@nanobpm/nano-workforce 0.178.5 → 0.179.0

package/openapi.yaml

@@ -2084,10 +2084,31 @@ components:
         proposal and launches the retained runner for its previewed graph. Dispatch is an operator
         action — this request carries NO graph and NO token (the graph is already staged; the operator's
         click is the approval).
+
+        Repository provisioning is REQUIRED by default (#729): the run either names EXACTLY the
+        `repository` + `baseBranch` its `agent` nodes implement against, OR opts out with `repoless: true`
+        for a genuinely checkout-less graph — never both, never neither. Modeled as `oneOf` named variants
+        (Camunda REST v2 pattern, as the convergence/plan/feature start bodies are) so the runtime rejects
+        the "neither/nor" and "both" shapes AT THE EDGE with a 400 that names the allowed shapes, rather
+        than the delegate being the only thing that enforces the mutual exclusivity. Dispatching without
+        either would silently share the worker's launch dir across concurrent fan-out agents (the issue
+        #684 field failure).
+      oneOf:
+        - $ref: "#/components/schemas/DeliveryGraphDispatchWithRepository"
+        - $ref: "#/components/schemas/DeliveryGraphDispatchRepoless"
+    DeliveryGraphDispatchWithRepository:
+      description: >-
+        The repository-provisioned dispatch shape (#729): names the `repository` + `baseBranch` the run's
+        `agent` nodes implement against, so the runner seeds the canonical
+        `io.nanobpm.agentTask.repository` isolation envelope onto every agent job. `repoless` is not a
+        member of this variant (`additionalProperties: false`), so supplying it alongside a repository is
+        rejected — the mutual exclusivity the `oneOf` enforces.
       type: object
       additionalProperties: false
       required:
         - digest
+        - repository
+        - baseBranch
       properties:
         digest:
           type: string
@@ -2123,24 +2144,77 @@ components:
           maxLength: 255
           pattern: '^[A-Za-z0-9-]+/(?!.*\.[Gg][Ii][Tt]$)[A-Za-z0-9._-]+$'
           description: >-
-            OPTIONAL `owner/repo` the run's `agent` nodes implement against (#684/#686). When supplied
-            together with `baseBranch`, the runner seeds the canonical `io.nanobpm.agentTask.repository`
-            provisioning envelope (`repoEnvelopeVars`) as a run-root process variable so every agent
-            node's servicing `senior:*` job gets an ISOLATED throwaway clone instead of inheriting the
-            worker's launch dir. Absent → no envelope (legacy launch-dir behaviour, unchanged). A value
-            that is not exactly `owner/repo` is rejected at submit.
+            The `owner/repo` the run's `agent` nodes implement against (#684/#686). REQUIRED together with
+            `baseBranch` on this variant: the runner seeds the canonical
+            `io.nanobpm.agentTask.repository` provisioning envelope (`repoEnvelopeVars`) as a run-root
+            process variable so every agent node's servicing `senior:*` job gets an ISOLATED throwaway
+            clone instead of inheriting — and clobbering — the worker's launch dir. A value that is not
+            exactly `owner/repo` is rejected at submit.
         baseBranch:
           type: string
           maxLength: 255
           pattern: '^(?![/.-])(?!.*[/.]$)(?!.*\.\.)(?!.*//)(?!.*/\.)(?!.*\.lock(?:/|$))[A-Za-z0-9._/-]+$'
           description: >-
-            OPTIONAL base branch the run's `agent` nodes branch off (#684/#686) — the `ref` the harness
-            checks out in the isolated clone (the PRE-PR shape: each agent cuts its own `feat/<node.id>`
-            branch off this base). Only consulted when `repository` is also set; absent → no envelope. A
-            value that is not a plausible git branch name (whitespace, shell metacharacters, a leading
-            `-`, `..`/`//`, a path segment starting with `.` or ending in `.lock`, etc.) is rejected at
