@nanobpm/nano-workforce 0.184.0 → 0.185.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.185.0](https://github.com/nanobpm/nano-workforce/compare/v0.184.1...v0.185.0) (2026-09-08)
+
+### Features
+
+* **delivery:** auto-inject the producer-completion contract into every agent node's prompt ([#761](https://github.com/nanobpm/nano-workforce/issues/761)) ([3eb90a3](https://github.com/nanobpm/nano-workforce/commit/3eb90a3ed3bca8a5fc8cb542716f9d19fa82a541)), closes [#731](https://github.com/nanobpm/nano-workforce/issues/731) [#551](https://github.com/nanobpm/nano-workforce/issues/551) [#506](https://github.com/nanobpm/nano-workforce/issues/506) [#731](https://github.com/nanobpm/nano-workforce/issues/731) [#760](https://github.com/nanobpm/nano-workforce/issues/760) [#731](https://github.com/nanobpm/nano-workforce/issues/731) [#731](https://github.com/nanobpm/nano-workforce/issues/731)
+
+## [0.184.1](https://github.com/nanobpm/nano-workforce/compare/v0.184.0...v0.184.1) (2026-09-08)
+
+### Bug Fixes
+
+* **delivery:** allow node repositories in staged dispatch form ([#759](https://github.com/nanobpm/nano-workforce/issues/759)) ([a9fb9f6](https://github.com/nanobpm/nano-workforce/commit/a9fb9f672a2b3cd365c191755847a303b906a343)), closes [#758](https://github.com/nanobpm/nano-workforce/issues/758)
+
 ## [0.184.0](https://github.com/nanobpm/nano-workforce/compare/v0.183.2...v0.184.0) (2026-09-07)
 
 ### Features

package/app/deliveryGraphCompiler.ts

@@ -119,8 +119,11 @@ function contractEscalationTaskElement(element: string): string {
  * and escalates AT the node instead of threading an incomplete result into a downstream consumer. An
  * ABSENT/null status passes the gate (a status-less completion — an older fleet worker or a bare test
  * stub — is not itself the failure mode; the required-emit gate still catches a missing data fact).
- * Sorted for the compiler's byte-identical-output determinism. */
-const AGENT_TERMINAL_SUCCESS_STATUSES: readonly string[] = ["done", "opened", "skipped"];
+ * Sorted for the compiler's byte-identical-output determinism. Exported as the SINGLE SOURCE OF TRUTH:
+ * the compiler's contract gate reads it here, and the runner's `renderProducerContract` (#760) derives
+ * the agent-facing status vocabulary from the SAME list — changing it changes both the gate and the
+ * prompt at once, so the two representations of the producer contract can never drift. */
+export const AGENT_TERMINAL_SUCCESS_STATUSES: readonly string[] = ["done", "opened", "skipped"];
 
 /** A never-reached exhaustiveness guard: `compileNode`'s `switch` covers every allowlisted kind, so
  * the closed union narrows to `never` here. If a future kind is added to the vocabulary without a

package/app/deliveryRunner.test.ts

@@ -11,7 +11,8 @@
 // proven end-to-end in `e2e/delivery-graph.e2e.ts`.
 import { test } from "node:test";
 import { assert, assertEquals, assertRejects } from "#test-assert";
-import { prepareDeliveryGraph, renderIdempotencyPreamble, runDeliveryGraph } from "./deliveryRunner.ts";
+import { AGENT_TERMINAL_SUCCESS_STATUSES } from "./deliveryGraphCompiler.ts";
+import { prepareDeliveryGraph, renderEmitContract, renderIdempotencyPreamble, renderProducerContract, runDeliveryGraph } from "./deliveryRunner.ts";
 import { RepoEnvelopeConflictError, RepoEnvelopeUnresolvedError } from "./repoEnvelope.ts";
 import type { DeliveryGraph } from "../nano-generated/api-io.d.ts";
 
@@ -76,8 +77,9 @@ test("nodeInputs seeds the exact per-kind fields each node's subProcess ioMappin
 
   const agent = byField((v) => v.jobType === "senior:feature");
   // Every agent node's appendPrompt is prefixed with the idempotency preflight (#551), then the
-  // authored prompt (this node declares no emits, so the emit contract adds nothing).
-  assertEquals(agent, { jobType: "senior:feature", appendPrompt: renderIdempotencyPreamble() + "un-draft + merge #B", timeout: "PT10M" });
+  // authored prompt, then the (emit-less) producer completion contract (#760) — this node declares no
+  // emits, so the emit contract adds nothing but the status block still applies.
+  assertEquals(agent, { jobType: "senior:feature", appendPrompt: renderIdempotencyPreamble() + "un-draft + merge #B" + renderEmitContract([]) + renderProducerContract([]), timeout: "PT10M" });
 
   const wait = byField((v) => "gateKey" in v);
   assertEquals(wait?.gateKey, "run-7:n3");
@@ -156,9 +158,103 @@ test("agent node classifier-emit contract (#506): a declared `emits` threads the
   assert(adoptPrompt.includes("breaking | compatible"), "the fact's optional description rides the contract");
   assert(adoptPrompt.includes("AGENT_RESULT_FILE"), "the contract names the completion channel the fact rides");
 
