@juangcarmona/lighthouse-sdlc 0.17.1 → 0.18.0

package/src/worker-recovery.mjs

@@ -1,5 +1,6 @@
-import { digest } from './host-contract.mjs';
-import { issueComments, readDispatchReceipt, loadDispatch, workerFor, stagePath, recordDispatch } from './stage-dispatch.mjs';
+import { digest, validateStageEnvelope } from './host-contract.mjs';
+import { issueComments, readDispatchReceipt, loadDispatch, workerFor, stagePath, recordDispatch, claimDispatch, checkDispatchClaim, finishDispatch } from './stage-dispatch.mjs';
+import { publishObservedStop, handoff, pendingQuestion, resultHandoffState, visibleNextAction, productApplyObservation } from './handoff.mjs';
 import { readActionsJson } from './actions-artifact.mjs';
 
 export const maintenancePath = '.github/workflows/lighthouse-worker-maintenance.yml';
@@ -21,6 +22,7 @@ export function recoveryDecision({ request, receipt, run, jobs, issue, comments,
   if (run.run_attempt !== 1) return result('uncertain', 'execution-rerun', 'Inspect all attempts; a rerun does not reclaim the original request.');
   if (String(receipt.workerRunId) !== String(run.id)) return result('uncertain', 'dispatch-unconfirmed', 'Reconcile the request with the observed execution.');
   if (receipt.status === 'waiting') return result('waiting-human', 'human-decision', 'Answer the recorded question; no automatic retry.');
+  if (receipt.status === 'blocked') return result('blocked', 'stage-blocked', 'Resolve the recorded blocker before requesting an authorized continuation.');
   if (receipt.status === 'completed' && run.conclusion === 'success') return result('succeeded', 'worker-completed', 'No recovery needed.');
   if (issue.state !== 'open' || issue.user?.login !== owner || issue.pull_request || issue.labels.some(l => ['future', 'needs-info', 'waiting-review', 'human-working', 'agent-working'].includes(l.name))) return result('blocked', 'issue-paused', 'Inspect the issue decision or reservation before requesting work.');
   if (request.sourceRevision !== revision || request.workflowRevision !== workflowRevision || request.taskDigest !== intent(issue, comments, owner)) return result('blocked', 'authority-changed', 'Request fresh work against the current source and owner intent.');
@@ -55,11 +57,192 @@ export async function observeDispatch(api, repository, owner, comment, issue, co
   const run = await api(`actions/runs/${receipt.workerRunId}`);
   const dispatch = await loadDispatch(api, repository, owner, issue.number, comment.id, run, readArtifact);
   const jobs = await api(`actions/runs/${run.id}/attempts/${run.run_attempt}/jobs?per_page=100`);
-  if (jobs.total_count > 100) throw Error('Execution job inventory exceeds recovery bounds');
+  if (!Array.isArray(jobs.jobs) || !Number.isSafeInteger(jobs.total_count) || jobs.total_count !== jobs.jobs.length || jobs.total_count > 100) throw Error('Execution job inventory is incomplete or exceeds recovery bounds');
   const repo = await api('');
   const revision = (await api(`commits/${encodeURIComponent(repo.default_branch)}`)).sha;
   const workflowRevision = (await api(`commits/${encodeURIComponent(dispatch.request.ref)}`)).sha;
-  return { ...recoveryDecision({ ...dispatch, run, jobs: jobs.jobs, issue, comments, owner, revision, workflowRevision, now }), dispatch };
+  const agent = jobs.jobs.find(job => job.name === 'agent');
+  const publishJob = jobs.jobs.find(job => job.name === 'Validate, publish and release');
+  const publish = publishJob?.steps?.find(step => step.name === 'Recheck authority and publish the validated result');
+  const prepare = jobs.jobs.find(job => job.name === 'Authorize and reserve issue');
+  const unpublished = publish?.conclusion === 'skipped' || publishJob?.conclusion === 'skipped';
+  const notStarted = !agent || agent.conclusion === 'skipped';
+  const activationFailed = jobs.jobs.some(job => ['pre_activation', 'activation'].includes(job.name) && ['failure', 'timed_out'].includes(job.conclusion));
+  const observation = ['completed', 'waiting', 'blocked'].includes(receipt.status) ? null
+    : workerFor(dispatch.request) === 'apply-product-change' ? productApplyObservation({ prepare: jobs.jobs.find(job => job.name === 'Recheck product approval')?.conclusion, apply: jobs.jobs.find(job => job.name === 'Apply with the pinned ProductShape provider')?.conclusion, publish: jobs.jobs.find(job => job.name === 'Recheck and publish provider output')?.conclusion })
+    : agent?.conclusion === 'success' && ['failure', 'timed_out', 'cancelled'].includes(publish?.conclusion) ? 'publication-unknown'
+    : ['failure', 'timed_out'].includes(prepare?.conclusion) && notStarted ? 'preparation-failure'
+    : prepare?.conclusion === 'success' && activationFailed && notStarted && unpublished ? 'activation-failure'
+    : unpublished && ['failure', 'timed_out'].includes(agent?.conclusion) ? 'failure'
+    : unpublished && agent?.conclusion === 'cancelled' ? 'cancelled'
+    : run.conclusion === 'cancelled' && notStarted && (unpublished || !publishJob) ? 'pre-agent-cancelled' : null;
+  const event = dispatch.request.event;
+  const answered = dispatch.request.eventName === 'issue_comment' && event?.action === 'created' && event.issue?.number === issue.number && !event.issue.pull_request && event.comment?.user?.login === owner && event.comment.user.type === 'User' && typeof event.comment.body === 'string' && !!event.comment.body.trim() && !dispatch.request.feedbackKey;
+  const stop = run.status === 'completed' && observation ? { run: String(run.id), attempt: String(run.run_attempt), observation, answerRetained: answered } : null;
+  return { ...recoveryDecision({ ...dispatch, run, jobs: jobs.jobs, issue, comments, owner, revision, workflowRevision, now }), dispatch, stop, run, jobs: jobs.jobs, revision, workflowRevision };
+}
+
+// Reporting is read-only so it can observe an active worker without acquiring its lease.
