@mmerterden/multi-agent-pipeline 20.23.2 → 20.24.0

package/pipeline/scripts/_plan-overlap.mjs

@@ -0,0 +1,231 @@
+/**
+ * @file _plan-overlap.mjs  -  where two plan tasks meet, and whether they agree.
+ *
+ * Phase 1 hands Phase 2 a list of tasks that may run in parallel. Two tasks
+ * that touch the same file, or name the same interface, are where a plan
+ * contradicts itself without any single task being wrong: both create the
+ * same new file, one deletes or renames what the other still uses, or a task
+ * consumes something its producer is not ordered before.
+ *
+ * Every pair that shares a name becomes an anchored row:
+ *
+ *   { a, b, kind: "file"|"symbol", name, aRole, bRole, order, finding }
+ *
+ * `a` precedes `b` in plan order. A role is what the task does to the name:
+ *
+ *   file    creates (in `creates`) | removes (in `removes`) | edits (in `files`)
+ *   symbol  produces (in `produces`) | removes (in `removes`) | consumes (in `consumes`)
+ *
+ * `removes` covers deletion and the old side of a rename, so one field holds
+ * files and symbols alike. A name is a file when it contains a `/`, ends in a
+ * known file extension, is a well-known extensionless file (Makefile,
+ * Dockerfile, Podfile, ...) or is a dotfile; anything else, `UserService.fetch`
+ * included, is a symbol. File names are compared normalised, so `./a` and `a`
+ * are one file. A task that names something in more than one field takes its
+ * strongest role: removes, then creates / produces, then edits / consumes.
+ *
+ * `order` comes from `dependsOn`, transitively: `a-first`, `b-first`, or
+ * `unordered` when neither task waits for the other.
+ *
+ * Findings:
+ *
+ *   double-create                two tasks create the same file. Contradiction:
+ *                                the second one overwrites the first.
+ *   removes-used                 one task removes what the other edits,
+ *                                consumes, creates or produces. Warning.
+ *   consumer-not-after-producer  the user of a created file or produced symbol
+ *                                is not ordered after its producer. Warning.
+ *   unordered-edit               two tasks edit one file with no order between
+ *                                them, so parallel workers collide. Warning.
+ *
+ * Only the roles the plan states are judged. A plan without `creates`,
+ * `removes`, `produces` or `consumes` still gets its shared-file rows, and the
+ * unordered-edit finding, from `files` alone.
+ *
+ * Zero runtime dependencies (ADR-0004).
+ *
+ * @module pipeline/scripts/_plan-overlap
+ */
+
+const RANK = { removes: 3, creates: 2, produces: 2, edits: 1, consumes: 1 };
+
+const list = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === "string" && x) : []);
+
+const FILE_EXTENSIONS = new Set(
+  (
+    "swift m mm h hh hpp c cc cpp cxx kt kts java gradle groovy scala js mjs cjs jsx ts tsx mts cts " +
+    "vue svelte py pyi rb go rs php cs dart lua pl sh bash zsh fish ps1 bat cmd sql graphql gql " +
+    "proto json jsonc json5 yaml yml toml ini cfg conf xml plist html htm css scss sass less md " +
+    "mdx markdown txt rst adoc csv tsv lock resolved xcconfig xcstrings strings stringsdict " +
+    "storyboard xib entitlements pbxproj xcscheme xcworkspacedata xcassets xcodeproj xcworkspace " +
+    "xcframework xctestplan png jpg jpeg gif svg webp heic pdf ico ttf otf woff woff2 mp3 mp4 mov " +
+    "wav zip gz tgz tar jar aar apk aab ipa dylib so tf hcl cmake mk patch diff pem p12 mobileprovision"
+  ).split(" "),
+);
+const FILE_NAMES = new Set([
+  "Makefile",
+  "GNUmakefile",
+  "Dockerfile",
+  "Containerfile",
+  "Podfile",
+  "Gemfile",
+  "Rakefile",
+  "Fastfile",
+  "Appfile",
+  "Matchfile",
+  "Pluginfile",
+  "Brewfile",
+  "Cartfile",
+  "Mintfile",
+  "Procfile",
+  "Jenkinsfile",
+  "Vagrantfile",
+  "Pipfile",
+  "Justfile",
+  "Package.swift",
+  "Package.resolved",
+  "Podfile.lock",
+  "Gemfile.lock",
+  "go.mod",
+  "go.sum",
+  "gradlew",
+  "mvnw",
+  "BUILD",
+  "WORKSPACE",
+  "LICENSE",
+  "README",
+  "CHANGELOG",
+  "CODEOWNERS",
+]);
+
+/** `./a`, `a` and `a//b/.` name the same file. */
+export function normalizeFile(name) {
+  const parts = [];
+  for (const seg of name.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === ".." && parts.length && parts.at(-1) !== "..") parts.pop();
+    else parts.push(seg);
+  }
+  const joined = parts.join("/");
+  return name.startsWith("/") ? `/${joined}` : joined || name;
+}
+
+export const isFileName = (name) => {
+  if (name.includes("/")) return true;
+  if (FILE_NAMES.has(name) || name.startsWith(".")) return true;
