@nanobpm/nano-workforce 0.190.0 → 0.191.0

package/app/deliveryGraphProposals.ts

@@ -62,6 +62,15 @@ export interface DeliveryGraphProposal {
   created_at: string;
   updated_at: string;
   expires_at: string;
+  /** A strictly-monotonic per-write stage revision (migration 114), reassigned to `MAX(stage_seq)+1`
+   * on every stage write (insert AND re-stage). It is the supersede reconcile's same-millisecond
+   * tie-break, AND the version token the dispatch door threads through so `markProposalDispatched`
+   * can guard its terminal flip against a concurrent re-stage that overwrote this same-digest row with
+   * a newer (e.g. credential-differing) graph after this dispatch snapshotted it (issue #778 review —
+   * thread deliveryGraphProposals.ts:243). Persisted rows carry a value ≥ 1; a pre-migration row reads
+   * `0` until its next stage re-sequences it. Assigned atomically in the `stageProposal` SQL, never
+   * from a row object — a freshly-`buildProposalRow`'d row's `0` here is a never-persisted placeholder. */
+  stage_seq: number;
 }
 
 /** The rendered preview a staged proposal carries — the operator-facing view of WHAT the graph does
@@ -150,6 +159,9 @@ export function buildProposalRow(input: {
     created_at: createdAt,
     updated_at: at,
     expires_at: proposalExpiry(createdAt),
+    // Placeholder only: the persisted `stage_seq` is assigned atomically as `MAX(stage_seq)+1` inside
+    // the `stageProposal` INSERT/UPSERT (never bound from this object), so this `0` is never written.
+    stage_seq: 0,
   };
 }
 