+export async function observeRecovery(api, repository, owner, issueNumber, now = Date.now(), readArtifact = readActionsJson) {
+  const issue = await api(`issues/${issueNumber}`), comments = await issueComments(api, issueNumber);
+  const entries = comments.filter(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body?.includes('<!-- lighthouse-dispatch:')).map(comment => ({ comment, receipt: readDispatchReceipt(comment, repository, issueNumber) }));
+  const unattended = comments.filter(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body?.includes('<!-- lighthouse-unattended:')).at(-1);
+  if (unattended && (!entries.length || unattended.id > entries.at(-1).comment.id)) return [];
+  const latest = new Map();
+  for (const entry of entries) latest.set(entry.receipt.recovery?.rootId ?? entry.receipt.id, entry);
+  const observations = [];
+  for (const { comment } of latest.values()) {
+    const { dispatch, stop, run, jobs, revision, workflowRevision, ...observation } = await observeDispatch(api, repository, owner, comment, issue, comments, now, readArtifact);
+    if (observation.state === 'stalled' || observation.code === 'dispatch-unconfirmed') observations.push(observation);
+  }
+  return observations;
+}
+
+async function reservationEvent(api, issue) {
+  let latest;
+  for (let page = 1; page <= 10; page++) {
+    const events = await api(`issues/${issue}/events?per_page=100&page=${page}`);
+    if (!Array.isArray(events)) throw Error('Issue event inventory unavailable');
+    for (const event of events) if (['labeled', 'unlabeled'].includes(event.event) && event.label?.name === 'agent-working') latest = event;
+    if (events.length < 100) return latest;
+  }
+  throw Error('Issue event history exceeds recovery bounds');
+}
+
+// Release only a retained reservation from a completed, unpublished read-only worker.
+export async function reconcileAbandonedReservation(api, repository, owner, issue, comments, observation, readArtifact = readActionsJson) {
+  const { dispatch, run, jobs, revision, workflowRevision } = observation;
+  if (!dispatch || !run || !['triage', 'refine'].includes(dispatch.request.stage) || workerFor(dispatch.request) !== dispatch.request.stage || run.status !== 'completed' || run.run_attempt !== 1 || !['failure', 'cancelled', 'timed_out'].includes(run.conclusion)) return false;
+  if (issue.state !== 'open' || issue.pull_request || issue.user?.login !== owner || !issue.labels.some(l => l.name === 'agent-working') || issue.labels.some(l => ['human-working', 'future'].includes(l.name)) || dispatch.request.sourceRevision !== revision || dispatch.request.workflowRevision !== workflowRevision || dispatch.request.taskDigest !== intent(issue, comments, owner)) return false;
+  if (comments.some(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body?.includes(`<!-- lighthouse-stop:${run.id}:${run.run_attempt} -->`))) return false;
+  const prepare = jobs.find(job => job.name === 'Authorize and reserve issue');
+  const agent = jobs.find(job => job.name === 'agent');
+  const publish = jobs.find(job => job.name === 'Validate, publish and release');
+  const step = publish?.steps?.find(item => item.name === 'Recheck authority and publish the validated result');
+  if (prepare?.conclusion !== 'success' || !['failure', 'timed_out', 'cancelled', 'skipped'].includes(agent?.conclusion) || !(publish?.conclusion === 'skipped' || step?.conclusion === 'skipped')) return false;
+  let snapshot;
+  try { snapshot = await readArtifact(api, repository, run.id, `lighthouse-input-${issue.number}-${run.run_attempt}`, 'request.json'); } catch { return false; }
+  if (snapshot?.runId !== digest(`${repository}:${issue.number}:${dispatch.request.stage}:${run.id}:${run.run_attempt}`) || snapshot.issue !== issue.number || snapshot.stage !== dispatch.request.stage || String(snapshot.workflowRunId) !== String(run.id) || snapshot.sourceRevision !== revision || snapshot.workflowRevision !== workflowRevision || snapshot.taskDigest !== dispatch.request.taskDigest || snapshot.dispatch?.commentId !== dispatch.commentId || snapshot.dispatch?.requestId !== dispatch.request.id || snapshot.dispatch?.digest !== dispatch.receipt.digest) return false;
+  const event = await reservationEvent(api, issue.number);
+  const start = Date.parse(run.run_started_at), end = Date.parse(run.updated_at), at = Date.parse(event?.created_at);
+  if (!Number.isSafeInteger(event?.id) || event.id < 1 || !Number.isFinite(start) || !Number.isFinite(end) || !Number.isFinite(at) || at < start || at > end || event.event !== 'labeled' || event.actor?.login !== 'github-actions[bot]' || event.actor.type !== 'Bot') return false;
+  const claim = { commentId: dispatch.commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest };
+  await checkDispatchClaim(api, repository, issue.number, claim, run.id);
+  const fresh = await api(`issues/${issue.number}`), current = await issueComments(api, issue.number), repo = await api('');
+  if (fresh.state !== 'open' || fresh.pull_request || fresh.user?.login !== owner || !fresh.labels.some(l => l.name === 'agent-working') || fresh.labels.some(l => ['human-working', 'future'].includes(l.name)) || intent(fresh, current, owner) !== dispatch.request.taskDigest || (await api(`commits/${encodeURIComponent(repo.default_branch)}`)).sha !== revision || (await api(`commits/${encodeURIComponent(dispatch.request.ref)}`)).sha !== workflowRevision) return false;
+  if (current.some(c => Number(c.id) > Number(dispatch.commentId) && c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body?.includes('<!-- lighthouse-dispatch:'))) return false;
+  if (current.some(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body?.includes(`<!-- lighthouse-stop:${run.id}:${run.run_attempt} -->`))) return false;
+  if ((await reservationEvent(api, issue.number))?.id !== event.id) return false;
+  await checkDispatchClaim(api, repository, issue.number, claim, run.id);
+  await api(`issues/${issue.number}/labels/agent-working`, 'DELETE');
+  issue.labels = fresh.labels.filter(l => l.name !== 'agent-working');
+  return true;
+}
+
+// A uniquely authenticated preparation failure can be recorded as failed only
+// when the agent and publisher were skipped. It never authorizes a new dispatch.
