@mrrlin-dev/mcp 0.3.67 → 0.3.68

package/dist/bin.cjs

@@ -20658,14 +20658,17 @@ var toml = __toESM(require_toml(), 1);
 
 // src/api-base-url.ts
 var DEFAULT_API_BASE_URL = "http://127.0.0.1:8787";
-var STAGING_API_BASE_URL = "https://mrrlin-api-mrrlin3.vercel.app";
+var STAGING_API_BASE_URL = "https://api-staging.mrrlin.com";
 function normalizeUrl(value) {
   return value.replace(/\/$/, "");
 }
 var RETIRED_API_BASE_URLS = {
   // Retired 2026-07-28 when staging moved to the mrrlin2 Vercel team; serves a decommissioned
   // Supabase project and now answers `GET /health` with 402 DEPLOYMENT_DISABLED. Added in 0.3.50.
-  "mrrlin-api-fnnzzz-fnnzzzs-projects.vercel.app": STAGING_API_BASE_URL
+  "mrrlin-api-fnnzzz-fnnzzzs-projects.vercel.app": STAGING_API_BASE_URL,
+  // Retired 2026-08-14 when staging decoupled onto the stable custom domain api-staging.mrrlin.com.
+  // A persisted operator configuration may still pin the mrrlin3 Vercel alias; retarget it in one hop.
+  "mrrlin-api-mrrlin3.vercel.app": STAGING_API_BASE_URL
 };
 function isSameApiHost(a, b) {
   const origin = (value) => {
@@ -36387,6 +36390,9 @@ var openApiOperationIds = {
   getExecutionRun: "getExecutionRun",
   getProjectSchedulerPolicy: "getProjectSchedulerPolicy",
   getProjectDeployWorkflow: "getProjectDeployWorkflow",
+  getDeployTopology: "getDeployTopology",
+  writeDeployTopology: "writeDeployTopology",
+  getTaskDeployTarget: "getTaskDeployTarget",
   getSchedulerPendingTasks: "getSchedulerPendingTasks",
   wakeDirector: "wakeDirector",
   getGithubInstallationRepositories: "getGithubInstallationRepositories",
@@ -37133,6 +37139,47 @@ function refineTaskCreateDomain(data, ctx) {
 }
 var mrrlinTaskCreateSchema = mrrlinTaskCreateShapeSchema.superRefine(refineTaskCreateDomain);
 var mrrlinTaskCreateWithoutIdSchema = mrrlinTaskCreateShapeSchema.omit({ id: true }).superRefine(refineTaskCreateDomain);
+var mrrlinDeployWorkflowEnvSchema = external_exports.enum(["dev", "prod"]);
+var mrrlinTaskDeployTargetInputSchema = external_exports.object({
+  env: mrrlinDeployWorkflowEnvSchema,
+  targetLabel: external_exports.string().min(1),
+  workflowId: external_exports.number().int().positive(),
+  workflowPath: external_exports.string().min(1),
+  workflowSha: external_exports.string().min(1),
+  topologyFingerprint: external_exports.string().min(1)
+});
+var deployTopologyResponseSchema = external_exports.object({
+  data: external_exports.object({
+    fingerprint: external_exports.string().nullable(),
+    snapshot: external_exports.array(external_exports.object({ id: external_exports.number(), path: external_exports.string(), sha: external_exports.string(), state: external_exports.string() })).nullable(),
+    entries: external_exports.array(external_exports.object({
+      label: external_exports.string(),
+      env: mrrlinDeployWorkflowEnvSchema,
+      workflowId: external_exports.number(),
+      workflowPath: external_exports.string(),
+      workflowSha: external_exports.string()
+    }))
+  })
+});
+var mrrlinDeployTopologyWriteSchema = external_exports.object({
+  fingerprint: external_exports.string().min(1),
+  entries: external_exports.array(external_exports.object({
+    label: external_exports.string().min(1),
+    env: mrrlinDeployWorkflowEnvSchema,
+    workflowId: external_exports.number().int().positive(),
+    workflowPath: external_exports.string().min(1),
+    workflowSha: external_exports.string().min(1)
+  }))
+});
+var taskDeployTargetResponseSchema = external_exports.object({
+  data: external_exports.object({
+    targetLabel: external_exports.string(),
+    workflowId: external_exports.number(),
+    workflowPath: external_exports.string(),
+    workflowSha: external_exports.string(),
+    topologyFingerprint: external_exports.string()
+  })
+});
 var mrrlinTaskUpdateSchema = external_exports.object({
   actor: external_exports.string().min(1).optional(),
   assignee: mrrlinTaskAssigneeSchema.optional(),
@@ -37155,8 +37202,13 @@ var mrrlinTaskUpdateSchema = external_exports.object({
   title: external_exports.string().min(1).optional(),
   type: mrrlinTaskTypeSchema.optional(),