@@ -190,55 +202,77 @@ export interface StageOutcome {
  * retire. */
 export async function stageProposal(data: DataLayer, row: DeliveryGraphProposal): Promise<StageOutcome> {
   const table = deliveryGraphProposals(data);
-  const existing = await table.get(row.digest);
   // Capture the same-logical-key staged siblings that exist BEFORE this stage writes (excluding our own
   // digest) — the supersede reconcile below normally flips them all to `superseded`; we re-read them
   // after to report exactly which digests this stage retired.
   const priorSameKey = (await table.find({ status: "staged" })).filter(
     (r) => r.logical_key === row.logical_key && r.digest !== row.digest && isLiveStaged(r),
   );
-  const toWrite = existing
-    ? buildProposalRow({
-        digest: row.digest,
-        logicalKey: row.logical_key,
-        title: row.title,
-        graphJson: row.graph,
-        preview: JSON.parse(row.preview),
-        nodeCount: row.node_count,
-        humanNodeCount: row.human_node_count,
-        sideEffectCount: row.side_effect_count,
-        sideEffecting: row.side_effecting === 1,
-        // Re-stage: if the existing row is STILL LIVE, preserve its original stage time so the TTL
-        // stays anchored to the first stage. But if it has already aged out of its TTL (or was
-        // dispatched/superseded long ago), reusing the stale `created_at` would yield a past
-        // `expires_at`, leaving the "re-staged" row immediately non-dispatchable (`getStagedProposal`
-        // rejects it as expired) while the preview claims it is staged. In that case re-anchor the TTL
-        // to now (omit `createdAt`) so a re-proposed digest is genuinely live again.
-        createdAt: isProposalExpired(existing.expires_at) ? undefined : existing.created_at,
-      })
-    : row;
-  if (existing) {
-    const { digest, ...patch } = toWrite;
-    await table.update(row.digest, patch);
-  } else {
-    await table.insert(toWrite);
-  }
-  // Reconcile to EXACTLY ONE live proposal per logical graph: supersede every `staged` row for this
-  // `logical_key` that has a strictly-NEWER staged sibling (by `updated_at`, with a deterministic
-  // `digest` tie-breaker), leaving only the globally-newest live. This is ORDER-INDEPENDENT — it never
-  // references the just-written digest, so it converges to a single live row regardless of the
-  // interleaving of concurrent stages. A supersede pass keyed to "only flip rows older than the one *I*
-  // just wrote" leaves TWO live proposals when an OLDER stage's pass runs AFTER a newer stage already
-  // committed (the older pass won't flip the newer row, and the newer pass ran before the older row
-  // existed) — and an unordered supersede-all leaves ZERO. Anchoring on the newest staged sibling avoids
-  // both: the newest row is never superseded (no newer sibling), so it stays staged throughout the
-  // statement and every older row's `EXISTS` is satisfied by it. Idempotent: a no-op once one row remains.
-  await data
-    .open()
-    .exec(
-      `UPDATE "delivery_graph_proposals" SET "status" = 'superseded', "updated_at" = ? WHERE "logical_key" = ? AND "status" = 'staged' AND EXISTS (SELECT 1 FROM "delivery_graph_proposals" AS "newer" WHERE "newer"."logical_key" = "delivery_graph_proposals"."logical_key" AND "newer"."status" = 'staged' AND ("newer"."updated_at" > "delivery_graph_proposals"."updated_at" OR ("newer"."updated_at" = "delivery_graph_proposals"."updated_at" AND "newer"."digest" > "delivery_graph_proposals"."digest")))`,
+  // Persist the write, its strictly-monotonic stage sequence, AND the supersede reconcile as ONE
+  // transaction (issue #778 review — threads deliveryGraphProposals.ts:237/:239). Two properties matter:
+  //   • `stage_seq` is assigned ATOMICALLY inside the write itself — `MAX(stage_seq)+1` in the
+  //     INSERT/UPDATE, NOT a separate stamp statement — so there is never a "written but unstamped
+  //     (seq 0)" window in which a rival same-millisecond stage's reconcile could read the half-written
+  //     sibling at its DEFAULT 0 and supersede it out of order (the inversion the old two-statement
+  //     stamp+reconcile allowed). Assigning inside the serialized transaction keeps `MAX(...)` atomic, so
+  //     `+1` is strictly greater than every committed seq and reflects true write order.
+  //   • wrapping the reconcile in the SAME transaction means no concurrent stage observes an intermediate
+  //     state between the write and the reconcile.
+  // `MAX(stage_seq)` reads the pre-write table via the `stage_seq` index (migration 114), an O(1)
+  // reverse-index seek rather than the full-history scan a bare aggregate over the retained terminal rows
+  // would cost.
+  const at = now();
+  const atExpiry = proposalExpiry(at);
+  const nextSeq = `(SELECT COALESCE(MAX("stage_seq"), 0) + 1 FROM "delivery_graph_proposals")`;
+  await data.open().tx(async (t) => {
+    // Single idempotent UPSERT rather than a read-`existing`-then-branch INSERT/UPDATE: reading the row
+    // BEFORE the transaction meant two concurrent FIRST stages of the same digest both saw `null` and
+    // would both take an INSERT — the second hitting a primary-key conflict that fails the stage and drops
+    // its reconciliation. `ON CONFLICT("digest") DO UPDATE` collapses the raced insert into an in-place
+    // update instead, so a same-digest stage is idempotent regardless of arrival order (issue #778 review —
+    // thread deliveryGraphProposals.ts:245). `stage_seq` is still assigned ATOMICALLY inside the write
+    // (`MAX(stage_seq)+1`, materialised once as `excluded."stage_seq"` so the insert and the on-conflict
+    // update use the exact same value), preserving the strictly-monotonic ordering the supersede reconcile
+    // below tie-breaks on.
+    //
+    // The TTL anchor (`created_at`) and horizon (`expires_at`) are ALSO derived inside this atomic write,
+    // from the row as it exists AT WRITE TIME — NOT from a pre-transaction `table.get` snapshot (issue #778
+    // review — thread deliveryGraphProposals.ts:247). A pre-read snapshot is a TOCTOU: a concurrent re-stage
+    // can commit a fresh TTL between the read and this write, and the stale caller — committing LAST, so it
+    // wins the newest `stage_seq` — would overwrite that fresh horizon with the one it computed from the OLD
+    // `created_at`, restoring an already-expired `expires_at` on the newest row and leaving the proposal
+    // non-dispatchable. On a fresh INSERT the caller's `created_at`/`expires_at` stand (first stage anchors
+    // the TTL). On a CONFLICT the `CASE` re-reads the CURRENT committed row: if it is still LIVE
+    // (`expires_at` in the future) the original anchor and horizon are PRESERVED (an idempotent re-stage
+    // keeps the TTL pinned to the first stage); once it has aged out (past, blank, or NULL `expires_at`,
+    // matching `isProposalExpired`'s fail-closed rule) the TTL is RE-ANCHORED to now so a re-proposed digest
+    // is genuinely live again. All timestamps are ISO-8601 UTC, so the lexical `>` comparison is a valid
+    // chronological test.
+    await t.exec(
+      `INSERT INTO "delivery_graph_proposals" ("digest", "logical_key", "title", "graph", "preview", "node_count", "human_node_count", "side_effect_count", "side_effecting", "status", "created_at", "updated_at", "expires_at", "stage_seq") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ${nextSeq}) ON CONFLICT("digest") DO UPDATE SET "logical_key" = excluded."logical_key", "title" = excluded."title", "graph" = excluded."graph", "preview" = excluded."preview", "node_count" = excluded."node_count", "human_node_count" = excluded."human_node_count", "side_effect_count" = excluded."side_effect_count", "side_effecting" = excluded."side_effecting", "status" = excluded."status", "created_at" = CASE WHEN "delivery_graph_proposals"."expires_at" > ? THEN "delivery_graph_proposals"."created_at" ELSE ? END, "updated_at" = ?, "expires_at" = CASE WHEN "delivery_graph_proposals"."expires_at" > ? THEN "delivery_graph_proposals"."expires_at" ELSE ? END, "stage_seq" = excluded."stage_seq"`,
+      [row.digest, row.logical_key, row.title, row.graph, row.preview, row.node_count, row.human_node_count, row.side_effect_count, row.side_effecting, row.status, row.created_at, at, row.expires_at, at, at, at, at, atExpiry],
+    );
+    // Reconcile to EXACTLY ONE live proposal per logical graph: supersede every `staged` row for this
+    // `logical_key` that has a strictly-NEWER staged sibling (by `updated_at`, with a deterministic
+    // `stage_seq` tie-breaker), leaving only the globally-newest live. This is ORDER-INDEPENDENT
+    // — it never references the just-written digest, so it converges to a single live row regardless of the
+    // interleaving of concurrent stages. A supersede pass keyed to "only flip rows older than the one *I*
+    // just wrote" leaves TWO live proposals when an OLDER stage's pass runs AFTER a newer stage already
+    // committed (the older pass won't flip the newer row, and the newer pass ran before the older row
+    // existed) — and an unordered supersede-all leaves ZERO. Anchoring on the newest staged sibling avoids
+    // both: the newest row is never superseded (no newer sibling), so it stays staged throughout the
+    // statement and every older row's `EXISTS` is satisfied by it. Idempotent: a no-op once one row remains.
+    // The tie-break is the monotonic `stage_seq` (atomically assigned in the write above), NOT the content
+    // `digest` NOR the frozen `rowid`: two stages landing in the SAME millisecond tie on `updated_at`, and a
+    // `digest`-string tie-break is arbitrary w.r.t. submission order while `rowid` does not advance on a
+    // re-stage UPDATE — so either could pick the LATER-submitted graph as the one superseded, inverting
+    // "the latest stage wins". `stage_seq` advances on every stage (insert AND re-stage alike), so the
+    // most-recently-written row deterministically wins the tie.
+    await t.exec(
+      `UPDATE "delivery_graph_proposals" SET "status" = 'superseded', "updated_at" = ? WHERE "logical_key" = ? AND "status" = 'staged' AND EXISTS (SELECT 1 FROM "delivery_graph_proposals" AS "newer" WHERE "newer"."logical_key" = "delivery_graph_proposals"."logical_key" AND "newer"."status" = 'staged' AND ("newer"."updated_at" > "delivery_graph_proposals"."updated_at" OR ("newer"."updated_at" = "delivery_graph_proposals"."updated_at" AND "newer"."stage_seq" > "delivery_graph_proposals"."stage_seq")))`,
       [now(), row.logical_key],
     );
+  });
 
