@nanobpm/nano-workforce 0.190.0 → 0.191.0

package/app/readiness.ts

@@ -63,6 +63,11 @@ export type Backoff = "fixed" | "exponential";
 // is added here without a matching vocabulary entry (AGENTS.md: no drift surfaces).
 export const PROBE_KINDS: readonly ProbeKind[] = ["http", "command", "npm", "github-check", "capability", "pr", "epic"];
 export const ON_TIMEOUTS: readonly OnTimeout[] = ["escalate", "fail", "continue"];
+// The DEFAULT `onTimeout` an omitted value takes — the single source of truth `parseProbe` fills in and
+// the compiler's display drops as an effective default (writing it explicitly is behaviourally identical
+// to omitting it, so surfacing it would fork `semanticBpmn`/the digest from the omitted-equivalent
+// graph; issue #778 review — thread deliveryGraphCompiler.ts:1398).
+export const DEFAULT_ON_TIMEOUT: OnTimeout = "escalate";
 export const BACKOFFS: readonly Backoff[] = ["fixed", "exponential"];
 export const PR_CONDITIONS: readonly PrCondition[] = ["ready", "merged", "mergeable", "checks-green"];
 export const EPIC_CONDITIONS: readonly EpicCondition[] = ["merged", "done"];
@@ -237,7 +242,7 @@ export function parseProbe(raw: unknown, opts?: { allowLateBoundTarget?: boolean
   if (onTimeoutRaw !== "" && !isOnTimeout(onTimeoutRaw)) {
     throw new Error(`readiness probe: invalid onTimeout '${onTimeoutRaw}' (expected ${ON_TIMEOUTS.join(", ")})`);
   }
-  const onTimeout: OnTimeout = onTimeoutRaw === "" ? "escalate" : onTimeoutRaw;
+  const onTimeout: OnTimeout = onTimeoutRaw === "" ? DEFAULT_ON_TIMEOUT : onTimeoutRaw;
 
   const match = isRecord(raw.match) ? parseMatch(raw.match) : undefined;
   // A capability edge whose ref or package is blank can never resolve — fail loudly here rather than
@@ -307,7 +312,7 @@ export function parseProbe(raw: unknown, opts?: { allowLateBoundTarget?: boolean
 
 // Membership guards that narrow a validated string to its union without a type assertion (the
 // `no-unsafe-type-assertion` gate bans `as`).
-function isProbeKind(v: string): v is ProbeKind {
+export function isProbeKind(v: string): v is ProbeKind {
   for (const k of PROBE_KINDS) if (k === v) return true;
   return false;
 }
@@ -318,7 +323,7 @@ function isOnTimeout(v: string): v is OnTimeout {
 
 // `isBackoff` narrows a validated string to its union without a type assertion (the
 // `no-unsafe-type-assertion` gate bans `as`).
-function isBackoff(v: string): v is Backoff {
+export function isBackoff(v: string): v is Backoff {
   for (const b of BACKOFFS) if (b === v) return true;
   return false;
 }
@@ -414,7 +419,17 @@ export function normalizePoll(poll: ProbePoll | undefined): Required<ProbePoll>
   const everyMs = typeof everyRaw === "number" && everyRaw >= 1 ? Math.trunc(everyRaw) : DEFAULT_EVERY_MS;
   const timeoutMs =
     typeof timeoutRaw === "number" && timeoutRaw >= 1 ? Math.trunc(timeoutRaw) : DEFAULT_TIMEOUT_MS;
-  return { everyMs: Math.min(everyMs, MAX_EVERY_MS), timeoutMs, backoff: poll?.backoff ?? DEFAULT_BACKOFF };
+  // TRIM `backoff` to match `parseProbe` (`parsePoll` does `str(raw.backoff).trim()`): a padded
+  // `" exponential "` runs as the SAME `exponential` policy, so leaving the whitespace here would make
+  // the compiler's display path (`normalizePoll(p.poll)`) emit a spurious non-default `Poll:` line for a
+  // runtime-default poll — forking `semanticBpmn`/the digest from the omitted-equivalent graph and
+  // letting a re-stage bypass the idempotency fence to duplicate the run (issue #778 review — thread
+  // deliveryGraphCompiler.ts:1414). A whitespace-only / unrecognised value falls back to the default
+  // (the compiler display path takes raw JSON; a genuinely invalid backoff fails loudly later in
+  // `parseProbe`, so defaulting the DISPLAY is safe and keeps the effective-policy render honest).
+  const backoffTrimmed = typeof poll?.backoff === "string" ? poll.backoff.trim() : undefined;
+  const backoff = backoffTrimmed && isBackoff(backoffTrimmed) ? backoffTrimmed : DEFAULT_BACKOFF;
+  return { everyMs: Math.min(everyMs, MAX_EVERY_MS), timeoutMs, backoff };
 }
 