+  const dot = name.lastIndexOf(".");
+  return dot > 0 && FILE_EXTENSIONS.has(name.slice(dot + 1).toLowerCase());
+};
+
+/** name -> role for one task, per kind, keeping the strongest role. */
+function rolesOf(task) {
+  const files = new Map();
+  const symbols = new Map();
+  const put = (map, name, role) => {
+    const cur = map.get(name);
+    if (!cur || RANK[role] > RANK[cur]) map.set(name, role);
+  };
+  for (const f of list(task.files)) put(files, normalizeFile(f), "edits");
+  for (const f of list(task.creates)) put(files, normalizeFile(f), "creates");
+  for (const s of list(task.consumes)) put(symbols, s, "consumes");
+  for (const s of list(task.produces)) put(symbols, s, "produces");
+  for (const n of list(task.removes)) {
+    if (isFileName(n)) put(files, normalizeFile(n), "removes");
+    else put(symbols, n, "removes");
+  }
+  return { file: files, symbol: symbols };
+}
+
+/** id -> set of every id it waits for, through dependsOn. */
+function ancestors(tasks) {
+  const deps = new Map(tasks.map((t) => [String(t.id), list(t.dependsOn)]));
+  const memo = new Map();
+  const walk = (id, trail = new Set()) => {
+    if (memo.has(id)) return memo.get(id);
+    const out = new Set();
+    if (trail.has(id)) return out;
+    trail.add(id);
+    for (const d of deps.get(id) || []) {
+      out.add(d);
+      for (const x of walk(d, trail)) out.add(x);
+    }
+    trail.delete(id);
+    memo.set(id, out);
+    return out;
+  };
+  return (id) => walk(id);
+}
+
+const PRODUCER = new Set(["creates", "produces"]);
+
+function judge(aRole, bRole, order) {
+  if (aRole === "creates" && bRole === "creates") return "double-create";
+  if ((aRole === "removes") !== (bRole === "removes")) return "removes-used";
+  if (aRole === "removes") return null;
+  const aMakes = PRODUCER.has(aRole);
+  const bMakes = PRODUCER.has(bRole);
+  if (aMakes && !bMakes && order !== "a-first") return "consumer-not-after-producer";
+  if (bMakes && !aMakes && order !== "b-first") return "consumer-not-after-producer";
+  if (aRole === "edits" && bRole === "edits" && order === "unordered") return "unordered-edit";
+  return null;
+}
+
+function sentence(row) {
+  const { a, b, name, aRole, bRole, order, finding } = row;
+  switch (finding) {
+    case "double-create":
+      return order === "unordered"
+        ? `${a} and ${b} both create ${name}; one task must create it and the other depend on it`
+        : `${a} and ${b} both create ${name}; they are already ordered, so drop ${name} from the creates of one (the later task edits it)`;
+    case "removes-used": {
+      const [rm, user, role] = aRole === "removes" ? [a, b, bRole] : [b, a, aRole];
+      return `${a} and ${b}: ${rm} removes ${name}, which ${user} ${role}`;
+    }
+    case "consumer-not-after-producer": {
+      const [maker, user, role] = PRODUCER.has(aRole) ? [a, b, bRole] : [b, a, aRole];
+      return `${a} and ${b}: ${user} ${role} ${name} but is not ordered after ${maker}, which ${PRODUCER.has(aRole) ? aRole : bRole} it`;
+    }
+    case "unordered-edit":
+      return `${a} and ${b} both edit ${name} with no dependsOn between them`;
+    default:
+      return null;
+  }
+}
+
+/**
+ * @param {Array<{id: string, files?: string[], creates?: string[], removes?: string[],
+ *   produces?: string[], consumes?: string[], dependsOn?: string[]}>} tasks
+ * @returns {{
+ *   rows: Array<{a: string, b: string, kind: "file"|"symbol", name: string, aRole: string,
+ *     bRole: string, order: "a-first"|"b-first"|"unordered", finding: string|null}>,
+ *   contradictions: string[],
+ *   warnings: string[],
+ * }}
+ */
+export function planOverlaps(tasks) {
+  const ts = (Array.isArray(tasks) ? tasks : []).filter((t) => t && t.id != null);
+  const roles = ts.map(rolesOf);
+  const before = ancestors(ts);
+  const rows = [];
+  for (const kind of ["file", "symbol"]) {
+    for (let i = 0; i < ts.length; i++) {
+      for (let j = i + 1; j < ts.length; j++) {
+        const a = String(ts[i].id);
+        const b = String(ts[j].id);
+        const order = before(b).has(a) ? "a-first" : before(a).has(b) ? "b-first" : "unordered";
+        for (const [name, aRole] of roles[i][kind]) {
+          const bRole = roles[j][kind].get(name);
+          if (!bRole) continue;
+          rows.push({ a, b, kind, name, aRole, bRole, order, finding: judge(aRole, bRole, order) });
+        }
+      }
+    }
+  }
+  const contradictions = [];
+  const warnings = [];
+  for (const row of rows) {
+    if (!row.finding) continue;
+    (row.finding === "double-create" ? contradictions : warnings).push(sentence(row));
+  }
+  return { rows, contradictions, warnings };
+}