   // Report what the stage did to siblings (issue #740). `superseded` = the same-logical-key proposals
   // this stage retired (re-read post-reconcile so a concurrent newer stage that kept ITS row live —
@@ -259,12 +293,13 @@ export async function stageProposal(data: DataLayer, row: DeliveryGraphProposal)
   }
   const siblingsStaged = (await listStagedProposals(data)).filter((r) => r.logical_key !== row.logical_key).length;
 
-  // Re-read the just-written row AFTER the reconcile so `row` reports the ACTUALLY-persisted state, not
-  // the pre-reconcile `toWrite`: a concurrent newer stage of a different digest can flip THIS digest to
-  // `superseded` in the reconcile above, so returning `toWrite` (still `staged`) would report a status
-  // that doesn't match the DB. Fall back to `toWrite` only if the row somehow vanished (it shouldn't —
-  // we just wrote it), keeping the return non-null.
-  const persisted = (await table.get(toWrite.digest)) ?? toWrite;
+  // Re-read the just-written row AFTER the reconcile so the returned row reports the ACTUALLY-persisted
+  // state: a concurrent newer stage of a different digest can flip THIS digest to `superseded` in the
+  // reconcile above, so returning the pre-reconcile input `row` (still `staged`) would report a status
+  // that doesn't match the DB — and the persisted `created_at`/`expires_at`/`stage_seq` are derived inside
+  // the write, not on `row`. Fall back to the input `row` only if the persisted row somehow vanished (it
+  // shouldn't — we just wrote it), keeping the return non-null.
+  const persisted = (await table.get(row.digest)) ?? row;
 
   return { row: persisted, superseded, siblingsStaged };
 }
@@ -321,9 +356,36 @@ export async function listStagedProposals(
 }
 
 /** Mark a staged proposal `dispatched` once the operator launches it — it drops out of the cockpit's
- * staged list (the run then shows in the in-flight grid). */
-export async function markProposalDispatched(data: DataLayer, digest: string): Promise<void> {
-  await deliveryGraphProposals(data).update(digest, { status: "dispatched", updated_at: now() });
+ * staged list (the run then shows in the in-flight grid).
+ *
+ * Like `markProposalExpired`/`markProposalDismissed`/`sweepExpiredProposals`, this is a GUARDED UPDATE
+ * (`... WHERE digest=? AND status='staged'`), not a blind update-by-key. The dispatch door's
+ * `getStagedProposal` liveness read, the launch, and this terminal flip are separate statements, so the
+ * row can leave `staged` in the window between them (a concurrent dispatch consumed it, or a
+ * dismiss/supersede/expiry sweep retired it); a blind `table.update(digest, …)` would clobber that
+ * newer terminal status back to `dispatched`, breaking monotonic lifecycle transitions.
+ *
+ * When `expectedStageSeq` is supplied the guard ALSO pins `stage_seq` to the value the dispatch door
+ * snapshotted when it loaded the proposal (issue #778 review — thread deliveryGraphProposals.ts:243). A
+ * concurrent RE-STAGE of the SAME digest overwrites the row in place with a newer graph (two
+ * credential-differing graphs share a semantic digest) and bumps `stage_seq`; without the seq pin, this
+ * flip would retire that newer, never-launched graph — the dispatch launched the STALE snapshot it read
+ * yet marks the fresh row consumed. Pinning `stage_seq` makes the flip a no-op in that race, leaving the
+ * re-staged graph `staged` for its own dispatch. Omit `expectedStageSeq` (e.g. a pre-migration row whose
+ * seq is `0`) to fall back to the `status='staged'`-only guard.
+ *
+ * Returns whether the guarded UPDATE actually flipped a row (`res.changed > 0`), mirroring
+ * `markProposalDismissed`/`sweepExpiredProposals`. A `false` return means the row was no longer the
+ * `staged` revision this dispatch snapshotted (a concurrent dispatch/re-stage/retire won) — the launched
+ * run still stands, but the mark was intentionally skipped so the newer row is not clobbered. */
+export async function markProposalDispatched(data: DataLayer, digest: string, expectedStageSeq?: number): Promise<boolean> {
+  const db = data.open();
+  const guardSeq = typeof expectedStageSeq === "number";
+  const res = await db.exec(
+    `UPDATE "delivery_graph_proposals" SET "status" = 'dispatched', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'${guardSeq ? ` AND "stage_seq" = ?` : ""}`,
+    guardSeq ? [now(), digest, expectedStageSeq] : [now(), digest],
+  );
+  return res.changed > 0;
 }
 
