single gated outward step.
  *
  *   self-repair:status                 list open records
- *   self-repair:release <fp> [--dry-run] [--repo <owner/name>]
+ *   self-repair:release <fp> --dry-run [--repo <owner/name>]
+ *   self-repair:release <fp> --approve <digest> [--repo <owner/name>]
  *
- * `release` is the ONE keystroke the loop is designed around: everything up to
+ * `release` is the ONE outward step the loop is designed around: everything up to
  * it — detection, dedup, analysis, the authored fix, the commit — happens
  * without the user. Publishing does not, because a push and a PR/issue are
  * both Hard-Floor actions under `non-destructive-by-default`, and no standing
@@ -18,15 +19,35 @@
  * authorized, failures degrade down the ladder WITHIN the same call (push/PR
  * failure or 30 s timeout → issue; issue failure → the record stays open with
  * the errors attached) — degrading never widens what leaves the machine, only
- * the vehicle. `--dry-run` prints the resolved route and the rendered body and
- * touches no network — that is the path the tests drive.
+ * the vehicle. `--dry-run` prints the resolved route, the GitHub account the
+ * send would carry, its destination and payload and their digest, and creates
+ * nothing: it reads the forge (auth status, push rights, the signed-in login)
+ * and the local repository, and writes to neither.
  *
  * Fail-closed on privacy: the record's own text goes through the audited
  * privacy floor before anything leaves the machine, and a refusal downgrades
  * the record to local-only rather than scrubbing it into publishable shape.
+ *
+ * The pull-request route never pushes the author's branch. It builds ONE commit
+ * on `origin/main` from the branch's net change, in a temporary index with no
+ * working tree, under a noreply identity and a neutral `retro/<fingerprint>`
+ * branch name, unsigned and dated in UTC. Nothing from the branch's history —
+ * its name, its commits, content added and later removed — is in that commit.
+ * The floor then walks every object the push adds to the base: the commit
+ * object, every tree and blob path, every blob's content, plus title and body.
+ * A finding skips every push rung.
+ *
+ * Nothing is sent without an approval of the exact bytes and their
+ * destination — repository, account, route, remote, base commit: the dry run
+ * prints them with their digest, and the release refuses unless
+ * `--approve <digest>` names what it is about to send and where. Only the
+ * commit date is outside the digest. A blob that is not UTF-8 text, or carries
+ * a NUL, is refused rather than scanned (`_lib/self_repair_outgoing.ts`).
  */
+import { isUtf8 } from 'node:buffer';
 import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
@@ -53,6 +74,29 @@ import {
     readOverflow,
     readRecord,
 } from './_lib/self_repair_store.js';
+import {
+    consumerDenyList,
+    describeFindings,
+    scanPayload,
+} from './_lib/self_repair_payload.js';
+import {
+    approvalRefusal,
+    type CommitIdentity,
+    commitMessage,
+    isNoreplyEmail,
+    noreplyIdentity,
+    type Destination,
+    type Outgoing,
+    type OutgoingPullRequest,
+    outgoingDigest,
+    renderOutgoing,
+    renderUpstreamBody,
+    retroBranch,
+} from './_lib/self_repair_outgoing.js';
+import { _detect_project_identifiers } from './check_portability.js';
+import { gitEnv } from './_lib/git_env.js';
+
+export { consumerDenyList };
 
 export const UPSTREAM_REPO = 'event4u-app/agent-config';
 
@@ -77,41 +121,96 @@ export interface RunResult {
     ok: boolean;
     out: string;
     timedOut: boolean;
+    /** stdout exactly as the process wrote it — set only when `binary` was asked for. */
+    bytes?: Buffer;
+}
+
+export interface RunOptions {
+    /**
+     * Keep stdout as bytes. A UTF-8 decode replaces every invalid sequence with
+     * U+FFFD, so text read that way is not the content that leaves.
+     */
+    binary?: boolean;
 }
 
-/** Injectable command runner — tests script it, production shells out. */
-export type Runner = (cmd: string, args: string[], cwd?: string) => RunResult;
+/**
+ * Injectable command runner — tests script it, production shells out. `env` is
+ * merged over the process environment, never a replacement for it.
+ */
+export type Runner = (
+    cmd: string,
+    args: string[],
+    cwd?: string,
+    env?: NodeJS.ProcessEnv,
+    opts?: RunOptions,
+) => RunResult;
 