+export async function reconcilePreparationFailure(api, repository, owner, issueNumber, commentId, runId, readArtifact = readActionsJson) {
+  const run = await api(`actions/runs/${runId}`);
+  if (run.status !== 'completed' || !['failure', 'timed_out'].includes(run.conclusion) || run.run_attempt !== 1) return false;
+  const dispatch = await loadDispatch(api, repository, owner, issueNumber, commentId, run, readArtifact);
+  if (dispatch.receipt.workerRunId && String(dispatch.receipt.workerRunId) !== String(run.id) || !['requested', 'running', 'unknown', 'failed'].includes(dispatch.receipt.status) || dispatch.request.worker || !['triage', 'refine'].includes(dispatch.request.stage)) return false;
+  const inventory = await api(`actions/runs/${run.id}/attempts/${run.run_attempt}/jobs?per_page=100`);
+  if (!Array.isArray(inventory.jobs) || inventory.total_count !== inventory.jobs.length || inventory.total_count > 100) return false;
+  const prepare = inventory.jobs.find(job => job.name === 'Authorize and reserve issue');
+  const agent = inventory.jobs.find(job => job.name === 'agent');
+  const publish = inventory.jobs.find(job => job.name === 'Validate, publish and release');
+  if (!['failure', 'timed_out'].includes(prepare?.conclusion) || agent?.conclusion !== 'skipped' || publish?.conclusion !== 'skipped') return false;
+  const issue = await api(`issues/${issueNumber}`), comments = await issueComments(api, issueNumber), repo = await api('');
+  const revision = (await api(`commits/${encodeURIComponent(repo.default_branch)}`)).sha;
+  const workflowRevision = (await api(`commits/${encodeURIComponent(dispatch.request.ref)}`)).sha;
+  if (issue.state !== 'open' || issue.pull_request || issue.user?.login !== owner || issue.labels.some(label => ['agent-working', 'human-working', 'future', 'needs-info', 'waiting-review'].includes(label.name)) || dispatch.request.sourceRevision !== revision || dispatch.request.workflowRevision !== workflowRevision || intent(issue, comments, owner) !== dispatch.request.taskDigest || comments.some(comment => Number(comment.id) > Number(commentId) && comment.user?.login === 'github-actions[bot]' && comment.user.type === 'Bot' && comment.body?.includes('<!-- lighthouse-dispatch:'))) return false;
+  if (!dispatch.receipt.workerRunId && !await claimDispatch(api, repository, dispatch, run.id)) return false;
+  await finishDispatch(api, repository, issueNumber, commentId, run.id, 'failed');
+  await publishObservedStop(api, { repository, issue: issueNumber, stage: dispatch.request.stage, run: String(run.id), attempt: String(run.run_attempt), sourceRevision: dispatch.request.sourceRevision, dispatch: { commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest }, observation: 'preparation-failure' });
+  return true;
+}
+
+// Restore only a completed, read-only stage whose authority and label still match.
+export async function reconcilePublishedStage(api, repository, owner, issue, comments, observation, readArtifact = readActionsJson) {
+  const { dispatch, run, jobs = [], revision, workflowRevision } = observation;
+  if (!dispatch || !run) return 'not-applicable';
+  const publication = jobs.find(j => j.name === 'Validate, publish and release');
+  const publish = publication?.steps?.find(s => s.name === 'Recheck authority and publish the validated result');
+  const failedPublication = run.conclusion === 'failure' && jobs.find(j => j.name === 'agent')?.conclusion === 'success' && publish?.conclusion === 'failure';
+  const interrupted = failedPublication && ['running', 'unknown'].includes(dispatch.receipt.status);
+  const completed = (run.conclusion === 'success' || failedPublication) && ['completed', 'waiting', 'blocked'].includes(dispatch.receipt.status);
+  if (run.status !== 'completed' || (!completed && !interrupted) || run.run_attempt !== 1 || !['triage', 'refine'].includes(dispatch.request.stage) || dispatch.request.worker) return 'not-applicable';
+  const id = digest(`${repository}:${issue.number}:${dispatch.request.stage}:${run.id}:${run.run_attempt}`);
+  const marker = `<!-- lighthouse-actions:${id} -->`;
+  if (!interrupted && comments.some(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body?.includes(marker))) return 'present';
+  const incompatibleStage = l => ['triage', 'refine', 'propose', 'implement'].includes(l.name) && (!interrupted || l.name !== dispatch.request.stage);
+  if (issue.state !== 'open' || issue.pull_request || issue.user?.login !== owner || issue.labels.some(l => ['agent-working', 'human-working'].includes(l.name) || incompatibleStage(l)) || dispatch.request.sourceRevision !== revision || dispatch.request.workflowRevision !== workflowRevision || dispatch.request.taskDigest !== intent(issue, comments, owner)) return 'uncertain';
+  let snapshot, envelope;
+  try {
+    snapshot = await readArtifact(api, repository, run.id, `lighthouse-input-${issue.number}-${run.run_attempt}`, 'request.json');
+    envelope = await readArtifact(api, repository, run.id, `lighthouse-result-${issue.number}-${run.run_attempt}`, 'envelope.json');
+  } catch { return 'uncertain'; }
+  if (snapshot?.runId !== id || snapshot.issue !== issue.number || snapshot.stage !== dispatch.request.stage || String(snapshot.workflowRunId) !== String(run.id) || snapshot.sourceRevision !== revision || snapshot.workflowRevision !== workflowRevision || snapshot.taskDigest !== dispatch.request.taskDigest || snapshot.autoImplement !== (dispatch.request.autoImplement === true) || snapshot.dispatch?.requestId !== dispatch.request.id || snapshot.dispatch?.digest !== dispatch.receipt.digest || snapshot.dispatch?.commentId !== dispatch.commentId || validateStageEnvelope(envelope, snapshot).length) return 'uncertain';