-            submit. This pattern mirrors the authoritative server-side gate (`isPlausibleBranchName`,
-            app/baseBranch.ts) so the documented contract and the door agree.
+            The base branch the run's `agent` nodes branch off (#684/#686) — the `ref` the harness checks
+            out in the isolated clone (the PRE-PR shape: each agent cuts its own `feat/<node.id>` branch
+            off this base). REQUIRED together with `repository` on this variant. A value that is not a
+            plausible git branch name (whitespace, shell metacharacters, a leading `-`, `..`/`//`, a path
+            segment starting with `.` or ending in `.lock`, etc.) is rejected at submit. This pattern
+            mirrors the authoritative server-side gate (`isPlausibleBranchName`, app/baseBranch.ts) so the
+            documented contract and the door agree.
+    DeliveryGraphDispatchRepoless:
+      description: >-
+        The checkout-less dispatch shape (#729): an EXPLICIT `repoless: true` opt-out of repository
+        provisioning for a genuinely repo-less graph (e.g. one whose nodes touch no repository). NO
+        isolation envelope is seeded — the legacy launch-dir behaviour, but now a CONSCIOUS choice rather
+        than a silent fallback. `repository`/`baseBranch` are not members of this variant
+        (`additionalProperties: false`), so supplying either alongside `repoless: true` is rejected — the
+        mutual exclusivity the `oneOf` enforces.
+      type: object
+      additionalProperties: false
+      required:
+        - digest
+        - repoless
+      properties:
+        digest:
+          type: string
+          description: The staged proposal's content digest (its primary key) — the proposal to dispatch.
+        idempotencyKey:
+          type: string
+          maxLength: 255
+          description: OPTIONAL idempotency key. A re-dispatch with the same key (or, when omitted, the same digest) does not double-launch. Blank/whitespace is treated as absent.
+        nodeTimeout:
+          type: string
+          pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+          maxLength: 64
+          description: >-
+            OPTIONAL run-level ISO-8601 SLA timeout for `agent`/`connector` nodes (#505) — the
+            bounded-timeout → escalate boundary bound every such node inherits unless it declares its own
+            per-node `timeout`. Absent → the `PT1H` default. An invalid duration is rejected at submit.
+        probeTimeout:
+          type: string
+          pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+          maxLength: 64
+          description: >-
+            OPTIONAL run-level ISO-8601 poll budget for `wait` gates (#505) before they escalate. Absent →
+            the `PT30M` default. An invalid duration is rejected at submit.
+        escalationSlaTimeout:
+          type: string
+          pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+          maxLength: 64
+          description: >-
+            OPTIONAL run-level ISO-8601 SLA for `human` nodes (#505) before they record an `escalated`
+            outcome. Absent → the `P1D` default. An invalid duration is rejected at submit.
+        repoless:
+          type: boolean
+          enum: [true]
+          description: >-
+            EXPLICIT opt-out of repository provisioning (#729). MUST be `true` on this variant — it
+            dispatches a genuinely checkout-less graph with NO isolation envelope (the legacy launch-dir
+            behaviour, now a CONSCIOUS choice). Mutually exclusive with `repository`/`baseBranch`: those
+            fields are not members of this variant, so supplying either alongside `repoless: true` fails
+            `oneOf` matching and is a 400. To provision a repository, use the repository variant (supply
+            `repository` + `baseBranch`) and omit `repoless` entirely.
     DeliveryGraphDismissRequest:
       description: >-
         The OPERATOR dismiss request (#520). The cockpit's staged-proposals grid posts the content