 /** Retire a proposal by flipping it to `expired` — its `graph` payload is unusable (e.g. corrupt JSON
@@ -342,12 +404,18 @@ export async function markProposalDispatched(data: DataLayer, digest: string): P
  * Returns whether the guarded UPDATE actually flipped a row (`res.changed > 0`), mirroring
  * `markProposalDismissed`/`sweepExpiredProposals`. A `false` return means the row was no longer `staged`
  * at write time (a dismiss/supersede/dispatch race won), so the caller must not treat the retirement as
- * having happened. */
-export async function markProposalExpired(data: DataLayer, digest: string): Promise<boolean> {
+ * having happened.
+ *
+ * When an `expectedStageSeq` is supplied (the dispatch door's corrupt-graph retirement), the flip is
+ * ADDITIONALLY guarded on `stage_seq = ?`, exactly like `markProposalDispatched`: a concurrent re-stage
+ * of the same digest bumps `stage_seq`, so guarding on the revision we inspected keeps the expiry from
+ * retiring a newer graph that landed in the read→write window (issue #778 review). */
+export async function markProposalExpired(data: DataLayer, digest: string, expectedStageSeq?: number): Promise<boolean> {
   const db = data.open();
+  const guardSeq = typeof expectedStageSeq === "number";
   const res = await db.exec(
-    `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'`,
-    [now(), digest],
+    `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'${guardSeq ? ` AND "stage_seq" = ?` : ""}`,
+    guardSeq ? [now(), digest, expectedStageSeq] : [now(), digest],
   );
   return res.changed > 0;
 }
@@ -404,9 +472,15 @@ export async function sweepExpiredProposals(data: DataLayer, at: Date = new Date
   let swept = 0;
   for (const row of staged) {
     if (isProposalExpired(row.expires_at, at)) {
+      // Pin `stage_seq` (like `markProposalDispatched`/`markProposalExpired`): the `find` liveness read and
+      // this flip are separate statements, so a concurrent RE-STAGE can overwrite the row in place with a
+      // newer graph — bumping `stage_seq` and REFRESHING `expires_at` — in the window between them. A blind
+      // `digest + status='staged'` update would then expire that fresh, un-expired revision. Guarding on the
+      // `stage_seq` we inspected makes the flip a no-op in that race, leaving the re-staged graph `staged`
+      // (issue #778 review — thread deliveryGraphProposals.ts:417).
       const res = await db.exec(
-        `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'`,
-        [ts, row.digest],
+        `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged' AND "stage_seq" = ?`,
+        [ts, row.digest, row.stage_seq],
       );
       swept += res.changed;
     }

package/app/deliveryGraphRun.test.ts

@@ -8,7 +8,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { test } from "node:test";
-import { assertEquals } from "#test-assert";
+import { assert, assertEquals, assertStringIncludes } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
 import { bootTestApp } from "@nanobpm/urban-testkit";
 import { compileDeliveryGraph } from "./deliveryGraphCompiler.ts";
@@ -19,6 +19,7 @@ import {
   computeRunKey,
   deriveDeliveryPhase,
   DELIVERY_PHASE,
+  deliveryGraphRunIdentities,
   deliveryGraphRuns,
   humanTaskElementId,
   parseHumanLabels,
@@ -107,6 +108,25 @@ test("claimRunForLaunch: re-running a terminal row clears the PRIOR instance key
   });
 });
 