+  const result = envelope.result;
+  if (!['passed', 'blocked'].includes(result.status)) return 'uncertain';
+  const question = result.status === 'blocked' ? pendingQuestion(result.output?.handoff?.question) : null;
+  const expectedStatus = result.status === 'passed' ? 'completed' : question ? 'waiting' : 'blocked';
+  if (!interrupted && dispatch.receipt.status !== expectedStatus) return 'uncertain';
+  const projection = resultHandoffState({ status: result.status, stage: snapshot.stage, question });
+  if (!projection.label || (!issue.labels.some(l => l.name === projection.label) && !(interrupted && issue.labels.some(l => l.name === snapshot.stage))) || issue.labels.some(l => ['ready', 'triaged', 'needs-info', 'waiting-review', 'execution-failed', 'pr-draft', 'pr-ready'].includes(l.name) && l.name !== projection.label)) return 'uncertain';
+  let action = question ? `Owner: ${question} Reply here.` : 'None.';
+  let next = question ? `The answer will be checked against this question before ${snapshot.stage} continues.` : 'Any continuation follows the configured authorization.';
+  if (snapshot.stage === 'refine' && result.status === 'passed') {
+    const paused = issue.labels.some(l => l.name === 'future');
+    action = !snapshot.autoImplement ? 'Owner: review the refinement and request the next authorized stage through the configured workflow.' : paused ? 'Owner: remove the future label when implementation may resume.' : 'None.';
+    next = !snapshot.autoImplement ? 'No automatic continuation is configured for this refinement.' : paused ? 'The workflow will recheck the authorized implementation request.' : 'The workflow will request implementation under the configured continuation policy; the owner can pause it with the future label.';
+  } else if (result.status === 'blocked' && !question) action = visibleNextAction(result.nextAction);
+  if (interrupted && snapshot.autoImplement && result.status === 'passed') { action = 'Owner: inspect the restored result and request the next authorized stage.'; next = 'The interrupted execution did not confirm an automatic continuation.'; }
+  const body = handoff({ status: projection.status, stage: snapshot.stage, happened: `A previous handoff was restored from retained execution evidence.\n\n${envelope.effect.body}`, action, next, details: `Outcome: ${result.status}\n\n[Workflow run](https://github.com/${repository}/actions/runs/${run.id}) · source \`${snapshot.sourceRevision}\`\n\n${marker}\n<!-- lighthouse-handoff:v1 -->\n<!-- lighthouse-stage:${snapshot.stage}:${result.status} -->${question ? '\n<!-- lighthouse-question -->' : ''}` });
+  await checkDispatchClaim(api, repository, issue.number, { commentId: dispatch.commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest }, run.id);
+  const fresh = await api(`issues/${issue.number}`), freshComments = await issueComments(api, issue.number);
+  const currentRepo = await api(''), currentRevision = (await api(`commits/${encodeURIComponent(currentRepo.default_branch)}`)).sha;
+  if (currentRevision !== revision || (await api(`commits/${encodeURIComponent(dispatch.request.ref)}`)).sha !== workflowRevision || fresh.state !== 'open' || fresh.user?.login !== owner || fresh.pull_request || fresh.labels.some(l => ['agent-working', 'human-working'].includes(l.name) || incompatibleStage(l)) || (!fresh.labels.some(l => l.name === projection.label) && !(interrupted && fresh.labels.some(l => l.name === snapshot.stage))) || fresh.labels.some(l => ['ready', 'triaged', 'needs-info', 'waiting-review', 'execution-failed', 'pr-draft', 'pr-ready'].includes(l.name) && l.name !== projection.label) || intent(fresh, freshComments, owner) !== dispatch.request.taskDigest) return 'uncertain';
+  if (freshComments.some(c => c.user?.login === 'github-actions[bot]' && Number(c.id) > Number(dispatch.commentId) && c.body?.includes('<!-- lighthouse-dispatch:'))) return 'uncertain';
+  if (interrupted && fresh.labels.some(l => l.name === snapshot.stage)) {
+    if (!fresh.labels.some(l => l.name === projection.label)) {
+      await checkDispatchClaim(api, repository, issue.number, { commentId: dispatch.commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest }, run.id);
+      await api(`issues/${issue.number}/labels`, 'POST', { labels: [projection.label] });
+    }
+    await checkDispatchClaim(api, repository, issue.number, { commentId: dispatch.commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest }, run.id);
+    await api(`issues/${issue.number}/labels/${snapshot.stage}`, 'DELETE');
+  }
+  if (freshComments.some(c => c.user?.login === 'github-actions[bot]' && c.body?.includes(marker))) {
+    if (interrupted) await finishDispatch(api, repository, issue.number, dispatch.commentId, run.id, question ? 'question' : result.status);
+    return 'present';
+  }
+  await checkDispatchClaim(api, repository, issue.number, { commentId: dispatch.commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest }, run.id);
+  await api(`issues/${issue.number}/comments`, 'POST', { body });
+  if (interrupted) await finishDispatch(api, repository, issue.number, dispatch.commentId, run.id, question ? 'question' : result.status);
+  return 'restored';
+}
+
+// Restore an uncertain handoff only for the latest authenticated unattended attempt.