package/operations/dispatchDeliveryGraph.test.ts

@@ -50,7 +50,10 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
   test("a missing/blank digest → 400 with a human error, nothing launched", async () => {
     const app = await boot();
     assert.ok(app.api);
-    const res = await app.api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", { body: { digest: "  " } });
+    // Carry a valid `repoless: true` variant so the body clears the edge `oneOf` and reaches the door's
+    // own blank-digest guard (the concern under test) rather than being rejected earlier as a shapeless
+    // request — a blank digest is still a clean 400 with a human error, launching nothing.
+    const res = await app.api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", { body: { digest: "  ", repoless: true } });
     assert.equal(res.status, 400);
     assert.equal(res.body.ok, false);
     assert.ok(typeof res.body.error === "string" && res.body.error.length > 0);
@@ -60,7 +63,7 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
   test("an unknown / never-staged digest → 400, nothing launched", async () => {
     const app = await boot();
     assert.ok(app.api);
-    const res = await app.api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", { body: { digest: "deadbeef0000" } });
+    const res = await app.api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", { body: { digest: "deadbeef0000", repoless: true } });
     assert.equal(res.status, 400);
     assert.equal(res.body.ok, false);
     assert.ok(/no staged proposal/.test(res.body.error ?? ""));
@@ -82,7 +85,7 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     // The operator dispatches that digest.
     const res = await api.call<{ ok: boolean; status: string; runKey: string; alreadyRunning?: boolean }>(
       "dispatchDeliveryGraph",
-      { body: { digest } },
+      { body: { digest, repoless: true } },
     );
     assert.equal(res.status, 202);
     assert.equal(res.body.ok, true);
@@ -107,7 +110,7 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
 
     const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SIDE_EFFECTING });
     const res = await api.call<{ ok: boolean; status: string; sideEffecting: boolean }>("dispatchDeliveryGraph", {
-      body: { digest: staged.body.digest },
+      body: { digest: staged.body.digest, repoless: true },
     });
     assert.equal(res.status, 202);
     assert.equal(res.body.ok, true);
@@ -122,9 +125,9 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     assert.ok(app.api);
     const api = app.api;
     const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
-    await api.call("dispatchDeliveryGraph", { body: { digest: staged.body.digest } });
+    await api.call("dispatchDeliveryGraph", { body: { digest: staged.body.digest, repoless: true } });
     await app.settle();
-    const again = await api.call<{ ok: boolean }>("dispatchDeliveryGraph", { body: { digest: staged.body.digest } });
+    const again = await api.call<{ ok: boolean }>("dispatchDeliveryGraph", { body: { digest: staged.body.digest, repoless: true } });
     assert.equal(again.status, 400);
     assert.equal(again.body.ok, false);
     // Still exactly one run — the consumed proposal cannot re-launch.
@@ -143,7 +146,7 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
 
     // Dispatch graph A under a shared idempotencyKey — it launches and stays running (parks on a human).
     const first = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
-      body: { digest: a.body.digest, idempotencyKey: "shared-key" },
+      body: { digest: a.body.digest, idempotencyKey: "shared-key", repoless: true },
     });
     assert.equal(first.status, 202);
     await app.settle();
@@ -151,7 +154,7 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     // Dispatch graph B under the SAME idempotencyKey — it short-circuits onto A's run. B's graph was
     // never launched, so B must NOT be consumed: refuse with 409 and leave B staged.
     const second = await api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", {
-      body: { digest: b.body.digest, idempotencyKey: "shared-key" },
+      body: { digest: b.body.digest, idempotencyKey: "shared-key", repoless: true },
     });
     assert.equal(second.status, 409);
     assert.equal(second.body.ok, false);
@@ -174,7 +177,7 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     assert.equal((await deliveryGraphProposals(app.db).get(digest))?.status, "staged");
     await deliveryGraphProposals(app.db).update(digest, { graph: "{not-json" });
 