-function run(cmd: string, args: string[], cwd?: string): RunResult {
-    const r = spawnSync(cmd, args, { cwd, encoding: 'utf-8', timeout: EGRESS_STEP_TIMEOUT_MS });
+export function runCommand(
+    cmd: string,
+    args: string[],
+    cwd?: string,
+    env?: NodeJS.ProcessEnv,
+    opts?: RunOptions,
+): RunResult {
+    const r = spawnSync(cmd, args, {
+        cwd,
+        encoding: 'buffer',
+        timeout: EGRESS_STEP_TIMEOUT_MS,
+        // An inherited GIT_DIR or GIT_INDEX_FILE (a release run from a hook)
+        // would point every git step at another repository or index.
+        env: { ...gitEnv(process.env), ...(env ?? {}) },
+    });
     // Only spawnSync's own ETIMEDOUT counts: a child killed externally by
     // SIGTERM is a failure, not a timeout, and recording it as "timed out"
     // points the next debugging session at the wrong cause (R2 finding #3).
     const timedOut = (r.error as NodeJS.ErrnoException | undefined)?.code === 'ETIMEDOUT';
+    const stdout = r.stdout ?? Buffer.alloc(0);
+    const stderr = r.stderr ?? Buffer.alloc(0);
     return {
         ok: r.status === 0 && !timedOut,
-        out: `${r.stdout ?? ''}${r.stderr ?? ''}`,
+        out: `${stdout.toString('utf-8')}${stderr.toString('utf-8')}`,
         timedOut,
+        ...(opts?.binary === true ? { bytes: Buffer.from(stdout) } : {}),
     };
 }
 
+function isPackageCheckout(dir: string): boolean {
+    return (
+        fs.existsSync(path.join(dir, 'src', 'rules')) &&
+        fs.existsSync(path.join(dir, 'src', 'scripts', 'hook_manifest.yaml'))
+    );
+}
+
+function realOrSelf(p: string): string {
+    try {
+        return fs.realpathSync(p);
+    } catch {
+        return path.resolve(p);
+    }
+}
+
 /**
- * Where the fix can be authored. `AGENT_CONFIG_SOURCE` wins; otherwise the CWD
- * when it IS the package checkout. A consumer project has neither — that is the
- * normal case, and the reason the issue fallback exists.
+ * The checkout of this package the release runs FROM, or null. A pull request
+ * is opened only from such a checkout (D5): a release run from a consumer
+ * project reaches the issue step and stops there, whatever the environment
+ * says, because the record it releases was found in that project.
+ *
+ * `AGENT_CONFIG_SOURCE` points at the checkout when the release runs inside it
+ * by a path that is not its root — a subdirectory, or a symlinked path. It is
+ * honoured only when the working directory is inside the checkout it names; set
+ * in a consumer project it widens nothing. Otherwise the working directory
+ * itself must be the package checkout.
  */
 export function findAgentConfigCheckout(env: NodeJS.ProcessEnv, cwd: string): string | null {
     const explicit = env['AGENT_CONFIG_SOURCE'];
-    if (explicit && fs.existsSync(path.join(explicit, 'src', 'rules'))) {
-        return explicit;
-    }
-    if (
-        fs.existsSync(path.join(cwd, 'src', 'rules')) &&
-        fs.existsSync(path.join(cwd, 'src', 'scripts', 'hook_manifest.yaml'))
-    ) {
-        return cwd;
+    if (explicit && isPackageCheckout(explicit)) {
+        const root = realOrSelf(explicit);
+        const here = realOrSelf(cwd);
+        if (here === root || here.startsWith(`${root}${path.sep}`)) {
+            return explicit;
+        }
     }
-    return null;
+    return isPackageCheckout(cwd) ? cwd : null;
 }
 
 /**
@@ -149,7 +248,7 @@ export function probeUpstreamRights(
 export function probeMachine(
     env: NodeJS.ProcessEnv,
     cwd: string,
-    runner: Runner = run,
+    runner: Runner = runCommand,
     repo: string = UPSTREAM_REPO,
 ): Probe {
     const checkout = findAgentConfigCheckout(env, cwd);
@@ -239,7 +338,8 @@ export function planRelease(
         blocked,
         patch_denied,
         title: titleFor(record),
-        body: renderReport(record, choice.route),
+        // Only a local-only plan keeps the free-text report: nothing leaves.
+        body: choice.route === 'local-only' ? renderReport(record, choice.route) : renderUpstreamBody(record, choice.route),
     };
 }
 