   followUpAt: external_exports.string().datetime().nullable().optional(),
-  verificationDueAt: external_exports.string().datetime().nullable().optional()
-}).refine((value) => value.assignee !== void 0 || value.autoDeploy !== void 0 || value.domain !== void 0 || value.autonomyLevel !== void 0 || value.autonomyReason !== void 0 || value.category !== void 0 || value.directorThreadId !== void 0 || value.dueDate !== void 0 || value.followUpAt !== void 0 || value.impact !== void 0 || value.notes !== void 0 || value.planId !== void 0 || value.specApproved !== void 0 || value.specWikiPageId !== void 0 || value.status !== void 0 || value.subcategory !== void 0 || value.tags !== void 0 || value.title !== void 0 || value.type !== void 0 || value.verificationDueAt !== void 0, { message: "TaskUpdate requires at least one field" }).superRefine((value, context) => {
+  verificationDueAt: external_exports.string().datetime().nullable().optional(),
+  deployTargets: external_exports.array(mrrlinTaskDeployTargetInputSchema).optional(),
+  // design.md D5 step 6 hint (task 3.16): the deploy gate's own bookkeeping write when the
+  // fingerprint moved but the topology still maps the label to the same workflow. Never sent
+  // by any other caller.
+  reverifyRequested: external_exports.boolean().optional()
+}).refine((value) => value.assignee !== void 0 || value.autoDeploy !== void 0 || value.domain !== void 0 || value.autonomyLevel !== void 0 || value.autonomyReason !== void 0 || value.category !== void 0 || value.directorThreadId !== void 0 || value.dueDate !== void 0 || value.followUpAt !== void 0 || value.impact !== void 0 || value.notes !== void 0 || value.planId !== void 0 || value.specApproved !== void 0 || value.specWikiPageId !== void 0 || value.status !== void 0 || value.subcategory !== void 0 || value.tags !== void 0 || value.title !== void 0 || value.type !== void 0 || value.verificationDueAt !== void 0 || value.deployTargets !== void 0 || value.reverifyRequested !== void 0, { message: "TaskUpdate requires at least one field" }).superRefine((value, context) => {
   if (value.autonomyLevel !== void 0 && value.autonomyReason === void 0) {
     context.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -37240,6 +37292,7 @@ var mrrlinWikiPageUpdateSchema = external_exports.object({
 }).refine((value) => Object.keys(value).length > 0, { message: "WikiPageUpdate requires at least one field" });
 var mrrlinWikiPageListFiltersSchema = external_exports.object({
   folder: external_exports.string().min(1).optional(),
+  id: mrrlinWikiPageIdSchema.optional(),
   q: external_exports.string().min(1).optional(),
   taskId: mrrlinTaskIdSchema.optional()
 });
@@ -37816,7 +37869,6 @@ var mrrlinProjectSchedulerPolicyUpsertSchema = external_exports.object({
 var projectSchedulerPolicyResponseSchema = external_exports.object({
   data: mrrlinProjectSchedulerPolicySchema
 });
-var mrrlinDeployWorkflowEnvSchema = external_exports.enum(["dev", "prod"]);
 var mrrlinDeployWorkflowSourceSchema = external_exports.enum(["agent", "operator"]);
 var mrrlinDeployWorkflowStateSchema = external_exports.enum(["resolved", "ambiguous"]);
 var mrrlinProjectDeployWorkflowSchema = external_exports.object({
@@ -39301,6 +39353,29 @@ function createMrrlinClient(config2) {
         throw error51;
       }
     },
+    async getDeployTopology(projectSlug) {
+      const body = await request(`${projectPath(projectSlug)}/deploy-topology`);
+      return deployTopologyResponseSchema.parse(body).data;
+    },
+    async writeDeployTopology(projectSlug, input) {
+      const body = await request(`${projectPath(projectSlug)}/deploy-topology`, {
+        body: JSON.stringify(mrrlinDeployTopologyWriteSchema.parse(input)),
+        headers: { "content-type": "application/json" },
+        method: "PUT"
+      });
+      return deployTopologyResponseSchema.parse(body).data;
+    },
+    async getTaskDeployTarget(projectSlug, taskId, env) {
+      try {
+        const body = await request(`${projectPath(projectSlug)}/tasks/${taskId}/deploy-target/${env}`);
+        return taskDeployTargetResponseSchema.parse(body).data;
+      } catch (error51) {