-    const res = await api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", { body: { digest } });
+    const res = await api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", { body: { digest, repoless: true } });
     assert.equal(res.status, 400);
     assert.equal(res.body.ok, false);
     assert.ok(/corrupt/.test(res.body.error ?? ""));
@@ -238,7 +241,7 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     const api = app.api;
     const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
     const res = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
-      body: { digest: staged.body.digest, nodeTimeout: "PT2H" },
+      body: { digest: staged.body.digest, nodeTimeout: "PT2H", repoless: true },
     });
     assert.equal(res.status, 202);
     assert.equal(res.body.ok, true);
@@ -309,4 +312,127 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
     assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "dispatched");
   });
+
+  // Issue #729: the fan-out dispatch door must REQUIRE repository provisioning — either a resolvable
+  // `repository` + `baseBranch`, or an EXPLICIT `repoless: true` opt-out — so it can never silently
+  // dispatch envelope-less and let concurrent fan-out agents share (and clobber) the worker's launch
+  // dir (issue #684's field failure re-opened as a silent fallback). This "neither/nor" shape is now
+  // rejected at the EDGE by the request `oneOf` (the two allowed variants), not only inside the door.
+  test("a dispatch with NEITHER repository/baseBranch NOR repoless is rejected at submit → 400, nothing launched (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest },
+    });
+    assert.equal(res.status, 400);
+    // The `oneOf` edge validator names the two allowed shapes — the neither/nor body matches neither.
+    assert.ok(typeof res.body.error === "string" && res.body.error.length > 0);
+    // Loud, not silent: nothing launched and the proposal stays staged (re-dispatchable once a repo /
+    // repoless choice is supplied).
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  test("a dispatch with ONLY repository (no baseBranch) is rejected → 400, nothing launched (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, repository: "owner/repo" },
+    });
+    assert.equal(res.status, 400);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  test("a dispatch with ONLY baseBranch (no repository) is rejected → 400, nothing launched (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, baseBranch: "main" },
+    });
+    assert.equal(res.status, 400);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  test("an EXPLICIT repoless: true dispatches a checkout-less graph → 202 running (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, repoless: true },
+    });
+    assert.equal(res.status, 202);
+    assert.equal(res.body.ok, true);
+    assert.equal(res.body.status, "running");
+    await app.settle();
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "dispatched");
+  });
+
+  test("repoless: true is mutually exclusive with repository/baseBranch → 400, nothing launched (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, repoless: true, repository: "owner/repo", baseBranch: "main" },
+    });
+    assert.equal(res.status, 400);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  test("a non-boolean repoless is rejected at submit → 400, nothing launched (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, repoless: "yes" },
+    });
+    assert.equal(res.status, 400);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  // `repoless` is a `true`-only opt-out (OpenAPI `oneOf`: `enum: [true]` on the repoless variant, absent
+  // from the repository variant with `additionalProperties: false`). An explicit `repoless: false` — with
+  // OR without a repository envelope — must be a clean 400 at the contract boundary, never silently folded
+  // into the "not repoless" path. The edge schema rejects it end-to-end here; the door's own guard
+  // (dispatchDeliveryGraph.ts) mirrors it as defense-in-depth for any non-schema-validated caller.
+  test("an explicit repoless: false (bare) is rejected at submit → 400, nothing launched (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, repoless: false },
+    });
+    assert.equal(res.status, 400);
+    assert.ok(typeof res.body.error === "string" && res.body.error.length > 0);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  test("an explicit repoless: false alongside a repository envelope is rejected → 400, nothing launched (#729)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, repository: "owner/repo", baseBranch: "main", repoless: false },
+    });
+    assert.equal(res.status, 400);
+    assert.ok(typeof res.body.error === "string" && res.body.error.length > 0);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
 });

package/operations/dispatchDeliveryGraph.ts

@@ -108,6 +108,54 @@ export default defineOperation("dispatchDeliveryGraph", async ({ body }, app) =>
     baseBranch = baseRaw;
   }
 