@@ -261,6 +361,191 @@ export interface ReleaseOutcome {
 export interface ReleaseDeps {
     runner: Runner;
     now: () => string;
+    /** The consumer project's identifiers; none means only the detector table applies. */
+    denyIdentifiers?: readonly string[];
+    /** The digest the person approved after reading the dry run; absent refuses. */
+    approvedDigest?: string | null;
+}
+
+/** The base the synthesised commit sits on, and what the pushed objects are compared against. */
+export const PAYLOAD_BASE_REF = 'origin/main';
+
+/** The account a send would carry: the login `gh` is authenticated as, or null. */
+export function resolveAccount(runner: Runner): string | null {
+    const who = runner('gh', ['api', 'user', '--jq', '.login']);
+    const login = who.out.trim();
+    return who.ok && login.length > 0 ? login : null;
+}
+
+/** The noreply identity of the signed-in account, or null when it cannot be resolved. */
+export function resolveIdentity(runner: Runner): CommitIdentity | null {
+    const who = runner('gh', ['api', 'user', '--jq', '"\\(.id) \\(.login)"']);
+    if (!who.ok) {
+        return null;
+    }
+    const [id, login] = who.out.trim().split(/\s+/);
+    return noreplyIdentity(login ?? '', id ?? '');
+}
+
+/** What a release would send, read without sending or building anything. */
+export interface Collected {
+    outgoing: Outgoing;
+    /** A precondition failed: nothing leaves, not even the issue. */
+    precondition: EgressAttempt | null;
+    /** The pull request cannot be built; the ladder starts at the issue. */
+    prUnavailable: EgressAttempt | null;
+    /** The base commit the pull request is built on, when it can be built. */
+    baseSha: string | null;
+}
+
+/**
+ * Read what the plan may send and where. The dry run renders this; the release
+ * recomputes it and accepts only an approval of the same bytes.
+ */
+export function collectOutgoing(
+    record: DefectRecord,
+    plan: ReleasePlan,
+    probe: Probe,
+    runner: Runner,
+    repo: string,
+): Collected {
+    const none: Collected = {
+        outgoing: { destination: null, pullRequest: null, issue: null },
+        precondition: null,
+        prUnavailable: null,
+        baseSha: null,
+    };
+    if (plan.route === 'local-only') {
+        return none;
+    }
+    // Re-rendered for the issue rung: a plan that degrades from pull-request
+    // must not file an issue whose body claims `Route: pull-request`.
+    const issue = { title: plan.title, body: plan.route === 'issue' ? plan.body : renderUpstreamBody(record, 'issue') };
+    // Where the bytes go is part of what is approved: the same text sent to
+    // another repository, from another account, is another act.
+    const account = resolveAccount(runner);
+    const issueOnly: Destination = {
+        repo,
+        account,
+        route: plan.route,
+        rungs: ['issue'],
+        remote: null,
+        baseSha: null,
+    };
+    const out: Collected = { ...none, outgoing: { destination: issueOnly, pullRequest: null, issue } };
+    if (plan.route !== 'pull-request') {
+        return out;
+    }
+    const checkout = probe.agentConfigCheckout!;
+    const author = runner('git', ['branch', '--show-current'], checkout).out.trim();
+    if (!author || author === 'main') {
+        // Precondition, not an egress failure: the authored fix exists and
+        // must ride its own branch — an issue instead would drop the fix.
+        return {
+            ...out,
+            precondition: {
+                step: 'branch-check',
+                ok: false,
+                detail:
+                    'the fix must sit on its own branch in the agent-config checkout ' +
+                    `(currently: ${author || 'detached'})`,
+            },
+        };
+    }
+    const unavailable = (step: string, detail: string): Collected => ({
+        ...out,
+        outgoing: { ...out.outgoing, destination: { ...issueOnly, route: 'issue' } },
+        prUnavailable: { step, ok: false, detail },