+        if (error51 instanceof MrrlinApiError && error51.status === 404 && error51.code === "DEPLOY_TARGET_UNSET") {
+          return null;
+        }
+        throw error51;
+      }
+    },
     async upsertProjectDeployWorkflow(projectSlug, env, input) {
       const body = await request(`${projectPath(projectSlug)}/deploy-workflows/${env}`, {
         body: JSON.stringify(input),
@@ -39975,7 +40050,7 @@ function startCodexProbe(deps = {}) {
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.3.67";
+var PKG_VERSION = "0.3.68";
 
 // src/api-base-url-migrate.ts
 var import_node_fs2 = __toESM(require("node:fs"), 1);
@@ -42355,6 +42430,111 @@ ${body}`;
   }
   return { markdown: body, tldrChars };
 }
+function extractDeployTarget(markdown) {
+  const section = /(## Deploy Target\s*\n)([\s\S]*?)(?=\n## |$)/i.exec(markdown);
+  if (!section || section.index === void 0) {
+    return { markdown, deployTarget: null };
+  }
+  const remaining = markdown.slice(0, section.index) + markdown.slice(section.index + section[0].length);
+  const fenced = /```(?:json)?\s*\n([\s\S]*?)```/m.exec(section[2] ?? "");
+  let deployTarget = null;
+  if (fenced) {
+    try {
+      const raw = JSON.parse(fenced[1] ?? "");
+      if (raw !== null && typeof raw === "object" && typeof raw.label === "string") {
+        const parsed = { label: raw.label };
+        if (Array.isArray(raw.derive)) {
+          const derive = raw.derive.filter(isDeployTopologyEntry);
+          if (derive.length === raw.derive.length) parsed.derive = derive;
+        }
+        deployTarget = parsed;
+      }
+    } catch {
+      deployTarget = null;
+    }
+  }
+  return { markdown: remaining, deployTarget };
+}
+function isDeployTopologyEntry(value) {
+  if (value === null || typeof value !== "object") return false;
+  const e = value;
+  return typeof e.label === "string" && e.label.length > 0 && (e.env === "dev" || e.env === "prod") && typeof e.workflowId === "number" && Number.isInteger(e.workflowId) && e.workflowId > 0 && typeof e.workflowPath === "string" && e.workflowPath.length > 0 && typeof e.workflowSha === "string" && e.workflowSha.length > 0;
+}
+function buildDeployTargetPromptSection(ctx) {
+  if (ctx.kind === "closed_menu") {
+    const labels = [...new Set(ctx.entries.map((entry) => entry.label))];
+    return [
+      ``,
+      `--- DEPLOY TARGET (required final section) ---`,
+      `This project's deploy topology is already resolved for its current workflow inventory. Pick the ONE label this task deploys under from this CLOSED menu \u2014 never invent a new label:`,
+      ...labels.map((label) => `- ${label}`),
+      ``,
+      `Append a final section \`## Deploy Target\` whose ONLY content is a single fenced json block of exactly this shape:`,
+      "```json",
+      `{"label": "<one of the menu labels above>"}`,
+      "```"
+    ].join("\n");
+  }
+  return [
+    ``,
+    `--- DEPLOY TARGET (required final section) ---`,
+    `This project's deploy topology is NOT yet resolved for its current workflow inventory. Below is the raw GitHub workflow list (workflowId / path / blob sha / state); every value used below must be copied VERBATIM from it \u2014 never invented:`,
+    ``,
+    JSON.stringify(ctx.snapshot, null, 2),
+    ``,
+    `First derive the FULL label map: identify every deploy target in the snapshot, give each a short kebab-case \`label\`, and classify each workflow into an \`env\` of exactly "dev" or "prod".`,
+    `Heuristic for dev vs prod (there is no fixed naming rule): prefer an explicit \`dev-\`/\`prod-\` filename prefix, then a \`/dev/\` or \`/prod/\` directory segment; if neither applies, group the workflows serving the same target and classify from the pair's context.`,
+    `Then pick the ONE \`label\` this task deploys under, from among the labels you just derived.`,
+    ``,
+    `Append a final section \`## Deploy Target\` whose ONLY content is a single fenced json block of exactly this shape:`,
+    "```json",
+    `{"label": "<label this task deploys under>", "derive": [{"label":"<target label>","env":"dev"|"prod","workflowId":N,"workflowPath":"<path>","workflowSha":"<blob sha>"}, ...]}`,
+    "```",
+    ``,