+  // Repository provisioning is REQUIRED on this fan-out door (issue #729): a delivery-graph run whose
+  // `agent` nodes implement against a repo MUST be dispatched with a resolvable `repository` + base
+  // branch so every `senior:*` job provisions an ISOLATED clone. Silently dispatching envelope-less
+  // (issue #684's field failure, re-opened as a silent fallback) let concurrent fan-out workers on one
+  // host share — and clobber — a single launch-dir checkout. So the operator must EITHER supply BOTH
+  // `repository` and `baseBranch`, OR explicitly opt out with `repoless: true` for a genuinely
+  // checkout-less graph — the default can never silently share a checkout.
+  const hasRepoless = body !== null && typeof body === "object" && "repoless" in body;
+  const repolessRaw = hasRepoless ? body.repoless : undefined;
+  // `repoless` is a `true`-ONLY opt-out, exactly as the OpenAPI `oneOf` models it: it is `enum: [true]`
+  // on the repoless variant and NOT a member of the repository variant (`additionalProperties: false`).
+  // So reject any present-but-not-`true` value — `false`, `"yes"`, `0`, … — rather than silently folding
+  // `repoless: false` into the "not repoless" path. Otherwise a caller that bypasses schema validation
+  // could send `{ digest, repository, baseBranch, repoless: false }` (or `{ digest, repoless: false }`)
+  // and slip through with a confusing tri-state the `oneOf` contract never permits.
+  if (hasRepoless && repolessRaw !== true) {
+    app.log.warn("dispatch-delivery-graph rejected: repoless is a true-only opt-out", { type: typeof repolessRaw });
+    return {
+      status: 400,
+      body: {
+        ok: false,
+        error: "`repoless` is a `true`-only opt-out — omit it to provision a repository (with `repository` + `baseBranch`), or set `repoless: true` to dispatch a checkout-less graph",
+      },
+    };
+  }
+  const repoless = repolessRaw === true;
+  if (repoless && (repository !== undefined || baseBranch !== undefined)) {
+    app.log.warn("dispatch-delivery-graph rejected: repoless with repository/baseBranch");
+    return {
+      status: 400,
+      body: { ok: false, error: "`repoless: true` is mutually exclusive with `repository`/`baseBranch` — pass one or the other, not both" },
+    };
+  }
+  if (!repoless && (repository === undefined || baseBranch === undefined)) {
+    app.log.warn("dispatch-delivery-graph rejected: missing repository/baseBranch (no repoless opt-in)", {
+      hasRepository: repository !== undefined,
+      hasBaseBranch: baseBranch !== undefined,
+    });
+    return {
+      status: 400,
+      body: {
+        ok: false,
+        error:
+          "a delivery-graph dispatch must provision an isolated checkout: supply BOTH `repository` (`owner/repo`) and `baseBranch`, or set `repoless: true` to dispatch a checkout-less graph — dispatching without either would silently share the worker's launch dir across agents (issue #729)",
+      },
+    };
+  }
+
   // Load the live staged proposal for this digest — refuses an unknown/expired/superseded/already-
   // dispatched digest cleanly (no run is launched).
   const proposal = await getStagedProposal(app.data, digest);
@@ -131,7 +179,7 @@ export default defineOperation("dispatchDeliveryGraph", async ({ body }, app) =>
     return { status: 400, body: { ok: false, error: `staged proposal ${digest} is corrupt: ${err instanceof Error ? err.message : String(err)}` } };
   }
 
-  const dispatched = await dispatchDeliveryGraphRun(app, graph, { runKey: idempotencyKey, title: proposal.title, repository, baseBranch, ...timeouts });
+  const dispatched = await dispatchDeliveryGraphRun(app, graph, { runKey: idempotencyKey, title: proposal.title, repository, baseBranch, repoless, ...timeouts });
   if (!dispatched.ok) {
     app.log.warn("dispatch-delivery-graph refused: compile", { digest, errors: dispatched.errors.length });
     const outBody: DeliveryGraphTextResult = {

package/operations/listStagedProposals.test.ts

@@ -115,7 +115,7 @@ describe("listStagedProposals — the live staged-proposals list", () => {
     const digest = staged.body.digest;
     assert.equal((await api.call<ListResponse>("listStagedProposals", {})).body.count, 1);
 
-    const dispatched = await api.call<{ ok: boolean }>("dispatchDeliveryGraph", { body: { digest } });
+    const dispatched = await api.call<{ ok: boolean }>("dispatchDeliveryGraph", { body: { digest, repoless: true } });
     assert.equal(dispatched.body.ok, true);
 
     const after = await api.call<ListResponse>("listStagedProposals", {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.178.5",
+  "version": "0.179.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/delivery-graphs/delivery-graphs.css