-  // A node that declares NO facts still carries the preflight, then exactly the authored prompt — the
-  // emit contract contributes nothing.
-  assertEquals(plain?.appendPrompt, renderIdempotencyPreamble() + "just implement it");
+  // A node that declares NO facts still carries the preflight and the (emit-less) producer contract,
+  // then exactly the authored prompt — the emit contract contributes nothing.
+  assertEquals(plain?.appendPrompt, renderIdempotencyPreamble() + "just implement it" + renderEmitContract([]) + renderProducerContract([]));
+});
+
+test("agent node producer completion contract (#760): every agent prompt carries the terminal-status vocabulary derived from AGENT_TERMINAL_SUCCESS_STATUSES + required-emit names; a non-agent node never does", async () => {
+  // #760: the #731 producer gate's terminal-status vocabulary (AGENT_TERMINAL_SUCCESS_STATUSES) lived
+  // ONLY in the compiler's gate — nothing told the agent which statuses count as success, so a
+  // correctly-done agent that self-reported `status: "success"` was parked on a __contract escalation
+  // (instance 15697). Auto-inject the vocabulary into every agent node's appendPrompt, derived from the
+  // single source of truth so the list and the prompt can never drift.
+  const graph: DeliveryGraph = {
+    name: "producer contract",
+    nodes: [
+      { id: "emit", kind: "agent", agent: { jobType: "senior:feature", prompt: "do the thing" }, emits: [{ name: "pr", type: "pr" }] },
+      { id: "plain", kind: "agent", agent: { jobType: "senior:feature", prompt: "no emits here" } },
+      { id: "gate", kind: "wait", wait: { kind: "pr", target: "owner/repo#1", match: { prState: "merged" } } },
+    ],
+    edges: [{ from: "emit.pr", to: "plain" }, { from: "plain", to: "gate" }],
+  };
+  const p = await prepareOk(graph);
+  const agents = Object.values(p.nodeInputs).filter((v) => "jobType" in v) as Array<Record<string, unknown>>;
+  assertEquals(agents.length, 2, "both agent nodes are seeded");
+
+  // Every agent node — emit-declaring OR not — carries the producer contract heading and the EXACT
+  // allowlist strings, derived from the single source of truth.
+  for (const a of agents) {
+    const prompt = String(a.appendPrompt);
+    assert(prompt.includes("Producer completion contract"), `every agent prompt carries the producer contract, got: ${prompt}`);
+    for (const status of AGENT_TERMINAL_SUCCESS_STATUSES) {
+      assert(prompt.includes(`\`${status}\``), `the allowlist status ${status} is surfaced verbatim, got: ${prompt}`);
+    }
+    assert(prompt.includes("escalation"), "it warns an out-of-vocabulary status parks a human escalation");
+  }
+
+  // The emit-declaring node names its required emit in the producer contract; the no-emit node carries
+  // the status block unchanged in every other respect (per #760 acceptance) but names no emit.
+  const emit = agents.find((v) => String(v.appendPrompt).includes("do the thing"));
+  const plain = agents.find((v) => String(v.appendPrompt).includes("no emits here"));
+  assert(String(emit?.appendPrompt).includes(renderProducerContract([{ name: "pr", type: "pr" }])), "the emit-declaring node's producer contract names its required emit");
+  assert(String(plain?.appendPrompt).includes(renderProducerContract([])), "the no-emit node still carries the status block");
+
+  // The vocabulary is AGENT-ONLY — a wait node's seed carries no prompt at all.
+  const wait = Object.values(p.nodeInputs).find((v) => "gateKey" in v) as Record<string, unknown> | undefined;
+  assert(wait, "the wait node is seeded");
+  assert(!("appendPrompt" in wait!), "a non-agent node never carries the producer completion contract");
+});
+
+
+test("producer contract required-emit subset (#761): a routing-only emit is NOT listed as a required field, but the classifier-emit contract still names it", async () => {
+  // #761: `renderProducerContract` was passed a node's FULL declared `emits`, so it told the agent to
+  // populate EVERY declared emit non-null — even a routing-only fact (named only in an edge `when`
+  // guard) that the #731 gate deliberately leaves optional. That contradicted the classifier-emit
+  // contract's "OMIT an undecidable routing fact (default branch)" guidance and pushed agents to guess.
+  // The producer contract must list ONLY the required-data-dependency subset (`from: "<node>.<fact>"`),
+  // while the emit contract still lists every declared fact.
+  const graph: DeliveryGraph = {
+    name: "routing-only producer",
+    nodes: [
+      { id: "classify", kind: "agent", agent: { jobType: "senior:feature", prompt: "classify it" }, emits: [{ name: "decision", type: "string" }] },
+      { id: "migrate", kind: "connector", connector: { target: "npm:install", dedupeKey: "m-1" } },
+      { id: "release", kind: "connector", connector: { target: "npm:publish", dedupeKey: "r-1" } },
+    ],
+    edges: [
+      { from: "classify", to: "migrate", when: "classify.decision", equals: "breaking" },
+      { from: "classify", to: "release", default: true },
+    ],
+  };
+  const p = await prepareOk(graph);
+  const classify = Object.values(p.nodeInputs).find((v) => "jobType" in v && String((v as Record<string, unknown>).appendPrompt).includes("classify it")) as Record<string, unknown> | undefined;
+  assert(classify, "the classify agent node is seeded");
+  const prompt = String(classify!.appendPrompt);
+  // The producer contract still gates on status but names NO required emit (routing-only ⇒ optional).
+  assert(prompt.includes("Producer completion contract"), "the producer contract is present");
+  assert(prompt.includes(renderProducerContract([])), "the producer contract lists no required emit for a purely routing-only producer");
+  assert(!prompt.includes("populate each of these top-level fields"), "no required-emit sentence is rendered when every emit is routing-only");
+  // The classifier-emit contract STILL tells the agent to return the routing fact (and omit if undecidable).
+  assert(prompt.includes("Classifier emit contract"), "the classifier-emit contract is present");
+  assert(prompt.includes("`decision`"), "the routing fact is still named by the classifier-emit contract");
+});
+
+
+test("producer contract semantics coverage (#761 follow-up): renderProducerContract emits a documented bullet for EVERY allowlisted status and fails fast on an undocumented one", () => {
+  // Copilot review follow-up: `renderProducerContract` previously FILTERED the allowlist against
+  // PRODUCER_STATUS_SEMANTICS, so adding a status to AGENT_TERMINAL_SUCCESS_STATUSES without documenting
+  // its semantics would silently render a prompt that LISTS the status in the vocabulary line yet gives
+  // no explanatory bullet — a quiet drift between the allowlist and the surfaced contract. It now emits
+  // a bullet for every allowlisted status and throws if any lacks semantics. Pin: every currently
+  // allowlisted status carries a documented `- \`<status>\` — …` bullet (so the throw path is
+  // unreachable for the shipped allowlist, and any future undocumented addition breaks the build).
+  const rendered = renderProducerContract([]);
+  for (const status of AGENT_TERMINAL_SUCCESS_STATUSES) {
+    assert(
+      rendered.includes(`- \`${status}\` — `),
+      `every allowlisted status carries a documented semantics bullet, missing: ${status}, got: ${rendered}`,
+    );
+  }
 });
 