package/pipeline/scripts/_redact.mjs

@@ -51,22 +51,136 @@ const SYSTEM_PATH = /(?<![\w.~\-/])\/(?:Volumes|private|var|opt|tmp)(?![\w.-])\S
 /** Any user's home directory, reduced to ~ so the rest of the path still reads. */
 const HOME_PATH = /(?<![\w.~\-/])\/(?:Users|home)(?:\/[^\s/)"'\]]+)?(?![\w.-])/g;
 
+/** The replacement chain, in order, with the kind each step counts as. */
+const STEPS = [
+  [SCHEME_LINK, "[link]", "link"],
+  [WWW_LINK, "[link]", "link"],
+  [EMAIL, "[email]", "email"],
+  [BARE_LINK, "[link]", "link"],
+  [IPV4, "[host]", "host"],
+  [DOTTED_NAME, hostOrSelf, "host"],
+  [SYSTEM_PATH, "[path]", "path"],
+  [HOME_PATH, "~", "home-path"],
+];
+
+/**
+ * scrub, plus how many replacements of each kind it made. A dotted name that
+ * hostOrSelf leaves alone is not counted.
+ *
+ * @returns {{text: string, counts: Record<string, number>}}
+ */
+export function scrubCounted(text) {
+  const counts = {};
+  let out = String(text ?? "");
+  for (const [re, replacement, kind] of STEPS) {
+    out = out.replace(re, (match, ...groups) => {
+      const next = typeof replacement === "function" ? replacement(match, ...groups) : replacement;
+      if (next !== match) counts[kind] = (counts[kind] || 0) + 1;
+      return next;
+    });
+  }
+  return { text: out.trim(), counts };
+}
+
 /**
  * Free text with URLs (with or without a scheme), e-mail addresses, IPv4
  * addresses, host names, absolute machine paths and home directories replaced
  * by markers.
  */
 export function scrub(text) {
-  return String(text ?? "")
-    .replace(SCHEME_LINK, "[link]")
-    .replace(WWW_LINK, "[link]")
-    .replace(EMAIL, "[email]")
-    .replace(BARE_LINK, "[link]")
-    .replace(IPV4, "[host]")
-    .replace(DOTTED_NAME, hostOrSelf)
-    .replace(SYSTEM_PATH, "[path]")
-    .replace(HOME_PATH, "~")
-    .trim();
+  return scrubCounted(text).text;
+}
+
+// --- credentials the provider rules (lib/redact.mjs) have no prefix for ------
+
+/**
+ * A variable, flag or header name that holds a credential: any word ending in
+ * TOKEN, SECRET, PASSWORD, PASSWD, PWD or API_KEY (PGPASSWORD, MYSQL_PWD,
+ * myAppToken, db-password, x-api-key), or a separated word ending in KEY.
+ */
+const SECRET_NAME = String.raw`[A-Za-z0-9_-]*(?:TOKEN|SECRET|PASSWORD|PASSWD|PWD|API[_-]?KEY)|(?:[A-Za-z0-9]+[_-])+KEY`;
+const NOT_MARKER = String.raw`(?!\[redacted:)`;
+const PEM_END = String.raw`-----END [A-Z ]*PRIVATE KEY-----`;
+const JSON_KEY = String.raw`[A-Za-z0-9_-]*(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|credentials?)`;
+
+/**
+ * Credential shapes the provider rules miss, as [pattern, replacer, kind].