+export async function reconcileUnattendedStop(api, repository, owner, issue, comments) {
+  if (issue.state !== 'open' || issue.pull_request || issue.user?.login !== owner) return 'not-applicable';
+  const relevant = comments.filter(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && /<!-- lighthouse-(?:unattended:|unattended-recovery:|dispatch:|actions:|stop:)/.test(c.body ?? ''));
+  const last = relevant.at(-1);
+  const heading = last?.body?.match(/^(?:## )?(?:Working|Requested|Queued) · (ff|hotfix)\b/);
+  const runMatch = last?.body?.match(/\[Execution\]\(https:\/\/github\.com\/[^/]+\/[^/]+\/actions\/runs\/([1-9][0-9]*)\)/);
+  if (!heading || !runMatch || !last.body.includes(`https://github.com/${repository}/actions/runs/${runMatch[1]}`)) return 'not-applicable';
+  const route = heading[1], runId = runMatch[1];
+  const marker = `<!-- lighthouse-unattended:${digest(JSON.stringify({ repository, issue: issue.number, route, run: runId }))} -->`;
+  if (!last.body.includes(marker)) return 'uncertain';
+  const run = await api(`actions/runs/${runId}`);
+  if (run?.repository?.full_name !== repository || run.path !== '.github/workflows/lighthouse-sdlc-unattended.yml' || run.event !== 'workflow_dispatch' || run.actor?.login !== owner || run.triggering_actor?.login !== owner || run.display_title !== `${route} #${issue.number} · ${owner}` || run.run_attempt !== 1) return 'uncertain';
+  if (run.status !== 'completed' || !['failure', 'timed_out', 'cancelled'].includes(run.conclusion)) return 'not-applicable';
+  const fresh = await api(`issues/${issue.number}`), latest = await issueComments(api, issue.number);
+  const current = latest.filter(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && /<!-- lighthouse-(?:unattended:|unattended-recovery:|dispatch:|actions:|stop:)/.test(c.body ?? '')).at(-1);
+  if (fresh.state !== 'open' || fresh.user?.login !== owner || current?.id !== last.id) return 'uncertain';
+  const reservation = fresh.labels.some(l => l.name === 'agent-working') ? ' The agent-working reservation remains; verify ownership before releasing it.' : '';
+  const body = handoff({ status: 'unknown', stage: route, happened: `The unattended execution ended ${run.conclusion}, but its terminal handoff is missing. Publication and integration effects have not been confirmed.`, action: `Workflow maintainer: inspect the execution, artifacts, issue and any candidate PR before resuming.${reservation}`, next: 'Do not retry or release a reservation until the observed effects and current ownership are reconciled.', link: `[Execution](https://github.com/${repository}/actions/runs/${runId})`, details: `<!-- lighthouse-unattended-recovery:${runId}:1 -->` });
+  await api(`issues/${issue.number}/comments`, 'POST', { body });
+  return 'restored';
 }
 
 // Called again by the worker, before claiming a maintenance-created retry.
@@ -76,7 +259,7 @@ export async function verifyRecoveryOrigin(api, repository, owner, dispatch, par
   if (JSON.stringify(originalFields(r)) !== JSON.stringify(originalFields(prior.request))) throw Error('Recovery changed the original authorization');
   if (!revalidate) return;
   const jobs = await api(`actions/runs/${priorRun.id}/attempts/${priorRun.run_attempt}/jobs?per_page=100`);
-  if (jobs.total_count > 100) throw Error('Execution job inventory exceeds recovery bounds');
+  if (!Array.isArray(jobs.jobs) || !Number.isSafeInteger(jobs.total_count) || jobs.total_count !== jobs.jobs.length || jobs.total_count > 100) throw Error('Execution job inventory is incomplete or exceeds recovery bounds');
   const issue = await api(`issues/${r.issue}`), comments = await issueComments(api, r.issue), repo = await api('');
   const revision = (await api(`commits/${encodeURIComponent(repo.default_branch)}`)).sha;
   const workflowRevision = (await api(`commits/${encodeURIComponent(r.ref)}`)).sha;
@@ -86,15 +269,30 @@ export async function verifyRecoveryOrigin(api, repository, owner, dispatch, par
 
 export async function prepareRecovery(api, repository, owner, issueNumber, parent, enabled, now = Date.now(), readArtifact = readActionsJson) {
   const issue = await api(`issues/${issueNumber}`), comments = await issueComments(api, issueNumber);
+  await reconcileUnattendedStop(api, repository, owner, issue, comments);
   const entries = comments.filter(c => c.user?.login === 'github-actions[bot]' && c.body.includes('<!-- lighthouse-dispatch:')).map(comment => ({ comment, receipt: readDispatchReceipt(comment, repository, issueNumber) }));
+  const unattended = comments.filter(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body?.includes('<!-- lighthouse-unattended:')).at(-1);
+  if (unattended && (!entries.length || unattended.id > entries.at(-1).comment.id)) return { observations: [] };
   const latest = new Map();
   for (const entry of entries) latest.set(entry.receipt.recovery?.rootId ?? entry.receipt.id, entry);
   const observations = [];
   const currentRoot = entries.at(-1)?.receipt.recovery?.rootId ?? entries.at(-1)?.receipt.id;
   for (const { comment } of latest.values()) {
     const observation = await observeDispatch(api, repository, owner, comment, issue, comments, now, readArtifact);
-    const { dispatch, ...publicObservation } = observation;