+test("claimRunForLaunch: winning a re-run claim ATOMICALLY invalidates the prior run's identity side-row — a concurrent loser's short-circuit read sees a MISSING (unprovable) fingerprint, not the stale prior one (issue #778 review — thread deliveryGraphDispatch.ts:180)", async () => {
+  await withData(async (data) => {
+    const runs = deliveryGraphRuns(data);
+    const identities = deliveryGraphRunIdentities(data);
+    // A terminal prior run still carrying its stamped lossless identity fingerprint.
+    await runs.insert({ ...claimRow("running"), status: "failed" });
+    await identities.insert({ run_key: "rk", graph_fingerprint: "PRIOR-FP", created_at: "2020-01-01T00:00:00.000Z" });
+    // The winner re-runs (conceptually a DIFFERENT graph that shares the digest-derived run_key but not
+    // the credential-sensitive fingerprint). The CAS flips the row to running…
+    assertEquals(await claimRunForLaunch(data, true, claimRow("running")), true);
+    // …and the stale identity row must be GONE the instant the row is `running`. Otherwise a racing loser
+    // reading between this flip and the winner's post-launch `upsertRunIdentity` re-stamp would read
+    // "PRIOR-FP" and, if that matched ITS graph, wrongly confirm identity for a credential-different run.
+    // Missing → dispatch's identityConfirmed is false (the safe 409) throughout the window.
+    const after = await identities.get("rk");
+    assert(after == null, `the stale identity row must be gone, got: ${JSON.stringify(after)}`);
+  });
+});
+
 // ── pollDeliveryGraphPhase: engine-key coercion ───────────────────────────────
 test("pollDeliveryGraphPhase: a numeric engine processInstanceKey still matches the string process_key, so a COMPLETED instance reconciles to done", async () => {
   await withData(async (data) => {
@@ -200,12 +220,32 @@ test("buildHumanLabels: maps each human node's compiled user-task element id →
   assertEquals(labels[humanTaskElementId(ackEl)], "ack"); // fallback to node id
 });
 
+test("buildHumanLabels: redacts a credential-bearing human prompt before it lands in human_labels (issue #778 review)", async () => {
+  const graph = {
+    nodes: [
+      { id: "publish", kind: "human", human: { prompt: "deploy via https://user:s3cr3t@registry.example.com then confirm" } },
+    ],
+    edges: [],
+  };
+  const compiled = await compileDeliveryGraph(graph);
+  assertEquals(compiled.ok, true);
+  if (!compiled.ok) return;
+  const labels = buildHumanLabels(compiled);
+  const publishEl = compiled.resolved.nodes.find((n) => n.id === "publish")?.element ?? "";
+  const label = labels[humanTaskElementId(publishEl)];
+  assert(!label.includes("s3cr3t") && !label.includes("user:s3cr3t"), "the credential must not survive into the denormalised inbox label");
+  assertStringIncludes(label, "//***@");
+});
+
 test("parseHumanLabels: round-trips a stored map and tolerates null/blank/corrupt", () => {
-  assertEquals(parseHumanLabels(JSON.stringify({ a: "x" })), { a: "x" });
   assertEquals(parseHumanLabels(null), {});
   assertEquals(parseHumanLabels(""), {});
   assertEquals(parseHumanLabels("  "), {});
   assertEquals(parseHumanLabels("{not json"), {});
+  assertEquals(parseHumanLabels(JSON.stringify({ n1: "manual OTP publish", n2: "confirm deploy" })), {
+    n1: "manual OTP publish",
+    n2: "confirm deploy",
+  }); // round-trips a valid string→string map
   assertEquals(parseHumanLabels(JSON.stringify(["a"])), {}); // non-object
   assertEquals(parseHumanLabels(JSON.stringify({ a: 1, b: "y" })), { b: "y" }); // drops non-string values
 });

package/app/deliveryGraphRun.ts

@@ -26,6 +26,7 @@
 import type { DataLayer, ProcessInstanceState } from "@nanobpm/urban";
 import type { CompileDeliveryGraphResult } from "../nano-generated/api-io.d.ts";
 import { isUniqueConstraintFence } from "./dbFence.ts";
+import { redactFreeText } from "./deliveryGraphCompiler.ts";
 import { DELIVERY_HUMAN_ELEMENT, isDeliveryHumanElement } from "./deliveryHuman.ts";
 
 const now = () => new Date().toISOString();
@@ -97,6 +98,24 @@ export const DELIVERY_PHASE = {
 export const deliveryGraphRuns = (data: DataLayer) =>
   data.table<DeliveryGraphRun>("delivery_graph_runs", "run_key");
 