 

package/app/deliveryRunner.ts

@@ -18,7 +18,7 @@ import { createHash, randomUUID } from "node:crypto";
 import type { EngineClient } from "@nanobpm/urban";
 import type { DeliveryFact, DeliveryGraph, DeliveryNode } from "../nano-generated/api-io.d.ts";
 import { TRANSCRIPT_URL_BASE_VAR, transcriptUrlBaseFor } from "./agentic/transcript-url.ts";
-import { AGENT_REPO_SPEC_HEADER, assertNever, compileDeliveryGraph, DELIVERY_GRAPH_PROCESS_ID } from "./deliveryGraphCompiler.ts";
+import { AGENT_REPO_SPEC_HEADER, AGENT_TERMINAL_SUCCESS_STATUSES, assertNever, compileDeliveryGraph, DELIVERY_GRAPH_PROCESS_ID } from "./deliveryGraphCompiler.ts";
 import { DEFAULT_EVERY_MS, msToIsoDuration, parseProbe, readinessPollEvery, readinessTimeout } from "./readiness.ts";
 import { agentNodeRepoEnvelope, flattenAgentTaskEnvelope, isResolvableRepo, RepoEnvelopeConflictError, RepoEnvelopeUnresolvedError } from "./repoEnvelope.ts";
 import { isoDuration } from "./reviewWait.ts";
@@ -100,6 +100,10 @@ const DEFAULTS: Required<Omit<DeliveryRunTimeouts, "escalationAssignee">> = {
   escalationSlaTimeout: "P1D",
 };
 
+/** Shared empty required-emit set for a node whose declared emits are all routing-only (or which
+ * declares none) — avoids allocating a throwaway `Set` per such node while seeding. */
+const EMPTY_REQUIRED_EMITS: ReadonlySet<string> = new Set<string>();
+
 /** The per-node config the compiled subProcess ioMappings read from `nodeInputs.<element>`. A closed
  * union mirrored by the compiler's `ioMappingLines` — the two must agree on field names (a drift here
  * silently seeds `null` into a node body), so both derive from the same node kinds. */
@@ -170,11 +174,22 @@ export async function prepareDeliveryGraph(
     escalationAssignee: options.escalationAssignee ?? null,
   };
   const elementByNodeId = new Map(compiled.resolved.nodes.map((n) => [n.id, n.element]));
+  // Required-emit subset per node (#761), derived from the SAME canonical `resolved.edges` the compiler's
+  // `requiredEmitsByElement` gate uses: a fact is a required data dependency exactly when some edge
+  // threads it as a fact-qualified `from: "<node>.<fact>"` (`fromFact` set). A routing-only fact (named
+  // only in a `when` guard) is deliberately absent, so the producer contract leaves it optional.
+  const requiredEmitsByNodeId = new Map<string, Set<string>>();
+  for (const edge of compiled.resolved.edges) {
+    if (edge.fromFact === undefined) continue;
+    const set = requiredEmitsByNodeId.get(edge.fromNode) ?? new Set<string>();
+    set.add(edge.fromFact);
+    requiredEmitsByNodeId.set(edge.fromNode, set);
+  }
   const nodeInputs: Record<string, NodeInput> = {};
   for (const node of graph.nodes) {
     const element = elementByNodeId.get(node.id);
     if (element === undefined) continue; // unreachable — resolved covers every node — but keep total.
-    nodeInputs[element] = buildNodeInput(node, { runKey, element, ...timeouts });
+    nodeInputs[element] = buildNodeInput(node, { runKey, element, ...timeouts, requiredEmits: requiredEmitsByNodeId.get(node.id) ?? EMPTY_REQUIRED_EMITS });
   }
   return { ok: true, prepared: { processDefinitionId, bpmn, nodeInputs } };
 }
@@ -419,11 +434,86 @@ export function renderEmitContract(emits: readonly DeliveryFact[]): string {
 }
 