+    `\`derive\` is the FULL map of every deploy target you can identify in the snapshot (not just this task's pick), so later tasks reuse this derivation instead of re-deriving. \`env\` must be exactly "dev" or "prod". \`workflowId\`/\`workflowPath\`/\`workflowSha\` must be copied verbatim from the snapshot above.`
+  ].join("\n");
+}
+function resolveDeployTargetRows(canonical, deployTarget, autoDeploy, fingerprint) {
+  if (autoDeploy === "off") return {};
+  const filtered = canonical.filter((entry) => entry.label === deployTarget.label);
+  const requiredEnvs = autoDeploy === "prod" ? ["dev", "prod"] : ["dev"];
+  const missingEnvs = [];
+  const deployTargets = [];
+  for (const env of requiredEnvs) {
+    const match = filtered.find((entry) => entry.env === env);
+    if (!match) {
+      missingEnvs.push(env);
+      continue;
+    }
+    deployTargets.push({
+      env,
+      targetLabel: deployTarget.label,
+      workflowId: match.workflowId,
+      workflowPath: match.workflowPath,
+      workflowSha: match.workflowSha,
+      topologyFingerprint: fingerprint
+    });
+  }
+  if (missingEnvs.length > 0) return { skippedReason: "incomplete_label", missingEnvs };
+  return { deployTargets };
+}
+function findDuplicateLabelEnvPairs(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const duplicateKeys = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const key = `${entry.label}\0${entry.env}`;
+    if (seen.has(key)) duplicateKeys.add(key);
+    seen.add(key);
+  }
+  const pairs = [];
+  for (const key of duplicateKeys) {
+    const parts = key.split("\0");
+    const label = parts[0] ?? "";
+    const env = parts[1] === "prod" ? "prod" : "dev";
+    pairs.push({ label, env });
+  }
+  return pairs;
+}
 function nextWikiPageId(pages) {
   let max = 0;
   for (const page of pages) {
@@ -42365,7 +42545,7 @@ function nextWikiPageId(pages) {
   }
   return `WK-${max + 1}`;
 }
-function buildDraftSpecPrompt(task, constitution) {
+function buildDraftSpecPrompt(task, constitution, deployTarget = null) {
   const budget = resolveSpecBudget(task.impact);
   const lines2 = [
     `Write a complete implementation spec for the task below.`,
@@ -42402,6 +42582,7 @@ function buildDraftSpecPrompt(task, constitution) {
     `The \`## TL;DR\` section MUST be at most ${DRAFT_SPEC_TLDR_MAX_CHARS} characters.`,
     `The spec MUST contain at most ${budget.maxRequirements} acceptance-criteria items and no more than ${budget.maxChars} characters total.`
   );
+  if (deployTarget) lines2.push(buildDeployTargetPromptSection(deployTarget));
   return lines2.join("\n");
 }
 function skipped(reason, extra = {}) {
@@ -42450,6 +42631,22 @@ async function runDraftSpec(ctx, input, deps) {
     }
     if (getActiveBlockedByIds(task.blockedBy, blockers).length > 0) return skipped("blocked_by_active");
   }
+  const autoDeploy = task.autoDeploy ?? "off";
+  let topology = null;
+  let deploySkippedReason = null;
+  let deploySkippedDetail = null;
+  if (autoDeploy !== "off") {
+    try {
+      topology = await client.getDeployTopology(projectSlug);
+    } catch {
+      deploySkippedReason = "topology_unavailable";
+      topology = null;
+    }
+  }
+  if (topology && (topology.fingerprint === null || topology.entries.length === 0 && topology.snapshot === null)) {
+    deploySkippedReason = topology.fingerprint === null ? "no_bound_deploy_target" : "topology_snapshot_unavailable";
+    topology = null;
+  }
   let persona;
   try {
     persona = loadPersonaFn(DRAFT_SPEC_PERSONA);
@@ -42478,7 +42675,8 @@ async function runDraftSpec(ctx, input, deps) {
   } catch {
     constitution = null;
   }
-  const prompt = buildDraftSpecPrompt(task, constitution);
+  const deployPromptContext = autoDeploy !== "off" && topology ? topology.entries.length > 0 ? { kind: "closed_menu", entries: topology.entries } : { kind: "derive", snapshot: topology.snapshot ?? [] } : null;
+  const prompt = buildDraftSpecPrompt(task, constitution, deployPromptContext);
   const exec = await runExec({
     prompt,
     developerInstructions: persona,
@@ -42493,7 +42691,8 @@ async function runDraftSpec(ctx, input, deps) {
   if (exec.text.trim().length === 0) {