+ * Each keeps the name or header in front of the value so the line still says
+ * what was configured, and drops only the value. They run after
+ * lib/redact.mjs, so they also finish what its markers leave behind: the body
+ * of a private key whose BEGIN line it replaced, and the host and port after
+ * a credential URL.
+ */
+const CREDENTIAL_STEPS = [
+  [
+    new RegExp(
+      String.raw`(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\[redacted:private-key-block\])[\s\S]*?(?:${PEM_END}|$(?![\s\S]))`,
+      "g",
+    ),
+    () => "[redacted:private-key-block]",
+    "private-key-block",
+  ],
+  [
+    /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@\S*|\[redacted:url-with-credentials\]@\S*/gi,
+    () => "[redacted:url-with-credentials]",
+    "url-with-credentials",
+  ],
+  [/\bAT(?:ATT|CTT)[A-Za-z0-9_=-]{20,}/g, () => "[redacted:atlassian-token]", "atlassian-token"],
+  [
+    new RegExp(
+      String.raw`\b(Authorization\s*:\s*)${NOT_MARKER}(?:(?:Bearer|Basic|Digest|token)\s+)?${NOT_MARKER}[^\s"',;]+`,
+      "gi",
+    ),
+    (_, head) => `${head}[redacted:authorization-header]`,
+    "authorization-header",
+  ],
+  [
+    /\b(Bearer\s+)(?!\[redacted:)(?=[A-Za-z0-9._~+/=-]*\d)([A-Za-z0-9._~+/=-]{12,})/g,
+    (_, head) => `${head}[redacted:bearer-token]`,
+    "bearer-token",
+  ],
+  [
+    new RegExp(
+      String.raw`(\\?")(${JSON_KEY})\1(\s*:\s*)\1${NOT_MARKER}(?:\\[^"]|[^"\\])+?\1`,
+      "gi",
+    ),
+    (_, q, key, sep) => `${q}${key}${q}${sep}${q}[redacted:json-secret]${q}`,
+    "json-secret",
+  ],
+  [
+    new RegExp(
+      String.raw`(?<![\w-])(${SECRET_NAME})(\s*[=:]\s*)${NOT_MARKER}("[^"\n]+"|'[^'\n]+'|[^\s"',;]+)`,
+      "gi",
+    ),
+    (_, name, sep) => `${name}${sep}[redacted:env-secret]`,
+    "env-secret",
+  ],
+  [
+    /(\bcurl\b[^\n]*?\s(?:-u\s*|--user[=\s]\s*)(["']?)[^\s:"']+:)(?!\[redacted:)[^\s"']+\2/g,
+    (_, head, q) => `${head}[redacted:basic-auth]${q}`,
+    "basic-auth",
+  ],
+  [
+    /\b((?:mysql|mysqldump|mysqladmin|mariadb|mariadb-dump)\b[^\n]*?\s-p)(?!\s)(?!\[redacted:)\S+/g,
+    (_, head) => `${head}[redacted:password-flag]`,
+    "password-flag",
+  ],
+  [
+    /(--password[= ])(?!\[redacted:)\S+/g,
+    (_, head) => `${head}[redacted:password-flag]`,
+    "password-flag",
+  ],
+];
+
+/**
+ * `text` with the credentials CREDENTIAL_STEPS recognise replaced by
+ * `[redacted:<kind>]` markers. Meant to run after lib/redact.mjs; markers it
+ * already wrote are never redacted a second time.
+ */
+export function redactCredentials(text) {
+  let out = String(text ?? "");
+  for (const [re, replacer] of CREDENTIAL_STEPS) out = out.replace(re, replacer);
+  return out;
 }
 