+/** One row of the `delivery_graph_run_identity` SIDE table (migration 113) — the run's LOSSLESS
+ * content-identity fingerprint, kept OFF the heavily-projected `delivery_graph_runs` base row so no
+ * drift-guarded read-model/compat view has to carry it. Keyed by `run_key`. */
+export interface DeliveryGraphRunIdentity {
+  run_key: string;
+  /** `sha256(digest \0 canonicalJson(digestInvisibleRawValues(graph)))`, captured at launch — the same
+   *  lossless identity `stableProposalRunKey` folds into the keyless run key. An explicit-`idempotencyKey`
+   *  short-circuit compares this to prove the running run is THIS exact graph (a same-payload retry) vs. a
+   *  credential-different graph re-staged under the same key. */
+  graph_fingerprint: string;
+  created_at: string;
+}
+
+/** The `delivery_graph_run_identity` side-table accessor — the run's lossless identity fingerprint,
+ * keyed by `run_key` (issue #778 review — thread dispatchDeliveryGraph.ts:332). */
+export const deliveryGraphRunIdentities = (data: DataLayer) =>
+  data.table<DeliveryGraphRunIdentity>("delivery_graph_run_identity", "run_key");
+
 /** Atomically claim a run for LAUNCH — the at-most-once dispatch fence. Returns `true` iff THIS caller
  * won the claim and must proceed to `runDeliveryGraph`; `false` iff a concurrent submit already claimed
  * it (the caller must short-circuit as `alreadyRunning` instead of double-launching). Two fences, one
@@ -119,7 +138,9 @@ export const deliveryGraphRuns = (data: DataLayer) =>
  * the row briefly visible as `running` while still pointing at the OLD instance key, so the
  * `process_key`-keyed instance-tracking reconciler / poller could act on (and mis-reconcile against)
  * the stale instance before the winner's follow-up metadata write lands. Clearing them atomically with
- * the flip means a claimed `running` row can never be observed with a stale instance key. */
+ * the flip means a claimed `running` row can never be observed with a stale instance key. A winning
+ * relaunch also DELETES the run's prior `delivery_graph_run_identity` side-row in the same transaction,
+ * for the same reason — see the inline note (issue #778 review). */
 export async function claimRunForLaunch(
   data: DataLayer,
   existing: boolean,
@@ -134,9 +155,8 @@ export async function claimRunForLaunch(
       return false;
     }
   }
-  const res = await data
-    .open()
-    .exec(
+  const res = await data.open().tx(async (t) => {
+    const flip = await t.exec(
       `UPDATE "delivery_graph_runs" SET "status" = ?, "process_key" = ?, "process_definition_id" = ?, "phase" = ?, "phase_node_id" = ?, "updated_at" = ? WHERE "run_key" = ? AND "status" <> 'running'`,
       [
         claim.status,
@@ -148,7 +168,21 @@ export async function claimRunForLaunch(
         claim.run_key,
       ],
     );
-  return res.changed === 1;
+    if (flip.changed !== 1) return false;
+    // Invalidate the PRIOR run's lossless identity fingerprint IN THE SAME transaction as the flip, so a
+    // claimed `running` row can never be observed alongside the previous run's stale `graph_fingerprint`.
+    // dispatch's `identityConfirmed` short-circuit reads this side-row to prove an already-running run is
+    // THIS exact graph (a same-payload retry) vs. a credential-different graph re-staged under the same
+    // key; between this flip and the winner's post-launch re-stamp (`upsertRunIdentity`) the prior row
+    // would otherwise still match a relaunch that shares only the digest, WRONGLY confirming identity for
+    // a different-credential run. Deleting it here makes the fingerprint UNPROVABLE (missing →
+    // identityConfirmed:false, the safe pre-existing 409) throughout that window, atomically with the
+    // status flip — the same "no stale side-state observable on a claimed row" invariant the instance-key
+    // clear above enforces (issue #778 review — thread deliveryGraphDispatch.ts:180).
+    await t.exec(`DELETE FROM "delivery_graph_run_identity" WHERE "run_key" = ?`, [claim.run_key]);
+    return true;
+  });
+  return res;
 }
 
 /** The idempotency key for a submitted graph: a caller-supplied `idempotencyKey` (trimmed) when
@@ -181,7 +215,13 @@ export function buildHumanLabels(compiled: CompileDeliveryGraphResult): Record<s
   for (const stop of compiled.humanNodes) {
     const element = elementByNodeId.get(stop.nodeId);
     if (element === undefined) continue;
-    labels[humanTaskElementId(element)] = firstLine(stop.prompt) || stop.nodeId;
+    // Redact the prompt with the SAME display-safe helper `nodeDisplay` uses BEFORE stamping it: this
+    // label is denormalised into the run row's `human_labels` and surfaced to the operator as the parked
+    // task's Decision context in the Tasks inbox, so a URL credential in a human prompt (`//user:pass@…`)
+    // must be stripped here too — else it is persisted and shown unredacted even though the BPMN display
+    // path redacts it. The RAW prompt still reaches the runtime user task unmodified (issue #778 review).
+    const safePrompt = typeof stop.prompt === "string" ? redactFreeText(stop.prompt) : "";
+    labels[humanTaskElementId(element)] = firstLine(safePrompt) || stop.nodeId;
   }
   return labels;
 }

package/app/deliveryRunner.test.ts

@@ -128,6 +128,27 @@ test("the human node seeds prompt/nodeId/emits; a click-done (no-emit, no-prompt
   assertEquals(ack?.nodeId, "ack");
 });
 
+test("the human node's seeded prompt REDACTS an embedded credential (issue #778 review): the read-only user-task form field never renders a `//user:pass@host` secret", async () => {
+  // The compiler already redacts the human prompt for the operator-facing PREVIEW (buildHumanNodes),
+  // but the runtime user-task seeds `nodeInputs.<el>.prompt` — rendered read-only in the delivery-human
+  // form (`delivery-human-{ack,publish}.form`, key "prompt", `readonly:true`). That display path must be
+  // redacted too, or a credential-bearing instruction leaks its secret to whoever opens the task. The
+  // prompt is DISPLAY-ONLY (the functional outputs are the emit/resolvedArtifact fields), so redacting it
+  // is safe. `redactFreeText` is a no-op for a credential-free prompt, so the plain-prompt tests above
+  // stay green.
+  const graph: DeliveryGraph = {
+    nodes: [
+      { id: "publish", kind: "human", human: { prompt: "clone https://user:s3cr3t@github.com/o/r then run the manual OTP publish" }, emits: [{ name: "resolvedArtifact", type: "artifact" }] },
+    ],
+    edges: [],
+  };
+  const p = await prepareOk(graph);
+  const human = Object.values(p.nodeInputs).find((v) => "escalationSlaTimeout" in (v as Record<string, unknown>)) as Record<string, unknown>;
+  const prompt = String(human.prompt);
+  assert(!prompt.includes("s3cr3t"), `the human-task form prompt must not expose the URL credential, got: ${prompt}`);
+  assert(prompt.includes("***@github.com"), `the credential userinfo is redacted in place, got: ${prompt}`);
+});
+
 test("agent node classifier-emit contract (#506): a declared `emits` threads the emit instruction into appendPrompt; a no-emit node leaves it untouched", async () => {
   // #506: a guarded split (S7) routes on a producer's emitted scalar, published from the engine
   // variable named exactly after the fact. A real `senior:*` agent completes with the Output-contract