     return { kind: "retry", failureReason: "zero_output", error: "spec authoring produced empty output" };
   }
-  const { markdown, tldrChars } = enforceSpecOutputContract(exec.text, taskId, task.title);
+  const { markdown: specMarkdown, deployTarget: parsedDeployTarget } = extractDeployTarget(exec.text);
+  const { markdown, tldrChars } = enforceSpecOutputContract(specMarkdown, taskId, task.title);
   let pageId;
   if (adoptedId) {
     try {
@@ -42553,6 +42752,45 @@ async function runDraftSpec(ctx, input, deps) {
     }
     pageId = created;
   }
+  let deployTargets;
+  if (topology && parsedDeployTarget) {
+    const fingerprint = topology.fingerprint;
+    if (fingerprint === null) {
+      deploySkippedReason = deploySkippedReason ?? "no_bound_deploy_target";
+    } else if (topology.entries.length > 0) {
+      const resolved = resolveDeployTargetRows(topology.entries, parsedDeployTarget, autoDeploy, fingerprint);
+      deployTargets = resolved.deployTargets;
+      if (resolved.skippedReason) {
+        deploySkippedReason = resolved.skippedReason;
+        if (resolved.skippedReason === "incomplete_label") {
+          deploySkippedDetail = `label "${parsedDeployTarget.label}" has no entry for: ${(resolved.missingEnvs ?? []).join(", ")}`;
+        }
+      }
+    } else {
+      const derive = parsedDeployTarget.derive ?? [];
+      const duplicateLabelEnvPairs = findDuplicateLabelEnvPairs(derive);
+      if (derive.length === 0) {
+        deploySkippedReason = "no_derivation";
+      } else if (duplicateLabelEnvPairs.length > 0) {
+        deploySkippedReason = "ambiguous_derivation";
+        deploySkippedDetail = `duplicate label/env pair(s): ${duplicateLabelEnvPairs.map((pair) => `${pair.label}/${pair.env}`).join(", ")}`;
+      } else {
+        try {
+          const written = await client.writeDeployTopology(projectSlug, { fingerprint, entries: derive });
+          const resolved = resolveDeployTargetRows(written.entries, parsedDeployTarget, autoDeploy, fingerprint);
+          deployTargets = resolved.deployTargets;
+          if (resolved.skippedReason) {
+            deploySkippedReason = resolved.skippedReason;
+            if (resolved.skippedReason === "incomplete_label") {
+              deploySkippedDetail = `label "${parsedDeployTarget.label}" has no entry for: ${(resolved.missingEnvs ?? []).join(", ")}`;
+            }
+          }
+        } catch {
+          deploySkippedReason = "topology_write_failed";
+        }
+      }
+    }
+  }
   let fresh;
   try {
     fresh = await client.getTask(projectSlug, taskId);
@@ -42569,8 +42807,12 @@ async function runDraftSpec(ctx, input, deps) {
   if (fresh.specWikiPageId) {
     return skipped("lost_link_race", { pageId, linkedPageId: fresh.specWikiPageId });
   }
+  const linkPatch = { specWikiPageId: pageId };
+  if (deployTargets !== void 0 && deployTargets.length > 0) {
+    linkPatch.deployTargets = deployTargets;
+  }
   try {
-    await client.updateTask(projectSlug, taskId, { specWikiPageId: pageId });
+    await client.updateTask(projectSlug, taskId, linkPatch);
   } catch (error51) {
     return {
       kind: "retry",
@@ -42578,18 +42820,20 @@ async function runDraftSpec(ctx, input, deps) {
       error: `failed to link spec page ${pageId} to task ${taskId}: ${errMessage2(error51)}`
     };
   }
+  const drafted = {
+    outcome: "DRAFTED",
+    pageId,
+    adopted: adoptedId !== null,
+    constitution: constitution !== null ? "included" : "missing",
+    tldrChars,
+    relatedContext: "skipped_no_client_method"
+  };
+  if (deploySkippedReason !== null) drafted.deployTargetSkippedReason = deploySkippedReason;
+  if (deploySkippedDetail !== null) drafted.deployTargetSkippedDetail = deploySkippedDetail;
+  drafted.taskTitle = task.title;
   return {
     kind: "done",
-    resultJson: JSON.stringify({
-      outcome: "DRAFTED",
-      pageId,
-      adopted: adoptedId !== null,
-      constitution: constitution !== null ? "included" : "missing",
-      tldrChars,
-      relatedContext: "skipped_no_client_method",
-      // Carried so onComplete can name the task in the operator notification without a re-read.