 
+/** Per-status semantics for the producer-completion contract (#760). Keyed by the SAME status strings
+ * as {@link AGENT_TERMINAL_SUCCESS_STATUSES} so the rendered bullets are DERIVED from the single source
+ * of truth: {@link renderProducerContract} iterates the allowlist and emits a bullet for EVERY status,
+ * failing fast if any allowlisted status has no entry here. Removing a status from the allowlist drops
+ * its bullet; adding one WITHOUT documenting its semantics here is a build/boot-time error (not a
+ * silently under-explained prompt) — so the surfaced list and the allowlist can never drift. */
+const PRODUCER_STATUS_SEMANTICS: Readonly<Record<string, string>> = {
+  opened: "you opened OR adopted a PR (return it in your `pr` emit if this node declares one)",
+  done: "the work completed with no PR to open",
+  skipped: "there was genuinely nothing to do",
+};
+
+/** Render the producer-completion contract auto-injected into EVERY `agent` node's `appendPrompt`
+ * (issue #760) — the missing THIRD contract block alongside {@link renderIdempotencyPreamble} (#551)
+ * and {@link renderEmitContract} (#506). The #731 producer gate (`app/deliveryGraphCompiler.ts`) only
+ * routes a completion onward when its self-reported `status` is one of `AGENT_TERMINAL_SUCCESS_STATUSES`
+ * AND every required emit is non-null; before this block that vocabulary lived ONLY in the gate, so a
+ * correctly-finished agent that self-reported an out-of-vocabulary `status` (e.g. `"success"`) was
+ * parked on a `__contract` escalation despite good work (instance 15697). This block hands the agent the
+ * same vocabulary through its sole steering channel, DERIVED from `AGENT_TERMINAL_SUCCESS_STATUSES` (and
+ * the node's REQUIRED emits) so the gate and the prompt cannot drift — changing the allowlist changes
+ * this block. Deterministic: fixed wording, statuses + emit names in declared order, so identical graphs
+ * still compile+seed byte-identically. Unconditional — a no-emit node still gets the status block (the
+ * gate applies to it too); only the required-emit sentence is elided when there are none.
+ *
+ * `requiredEmits` is the subset of the node's declared `emits` the #731 gate actually gates on — those
+ * consumed downstream as a REQUIRED DATA DEPENDENCY (threaded on a fact-qualified `from: "<node>.<fact>"`
+ * edge), derived from the SAME `requiredEmitsByElement` source the compiler's proceed-condition uses
+ * (see `prepareDeliveryGraph`). It deliberately EXCLUDES a routing-only fact (named only in an edge
+ * `when` guard) — the gate leaves those optional (omit ⇒ default branch), and the classifier-emit
+ * contract already tells the agent to omit an undecidable routing fact. Listing every DECLARED emit
+ * here instead would contradict that guidance and push agents to guess values that should stay
+ * optional (#761). */
+export function renderProducerContract(requiredEmits: readonly DeliveryFact[]): string {
+  const list = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => `\`${s}\``).join(", ");
+  const semantics = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => {
+    const doc = PRODUCER_STATUS_SEMANTICS[s];
+    if (doc === undefined) {
+      throw new Error(
+        `renderProducerContract: allowlisted status "${s}" has no PRODUCER_STATUS_SEMANTICS entry — ` +
+          "document its semantics so the producer-contract prompt and AGENT_TERMINAL_SUCCESS_STATUSES cannot drift.",
+      );
+    }
+    return `- \`${s}\` — ${doc}.`;
+  });
+  const lines = [
+    "",
+    "",
+    "---",
+    "",
+    "## Producer completion contract (delivery graph)",
+    "",
+    "This node is a PRODUCER in a delivery graph: a completion barrier gates your result before it can",
+    "route to a downstream consumer. The structured result you write to `AGENT_RESULT_FILE` MUST end",
+    `with a \`status\` field that is one of the terminal-success values ${list}:`,
+    "",
+    ...semantics,
+    "",
+    `Any \`status\` OUTSIDE ${list} — including a free-form \`success\`/\`in_progress\`/\`failed\` — parks the`,
+    "run on a human escalation (the gate is fail-closed), EVEN when your underlying work was correct. So",
+    "do not invent a status: report exactly one of the allowlisted values above.",
+  ];
+  if (requiredEmits.length > 0) {
+    lines.push(
+      "",
+      "AND every emit a downstream node requires must be populated non-null before your result routes",
+      "onward — populate each of these top-level fields:",
+      "",
+      ...requiredEmits.map((f) => `- \`${f.name}\``),
+    );
+  }
+  return lines.join("\n");
+}
+
+
 /** Build the `nodeInputs.<element>` seed for one node, per its kind — the exact fields the compiled
  * subProcess ioMapping pulls. Total over the closed kind set. */
 function buildNodeInput(
   node: DeliveryNode,
-  ctx: { runKey: string; element: string; nodeTimeout: string; probeTimeout: string; probePollEvery: string; escalationSlaTimeout: string; escalationAssignee: string | null },
+  ctx: { runKey: string; element: string; nodeTimeout: string; probeTimeout: string; probePollEvery: string; escalationSlaTimeout: string; escalationAssignee: string | null; requiredEmits: ReadonlySet<string> },
 ): NodeInput {
   switch (node.kind) {
     case "agent": {
@@ -439,7 +529,13 @@ function buildNodeInput(
       // truth. A no-emit node appends nothing, so a plain implementation node is unchanged.
       const basePrompt = node.agent.prompt ?? "";
       const emits = Array.isArray(node.emits) ? node.emits.map((f) => ({ ...f })) : [];
-      return { jobType: node.agent.jobType, appendPrompt: renderIdempotencyPreamble() + basePrompt + renderEmitContract(emits), timeout: isoDuration(node.agent.timeout, ctx.nodeTimeout) };
+      // The classifier-emit contract lists ALL declared emits (the agent returns each fact it can, and
+      // OMITS an undecidable routing fact). The producer contract's required-emit sentence instead lists
+      // only the subset the #731 gate fails closed on — the facts consumed downstream as a required data
+      // dependency (`ctx.requiredEmits`) — so it never contradicts the emit contract by demanding a
+      // routing-only fact be non-null (#761).
+      const requiredEmits = emits.filter((f) => ctx.requiredEmits.has(f.name));
+      return { jobType: node.agent.jobType, appendPrompt: renderIdempotencyPreamble() + basePrompt + renderEmitContract(emits) + renderProducerContract(requiredEmits), timeout: isoDuration(node.agent.timeout, ctx.nodeTimeout) };
     }
     case "wait": {
       const probe = parseProbe(node.wait, { allowLateBoundTarget: true });

package/docs/agent-guide.md

@@ -621,6 +621,22 @@ agent node and guard the downstream edge on `<node>.<name>`; a contract-followin
 **omits** it, and the split takes its `default` (else) branch — the deadlock-safe fallback. A
 node that declares no `emits` gets no contract text and behaves exactly as before.
 