+    });
+    const identity = resolveIdentity(runner);
+    if (identity === null) {
+        return unavailable('identity', 'identity: no noreply identity could be resolved for the signed-in account');
+    }
+    const base = runner('git', ['rev-parse', '--verify', `${PAYLOAD_BASE_REF}^{commit}`], checkout);
+    if (!base.ok) {
+        return unavailable('patch-build', `patch-build: ${PAYLOAD_BASE_REF} cannot be resolved`);
+    }
+    // The net change since the merge base, binary-safe, never summarised by a
+    // textconv or an external driver: this is the patch that is committed.
+    const diff = runner(
+        'git',
+        ['diff', '--binary', '--no-color', '--no-ext-diff', '--no-textconv', `${PAYLOAD_BASE_REF}...${author}`],
+        checkout,
+    );
+    if (!diff.ok) {
+        return unavailable('patch-build', `patch-build: the change on ${PAYLOAD_BASE_REF}...<branch> could not be read`);
+    }
+    const rungs: Destination['rungs'] =
+        plan.pushVia === 'upstream' && probe.canFork ? ['upstream', 'fork', 'issue'] : [plan.pushVia ?? 'upstream', 'issue'];
+    let remote: string | null = null;
+    if (rungs[0] === 'upstream') {
+        const url = runner('git', ['remote', 'get-url', 'origin'], checkout);
+        if (!url.ok || url.out.trim() === '') {
+            return unavailable('destination', 'destination: the origin remote of the checkout could not be read');
+        }
+        remote = url.out.trim();
+    } else if (account !== null) {
+        remote = `https://github.com/${account}/${repo.split('/')[1] ?? repo}.git`;
+    }
+    if (account === null || remote === null) {
+        return unavailable('destination', 'destination: the account the pull request would carry could not be resolved');
+    }
+    if (diff.out.trim() === '') {
+        return {
+            ...out,
+            precondition: {
+                step: 'patch-build',
+                ok: false,
+                detail: `the branch carries no change against ${PAYLOAD_BASE_REF}; there is no fix to send`,
+            },
+        };
+    }
+    return {
+        ...out,
+        baseSha: base.out.trim(),
+        outgoing: {
+            destination: { repo, account, route: 'pull-request', rungs, remote, baseSha: base.out.trim() },
+            issue,
+            pullRequest: {
+                branch: retroBranch(record.fingerprint),
+                identity,
+                message: commitMessage(plan.title, record.fingerprint),
+                patch: diff.out,
+                title: plan.title,
+                body: plan.body,
+            },
+        },
+    };
+}
+
+/** The dry run: the account, the destination and payload, then their digest. */
+export function renderDryRun(plan: ReleasePlan, account: string | null, collected?: Collected): string {
+    let out = '';
+    if (plan.route === 'pull-request' || plan.route === 'issue') {
+        out +=
+            account !== null
+                ? `  ACCOUNT  the ${plan.route} will be opened as GitHub account '${account}'\n`
+                : `  ACCOUNT  the ${plan.route} will carry the GitHub account gh is signed in as; ` +
+                  'that account could not be resolved here\n';
+    }
+    if (collected === undefined) {
+        return `${out}\n--- ${plan.title} ---\n${plan.body}\n`;
+    }
+    if (collected.precondition !== null) {
+        return `${out}  STOP  ${collected.precondition.detail}\n`;
+    }
+    if (collected.prUnavailable !== null) {
+        out += `  NOTE  no pull request: ${collected.prUnavailable.detail}; the issue is what would be sent\n`;
+    }
+    if (collected.outgoing.pullRequest !== null) {
+        out += '  DATE   the commit is dated at the moment of release, in UTC\n';
+    }
+    out += `\n${renderOutgoing(collected.outgoing)}`;
+    if (plan.route !== 'local-only') {
+        out += `\n  DIGEST ${outgoingDigest(collected.outgoing)}\n`;
+        out += '  Send exactly these bytes: self-repair:release <fingerprint> --approve <digest>\n';
+    }
+    return out;
 }
 