-      taskTitle: task.title
-    }),
+    resultJson: JSON.stringify(drafted),
     finalReviewedHash: null
   };
 }
@@ -42607,6 +42851,14 @@ function onComplete(outcome, input) {
         body: `Spec draft for ${input.taskId} skipped (${parsed.reason ?? "unknown"}); nothing changed.`
       };
     }
+    if (parsed.deployTargetSkippedReason === "ambiguous_derivation" || parsed.deployTargetSkippedReason === "incomplete_label") {
+      return {
+        kind: "handoff",
+        taskId: input.taskId,
+        id: `II-deploy-target-${parsed.deployTargetSkippedReason}-${input.taskId}`,
+        body: `Spec for ${input.taskId} was drafted (page ${parsed.pageId ?? "?"} in Specs/), but its deploy target needs a human: ${parsed.deployTargetSkippedDetail ?? parsed.deployTargetSkippedReason}. The spec itself proceeds to the normal consensus review; the deploy target stays unresolved until this is fixed.`
+      };
+    }
     const taskRef = parsed.taskTitle ? `${input.taskId} \u2014 ${parsed.taskTitle}` : input.taskId;
     return {
       kind: "info",
@@ -42980,34 +43232,42 @@ async function tryProdAutoRevert(deps, projectSlug, run3, task) {
     return null;
   }
 }
-function computeActiveSetFingerprint(workflows) {
-  return workflows.map((workflow) => `${workflow.id}:${workflow.path}`).sort().join(",");
-}
-async function resolveWorkflowId(deps, projectSlug, run3, env) {
+async function resolveWorkflowId(deps, projectSlug, run3, task, env) {
   const pinned = env === "dev" ? run3.devWorkflowId : run3.prodWorkflowId;
-  if (pinned) return { workflowId: pinned, source: null, resolvedFromStore: false };
-  const row = await deps.client.getProjectDeployWorkflow(projectSlug, env);
-  if (!row || row.state !== "resolved" || row.workflowId === null) {
-    return { workflowId: null, source: null, resolvedFromStore: false };
-  }
-  if (row.source !== "operator") {
-    const liveWorkflows = await deps.client.listGithubWorkflows(projectSlug);
-    const activeWorkflows = liveWorkflows.filter((workflow) => workflow.state === "active");
-    const isLive = activeWorkflows.some((workflow) => String(workflow.id) === String(row.workflowId));
-    if (!isLive) return { workflowId: null, source: null, resolvedFromStore: false };
-    const liveFingerprint = computeActiveSetFingerprint(activeWorkflows);
-    if (!row.reverifyRequested && row.activeSetFingerprint !== null && liveFingerprint !== row.activeSetFingerprint) {
-      await deps.client.upsertProjectDeployWorkflow(projectSlug, env, {
-        workflowId: row.workflowId,
-        workflowPath: row.workflowPath,
-        reason: row.reason,
-        state: row.state,
-        activeSetFingerprint: row.activeSetFingerprint,
-        reverifyRequested: true
-      });
-    }
+  if (pinned) {
+    return { workflowId: pinned, workflowPath: null, blockReason: null, pinned: true, reverifyRequested: false };
+  }
+  const target = await deps.getTaskDeployTarget(projectSlug, task.id, env);
+  if (!target) {
+    return { workflowId: null, workflowPath: null, blockReason: "deploy_target_unset", pinned: false, reverifyRequested: false };
+  }
+  const snapshot = await deps.getRepoSnapshot(projectSlug);
+  const activeWorkflows = (snapshot?.lastSnapshot ?? []).filter((w) => w.state === "active");
+  const liveMatch = activeWorkflows.find((w) => w.id === target.workflowId);
+  if (!liveMatch || liveMatch.path !== target.workflowPath) {
+    return { workflowId: null, workflowPath: null, blockReason: "deploy_target_inactive", pinned: false, reverifyRequested: false };
+  }
+  if (liveMatch.sha !== target.workflowSha) {
+    return { workflowId: null, workflowPath: null, blockReason: "deploy_target_modified", pinned: false, reverifyRequested: false };
+  }
+  const currentFingerprint = snapshot?.lastFingerprint ?? null;
+  if (currentFingerprint !== null && currentFingerprint === target.topologyFingerprint) {