+**Producer completion contract (auto-injected — do NOT hand-encode it).** Every `agent` node
+*also* has a **producer completion contract** appended to its prompt at dispatch, alongside the
+idempotency preflight and — only for a node that declares `emits` — the classifier emit contract.
+It hands the agent the terminal-status vocabulary
+the `#731` producer gate enforces: the injected text tells the agent it MUST end its result with
+one of `AGENT_TERMINAL_SUCCESS_STATUSES` (`done` / `opened` / `skipped`) — never omit `status` or
+invent one. The gate routes a completion onward only when its self-reported `status` is one of that
+allowlist **and** every required emit is non-null; any *explicitly non-terminal* status parks the
+run on a human `__contract` escalation (fail-closed). (As a backward-compat concession the gate
+*also* routes onward an **absent/null** status — for legacy workers / stubs that report none — but
+the injected contract never invites a real agent to lean on that: always return an allowlisted
+status.) The wording is **derived from that single allowlist** (changing the
+list changes the prompt — no second copy), so **authors must not hand-encode status vocabulary
+in a node's prompt.** Unlike the emit contract, a no-emit node still receives the status block
+(the gate applies to it too).
+
 ### 9.2 The agent loop: draft → compile → stage → ask an operator to dispatch
 
 ```

package/e2e/delivery-graph.e2e.ts

@@ -209,7 +209,11 @@ describe("delivery-graph runner — engine-native execution (S4)", () => {
           processInstanceKey: job.processInstanceKey ?? null,
           elementId: job.elementId ?? null,
         });
-        return await dispatchConnector(app.db, { dedupeKey: dedupeKey ?? "x", target, payload, boundFacts }, new Date().toISOString());
+        // Mirror the real worker's fail-closed contract: an un-dedupable dispatch (no author key AND
+        // no engine identity) throws rather than papering over it with a hardcoded fallback that would
+        // mask a regression where the connector node stops seeding `dedupeKey`.
+        if (!dedupeKey) throw new Error("connector stub: no dedupe key (author-supplied or graph-derived) available");
+        return await dispatchConnector(app.db, { dedupeKey, target, payload, boundFacts }, new Date().toISOString());
       },
       { fetchVariables: ["boundFacts", "target", "dedupeKey", "payload"] },
     );
@@ -246,6 +250,64 @@ describe("delivery-graph runner — engine-native execution (S4)", () => {
     assert.ok(takenFlows(app).some((f) => f.endsWith("->End")), "the resumed producer's result reaches End");
   });
 
+  test("#760 producer contract satisfied: an agent completing with an allowlisted status + its required emit passes the gate with NO __contract escalation and threads onward", async () => {
+    const app = track(await boot(freshDir()));
+
+    // The instance-15697 failure mode: the agent DID the work correctly and returned its required emit,
+    // but self-reported an out-of-vocabulary `status` (e.g. "success") and so was wrongly parked on a
+    // __contract escalation — because the terminal-status vocabulary lived ONLY in the gate. With #760
+    // the vocabulary is auto-injected into the agent's appendPrompt (proven in the runner unit tests);
+    // here we prove the gate's happy path: a status FROM `AGENT_TERMINAL_SUCCESS_STATUSES` ("opened")
+    // WITH the required emit sails through — no escalation, the downstream connector fires.
+    let agentFired = 0;
+    await app.engine.registerWorker("senior:demo", async () => {
+      agentFired++;
+      return { status: "opened", pr: "owner/repo#99", summary: "PR opened and green." };
+    });
+    let connectorFired = 0;
+    await app.engine.registerWorker(
+      "pr.delivery-connector",
+      async (job) => {
+        connectorFired++;
+        const vars = job.variables as Record<string, unknown>;
+        const { target, payload, boundFacts } = readConnectorInput(vars as Parameters<typeof readConnectorInput>[0]);
+        const dedupeKey = connectorDedupeKey({
+          dedupeKey: (vars.dedupeKey as string | null | undefined) ?? null,
+          processInstanceKey: job.processInstanceKey ?? null,
+          elementId: job.elementId ?? null,
+        });
+        // Mirror the real worker's fail-closed contract: an un-dedupable dispatch (no author key AND
+        // no engine identity) throws rather than papering over it with a hardcoded fallback that would
+        // mask a regression where the connector node stops seeding `dedupeKey`.
+        if (!dedupeKey) throw new Error("connector stub: no dedupe key (author-supplied or graph-derived) available");
+        return await dispatchConnector(app.db, { dedupeKey, target, payload, boundFacts }, new Date().toISOString());
+      },
+      { fetchVariables: ["boundFacts", "target", "dedupeKey", "payload"] },
+    );
+
+    const graph: DeliveryGraph = {
+      name: "e2e producer gate satisfied",
+      nodes: [
+        { id: "open", kind: "agent", agent: { jobType: "senior:demo" }, emits: [{ name: "pr", type: "pr" }] },
+        { id: "land", kind: "connector", connector: { target: "slack", payload: { pr: "open.pr" }, dedupeKey: "land-760" } },
+      ],
+      edges: [{ from: "open.pr", to: "land" }],
+    };
+
+    const run = await runDeliveryGraph(app.engine, graph, { escalationSlaTimeout: "PT1H", repoless: true });
+    assert.ok(run.ok, `graph should deploy + run, got ${JSON.stringify(run)}`);
+    await app.settle();
+
+    // The producer satisfied its contract (allowlisted status + non-null required emit): NO __contract
+    // escalation was raised, the downstream connector fired once, and the graph reached End.
+    assert.equal(agentFired, 1, "the agent node's job fired and completed");
+    const createdTasks = await app.engine.searchUserTasks({ state: "CREATED" });
+    const contract = createdTasks.find((t) => t.elementId?.startsWith("delivery-human-task__") && t.elementId?.endsWith("__contract"));
+    assert.ok(!contract, `an allowlisted status + required emit must NOT escalate, got ${JSON.stringify(createdTasks.map((t) => t.elementId))}`);
+    assert.equal(connectorFired, 1, "the satisfied producer threads its result to the downstream connector");
+    assert.ok(takenFlows(app).some((f) => f.endsWith("->End")), "the satisfied producer's result reaches End");
+  });
+
   test("resume never double-fires: an at-least-once redelivery of the connector dedupes", async () => {
     const app = track(await boot(freshDir()));
     // The connector fired once above's-style; here prove the idempotency directly against the ledger a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.184.0",
+  "version": "0.185.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/delivery-graphs/staged.mount.js

@@ -4,8 +4,8 @@
 //   • Preview DI  — recompile the proposal's BPMN (with diagram interchange) and hand it UP to the host
 //     console's process explorer over the `nano-navigate` bridge, rendered read-only BEFORE dispatch;
 //   • Dispatch    — the operator's launch action (#460): POST the proposal's `digest` — plus the