 const FORK_REMOTE = 'self-repair-fork';
@@ -271,24 +556,131 @@ function failDetail(step: string, r: RunResult): string {
         : `${step}: ${r.out.trim() || 'failed'}`;
 }
 
+/** A commit date in UTC, so the local timezone offset does not leave with it. */
+function utcDate(nowIso: string): string {
+    const ms = Date.parse(nowIso);
+    return `${Math.floor((Number.isFinite(ms) ? ms : Date.now()) / 1000)} +0000`;
+}
+
+/**
+ * Build the one commit that is pushed: the approved patch on the base, in a
+ * temporary index with no working tree — so no hook, no checkout state and no
+ * file outside the patch can reach it. Unsigned, because a signature would
+ * carry the configured identity the noreply one replaces.
+ */
+function buildCleanCommit(
+    pr: OutgoingPullRequest,
+    baseSha: string,
+    checkout: string,
+    deps: ReleaseDeps,
+): { sha: string } | EgressAttempt {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'self-repair-'));
+    try {
+        const patchFile = path.join(tmp, 'change.patch');
+        const messageFile = path.join(tmp, 'message');
+        fs.writeFileSync(patchFile, pr.patch);
+        fs.writeFileSync(messageFile, pr.message);
+        const index = { GIT_INDEX_FILE: path.join(tmp, 'index') };
+        const step = (args: string[], env: NodeJS.ProcessEnv): RunResult => deps.runner('git', args, checkout, env);
+        const read = step(['read-tree', baseSha], index);
+        if (!read.ok) return { step: 'patch-build', ok: false, detail: failDetail('patch-build', read) };
+        const applied = step(['apply', '--cached', '--binary', patchFile], index);
+        if (!applied.ok) return { step: 'patch-build', ok: false, detail: failDetail('patch-build', applied) };
+        const tree = step(['write-tree'], index);
+        if (!tree.ok) return { step: 'patch-build', ok: false, detail: failDetail('patch-build', tree) };
+        const date = utcDate(deps.now());
+        const commit = step(['commit-tree', '--no-gpg-sign', tree.out.trim(), '-p', baseSha, '-F', messageFile], {
+            GIT_AUTHOR_NAME: pr.identity.name,
+            GIT_AUTHOR_EMAIL: pr.identity.email,
+            GIT_AUTHOR_DATE: date,
+            GIT_COMMITTER_NAME: pr.identity.name,
+            GIT_COMMITTER_EMAIL: pr.identity.email,
+            GIT_COMMITTER_DATE: date,
+        });
+        if (!commit.ok) return { step: 'patch-build', ok: false, detail: failDetail('patch-build', commit) };
+        return { sha: commit.out.trim() };
+    } finally {
+        fs.rmSync(tmp, { recursive: true, force: true });
+    }
+}
+
+/**
+ * Every object the push adds to the base, read from the object store: each
+ * commit raw, each tree and blob path, each blob whole. Null when any of it
+ * cannot be read — the caller refuses rather than send what nobody read.
+ */
+function readPushedObjects(
+    runner: Runner,
+    checkout: string,
+    baseSha: string,
+    sha: string,
+): { commits: string; objects: string; unscannable: number } | null {
+    const list = runner('git', ['rev-list', '--objects', `${baseSha}..${sha}`], checkout);
+    if (!list.ok) {
+        return null;
+    }
+    let commits = '';
+    let objects = '';
+    let unscannable = 0;
+    for (const line of list.out.split('\n')) {
+        const [oid, ...rest] = line.trim().split(' ');
+        if (!oid) continue;
+        const type = runner('git', ['cat-file', '-t', oid], checkout);
+        if (!type.ok) return null;
+        const kind = type.out.trim();
+        if (kind === 'commit') {
+            const body = runner('git', ['cat-file', 'commit', oid], checkout);
+            if (!body.ok) return null;
+            commits += `${body.out}\n`;
+            continue;
+        }
+        objects += `${rest.join(' ')}\n`;
+        if (kind === 'blob') {
+            const blob = runner('git', ['cat-file', 'blob', oid], checkout, undefined, { binary: true });
+            if (!blob.ok) return null;
+            const bytes = blob.bytes ?? Buffer.from(blob.out, 'utf-8');
+            // A blob that is not UTF-8 text, or carries a NUL, is not a text
+            // the detector table can read: a token spelled in UTF-16, or split
+            // by an invalid sequence, survives no text view of it. The floor
+            // cannot clear it, so it refuses rather than guesses.
+            if (bytes.includes(0) || !isUtf8(bytes)) {
+                unscannable += 1;
+            }
+            // Scanned byte for byte as well: latin1 maps each byte to one
+            // character, so nothing is replaced before the rules read it.
+            objects += `${bytes.toString('latin1')}\n`;
+        }
+    }
+    return { commits, objects, unscannable };
+}
+
+const IDENTITY_LINE_RE = /^(?:author|committer) .* <([^>]*)> \d+ [+-]\d{4}$/gm;
+
+/** Every e-mail a commit object records — what the push would show next to the change. */
+function committedEmails(commits: string): string[] {
+    return [...commits.matchAll(IDENTITY_LINE_RE)].map((m) => m[1] ?? '');
+}
+
 /**
- * Push the fix branch — directly, or via fork → cross-repo PR — then open the
- * PR. Returns null on success; on any step failure or timeout returns the
- * failed attempt so the caller degrades down the ladder.
+ * Push the synthesised commit — directly, or via fork → cross-repo PR — then
+ * open the PR. Returns null on success; on any step failure or timeout returns
+ * the failed attempt so the caller degrades down the ladder.
  */
 function tryPullRequest(
-    plan: ReleasePlan,
+    pr: OutgoingPullRequest,
+    sha: string,
     probe: Probe,
     repo: string,
-    branch: string,
     via: PushVia,
     deps: ReleaseDeps,
+    approvedAccount: string | null,
 ): EgressAttempt | null {
     const checkout = probe.agentConfigCheckout!;
-    let prHead: string | null = null;
+    const refspec = `${sha}:refs/heads/${pr.branch}`;
+    let prHead = pr.branch;
 