@@ -206,6 +206,33 @@
   min-width: 200px;
 }
 
+/* The inline Dispatch envelope fields (issue #729): the operator supplies `repository` + `baseBranch`
+   (or ticks "checkout-less") before confirming a dispatch, since a staged proposal carries no repo
+   metadata. A disabled repo/base input (dimmed) reads as inactive while checkout-less is ticked. */
+.dg .confirm-field {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  color: #d7e0ea;
+  font-size: 13px;
+}
+
+.dg .confirm-field .confirm-input {
+  min-width: 160px;
+}
+
+.dg .confirm-input:disabled {
+  opacity: 0.5;
+}
+
+.dg .confirm-check {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  color: #d7e0ea;
+  font-size: 13px;
+}
+
 /* The filesystem Import control (issue #524): a <label class="btn"> wrapping a visually-hidden native
    <input type=file>, so the file picker reads as a button consistent with the other actions. The label
    dims while its input is disabled (busy) via :has(), mirroring .btn:disabled. */

package/pages/delivery-graphs/staged.mount.js

@@ -3,8 +3,10 @@
 // has staged: it lists every LIVE staged proposal and, per row, offers
 //   • Preview DI  — recompile the proposal's BPMN (with diagram interchange) and hand it UP to the host
 //     console's process explorer over the `nano-navigate` bridge, rendered read-only BEFORE dispatch;
-//   • Dispatch    — the operator's launch action (#460): POST the proposal's `digest` to the dispatch
-//     door. Clicking Dispatch IS the approval, content-addressed to exactly the graph previewed.
+//   • Dispatch    — the operator's launch action (#460): POST the proposal's `digest` — plus the
+//     repository-isolation envelope (`repository` + `baseBranch`, or an explicit `repoless` opt-out,
+//     #729) the operator supplies inline — to the dispatch door. Clicking Dispatch IS the approval,
+//     content-addressed to exactly the graph previewed.
 //
 // It REPLACES the old declarative `dataGrid` (a grid row-action can POST but cannot take the recompiled
 // BPMN and `postMessage` it to the explorer — so a staged proposal had a Dispatch button but no way to
@@ -97,10 +99,23 @@ function isPending(pending, kind, digest) {
 // The Dispatch affordance for a row: normally a single button; while its inline confirmation is open,
 // an in-DOM "Confirm dispatch / Cancel" pair (NOT a native window.confirm, suppressed in the sandboxed
 // App-View iframe — #569). Clicking "Confirm dispatch" IS the operator approval (#460).
+//
+// The dispatch door (issue #729) now REQUIRES a repository-isolation envelope: the operator must supply
+// BOTH `repository` (`owner/repo`) and `baseBranch`, OR explicitly opt out with `repoless` for a
+// checkout-less graph — dispatching with neither would silently share the worker's launch dir across
+// agents. A staged proposal carries no repository metadata, so the operator provides it HERE at
+// dispatch time via the inline fields below. Ticking "checkout-less" disables the repo/base inputs.
 function dispatchControl(p, pending) {
   if (isPending(pending, "dispatch", p.digest)) {
+    const repository = typeof pending.repository === "string" ? pending.repository : "";
+    const baseBranch = typeof pending.baseBranch === "string" ? pending.baseBranch : "";
+    const repoless = pending.repoless === true;
+    const provDisabled = repoless ? " disabled" : "";
     return `<span class="confirm" data-confirm="dispatch">
       <span class="confirm-msg">${esc(DISPATCH_CONFIRM)}</span>
+      <label class="confirm-field">Repository <input class="confirm-input" type="text" data-dispatch-repository="${esc(p.digest)}" value="${esc(repository)}" placeholder="owner/repo" aria-label="Repository (owner/repo)"${provDisabled} /></label>
+      <label class="confirm-field">Base branch <input class="confirm-input" type="text" data-dispatch-base="${esc(p.digest)}" value="${esc(baseBranch)}" placeholder="main" aria-label="Base branch"${provDisabled} /></label>
+      <label class="confirm-check"><input type="checkbox" data-dispatch-repoless="${esc(p.digest)}"${repoless ? " checked" : ""} /> Dispatch checkout-less (no repository)</label>
       <button class="btn btn-primary" type="button" data-dispatch-confirm="${esc(p.digest)}">Confirm dispatch</button>