package/app/deliveryRunner.ts

@@ -19,7 +19,7 @@ import type { EngineClient } from "@nanobpm/urban";
 import type { DeliveryFact, DeliveryGraph, DeliveryNode } from "../nano-generated/api-io.d.ts";
 import { TRANSCRIPT_URL_BASE_VAR, transcriptUrlBaseFor } from "./agentic/transcript-url.ts";
 import { isPlausibleBranchName } from "./baseBranch.ts";
-import { AGENT_REPO_SPEC_HEADER, AGENT_TERMINAL_SUCCESS_STATUSES, assertNever, compileDeliveryGraph, DELIVERY_GRAPH_PROCESS_ID } from "./deliveryGraphCompiler.ts";
+import { AGENT_REPO_SPEC_HEADER, AGENT_TERMINAL_SUCCESS_STATUSES, assertNever, compileDeliveryGraph, DELIVERY_GRAPH_PROCESS_ID, redactFreeText } from "./deliveryGraphCompiler.ts";
 import { DEFAULT_EVERY_MS, msToIsoDuration, parseProbe, readinessPollEvery, readinessTimeout } from "./readiness.ts";
 import { agentNodeRepoEnvelope, flattenAgentTaskEnvelope, isResolvableRepo, RepoEnvelopeConflictError, RepoEnvelopeUnresolvedError } from "./repoEnvelope.ts";
 import { isoDuration } from "./reviewWait.ts";
@@ -585,7 +585,14 @@ function buildNodeInput(
         // form can render its "now do X" prompt, name the parked node, and label/hide its emit field
         // (issue #499 — the generic form otherwise renders contextless). `emits` stays the single
         // source of truth: the compiled ioMapping derives the emit label/mode from it in FEEL.
-        prompt: node.human?.prompt ?? "",
+        // REDACT the prompt: this seeds `nodeInputs.<el>.prompt`, rendered in the delivery-human form's
+        // read-only `prompt` textarea (`delivery-human-{ack,publish}.form`) to whoever opens the task —
+        // a DISPLAY surface, not a functional value (the functional outputs are the emit/resolvedArtifact
+        // fields). So it gets the SAME embedded-credential redaction the operator-facing compile PREVIEW
+        // already applies (buildHumanNodes), closing the runtime leak where a credential-bearing
+        // instruction would expose its secret in the parked task's form (issue #778 review — thread
+        // deliveryGraphCompiler.ts:826). `redactFreeText` is a no-op for a credential-free prompt.
+        prompt: redactFreeText(node.human?.prompt ?? ""),
         nodeId: node.id ?? ctx.element,
         emits: Array.isArray(node.emits) ? node.emits.map((f) => ({ ...f })) : [],
       };

package/app/readiness.test.ts

@@ -48,6 +48,7 @@ import {
   readinessTimeoutMs,
   redactString,
   redactTarget,
+  isUrlShaped,
 } from "./readiness.ts";
 
 // A ProbeExec stub: canned http/command responses, capturing the last command it was asked to run.
@@ -862,6 +863,20 @@ test("probeBudgetMs: prefers the seeded probeTimeout (the gate timer's bound), f
 });
 
 // ── repo/ref parse + redaction ──────────────────────────────────────────────────────────────
+test("isUrlShaped: tolerates XML-attribute whitespace (TAB/LF/CR/space) between the scheme and `//` — `https:\\t//host` still classifies as a URL so its credential is redacted, not passed through as a non-URL (#778 review — thread readiness.ts:1191)", () => {
+  assert(isUrlShaped("https://host"), "a plain URL");
+  assert(isUrlShaped("//host"), "scheme-relative");
+  assert(isUrlShaped("  https://host"), "leading whitespace (trimmed first)");
+  // The XML-valid whitespace `stripXmlInvalidChars` keeps must not break the scheme→authority match:
+  assert(isUrlShaped("https:\t//user:pass@host"), "TAB between scheme and //");
+  assert(isUrlShaped("https:\n//host"), "LF between scheme and //");
+  assert(isUrlShaped("https:\r//host"), "CR between scheme and //");
+  assert(isUrlShaped("https:  //host"), "spaces between scheme and //");
+  // A plain routing token / non-URL is still NOT url-shaped.
+  assert(!isUrlShaped("senior:feature"), "a plain job-type token is not url-shaped");
+  assert(!isUrlShaped("owner/repo#1"), "a PR ref is not url-shaped");
+});
+
 test("parseRepoRef: splits owner/repo@ref and defaults the ref to HEAD", () => {
   assertEquals(parseRepoRef("o/r@abc123"), { repo: "o/r", ref: "abc123" });
   assertEquals(parseRepoRef("o/r"), { repo: "o/r", ref: "HEAD" });
@@ -874,6 +889,63 @@ test("redactString/redactTarget: strip userinfo and query (a token often rides e
   assert(!t.includes("s3cr3t"), "the secret must not survive redaction");
 });
 