     if (via === 'upstream') {
-        const pushed = deps.runner('git', ['push', '-u', 'origin', branch], checkout);
+        const pushed = deps.runner('git', ['push', 'origin', refspec], checkout);
         if (!pushed.ok) {
             return { step: 'push-upstream', ok: false, detail: failDetail('push-upstream', pushed) };
         }
@@ -302,34 +694,53 @@ function tryPullRequest(
             return { step: 'whoami', ok: false, detail: failDetail('whoami', who) };
         }
         const login = who.out.trim();
+        if (login !== approvedAccount) {
+            return { step: 'whoami', ok: false, detail: 'whoami: the signed-in account changed after the approval — nothing was pushed' };
+        }
         const repoName = repo.split('/')[1] ?? repo;
+        const forkUrl = `https://github.com/${login}/${repoName}.git`;
+        // A remote of that name already in the checkout's config is reused only
+        // when it points at the approved fork; anything else is repointed first.
         const hasRemote = deps.runner('git', ['remote', 'get-url', FORK_REMOTE], checkout);
-        if (!hasRemote.ok) {
-            const added = deps.runner(
-                'git',
-                ['remote', 'add', FORK_REMOTE, `https://github.com/${login}/${repoName}.git`],
-                checkout,
-            );
+        if (!hasRemote.ok || hasRemote.out.trim() !== forkUrl) {
+            const added = deps.runner('git', ['remote', hasRemote.ok ? 'set-url' : 'add', FORK_REMOTE, forkUrl], checkout);
             if (!added.ok) {
                 return { step: 'fork-remote', ok: false, detail: failDetail('fork-remote', added) };
             }
         }
-        const pushed = deps.runner('git', ['push', '-u', FORK_REMOTE, branch], checkout);
+        const pushed = deps.runner('git', ['push', FORK_REMOTE, refspec], checkout);
         if (!pushed.ok) {
             return { step: 'push-fork', ok: false, detail: failDetail('push-fork', pushed) };
         }
-        prHead = `${login}:${branch}`;
+        prHead = `${login}:${pr.branch}`;
     }
 
-    const prArgs = ['pr', 'create', '--repo', repo, '--title', plan.title, '--body', plan.body];
-    if (prHead !== null) {
-        prArgs.push('--head', prHead);
-    }
-    const pr = deps.runner('gh', prArgs, checkout);
-    if (!pr.ok) {
-        return { step: 'pr-create', ok: false, detail: failDetail('pr-create', pr) };
+    // `--draft` on every rung, never only on the fork one. A draft is the
+    // weaker of the two states a pull request can arrive in: it asks for no
+    // review, notifies no code owner, and runs no required check until someone
+    // marks it ready. An upstream finding is a proposal from a machine the
+    // maintainer has not met, so the maintainer decides when it becomes a
+    // request. Opening ready-for-review is the stronger act and nothing here
+    // has the standing to take it. `--head` is always named: the pushed
+    // branch is not the one checked out.
+    const prArgs = [
+        'pr',
+        'create',
+        '--repo',
+        repo,
+        '--draft',
+        '--title',
+        pr.title,
+        '--body',
+        pr.body,
+        '--head',
+        prHead,
+    ];
+    const created = deps.runner('gh', prArgs, checkout);
+    if (!created.ok) {
+        return { step: 'pr-create', ok: false, detail: failDetail('pr-create', created) };
     }
-    process.stdout.write(`${pr.out}`);
+    process.stdout.write(`${created.out}`);
     return null;
 }
 