+    const { dispatch, stop, run, jobs, revision, workflowRevision, ...publicObservation } = observation;
+    if (observation.rootId === currentRoot) {
+      if (await reconcileAbandonedReservation(api, repository, owner, issue, comments, observation, readArtifact)) Object.assign(publicObservation, { state: 'reconciled', code: 'reservation-released', nextAction: 'Follow the retained outcome before requesting further work.' });
+      const preparationRun = observation.observedRunId ?? run?.id;
+      if (preparationRun && await reconcilePreparationFailure(api, repository, owner, issueNumber, comment.id, preparationRun, readArtifact)) { observation.stop = null; Object.assign(publicObservation, { state: 'reconciled', code: 'preparation-failed', nextAction: 'Inspect the confirmed failed execution before requesting new work.' }); }
+      const reconciliation = await reconcilePublishedStage(api, repository, owner, issue, comments, observation, readArtifact);
+      if (reconciliation === 'restored' || reconciliation === 'present') {
+        observation.stop = null;
+        if (run?.conclusion === 'failure') Object.assign(publicObservation, { state: 'reconciled', code: 'handoff-restored', nextAction: 'Follow the restored handoff.' });
+      }
+      if (reconciliation === 'uncertain') Object.assign(publicObservation, { state: 'uncertain', code: 'handoff-unconfirmed', nextAction: 'Inspect the retained result and current issue state before restoring its handoff.' });
+    }
     observations.push(publicObservation);
+    if (observation.stop && observation.rootId === currentRoot) await publishObservedStop(api, { repository, issue: issueNumber, stage: dispatch.request.stage, ...observation.stop, sourceRevision: dispatch.request.sourceRevision, dispatch: { commentId: dispatch.commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest } });
     if (observation.state !== 'retryable' || enabled !== true || observation.rootId !== currentRoot) continue;
     const attempt = observation.attempt + 1;
     const request = { ...dispatch.request, id: recoveryId(repository, observation.rootId, attempt), routerRunId: String(parent.id), routerAttempt: parent.run_attempt, routerRevision: parent.head_sha, routerRef: parent.head_branch, routerEventName: parent.event, recovery: { rootId: observation.rootId, previousComment: comment.id, attempt } };

package/workflows/lighthouse-sdlc-apply-product-change.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f4d9b81a1c900e855e8ef604fe4596e5eebf87041febc68e1351da79acff567e","body_hash":"900316ff8535f6f9b38fea05138e4e8aa8ed64b3d4844ebad51810faf4bddea5","compiler_version":"v0.93.2","agent_id":"copilot","engine_versions":{"copilot":"1.0.101"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"6e978e33b557d99c929fbd67778258832f1938ec206c0624ee4cf9f5da7f88ff","body_hash":"900316ff8535f6f9b38fea05138e4e8aa8ed64b3d4844ebad51810faf4bddea5","compiler_version":"v0.93.2","agent_id":"copilot","engine_versions":{"copilot":"1.0.101"},"agent_image_runner":"[\"self-hosted\",\"linux\",\"lighthouse-workflow\"]"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09","version":"v5"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/setup-node","sha":"a0853c24544627f65ddf259abe73b1d18a591444","version":"v5"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"d9128eb3ea40c18b77c76184eda03c0ff2608d79","version":"v0.93.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.70","digest":"sha256:b15ab48cbbab02904eb9bbd359a398db59690eebbea1e6934d47ed2bb407dd34","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.70@sha256:b15ab48cbbab02904eb9bbd359a398db59690eebbea1e6934d47ed2bb407dd34"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.70","digest":"sha256:9ac8f9c7294e892c916de3da9d2588dfd8cd4931e5c39b00143266d7ed9fd52a","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.70@sha256:9ac8f9c7294e892c916de3da9d2588dfd8cd4931e5c39b00143266d7ed9fd52a"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.70","digest":"sha256:b5bc53f4becfd96e926e63c83831f1b3c9512f713c83161d2b8c9b7204b3e917","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.70@sha256:b5bc53f4becfd96e926e63c83831f1b3c9512f713c83161d2b8c9b7204b3e917"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.37","digest":"sha256:9c7f242f6dec2d7d7b55d4c9e07872d59b85377c6cb3de46c915a5d1ffb91442","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.37@sha256:9c7f242f6dec2d7d7b55d4c9e07872d59b85377c6cb3de46c915a5d1ffb91442"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382","pinned_image":"ghcr.io/github/gh-aw-node@sha256:41835613992df88f51e923bad486f96dfb2e6cda29f13e217df41833284ae382"},{"image":"ghcr.io/github/github-mcp-server:v2.0.2","digest":"sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["noop","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"disabled"},"admission":false}
 # This file was automatically generated by gh-aw (v0.93.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -112,7 +112,7 @@ jobs:
     needs:
       - pre_activation
       - prepare
-    if: needs.pre_activation.outputs.activated == 'true' && (needs.prepare.outputs.eligible == 'true')
+    if: needs.pre_activation.outputs.activated == 'true' && (false)