+test("redactString: a `//user:pass@` userinfo that embeds a raw line break is still stripped (newline-safe)", () => {
+  // The userinfo class is `[^/@]` (NOT `[^/@\s]`): a CR/LF smuggled inside the userinfo must not
+  // break the `//…@` match and leave the credential tail visible.
+  const r = redactString("https://user:pa\nss@host/path");
+  assert(!r.includes("ss@host") && !r.includes("user:pa"), "the newline-split userinfo is redacted");
+  assertStringIncludes(r, "//***@");
+});
+
+test("redactString: a `//user:pass@` userinfo that embeds a raw TAB is still stripped (tab-safe)", () => {
+  // A TAB is a VALID XML character `stripXmlInvalidChars` does not remove, so an earlier `[^/@ \t]`
+  // userinfo class (excluding TAB) let `https://user:pa\tss@host` split before the `@` — leaving
+  // `ss@host` visible in the display artifact. The class is now `[^/@]` (issue #778 review).
+  const r = redactString("https://user:pa\tss@host/path?token=s3cr3t");
+  assert(!r.includes("ss@host") && !r.includes("user:pa"), "the tab-split userinfo is redacted");
+  assert(!r.includes("s3cr3t"), "the query token is redacted");
+  assertStringIncludes(r, "//***@");
+});
+
+test("redactString: a `//user:secret pass@` userinfo that embeds a literal SPACE is still stripped (space-safe)", () => {
+  // An earlier `[^/@ ]` class bounded the userinfo at a SPACE to avoid over-matching prose, but that let
+  // a malformed but operator-authored `https://user:secret pass@host` leave `user:secret` visible in the
+  // display artifact. The class is now `[^/@]` (space-tolerant), so the whole userinfo through the `@`
+  // collapses; the RAW value still reaches runtime unmodified (issue #778 review — thread readiness.ts:1177).
+  const r = redactString("https://user:secret pass@host/path?token=s3cr3t");
+  assert(!r.includes("secret") && !r.includes("user:"), `the space-split userinfo is redacted: ${r}`);
+  assert(!r.includes("s3cr3t"), "the query token is redacted");
+  assertStringIncludes(r, "//***@");
+});
+
+test("redactString: userinfo carrying MULTIPLE raw `@` collapses the WHOLE authority credential, not just the prefix (multi-@ suffix-leak, #778 review — thread readiness.ts:1175)", () => {
+  // Per RFC 3986 the userinfo runs to the LAST `@` before the authority's path. An earlier `[^/@]*@`
+  // span stopped at the FIRST `@`, so `https://user:pass@ss@host` rendered as `https://***@ss@host` —
+  // leaking `ss@host`, the userinfo suffix, into the display artifact. The class is now `[^/]` so the
+  // span reaches the final `@` and the entire credential authority collapses to `//***@` (leaving the
+  // real host `host`).
+  const r = redactString("https://user:pass@ss@host/path?token=s3cr3t");
+  assert(!r.includes("ss@host"), `the multi-@ userinfo suffix must not leak: ${r}`);
+  assert(!r.includes("user:pass"), "the userinfo prefix is redacted");
+  assert(!r.includes("s3cr3t"), "the query token is redacted");
+  assertStringIncludes(r, "//***@host");
+});
+
+test("redactString: a `?query`/`#fragment` value containing a literal `@` does NOT let the userinfo span cross the delimiter and leak the tail (#778 review — thread readiness.ts:1199)", () => {
+  // `//host?token=secret@tail` has NO userinfo — the `@` sits INSIDE the query. An unbounded `[^/]*@`
+  // userinfo class consumed the `?` marker (`//host?token=secret@` → `//***@`), so the follow-on
+  // query strip found no `?` and left `tail` visible. Bounding the userinfo class before `?`/`#`
+  // (`[^/?#]*@`) keeps the `?` in place so the whole `?query` (incl. the `@tail`) is redacted.
+  const r = redactString("https://host?token=secret@tail");
+  assert(!r.includes("tail"), `the query tail past the @ must not leak: ${r}`);
+  assert(!r.includes("secret"), "the query token is redacted");
+  assertEquals(r, "https://host?***");
+  // A GENUINE userinfo credential still collapses AND its query is still stripped.
+  const c = redactString("https://user:pass@host?token=s3cr3t@x");
+  assert(!c.includes("user:pass") && !c.includes("s3cr3t"), `userinfo + query both redacted: ${c}`);
+  assertEquals(c, "https://***@host?***");
+});
+
 test("redactTarget: a command target is never logged — only the kind + a fixed placeholder", () => {
   const ct = redactTarget(parseProbe({ kind: "command", target: "curl -H 'Authorization: Bearer s3cr3t' https://h/p" }));
   assertEquals(ct, "command:<redacted>");