       <button class="btn btn-ghost" type="button" data-dispatch-cancel="${esc(p.digest)}">Cancel</button>
     </span>`;
@@ -230,9 +245,11 @@ export function mountStagedProposals(host, config = {}) {
   // click can re-render the SAME list synchronously (without waiting for the next poll).
   let currentProposals = [];
   // The single open in-DOM confirmation, or null. Shape: { kind: "dispatch"|"dismiss"|"save",
-  // digest: string, name?: string }. This REPLACES the native window.confirm/window.prompt the console's
-  // sandboxed App-View iframe suppresses (#569): the operator approval is an inline two-step control
-  // (Confirm/Cancel) or an inline name input, rendered by renderProposal from this state.
+  // digest: string, name?: string, repository?: string, baseBranch?: string, repoless?: boolean }. This
+  // REPLACES the native window.confirm/window.prompt the console's sandboxed App-View iframe suppresses
+  // (#569): the operator approval is an inline two-step control (Confirm/Cancel), an inline name input
+  // (Save), or — for Dispatch — the repository/baseBranch/repoless envelope fields (#729), all rendered
+  // by renderProposal from this state so a background poll re-render preserves what the operator typed.
   let pending = null;
   // A re-render (renderList → new buttons) resets every button to enabled, so the disabled state is
   // NOT stored on the elements — it is derived from busyCount and re-applied after each render (below)
@@ -352,13 +369,26 @@ export function mountStagedProposals(host, config = {}) {
   // the click handler, #569) — by the time we're here the operator has clicked "Confirm dispatch", so we
   // POST the digest to the dispatch door; on success the proposal flips to `dispatched` and drops off
   // the list on the next poll — refresh immediately so the operator sees it leave.
-  async function doDispatch(digest) {
+  async function doDispatch(digest, opts) {
     const staged = typeof digest === "string" ? digest.trim() : "";
     if (staged === "") return;
+    const options = opts && typeof opts === "object" ? opts : {};
+    const repoless = options.repoless === true;
+    const repository = typeof options.repository === "string" ? options.repository.trim() : "";
+    const baseBranch = typeof options.baseBranch === "string" ? options.baseBranch.trim() : "";
+    // The dispatch door (issue #729) requires an isolation envelope: BOTH `repository` + `baseBranch`,
+    // or an explicit `repoless: true` opt-out. Guard here so the operator gets an inline hint instead of
+    // a bare 400 from the door (the confirm has already been closed by the click handler on a valid one).
+    if (!repoless && (repository === "" || baseBranch === "")) {
+      setStatus("Provide both a repository (owner/repo) and a base branch, or tick “Dispatch checkout-less”.", "err");
+      return;
+    }
+    // Mirror the door's mutual-exclusivity contract: pass EITHER the repo envelope OR `repoless`, never both.
+    const payload = repoless ? { digest: staged, repoless: true } : { digest: staged, repository, baseBranch };
     busy(true);
     setStatus("Dispatching…");
     try {
-      const { status, body } = await post(dispatchUrl, { digest: staged });
+      const { status, body } = await post(dispatchUrl, payload);
       if ((status === 202 || status === 200) && body.ok) {
         setStatus("\u2713 Dispatched — the run is now in flight.", "ok");
         await refresh();
@@ -431,7 +461,7 @@ export function mountStagedProposals(host, config = {}) {
   function openConfirm(kind, digest, name) {
     const staged = typeof digest === "string" ? digest.trim() : "";
     if (staged === "") return;
-    pending = { kind, digest: staged, name: typeof name === "string" ? name : "" };
+    pending = { kind, digest: staged, name: typeof name === "string" ? name : "", repository: "", baseBranch: "", repoless: false };
     rerender();
     // Move focus into the name input so the operator can type immediately (best-effort; not all hosts
     // implement focus()).
@@ -459,12 +489,49 @@ export function mountStagedProposals(host, config = {}) {
     return input && typeof input.value === "string" ? input.value : "";
   }
 