@@ -348,28 +759,45 @@ export function executeRelease(
     deps: ReleaseDeps,
 ): ReleaseOutcome {
     const attempts: EgressAttempt[] = [];
+    if (plan.route === 'local-only') {
+        return { published: null, attempts };
+    }
+    const collected = collectOutgoing(record, plan, probe, deps.runner, repo);
+    if (collected.precondition !== null) {
+        attempts.push(collected.precondition);
+        return { published: null, attempts };
+    }
+    const refusal = approvalRefusal(record, collected.outgoing, deps.approvedDigest);
+    if (refusal !== null) {
+        attempts.push({ step: 'approval', ok: false, detail: `approval: ${refusal} — nothing was sent` });
+        return { published: null, attempts };
+    }
+    const deny = deps.denyIdentifiers ?? [];
+    const pr = collected.outgoing.pullRequest;
 
     if (plan.route === 'pull-request') {
-        const checkout = probe.agentConfigCheckout!;
-        const branch = deps.runner('git', ['branch', '--show-current'], checkout).out.trim();
-        if (!branch || branch === 'main') {
-            // Precondition, not an egress failure: the authored fix exists and
-            // must ride its own branch — an issue instead would drop the fix.
-            attempts.push({
-                step: 'branch-check',
-                ok: false,
-                detail:
-                    'the fix must sit on its own branch in the agent-config checkout ' +
-                    `(currently: ${branch || 'detached'})`,
-            });
+        // Title and body are scanned before and independently of anything
+        // built from the branch, so a build failure cannot skip them. A finding
+        // there would leave through the issue too — its title is the same and
+        // its body is rendered from the same record.
+        const headFindings = scanPayload(
+            { branch: pr?.branch ?? '', commits: '', objects: '', title: plan.title, body: plan.body },
+            deny,
+        );
+        if (headFindings.some((f) => f.part === 'title' || f.part === 'body')) {
+            attempts.push({ step: 'payload-scan', ok: false, detail: describeFindings(headFindings) });
             return { published: null, attempts };
         }
+        if (collected.prUnavailable !== null) {
+            attempts.push(collected.prUnavailable);
+        }
+        const sha = pr !== null && collected.baseSha !== null ? cleanCommit(pr, collected.baseSha, probe, deps, deny, attempts) : null;
+        // Any refusal skips every push rung and degrades to the issue, which
+        // carries none of the refused branch, commit or object bytes.
         const ladder: PushVia[] =
-            plan.pushVia === 'upstream' && probe.canFork
-                ? ['upstream', 'fork']
-                : [plan.pushVia ?? 'upstream'];
+            sha === null ? [] : plan.pushVia === 'upstream' && probe.canFork ? ['upstream', 'fork'] : [plan.pushVia ?? 'upstream'];
         for (const via of ladder) {
-            const failed = tryPullRequest(plan, probe, repo, branch, via, deps);
+            const failed = tryPullRequest(pr!, sha!, probe, repo, via, deps, collected.outgoing.destination?.account ?? null);
             if (failed === null) {
                 return { published: 'pull-request', attempts };
             }
@@ -377,32 +805,71 @@ export function executeRelease(
         }
     }
 
-    if (plan.route === 'pull-request' || plan.route === 'issue') {
-        // Re-render for the rung actually taken: a plan that degraded from
-        // pull-request must not file an issue whose body claims
-        // `Route: pull-request` (R2 finding #4).
-        const issueBody =
-            plan.route === 'issue' ? plan.body : renderReport(record, 'issue');
-        const issue = deps.runner('gh', [
-            'issue',
-            'create',
-            '--repo',
-            repo,
-            '--title',
-            plan.title,
-            '--body',
-            issueBody,
-        ]);
-        if (issue.ok) {
-            process.stdout.write(`${issue.out}`);
-            return { published: 'issue', attempts };
-        }
-        attempts.push({ step: 'issue-create', ok: false, detail: failDetail('issue-create', issue) });
+    const issue = collected.outgoing.issue!;
+    // Scanned on every route that reaches here: the degraded body is re-rendered,
+    // and an issue-only plan never passed the pull-request scan above.
+    const bodyFindings = scanPayload({ branch: '', commits: '', objects: '', title: issue.title, body: issue.body }, deny);
+    if (bodyFindings.length > 0) {
+        attempts.push({ step: 'payload-scan', ok: false, detail: describeFindings(bodyFindings) });
+        return { published: null, attempts };
     }
-
+    const created = deps.runner('gh', ['issue', 'create', '--repo', repo, '--title', issue.title, '--body', issue.body]);
+    if (created.ok) {
+        process.stdout.write(`${created.out}`);
+        return { published: 'issue', attempts };
+    }
+    attempts.push({ step: 'issue-create', ok: false, detail: failDetail('issue-create', created) });
     return { published: null, attempts };
 }
 