 /** A copy of `obj` without `keys`. */

package/pipeline/scripts/analysis-story-tree.mjs

@@ -62,6 +62,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { hostCommand } from "../lib/user-facing.mjs";
 import { lockTimeoutFrom, updateJsonFileSync } from "../lib/json-file-lock.mjs";
+import { analyzeGraph, cyclicComponentOf } from "../lib/task-graph.mjs";
 import { resolveConstitution } from "./constitution.mjs";
 import { gateContext, recordQuietly } from "./gate-ledger.mjs";
 import {
@@ -170,6 +171,7 @@ export function identityLabel(prefix, docId, sourceIds) {
  *   issueTree.cloneLinkType      the link type between a story and its clones
  *   issueTree.storyPanels        story section panel colours, or false for none
  *   issueTree.subtaskRolesDeclined  the person chose no sub-tasks; do not ask again
+ *   issueTree.dependencyLinkType  the link type written for a story dependency
  */
 const ISSUE_TREE_SETTINGS = [
   "issueTree.enabled",
@@ -187,6 +189,7 @@ const ISSUE_TREE_SETTINGS = [
   "issueTree.cloneLinkType",
   "issueTree.storyPanels",
   "issueTree.subtaskRolesDeclined",
+  "issueTree.dependencyLinkType",
 ];
 
 function readPrefs() {
@@ -216,6 +219,100 @@ export function subtaskTypeFor(setting, role) {
   return null;
 }
 