+    return { workflowId: target.workflowId, workflowPath: target.workflowPath, blockReason: null, pinned: false, reverifyRequested: false };
+  }
+  if (currentFingerprint === null) {
+    deps.recordDeployTargetTelemetry("deploy_target_cache_missing");
+    return { workflowId: null, workflowPath: null, blockReason: "deploy_target_cache_missing", pinned: false, reverifyRequested: false };
   }
-  return { workflowId: row.workflowId, source: row.source, resolvedFromStore: true };
+  const entry = await deps.lookupTopologyEntry(projectSlug, currentFingerprint, target.targetLabel, env);
+  if (!entry) {
+    deps.recordDeployTargetTelemetry("deploy_target_cache_missing");
+    return { workflowId: null, workflowPath: null, blockReason: "deploy_target_cache_missing", pinned: false, reverifyRequested: false };
+  }
+  if (entry.workflowId !== target.workflowId) {
+    deps.recordDeployTargetTelemetry("deploy_target_reassigned");
+    return { workflowId: null, workflowPath: null, blockReason: "deploy_target_reassigned", pinned: false, reverifyRequested: false };
+  }
+  return { workflowId: target.workflowId, workflowPath: target.workflowPath, blockReason: null, pinned: false, reverifyRequested: true };
 }
 async function runDeployGateTick(deps, projectSlug, run3, task) {
   const artifacts = await deps.client.listExecutionArtifacts(projectSlug, run3.id);
@@ -43029,7 +43289,10 @@ async function runDeployGateTick(deps, projectSlug, run3, task) {
     return { kind: "done" };
   }
   const env = activeEnv;
-  const resolution = await resolveWorkflowId(deps, projectSlug, run3, env);
+  const resolution = await resolveWorkflowId(deps, projectSlug, run3, task, env);
+  if (resolution.reverifyRequested) {
+    await deps.setTaskReverifyRequested(projectSlug, task.id);
+  }
   const workflowId = resolution.workflowId;
   const attempt = latestByEnv(artifacts, "deploy_attempt", env, { realAttemptsOnly: true });
   if (!attempt) {
@@ -43056,9 +43319,13 @@ async function runDeployGateTick(deps, projectSlug, run3, task) {
       await deps.handoff(projectSlug, task, run3, "verification_steps_missing");
       return { kind: "handoff", reason: "verification_steps_missing" };
     }
+    if (resolution.blockReason) {
+      await deps.handoff(projectSlug, task, run3, `${resolution.blockReason}:${env}`);
+      return { kind: "handoff", reason: `${resolution.blockReason}:${env}` };
+    }
     if (!workflowId) {
-      await deps.handoff(projectSlug, task, run3, `workflow_id_missing:${env}`);
-      return { kind: "handoff", reason: `workflow_id_missing:${env}` };
+      await deps.handoff(projectSlug, task, run3, `deploy_target_unset:${env}`);
+      return { kind: "handoff", reason: `deploy_target_unset:${env}` };
     }
     if (!run3.branch) {
       await deps.handoff(projectSlug, task, run3, "run_branch_missing");
@@ -43076,19 +43343,13 @@ async function runDeployGateTick(deps, projectSlug, run3, task) {
     try {
       await deps.client.dispatchTaskDeploy(projectSlug, task.id, { env, ref: run3.branch, workflowId: String(workflowId) });
     } catch (error51) {
-      if (resolution.source === "operator") {
-        await deps.handoff(
-          projectSlug,
-          task,
-          run3,
-          `deploy_workflow_operator_choice_stale:${env}:${String(error51).slice(0, 120)}`
-        );
-        return { kind: "handoff", reason: `deploy_workflow_operator_choice_stale:${env}` };
+      if (!resolution.pinned && !resolution.reverifyRequested) {
+        deps.recordDeployTargetTelemetry("deploy_dispatch_failed_fingerprint_unchanged");
       }
       await deps.handoff(projectSlug, task, run3, `workflow_dispatch_failed:${env}:${String(error51).slice(0, 120)}`);
       return { kind: "handoff", reason: `workflow_dispatch_failed:${env}` };
     }
-    if (resolution.resolvedFromStore) {
+    if (!resolution.pinned) {
       await deps.client.updateExecutionRun(projectSlug, run3.id, {
         [env === "dev" ? "devWorkflowId" : "prodWorkflowId"]: workflowId