+/**
+ * Build the commit and scan every object it adds. Returns the sha only when
+ * the floor found nothing and the commit carries the noreply identity alone;
+ * otherwise records why and returns null.
+ */
+function cleanCommit(
+    pr: OutgoingPullRequest,
+    baseSha: string,
+    probe: Probe,
+    deps: ReleaseDeps,
+    deny: readonly string[],
+    attempts: EgressAttempt[],
+): string | null {
+    const checkout = probe.agentConfigCheckout!;
+    const built = buildCleanCommit(pr, baseSha, checkout, deps);
+    if (!('sha' in built)) {
+        attempts.push(built);
+        return null;
+    }
+    const pushed = readPushedObjects(deps.runner, checkout, baseSha, built.sha);
+    if (pushed === null) {
+        attempts.push({
+            step: 'payload-scan',
+            ok: false,
+            detail: 'payload floor refused the pull request: the objects the push adds could not be read',
+        });
+        return null;
+    }
+    const findings = scanPayload({ commits: pushed.commits, objects: pushed.objects, branch: pr.branch, title: '', body: '' }, deny);
+    if (pushed.unscannable > 0) {
+        findings.push({ part: 'object', rule: 'unscannable-binary' });
+    }
+    if (findings.length > 0) {
+        attempts.push({ step: 'payload-scan', ok: false, detail: describeFindings(findings) });
+        return null;
+    }
+    const emails = committedEmails(pushed.commits);
+    if (emails.length === 0 || emails.some((e) => e !== pr.identity.email || !isNoreplyEmail(e))) {
+        attempts.push({
+            step: 'identity',
+            ok: false,
+            detail: 'identity: the built commit records an identity other than the noreply one — nothing was pushed',
+        });
+        return null;
+    }
+    return built.sha;
+}
+
 /**
  * The creation cap's drop tally, printed whenever it is non-zero. This is the
  * half that keeps the cap honest: a bounded store is only an improvement if
@@ -446,7 +913,9 @@ function statusCmd(root: string): number {
 }
 
 function releaseCmd(root: string, argv: string[]): number {
-    const fp = argv.find((a) => !a.startsWith('-'));
+    // A flag's value is not the fingerprint: `--approve <digest>` and
+    // `--repo <owner/name>` both take one.
+    const fp = argv.find((a, i) => !a.startsWith('-') && argv[i - 1] !== '--approve' && argv[i - 1] !== '--repo');
     if (!fp) {
         process.stderr.write('self-repair:release needs a fingerprint (see self-repair:status).\n');
         return EXIT_FAIL;
@@ -473,7 +942,8 @@ function releaseCmd(root: string, argv: string[]): number {
         process.stdout.write(`  DENY  ${plan.patch_denied}\n`);
     }
     if (dryRun) {
-        process.stdout.write(`\n--- ${plan.title} ---\n${plan.body}\n`);
+        const account = plan.route === 'local-only' ? null : resolveAccount(runCommand);
+        process.stdout.write(renderDryRun(plan, account, collectOutgoing(record, plan, probe, runCommand, repo)));
         return EXIT_OK;
     }
     if (plan.route === 'local-only') {
@@ -483,7 +953,13 @@ function releaseCmd(root: string, argv: string[]): number {
         return EXIT_OK;
     }
 
-    const deps: ReleaseDeps = { runner: run, now: () => new Date().toISOString() };
+    const approveArg = argv.indexOf('--approve');
+    const deps: ReleaseDeps = {
+        runner: runCommand,
+        now: () => new Date().toISOString(),
+        denyIdentifiers: consumerDenyList(_detect_project_identifiers(root), repo),
+        approvedDigest: approveArg >= 0 ? (argv[approveArg + 1] ?? null) : null,
+    };
     const outcome = executeRelease(record, plan, probe, repo, deps);
 
     for (const a of outcome.attempts) {