     runs-on: ubuntu-24.04
     # Permissions for the activation job (workflow permissions default to none).
     permissions:
@@ -454,9 +454,10 @@ jobs:
     needs:
       - activation
       - apply
+      - finalize
       - prepare
       - publish
-    if: (needs.prepare.outputs.eligible == 'true') && (needs.activation.outputs.daily_ai_credits_exceeded != 'true')
+    if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
     runs-on:
     - self-hosted
     - linux
@@ -1260,10 +1261,13 @@ jobs:
           GH_HOST="${GITHUB_SERVER_URL#https://}"
           GH_HOST="${GH_HOST#http://}"
           echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - name: Load the approved source without credentials
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          persist-credentials: false
-          ref: ${{ needs.prepare.outputs.head }}
+          name: lighthouse-product-apply-source-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/product-source
+      - name: Restore the approved source
+        run: tar -xzf "$RUNNER_TEMP/product-source/lighthouse-product-source.tar.gz" -C "$GITHUB_WORKSPACE"
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           path: .lighthouse-harness
@@ -1277,6 +1281,7 @@ jobs:
         run: |
           npm ci --ignore-scripts
           npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
+        working-directory: .lighthouse-harness
       - name: Load the approval checkpoint
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -1294,6 +1299,13 @@ jobs:
             ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/apply-result.json
             ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/affected-citations.json
           retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '30' }}
+      - name: Preserve the bounded apply proof
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          if-no-files-found: error
+          name: lighthouse-product-apply-proof-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/apply-proof.json
+          retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '30' }}
 
   conclusion:
     name: conclusion
@@ -1301,6 +1313,7 @@ jobs:
       - activation
       - agent
       - apply
+      - finalize
       - prepare
       - publish
       - safe_outputs
@@ -1319,9 +1332,9 @@ jobs:
       cancel-in-progress: false
       queue: max
     env:
-      GH_AW_JOB_DISPLAY_NAMES: "{\"activation\":\"activation\",\"agent\":\"agent\",\"apply\":\"Apply with the pinned ProductShape provider\",\"conclusion\":\"conclusion\",\"pre_activation\":\"pre_activation\",\"prepare\":\"Recheck product approval\",\"publish\":\"Recheck and publish provider output\",\"safe_outputs\":\"safe_outputs\"}"
-      GH_AW_JOB_RESULTS: "{\"activation\":{\"result\":\"${{ needs.activation.result }}\"},\"agent\":{\"result\":\"${{ needs.agent.result }}\"},\"apply\":{\"result\":\"${{ needs.apply.result }}\"},\"prepare\":{\"result\":\"${{ needs.prepare.result }}\"},\"publish\":{\"result\":\"${{ needs.publish.result }}\"},\"safe_outputs\":{\"result\":\"${{ needs.safe_outputs.result }}\"}}"
-      GH_AW_JOB_TIMING_ELIGIBLE: "{\"activation\":true,\"agent\":true,\"apply\":true,\"conclusion\":true,\"pre_activation\":true,\"prepare\":true,\"publish\":true,\"safe_outputs\":true}"
+      GH_AW_JOB_DISPLAY_NAMES: "{\"activation\":\"activation\",\"agent\":\"agent\",\"apply\":\"Apply with the pinned ProductShape provider\",\"conclusion\":\"conclusion\",\"finalize\":\"Report an interrupted product apply\",\"pre_activation\":\"pre_activation\",\"prepare\":\"Recheck product approval\",\"publish\":\"Recheck and publish provider output\",\"safe_outputs\":\"safe_outputs\"}"
+      GH_AW_JOB_RESULTS: "{\"activation\":{\"result\":\"${{ needs.activation.result }}\"},\"agent\":{\"result\":\"${{ needs.agent.result }}\"},\"apply\":{\"result\":\"${{ needs.apply.result }}\"},\"finalize\":{\"result\":\"${{ needs.finalize.result }}\"},\"prepare\":{\"result\":\"${{ needs.prepare.result }}\"},\"publish\":{\"result\":\"${{ needs.publish.result }}\"},\"safe_outputs\":{\"result\":\"${{ needs.safe_outputs.result }}\"}}"
+      GH_AW_JOB_TIMING_ELIGIBLE: "{\"activation\":true,\"agent\":true,\"apply\":true,\"conclusion\":true,\"finalize\":true,\"pre_activation\":true,\"prepare\":true,\"publish\":true,\"safe_outputs\":true}"
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
     outputs:
       noop_comment_body: ${{ steps.noop.outputs.noop_comment_body }}
@@ -1592,9 +1605,52 @@ jobs:
           overwrite: true
           retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '0' }}
 
+  finalize:
+    name: Report an interrupted product apply
+    needs:
+      - apply
+      - prepare
+      - publish
+    if: always()
+    runs-on: ubuntu-24.04
+    # Permissions for the finalize job (workflow permissions default to none).
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    env:
+      LIGHTHOUSE_APPLY_RESULT: ${{ needs.apply.result }}
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+      LIGHTHOUSE_PREPARE_RESULT: ${{ needs.prepare.result }}
+      LIGHTHOUSE_PUBLISH_RESULT: ${{ needs.publish.result }}
+    steps:
+      - name: Configure GH_HOST for enterprise compatibility
+        id: ghes-host-config
+        shell: bash
+        run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.