-//     repository-isolation envelope (`repository` + `baseBranch`, or an explicit `repoless` opt-out,
-//     #729) the operator supplies inline — to the dispatch door. Clicking Dispatch IS the approval,
+//     optional run-level repository fallback or explicit `repoless` opt-out — to the dispatch door.
+//     By default the graph's nodes supply their own repositories (#739/#758). Clicking Dispatch IS the approval,
 //     content-addressed to exactly the graph previewed.
 //
 // It REPLACES the old declarative `dataGrid` (a grid row-action can POST but cannot take the recompiled
@@ -100,22 +100,23 @@ function isPending(pending, kind, digest) {
 // an in-DOM "Confirm dispatch / Cancel" pair (NOT a native window.confirm, suppressed in the sandboxed
 // App-View iframe — #569). Clicking "Confirm dispatch" IS the operator approval (#460).
 //
-// The dispatch door (issue #729) now REQUIRES a repository-isolation envelope: the operator must supply
-// BOTH `repository` (`owner/repo`) and `baseBranch`, OR explicitly opt out with `repoless` for a
-// checkout-less graph — dispatching with neither would silently share the worker's launch dir across
-// agents. A staged proposal carries no repository metadata, so the operator provides it HERE at
-// dispatch time via the inline fields below. Ticking "checkout-less" disables the repo/base inputs.
+// The list omits the graph's repository metadata. Default to node repositories and let the dispatch
+// door validate provisioning (#739/#758); don't duplicate its graph-resolution algorithm here.
+// Run-level fields are an explicit fallback, not an override of nodes' own declarations.
 function dispatchControl(p, pending) {
   if (isPending(pending, "dispatch", p.digest)) {
     const repository = typeof pending.repository === "string" ? pending.repository : "";
     const baseBranch = typeof pending.baseBranch === "string" ? pending.baseBranch : "";
-    const repoless = pending.repoless === true;
-    const provDisabled = repoless ? " disabled" : "";
+    const mode = pending.mode;
+    const provDisabled = mode === "fallback" ? "" : " disabled";
     return `<span class="confirm" data-confirm="dispatch">
       <span class="confirm-msg">${esc(DISPATCH_CONFIRM)}</span>
+      <label class="confirm-check"><input type="radio" name="dispatch-mode-${esc(p.digest)}" data-dispatch-mode="${esc(p.digest)}" value="nodes"${mode === "nodes" ? " checked" : ""} /> Use node repositories</label>
+      <label class="confirm-check"><input type="radio" name="dispatch-mode-${esc(p.digest)}" data-dispatch-mode="${esc(p.digest)}" value="fallback"${mode === "fallback" ? " checked" : ""} /> Supply run-level fallback</label>
+      <label class="confirm-check"><input type="radio" name="dispatch-mode-${esc(p.digest)}" data-dispatch-mode="${esc(p.digest)}" data-dispatch-repoless="${esc(p.digest)}" value="repoless"${mode === "repoless" ? " checked" : ""} /> Dispatch checkout-less (no repository)</label>
+      <span class="confirm-msg">Use node repositories sends no run-level repository settings; the server validates that every agent node is provisioned. A run-level repository is a fallback for nodes without their own repository, not an override of node declarations. Checkout-less explicitly opts out of repository provisioning.</span>
       <label class="confirm-field">Repository <input class="confirm-input" type="text" data-dispatch-repository="${esc(p.digest)}" value="${esc(repository)}" placeholder="owner/repo" aria-label="Repository (owner/repo)"${provDisabled} /></label>
       <label class="confirm-field">Base branch <input class="confirm-input" type="text" data-dispatch-base="${esc(p.digest)}" value="${esc(baseBranch)}" placeholder="main" aria-label="Base branch"${provDisabled} /></label>
-      <label class="confirm-check"><input type="checkbox" data-dispatch-repoless="${esc(p.digest)}"${repoless ? " checked" : ""} /> Dispatch checkout-less (no repository)</label>
       <button class="btn btn-primary" type="button" data-dispatch-confirm="${esc(p.digest)}">Confirm dispatch</button>
       <button class="btn btn-ghost" type="button" data-dispatch-cancel="${esc(p.digest)}">Cancel</button>
     </span>`;
@@ -245,10 +246,10 @@ export function mountStagedProposals(host, config = {}) {
   // click can re-render the SAME list synchronously (without waiting for the next poll).
   let currentProposals = [];
   // The single open in-DOM confirmation, or null. Shape: { kind: "dispatch"|"dismiss"|"save",
-  // digest: string, name?: string, repository?: string, baseBranch?: string, repoless?: boolean }. This
+  // digest: string, name?: string, repository?: string, baseBranch?: string, mode: "nodes"|"fallback"|"repoless" }. This
   // REPLACES the native window.confirm/window.prompt the console's sandboxed App-View iframe suppresses
   // (#569): the operator approval is an inline two-step control (Confirm/Cancel), an inline name input
-  // (Save), or — for Dispatch — the repository/baseBranch/repoless envelope fields (#729), all rendered
+  // (Save), or — for Dispatch — the provisioning mode and optional fallback fields, all rendered
   // by renderProposal from this state so a background poll re-render preserves what the operator typed.
   let pending = null;
   // A re-render (renderList → new buttons) resets every button to enabled, so the disabled state is
@@ -369,22 +370,7 @@ export function mountStagedProposals(host, config = {}) {
   // the click handler, #569) — by the time we're here the operator has clicked "Confirm dispatch", so we
   // POST the digest to the dispatch door; on success the proposal flips to `dispatched` and drops off
   // the list on the next poll — refresh immediately so the operator sees it leave.
-  async function doDispatch(digest, opts) {
-    const staged = typeof digest === "string" ? digest.trim() : "";
-    if (staged === "") return;
-    const options = opts && typeof opts === "object" ? opts : {};
-    const repoless = options.repoless === true;
-    const repository = typeof options.repository === "string" ? options.repository.trim() : "";
-    const baseBranch = typeof options.baseBranch === "string" ? options.baseBranch.trim() : "";
-    // The dispatch door (issue #729) requires an isolation envelope: BOTH `repository` + `baseBranch`,
-    // or an explicit `repoless: true` opt-out. Guard here so the operator gets an inline hint instead of
-    // a bare 400 from the door (the confirm has already been closed by the click handler on a valid one).
-    if (!repoless && (repository === "" || baseBranch === "")) {
-      setStatus("Provide both a repository (owner/repo) and a base branch, or tick “Dispatch checkout-less”.", "err");
-      return;
-    }
-    // Mirror the door's mutual-exclusivity contract: pass EITHER the repo envelope OR `repoless`, never both.
-    const payload = repoless ? { digest: staged, repoless: true } : { digest: staged, repository, baseBranch };
+  async function doDispatch(payload) {
     busy(true);
     setStatus("Dispatching…");
     try {
@@ -461,7 +447,7 @@ export function mountStagedProposals(host, config = {}) {
   function openConfirm(kind, digest, name) {