+const DEPENDS_ON = /\bdepends on:([^|\n]*)/gi;
+
+/**
+ * The `Depends on: <ids>` clauses of a document's requirement rows.
+ *
+ * A clause belongs to the table row it sits in, in any cell, so a trailing
+ * column under any header works and so does a note appended to a cell. The
+ * row's subject is the first requirement id left once the clause is removed.
+ * Clauses outside a table row are not read: without a row there is no subject.
+ *
+ * `stripped` is the text with every read clause removed. Ids are defined by
+ * where they appear, so a reference left in place would define the id it
+ * points at, and a dependency on a requirement nobody wrote would plan a story
+ * for it instead of being reported.
+ *
+ * @returns {{deps: Map<string, Set<string>>, stripped: string}}
+ */
+export function dependencyClauses(text, corporate) {
+  const atom = corporate ? ATOM_CORP : ATOM_GLOBAL;
+  const deps = new Map();
+  const lines = text.split("\n");
+  for (const [i, line] of lines.entries()) {
+    if (!/^\s*\|/.test(line) || !/\bdepends on:/i.test(line)) continue;
+    const refs = [];
+    const rest = line.replace(DEPENDS_ON, (clause, ids) => {
+      const found = ids.match(atom);
+      if (!found) return clause;
+      refs.push(...found.map((x) => x.toUpperCase()));
+      return "";
+    });
+    const subject = (rest.match(atom) || [])[0]?.toUpperCase();
+    if (!subject || !refs.length) continue;
+    lines[i] = rest;
+    for (const r of refs) {
+      if (r === subject) continue;
+      if (!deps.has(subject)) deps.set(subject, new Set());
+      deps.get(subject).add(r);
+    }
+  }
+  return { deps, stripped: lines.join("\n") };
+}
+
+/**
+ * Requirement dependencies, read as story-to-story edges and checked as a
+ * graph. A story depends on another when one of its source ids depends on a
+ * source id of the other; two ids of one story give no edge. A dependency on
+ * an id no story covers, and a cycle between stories, are problems: the plan
+ * reports them and is not `ok`. An edge whose two stories sit in one strongly
+ * connected component carries `onCycle: true`; such an edge has no order to
+ * record, so it is never linked and never counted as a write.
+ */
+function storyDependencies(stories, reqDeps) {
+  const coverers = new Map();
+  for (const s of stories)
+    for (const id of s.sourceIds) {
+      if (!coverers.has(id)) coverers.set(id, []);
+      coverers.get(id).push(s);
+    }
+  const edges = new Map();
+  const missing = [];
+  for (const s of stories) {
+    for (const id of s.sourceIds) {
+      for (const dep of reqDeps.get(id) || []) {
+        const targets = coverers.get(dep);
+        if (!targets) {
+          missing.push({ id, dependsOn: dep });
+          continue;
+        }
+        for (const t of targets) {
+          if (t === s) continue;
+          const key = `${s.label}>${t.label}`;
+          if (!edges.has(key))
+            edges.set(key, { dependent: s.label, prerequisite: t.label, via: [] });
+          const via = `${dep} -> ${id}`;
+          if (!edges.get(key).via.includes(via)) edges.get(key).via.push(via);
+        }
+      }
+    }
+  }
+  for (const s of stories) {
+    const on = [...edges.values()].filter((e) => e.dependent === s.label);
+    if (on.length) s.dependsOn = on.map((e) => e.prerequisite);
+  }
+  const graph = stories.map((s) => ({ id: s.label, deps: s.dependsOn || [], status: "pending" }));
+  const { cycles } = analyzeGraph(graph);
+  const component = cyclicComponentOf(graph);
+  for (const e of edges.values()) {
+    const c = component.get(e.dependent);
+    if (c !== undefined && c === component.get(e.prerequisite)) e.onCycle = true;
+  }
+  const unique = [...new Map(missing.map((m) => [`${m.id}>${m.dependsOn}`, m])).values()];
+  return { edges: [...edges.values()], cycles, missing: unique };
+}
+
 /** Every open placeholder that makes a document unfit to become work. */
 export function openItems(text) {
   const found = [];
@@ -268,10 +365,11 @@ export function coverageOf(defined, nodes, corporate = false) {
   };
 }
 