+          # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
+          # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
+          GH_HOST="${GITHUB_SERVER_URL#https://}"
+          GH_HOST="${GH_HOST#http://}"
+          echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+          ref: __LIGHTHOUSE_REF__
+          repository: juangcarmona/lighthouse
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 24
+      - name: Publish the authenticated outcome
+        run: node src/packages/sdlc/src/issue-actions.mjs product-apply-cleanup
+        env:
+          GH_TOKEN: ${{ github.token }}
+
   pre_activation:
     name: pre_activation
     needs: prepare
+    if: false
     runs-on: ubuntu-24.04
     env:
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
@@ -1626,7 +1682,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-      issues: read
+      issues: write
       pull-requests: read
     env:
       LIGHTHOUSE_DISPATCH_REQUIRED: true
@@ -1668,6 +1724,30 @@ jobs:
           name: lighthouse-product-apply-input-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/product-apply.json
           retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '14' }}
+      - name: Check out the approved private source without persisted credentials
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          fetch-depth: 0
+          path: product-source
+          persist-credentials: false
+          ref: ${{ steps.prepare.outputs.head }}
+      - name: Preserve the approved source for the credential-free provider
+        if: steps.prepare.outputs.eligible == 'true'
+        run: |
+          test "$(git -C product-source rev-parse HEAD)" = "$APPROVED_HEAD"
+          if git -C product-source config --local --name-only --get-regexp '^http\..*\.extraheader$' >/dev/null; then exit 1; fi
+          tar -czf "$RUNNER_TEMP/lighthouse-product-source.tar.gz" -C product-source .
+        env:
+          APPROVED_HEAD: ${{ steps.prepare.outputs.head }}
+      - name: Upload the approved source
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          if-no-files-found: error
+          name: lighthouse-product-apply-source-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-product-source.tar.gz
+          retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '14' }}
 
   publish:
     name: Recheck and publish provider output
@@ -1678,7 +1758,7 @@ jobs:
     runs-on: ubuntu-24.04
     # Permissions for the publish job (workflow permissions default to none).
     permissions:
-      actions: read
+      actions: write
       contents: write
       issues: write
       pull-requests: write
@@ -1717,6 +1797,12 @@ jobs:
         with:
           name: lighthouse-product-apply-result-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Load the bounded apply proof
+        if: needs.apply.result == 'success'
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: lighthouse-product-apply-proof-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Stop when the provider apply did not complete
         if: needs.apply.result != 'success'
         run: exit 1

package/workflows/lighthouse-sdlc-apply-product-change.md

@@ -29,7 +29,7 @@ on:
         required: true
         type: string
   needs: [prepare]
-if: needs.prepare.outputs.eligible == 'true'
+if: "false"
 runs-on: [self-hosted, linux, lighthouse-workflow]
 runs-on-slim: ubuntu-24.04
 timeout-minutes: 30
@@ -62,7 +62,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-      issues: read
+      issues: write
       pull-requests: read
     env:
       LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
@@ -92,6 +92,30 @@ jobs:
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/product-apply.json
           if-no-files-found: error
           retention-days: 14
+      - name: Check out the approved private source without persisted credentials
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ steps.prepare.outputs.head }}
+          path: product-source
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Preserve the approved source for the credential-free provider
+        if: steps.prepare.outputs.eligible == 'true'
+        env:
+          APPROVED_HEAD: ${{ steps.prepare.outputs.head }}
+        run: |
+          test "$(git -C product-source rev-parse HEAD)" = "$APPROVED_HEAD"
+          if git -C product-source config --local --name-only --get-regexp '^http\..*\.extraheader$' >/dev/null; then exit 1; fi
+          tar -czf "$RUNNER_TEMP/lighthouse-product-source.tar.gz" -C product-source .
+      - name: Upload the approved source
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-product-apply-source-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-product-source.tar.gz
+          if-no-files-found: error
+          retention-days: 14
   apply:
     name: Apply with the pinned ProductShape provider
     needs: [prepare]
@@ -99,10 +123,13 @@ jobs:
     runs-on: ubuntu-24.04
     permissions: {}
     steps:
-      - uses: actions/checkout@v5
+      - name: Load the approved source without credentials
+        uses: actions/download-artifact@v8
         with:
-          persist-credentials: false
-          ref: ${{ needs.prepare.outputs.head }}
+          name: lighthouse-product-apply-source-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/product-source
+      - name: Restore the approved source
+        run: tar -xzf "$RUNNER_TEMP/product-source/lighthouse-product-source.tar.gz" -C "$GITHUB_WORKSPACE"
       - uses: actions/checkout@v5
         with:
           repository: juangcarmona/lighthouse
@@ -113,6 +140,7 @@ jobs:
         with:
           node-version: 24
       - name: Install provider packages without credentials
+        working-directory: .lighthouse-harness
         run: |
           npm ci --ignore-scripts
           npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
@@ -133,13 +161,20 @@ jobs:
             ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/affected-citations.json
           if-no-files-found: error
           retention-days: 30
+      - name: Preserve the bounded apply proof
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-product-apply-proof-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/apply-proof.json
+          if-no-files-found: error
+          retention-days: 30
   publish:
     name: Recheck and publish provider output
     needs: [prepare, apply]
     if: always() && needs.prepare.outputs.eligible == 'true'
     runs-on: ubuntu-24.04
     permissions:
-      actions: read
+      actions: write
       contents: write
       issues: write
       pull-requests: write
@@ -169,6 +204,12 @@ jobs:
         with:
           name: lighthouse-product-apply-result-${{ inputs.issue }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Load the bounded apply proof
+        if: needs.apply.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-product-apply-proof-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Stop when the provider apply did not complete
         if: needs.apply.result != 'success'
         run: exit 1
@@ -176,6 +217,34 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: node src/packages/sdlc/src/issue-actions.mjs product-apply-publish
+  finalize:
+    name: Report an interrupted product apply
+    needs: [prepare, apply, publish]
+    if: always()
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+      LIGHTHOUSE_PREPARE_RESULT: ${{ needs.prepare.result }}
+      LIGHTHOUSE_APPLY_RESULT: ${{ needs.apply.result }}
+      LIGHTHOUSE_PUBLISH_RESULT: ${{ needs.publish.result }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Publish the authenticated outcome
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs product-apply-cleanup
 ---
 
 # Apply an approved Product Change