     const staged = typeof digest === "string" ? digest.trim() : "";
     if (staged === "") return;
-    pending = { kind, digest: staged, name: typeof name === "string" ? name : "", repository: "", baseBranch: "", repoless: false };
+    pending = { kind, digest: staged, name: typeof name === "string" ? name : "", repository: "", baseBranch: "", mode: "nodes" };
     rerender();
     // Move focus into the name input so the operator can type immediately (best-effort; not all hosts
     // implement focus()).
@@ -496,12 +482,6 @@ export function mountStagedProposals(host, config = {}) {
     return input && typeof input.value === "string" ? input.value : "";
   }
 
-  // Read the current state of the inline "Dispatch checkout-less" checkbox for `digest`.
-  function readRepoless(digest) {
-    const box = listEl.querySelector(`[data-dispatch-repoless="${cssAttr(digest)}"]`);
-    return !!(box && box.checked);
-  }
-
   // Keep pending in sync as the operator types, so a background poll re-render (or a later confirm)
   // preserves what they've entered — the library name (Save) and the repo/base envelope fields (Dispatch).
   listEl.addEventListener("input", (ev) => {
@@ -523,14 +503,15 @@ export function mountStagedProposals(host, config = {}) {
     }
   });
 
-  // The "Dispatch checkout-less" checkbox toggles the repo/base inputs (disabled when checkout-less), so
-  // re-render on change — first hoisting the live text values into pending so the toggle doesn't drop them.
+  // Preserve fallback text across mode changes, but only enable and submit it in fallback mode.
   listEl.addEventListener("change", (ev) => {
-    const box = ev.target && ev.target.closest ? ev.target.closest("[data-dispatch-repoless]") : null;
-    if (box && pending != null && pending.kind === "dispatch") {
+    const choice = ev.target && ev.target.closest ? ev.target.closest("[data-dispatch-mode]") : null;
+    if (choice && choice.checked && pending != null && pending.kind === "dispatch" &&
+        choice.getAttribute("data-dispatch-mode") === pending.digest &&
+        ["nodes", "fallback", "repoless"].includes(choice.value)) {
       pending.repository = readDispatchField(pending.digest, "repository");
       pending.baseBranch = readDispatchField(pending.digest, "base");
-      pending.repoless = !!box.checked;
+      pending.mode = choice.value;
       rerender();
     }
   });
@@ -556,21 +537,26 @@ export function mountStagedProposals(host, config = {}) {
     const dispatchConfirmBtn = closest("[data-dispatch-confirm]");
     if (dispatchConfirmBtn) {
       ev.preventDefault();
-      const digest = dispatchConfirmBtn.getAttribute("data-dispatch-confirm");
+      const rawDigest = dispatchConfirmBtn.getAttribute("data-dispatch-confirm");
+      const digest = typeof rawDigest === "string" ? rawDigest.trim() : "";
       const isThisPending = pending != null && pending.kind === "dispatch" && pending.digest === digest;
-      // `pending.repoless` is the durable source of truth (synced on the checkbox `change`); fall back to
-      // the live DOM checkbox so a confirm without a prior toggle still reads correctly.
-      const repoless = readRepoless(digest) || (isThisPending && pending.repoless === true);
+      if (!isThisPending) return;
+      const mode = pending.mode;
       const repository = readDispatchField(digest, "repository").trim();
       const baseBranch = readDispatchField(digest, "base").trim();
       // Keep the inline confirmation OPEN on an incomplete envelope so the operator can fix it in place
       // (issue #729) — closing it would drop the fields they'd started filling.
-      if (!repoless && (repository === "" || baseBranch === "")) {
-        setStatus("Provide both a repository (owner/repo) and a base branch, or tick “Dispatch checkout-less”.", "err");
+      if (mode === "fallback" && (repository === "" || baseBranch === "")) {
+        setStatus("Run-level fallback requires both a repository (owner/repo) and a base branch.", "err");
         return;
       }
+      // Construct only the selected mode's fields: disabled fallback text must never leak into node
+      // or checkout-less dispatches, and repoless must never be inferred from blank fields.
+      const payload = mode === "fallback"
+        ? { digest, repository, baseBranch }
+        : mode === "repoless" ? { digest, repoless: true } : { digest };
       closeConfirm();
-      doDispatch(digest, { repository, baseBranch, repoless });
+      doDispatch(payload);
       return;
     }
     const dispatchCancelBtn = closest("[data-dispatch-cancel]");

package/test/delivery-graphs-staged-confirm.test.ts

@@ -37,7 +37,7 @@ interface FetchCall {
 
 /** Boot the real mount over a linkedom DOM whose `window` mimics a sandboxed App-View iframe (native
  *  confirm/prompt SUPPRESSED → false/null), with a recording fetch double. */
-function harness() {
+function harness(dispatchError?: string) {
   const { window: domWindow, document } = parseHTML(
     "<!doctype html><html><body><div id='host'></div></body></html>",
   );
@@ -54,7 +54,11 @@ function harness() {
     if (method === "GET" && url === STAGED_URL) {
       return new Response(JSON.stringify({ proposals: [PROPOSAL] }), { status: 200 });
     }
-    if (url === DISPATCH_URL) return new Response(JSON.stringify({ ok: true }), { status: 202 });
+    if (url === DISPATCH_URL) {
+      return dispatchError
+        ? new Response(JSON.stringify({ ok: false, error: dispatchError }), { status: 400 })
+        : new Response(JSON.stringify({ ok: true }), { status: 202 });
+    }
     if (url === DISMISS_URL) return new Response(JSON.stringify({ ok: true }), { status: 200 });
     if (url === SAVE_URL) return new Response(JSON.stringify({ ok: true }), { status: 200 });
     return new Response(JSON.stringify({}), { status: 404 });
@@ -93,8 +97,14 @@ function harness() {
     el.dispatchEvent(new domWindow.Event("click", { bubbles: true, cancelable: true }));
   const fire = (el: { dispatchEvent: (ev: unknown) => boolean }, type: string) =>
     el.dispatchEvent(new domWindow.Event(type, { bubbles: true, cancelable: true }));
+  const mode = (value: string) => {
+    const input = host.querySelector(`[data-dispatch-mode][value="${value}"]`);
+    assert(input, `the mounted confirmation must offer ${value} mode`);
+    input.checked = true;
+    fire(input, "change");
+  };
 
-  return { host, calls, teardown, flush, click, fire };
+  return { host, calls, teardown, flush, click, fire, mode };
 }
 
 const posts = (calls: FetchCall[], url: string) => calls.filter((c) => c.method === "POST" && c.url === url);
@@ -112,12 +122,12 @@ test("#569/#729: Dispatch dispatches via the in-DOM confirmation with the repo e
     h.click(dispatchBtn);
     await h.flush();
     assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "Dispatch must not POST before the operator confirms in-DOM");
+    h.mode("fallback");
     const confirmBtn = h.host.querySelector("[data-dispatch-confirm]");
     assert(confirmBtn, "clicking Dispatch must reveal an in-DOM Confirm-dispatch control (#569), not call window.confirm");