       });
@@ -45180,7 +45441,35 @@ async function runBackstopSweep(deps, drive = (slug, id) => driveRun(deps, slug,
                 await deployGateHandoff(deps, projectSlug, t, r.id, reason, r.leaseId);
               },
               budgetSeconds: deps.deployGate.budgetSeconds ?? deployPollBudgetSeconds(),
-              now: () => /* @__PURE__ */ new Date()
+              now: () => /* @__PURE__ */ new Date(),
+              getTaskDeployTarget: async (projectSlug, taskId, env) => deps.client.getTaskDeployTarget(projectSlug, taskId, env),
+              getRepoSnapshot: async (projectSlug) => {
+                try {
+                  const topology = await deps.client.getDeployTopology(projectSlug);
+                  return { lastFingerprint: topology.fingerprint, lastSnapshot: topology.snapshot };
+                } catch {
+                  return null;
+                }
+              },
+              lookupTopologyEntry: async (projectSlug, fingerprint, label, env) => {
+                try {
+                  const topology = await deps.client.getDeployTopology(projectSlug);
+                  if (topology.fingerprint !== fingerprint) return null;
+                  const entry = topology.entries.find((e) => e.label === label && e.env === env);
+                  return entry ? { workflowId: entry.workflowId, workflowPath: entry.workflowPath, workflowSha: entry.workflowSha } : null;
+                } catch {
+                  return null;
+                }
+              },
+              setTaskReverifyRequested: async (projectSlug, taskId) => {
+                await deps.client.updateTask(projectSlug, taskId, { reverifyRequested: true }).catch(() => {
+                });
+              },
+              recordDeployTargetTelemetry: (counter) => {
+                console.log(
+                  JSON.stringify({ event: "deploy_target_telemetry", counter, projectSlug: slug, taskId: task.id })
+                );
+              }
             };
             await runDeployGateTick(gateDeps, slug, run3, task);
           } catch {
@@ -50366,12 +50655,13 @@ var DEFAULT_DIRECTOR_BRIDGE_ALLOWED_ORIGINS = [
   "http://localhost:*",
   "http://127.0.0.1:*",
   "http://[::1]:*",
-  // Staging Vercel team migrated 2026-07-28 (see docs/reference/deployments.md). The prior
-  // fnnzzz-fnnzzzs-projects web alias was dropped once no operator was left on an old build.
-  // mrrlin2 hit usage limits and was replaced by mrrlin3 on 2026-08-11; the mrrlin2 web alias
-  // was dropped the same day since no operator was left on that build either.
-  "https://mrrlin-web-mrrlin3.vercel.app",
-  "https://app.mrrlin.dev",
+  // Staging decoupled onto the stable custom domain staging.mrrlin.com on 2026-08-14 (Cloudflare DNS
+  // in front of the mrrlin3 Vercel project). The Vercel-owned web alias (mrrlin-web-mrrlin3.vercel.app)
+  // and the old app.mrrlin.dev origin are dropped from the defaults: the browser now reaches the
+  // bridge from the owned domain, which is stable across future Vercel project/team moves.
+  // See docs/reference/deployments.md.
+  "https://staging.mrrlin.com",
+  // Production web (unchanged).
   "https://mrrlin-web.vercel.app"
 ];
 function normalizeReasoningEffort(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.3.67",
+  "version": "0.3.68",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"
@@ -21,12 +21,12 @@
     "@types/ws": "^8.18.1",
     "esbuild": "^0.24.0",
     "tsx": "^4.22.3",
-    "@mrrlin/codex-client": "0.0.0",
-    "@mrrlin/director-e2e": "0.0.0",
-    "@mrrlin/client": "0.0.0",
-    "@mrrlin/schemas": "0.0.0",
     "@mrrlin/wiki": "0.0.0",
-    "@mrrlin/tsconfig": "0.0.0"
+    "@mrrlin/schemas": "0.0.0",
+    "@mrrlin/client": "0.0.0",
+    "@mrrlin/tsconfig": "0.0.0",
+    "@mrrlin/director-e2e": "0.0.0",
+    "@mrrlin/codex-client": "0.0.0"
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",