-export function plan(text, prefs, { pageUrl = null } = {}) {
-  const fm = frontMatter(text);
+export function plan(source, prefs, { pageUrl = null } = {}) {
+  const fm = frontMatter(source);
   const profile = (fm.profile || "global").toLowerCase();
   const corporate = profile === "corporate";
+  const { deps: reqDeps, stripped: text } = dependencyClauses(source, corporate);
   const secs = sections(text);
 
   const atomRe = corporate ? ATOM_CORP : ATOM_GLOBAL;
@@ -423,6 +521,30 @@ export function plan(text, prefs, { pageUrl = null } = {}) {
   }
 
   const coverage = coverageOf(defined, stories, corporate);
+  const dependencies = reqDeps.size ? storyDependencies(stories, reqDeps) : null;
+  if (dependencies) {
+    const titleOf = new Map(stories.map((s) => [s.label, s.group]));
+    const linked = new Set(dependencies.edges.map((e) => `${e.dependent}>${e.prerequisite}`));
+    const isLoop = (c) => c.every((l, i) => linked.has(`${l}>${c[(i + 1) % c.length]}`));
+    const problems = [
+      ...dependencies.cycles.map((c) =>
+        isLoop(c)
+          ? `dependency cycle: ${[c[0], ...[...c].reverse()].map((l) => titleOf.get(l)).join(" -> ")}`
+          : `dependency cycle among: ${c.map((l) => titleOf.get(l)).join(", ")}`,
+      ),
+      ...dependencies.missing.map(
+        (m) => `${m.id} depends on ${m.dependsOn}, which no story covers`,
+      ),
+    ];
+    if (problems.length) {
+      coverage.dependencyProblems = problems;
+      if (coverage.verdict === "ok") coverage.verdict = "incomplete";
+      if (coverage.verdict === "incomplete" && !coverage.reason) {
+        coverage.reason = `${problems.length} dependency problem(s): ${problems.join("; ")}`;
+      }
+    }
+  }
+  const linkType = prefs.dependencyLinkType ?? "Blocks";
 
   return {
     document: {
@@ -447,12 +569,15 @@ export function plan(text, prefs, { pageUrl = null } = {}) {
       cloneLinkType: prefs.cloneLinkType ?? "Relates",
       storyPanels: prefs.storyPanels ?? null,
       subtaskRolesDeclined: prefs.subtaskRolesDeclined === true,
+      ...(dependencies || prefs.dependencyLinkType !== undefined
+        ? { dependencyLinkType: linkType }
+        : {}),
     },
     nodes: stories,
-    writeCount: stories.reduce(
-      (n, s) => n + 1 + s.subtasks.length + 2 * (s.clones?.length || 0),
-      0,
-    ),
+    ...(dependencies ? { dependencies } : {}),
+    writeCount:
+      stories.reduce((n, s) => n + 1 + s.subtasks.length + 2 * (s.clones?.length || 0), 0) +
+      (dependencies?.edges.filter((e) => !e.onCycle).length || 0),
   };
 }
 