     assert(!h.host.querySelector("[data-dispatch]"), "the plain Dispatch button is replaced by the inline confirmation while it is open");
 
-    // The operator supplies the repository-isolation envelope the door now requires (#729): a staged
-    // proposal carries no repo metadata, so the cockpit collects it here.
+    // In fallback mode the operator explicitly supplies the run-level repository-isolation envelope.
     const repoInput = h.host.querySelector("[data-dispatch-repository]");
     const baseInput = h.host.querySelector("[data-dispatch-base]");
     assert(repoInput && baseInput, "the Dispatch confirmation must expose repository + base-branch fields (#729)");
@@ -165,23 +175,134 @@ test("#729: Dispatch checkout-less posts `repoless: true` (no repo envelope) ins
   }
 });
 
-test("#729: confirming a dispatch with neither the repo envelope nor checkout-less does NOT POST (keeps the confirmation open)", async () => {
+test("#729/#758: fallback mode requires both repository and base branch and keeps incomplete confirmation open", async () => {
   const h = harness();
   try {
     await h.flush();
     h.click(h.host.querySelector("[data-dispatch]"));
     await h.flush();
-    // Confirm with blank repository/baseBranch and checkout-less unticked — the door would 400, so the
-    // mount guards client-side: no POST, and the confirmation stays open so the operator can fix it.
+    h.mode("fallback");
+    // An explicitly selected fallback needs both fields; keep it editable rather than silently
+    // changing to node repositories or checkout-less when the fields are blank.
     h.click(h.host.querySelector("[data-dispatch-confirm]"));
     await h.flush();
     assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "an incomplete envelope must not POST to the dispatch door (#729)");
     assert(h.host.querySelector("[data-dispatch-confirm]"), "the confirmation stays open so the operator can supply the envelope");
+    const repoInput = h.host.querySelector("[data-dispatch-repository]");
+    const baseInput = h.host.querySelector("[data-dispatch-base]");
+    for (const [repository, baseBranch] of [["acme/widgets", " "], [" ", "main"]]) {
+      repoInput.value = repository;
+      baseInput.value = baseBranch;
+      h.click(h.host.querySelector("[data-dispatch-confirm]"));
+      await h.flush();
+      assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "each fallback field is required");
+      assert(h.host.querySelector("[data-dispatch-confirm]"), "invalid fallback remains editable");
+    }
   } finally {
     h.teardown();
   }
 });
 
+test("#758: node-provisioned graph confirms through the real mount with digest only", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "opening confirmation must not dispatch");
+    h.click(h.host.querySelector("[data-dispatch-confirm]"));
+    await h.flush();
+    const dispatched = posts(h.calls, DISPATCH_URL);
+    assertEquals(dispatched.length, 1, "node repositories must reach the authoritative dispatch door");
+    assertEquals(JSON.parse(dispatched[0].body), { digest: PROPOSAL.digest });
+    assert(h.host.querySelector("#dg-staged-status").textContent.includes("Dispatched"));
+  } finally {
+    h.teardown();
+  }
+});
+
+test("dispatch normalizes the attribute-sourced digest before POSTing (untrusted DOM value)", async () => {
+  // The confirm digest is read back from a DOM attribute (untrusted) at confirm time; like doDismiss/
+  // doSaveToLibrary/doPreviewDi, dispatch must trim it so accidental whitespace never reaches the door.
+  const h = harness();
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    const confirmBtn = h.host.querySelector("[data-dispatch-confirm]");
+    assert(confirmBtn, "the in-DOM Confirm dispatch affordance must appear");
+    // Simulate an untrusted DOM value: pad the attribute the confirm handler reads the digest from.
+    confirmBtn.setAttribute("data-dispatch-confirm", `  ${PROPOSAL.digest}  `);
+    h.click(confirmBtn);
+    await h.flush();
+    const dispatched = posts(h.calls, DISPATCH_URL);
+    assertEquals(dispatched.length, 1, "the confirmed dispatch must POST despite the padded attribute");
+    assertEquals(JSON.parse(dispatched[0].body), { digest: PROPOSAL.digest }, "the digest is trimmed before dispatch");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#758: node mode displays the server's missing-node provisioning error without inferring checkout-less", async () => {
+  const error = "1 agent node(s) resolve to no repository (implement-api): each must declare its own `repository`, or the dispatch must supply a run-level `repository` + `baseBranch` fallback";
+  const h = harness(error);
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    h.click(h.host.querySelector("[data-dispatch-confirm]"));
+    await h.flush();
+    assertEquals(h.host.querySelector("#dg-staged-status").textContent, error);
+    assertEquals(posts(h.calls, DISPATCH_URL).map((call) => JSON.parse(call.body)), [{ digest: PROPOSAL.digest }]);
+    assert(h.host.querySelector("[data-dispatch]"), "the rejected proposal remains available");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#758: repository choices explain server validation and run-level fallback semantics", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    const nodes = h.host.querySelector('[data-dispatch-mode][value="nodes"]');
+    assert(nodes?.hasAttribute("checked"), "node repositories is the explicit default, not checkout-less");
+    assert(h.host.querySelector("[data-dispatch-repository]").disabled);
+    assert(h.host.querySelector("[data-dispatch-base]").disabled);
+    const text = h.host.textContent;
+    assert(text.includes("Use node repositories"));
+    assert(text.includes("fallback for nodes without their own repository"));
+    assert(text.includes("server validates"));
+  } finally {
+    h.teardown();
+  }
+});
+
+for (const target of ["nodes", "repoless", "fallback"]) {
+  test(`#758: switching modes to ${target} submits only the selected provisioning choice`, async () => {
+    const h = harness();
+    try {
+      await h.flush();
+      h.click(h.host.querySelector("[data-dispatch]"));
+      h.mode("fallback");
+      h.host.querySelector("[data-dispatch-repository]").value = " acme/widgets ";
+      h.host.querySelector("[data-dispatch-base]").value = " main ";
+      h.mode("repoless");
+      assert(h.host.querySelector("[data-dispatch-repository]").disabled);
+      assert(h.host.querySelector("[data-dispatch-base]").disabled);
+      h.mode("nodes");
+      h.mode(target);
+      h.click(h.host.querySelector("[data-dispatch-confirm]"));
+      await h.flush();
+      const expected = target === "fallback"
+        ? { digest: PROPOSAL.digest, repository: "acme/widgets", baseBranch: "main" }
+        : target === "repoless"
+          ? { digest: PROPOSAL.digest, repoless: true }
+          : { digest: PROPOSAL.digest };
+      assertEquals(posts(h.calls, DISPATCH_URL).map((call) => JSON.parse(call.body)), [expected]);
+    } finally {
+      h.teardown();
+    }
+  });
+}
+
 test("#569: Cancel on the in-DOM Dispatch confirmation aborts without POSTing", async () => {
   const h = harness();
   try {