-  // Keep pending.name in sync as the operator types, so a background poll re-render (or a later confirm)
-  // preserves what they've entered.
+  // Read the current text of an inline Dispatch envelope field (`repository`/`base`) for `digest`.
+  function readDispatchField(digest, which) {
+    const attr = which === "repository" ? "data-dispatch-repository" : "data-dispatch-base";
+    const input = listEl.querySelector(`[${attr}="${cssAttr(digest)}"]`);
+    return input && typeof input.value === "string" ? input.value : "";
+  }
+
+  // Read the current state of the inline "Dispatch checkout-less" checkbox for `digest`.
+  function readRepoless(digest) {
+    const box = listEl.querySelector(`[data-dispatch-repoless="${cssAttr(digest)}"]`);
+    return !!(box && box.checked);
+  }
+
+  // Keep pending in sync as the operator types, so a background poll re-render (or a later confirm)
+  // preserves what they've entered — the library name (Save) and the repo/base envelope fields (Dispatch).
   listEl.addEventListener("input", (ev) => {
-    const input = ev.target && ev.target.closest ? ev.target.closest("[data-library-name]") : null;
-    if (input && pending != null && pending.kind === "save") {
-      pending.name = typeof input.value === "string" ? input.value : "";
+    const target = ev.target && ev.target.closest ? ev.target : null;
+    if (target == null || pending == null) return;
+    if (pending.kind === "save") {
+      const input = target.closest("[data-library-name]");
+      if (input) pending.name = typeof input.value === "string" ? input.value : "";
+      return;
+    }
+    if (pending.kind === "dispatch") {
+      const repoInput = target.closest("[data-dispatch-repository]");
+      if (repoInput) {
+        pending.repository = typeof repoInput.value === "string" ? repoInput.value : "";
+        return;
+      }
+      const baseInput = target.closest("[data-dispatch-base]");
+      if (baseInput) pending.baseBranch = typeof baseInput.value === "string" ? baseInput.value : "";
+    }
+  });
+
+  // The "Dispatch checkout-less" checkbox toggles the repo/base inputs (disabled when checkout-less), so
+  // re-render on change — first hoisting the live text values into pending so the toggle doesn't drop them.
+  listEl.addEventListener("change", (ev) => {
+    const box = ev.target && ev.target.closest ? ev.target.closest("[data-dispatch-repoless]") : null;
+    if (box && pending != null && pending.kind === "dispatch") {
+      pending.repository = readDispatchField(pending.digest, "repository");
+      pending.baseBranch = readDispatchField(pending.digest, "base");
+      pending.repoless = !!box.checked;
+      rerender();
     }
   });
 
@@ -490,8 +557,20 @@ export function mountStagedProposals(host, config = {}) {
     if (dispatchConfirmBtn) {
       ev.preventDefault();
       const digest = dispatchConfirmBtn.getAttribute("data-dispatch-confirm");
+      const isThisPending = pending != null && pending.kind === "dispatch" && pending.digest === digest;
+      // `pending.repoless` is the durable source of truth (synced on the checkbox `change`); fall back to
+      // the live DOM checkbox so a confirm without a prior toggle still reads correctly.
+      const repoless = readRepoless(digest) || (isThisPending && pending.repoless === true);
+      const repository = readDispatchField(digest, "repository").trim();
+      const baseBranch = readDispatchField(digest, "base").trim();
+      // Keep the inline confirmation OPEN on an incomplete envelope so the operator can fix it in place
+      // (issue #729) — closing it would drop the fields they'd started filling.
+      if (!repoless && (repository === "" || baseBranch === "")) {
+        setStatus("Provide both a repository (owner/repo) and a base branch, or tick “Dispatch checkout-less”.", "err");
+        return;
+      }
       closeConfirm();
-      doDispatch(digest);
+      doDispatch(digest, { repository, baseBranch, repoless });
       return;
     }
     const dispatchCancelBtn = closest("[data-dispatch-cancel]");