@@ -461,7 +586,9 @@ export function plan(text, prefs, { pageUrl = null } = {}) {
  *
  * @returns {object}  a spec-consistency-gate result
  */
-function consistencyOf(text, nodes) {
+function consistencyOf(source, nodes) {
+  const corporate = (frontMatter(source).profile || "").toLowerCase() === "corporate";
+  const text = dependencyClauses(source, corporate).stripped;
   const constitution = resolveConstitution({
     repo: dirname(file),
     feature: frontMatter(text).feature || null,
@@ -606,12 +733,18 @@ async function main() {
   );
   if (c.uncovered.length) process.stdout.write(`  not in any story: ${c.uncovered.join(", ")}\n`);
   if (c.invented.length) process.stdout.write(`  cited but undefined: ${c.invented.join(", ")}\n`);
+  for (const p of c.dependencyProblems || []) process.stdout.write(`  ${p}\n`);
   const k = result.consistency;
   process.stdout.write(
     `consistency: ${k.verdict} (${k.advisory ? "advisory, " : ""}${consistencyDetail(k)})\n`,
   );
   for (const line of describe(k)) process.stdout.write(`${line}\n`);
-  process.stdout.write(`\n${result.writeCount} issue(s) would be created:\n`);
+  const linkCount =
+    result.nodes.reduce((n, s) => n + (s.clones?.length || 0), 0) +
+    (result.dependencies?.edges.filter((e) => !e.onCycle).length || 0);
+  process.stdout.write(
+    `\n${result.writeCount - linkCount} issue(s) and ${linkCount} link(s) would be created:\n`,
+  );
   for (const s of result.nodes) {
     process.stdout.write(`  ${result.prefsUsed.storyIssueType}  ${s.title}\n`);
     process.stdout.write(
@@ -635,6 +768,18 @@ async function main() {
       );
     }
   }
+  const d = result.dependencies;
+  if (d) {
+    const group = new Map(result.nodes.map((n) => [n.label, n.group]));
+    process.stdout.write(
+      `\ndependencies: ${d.edges.length} ${result.prefsUsed.dependencyLinkType} link(s), the prerequisite first:\n`,
+    );
+    for (const e of d.edges) {
+      process.stdout.write(
+        `  ${group.get(e.prerequisite)} -> ${group.get(e.dependent)}  (${e.via.join(", ")})  [${e.prerequisite} -> ${e.dependent}]${e.onCycle ? "  not linked: on a dependency cycle" : ""}\n`,
+      );
+    }
+  }
   // Every field's provenance, so a wrong setting is visible here rather than in
   // Jira after the writes have happened.
   process.stdout.write("\nfrom prefs.global.issueTree:\n");

package/pipeline/scripts/autopilot-publish.mjs

@@ -13,7 +13,9 @@
  *   1. The request, the state and the test log are read as bounded regular
  *      files (lib/regular-file.mjs): a FIFO, a device or an oversized file is
  *      refused, never read. The request is read once and validated in process
- *      (pr-request.mjs validatePrRequest) on those same bytes.
+ *      (pr-request.mjs validatePrRequest) on those same bytes. The state's
+ *      `decisions[]` is appended to the body as one redacted section
+ *      (lib/decisions.mjs), so the PR lists what the run chose unasked.
  *   2. The repository comes from the runner's own config (the queue item's
  *      `nameWithOwner`), never from the request. A request naming another
  *      repository is refused, not redirected. The base is the configured
@@ -104,6 +106,7 @@ import {
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join } from "node:path";
 
+import { appendDecisionsSection } from "../lib/decisions.mjs";
 import { invokedDirectly } from "../lib/invoked-directly.mjs";
 import { scan } from "../lib/outbound-gate.mjs";
 import { prRequestPath, prRequestsDir, prVerdictPath } from "../lib/pr-request-location.mjs";
@@ -123,6 +126,7 @@ const GIT_TIMEOUT_MS = 60 * 1000;
 const NET_TIMEOUT_MS = 5 * 60 * 1000;
 // A valid request is at most a 256-character title and a 65536-character body.
 const REQUEST_MAX_BYTES = 1024 * 1024;
+const BODY_MAX_CHARS = 65536;
 const STATE_MAX_BYTES = 16 * 1024 * 1024;
 const LOG_MAX_BYTES = 64 * 1024 * 1024;
 const VERIFY_TIMEOUT_SEC = 30 * 60;
@@ -1268,6 +1272,13 @@ export async function publish({ sessionId, statePath, item, config, env = proces
     }
 
     req = readRequest(reqPath);
+    // What the run decided in place of a person goes into the PR it opens. The
+    // section is redacted when rendered and passes the outbound gate below with
+    // the rest of the body.
+    req = {
+      ...req,
+      body: appendDecisionsSection(req.body, state.decisions, { maxChars: BODY_MAX_CHARS }),
+    };
 
     const repoCfg = (config?.repos || []).find((r) => r && r.nameWithOwner === repo);
     if (!repo || !repoCfg)