 /** The delay (ms) before the `attempt`-th retry (1-based). Fixed backoff returns `everyMs`;
@@ -1157,10 +1172,221 @@ export function redactTarget(probe: ReadinessProbe): string {
   return `${probe.kind}:${redactString(probe.target)}`;
 }
 
+/** The ONE canonical embedded-`//<userinfo>@` credential-userinfo span, shared by the redactor
+ * ({@link redactString}, which REWRITES the span to `//***@`) and the semantic reject path
+ * ({@link hasEmbeddedCredential}, used by `validateDeliveryGraph` to REJECT a credential-bearing
+ * `agent.jobType`). Keeping ONE source string means the "what counts as an embedded credential" rule
+ * can never drift between the two — the redactor must strip exactly what the validator rejects, or a
+ * credential the validator misses would be echoed un-redacted. The userinfo class is `[^/?#]` (NOT
+ * `[^/@\s]`, and NOT the earlier `[^/@]`/`[^/]`): it deliberately spans WHITESPACE up to the `@`, so a
+ * malformed-but-operator-authored `//user:secret pass@host` (a literal space in the userinfo) is
+ * caught, not left to leak verbatim into the executable `<zeebe:taskDefinition type=…>` / compiled BPMN
+ * (issue #778 review — thread deliveryGraph.ts:570). The userinfo colon is DELIBERATELY OPTIONAL
+ * (`[^/?#]*@`, not `[^/?#]*:[^/?#]*@`):
+ * a passwordless, username-only `//token@host` is a bearer/OAuth token riding the userinfo and MUST be
+ * caught too — a plain worker-routing job type never contains a `//…@` span at all (with or without a
+ * colon), so requiring a colon would only re-open a real leak for no legitimate gain (issue #778 review
+ * — thread readiness.ts:1170). `[^/?#]*@` is a single-quantifier match — linear, no catastrophic
+ * backtracking.
+ *
+ * The userinfo class is `[^/?#]` (NOT `[^/@]`): per RFC 3986 the userinfo runs to the LAST `@` before the
+ * authority's path, so a malformed-but-accepted multi-`@` value (`//user:pass@ss@host`) must collapse
+ * through EVERY `@` up to the path — an earlier `[^/@]*@` stopped at the FIRST `@`, rewriting only
+ * `//user:pass@` and leaking the `ss@host` suffix into the display artifact (issue #778 review — thread
+ * readiness.ts:1175).
+ *
+ * The class also EXCLUDES `?` and `#` (NOT the earlier `[^/]`): per RFC 3986 a raw `?`/`#` starts the
+ * query/fragment and so ENDS the authority — a `//host?token=secret@tail` carries its `@` INSIDE the
+ * query, with no userinfo at all. An unbounded `[^/]*@` greedily consumed the `?` marker
+ * (`//host?token=secret@` → `//***@`), so the follow-on `?query`/`#fragment` strip in {@link redactString}
+ * found no marker and left `tail` visible. Bounding the userinfo before `?`/`#` keeps the marker in
+ * place so the whole query/fragment (incl. any `@tail`) is redacted, while a genuine `//user:pass@host?…`
+ * still collapses its userinfo AND has its query stripped (issue #778 review — thread readiness.ts:1199).
+ * `[^/?#]` still excludes `/` (so it never crosses into the path), and the trailing `@` is anchored
+ * greedily to the last one before a `/`/`?`/`#`; `[^/?#]*@` remains a single-quantifier match, so it is
+ * linear with no catastrophic backtracking. */
+export const EMBEDDED_CREDENTIAL_SRC = "\\/\\/[^/?#]*@";
+
 /** Strip credential-bearing pieces from a free-form target string for logging: any `user:pass@`
- * userinfo and any `?query`/`#fragment` (a token often rides the query). */
+ * userinfo and any `?query`/`#fragment` (a token often rides the query). The query/fragment strip uses
+ * `[\s\S]*` (NOT `.*$`, which cannot cross a line break) so an embedded CR/LF after the `?`/`#` — e.g.
+ * `https://host/?token=secret\nnext` — cannot leave the token un-redacted; everything from the first
+ * `?`/`#` to end-of-string is consumed regardless of intervening newlines. The userinfo class is
+ * `[^/?#]` (NOT `[^/@\s]`, NOT the earlier `[^/@ ]`/`[^/@ \t]`/`[^/@]`, and NOT the later `[^/]`): ANY character smuggled
+ * INSIDE the
+ * userinfo up to the `@` — a raw CR/LF (`https://user:pa\nss@host`), an embedded TAB
+ * (`https://user:pa\tss@host`), a literal SPACE (`https://user:secret pass@host`, a malformed but
+ * operator-authored value), OR an extra raw `@` (`https://user:pass@ss@host`, whose userinfo per RFC
+ * 3986 runs to the LAST `@`) — must not break the `//…@` match and leave the credential tail visible.
+ * An earlier `[^/@ ]` bounded the userinfo at a SPACE to avoid over-matching prose, and `[^/@]` stopped
+ * at the FIRST `@` (leaking a multi-`@` suffix), but both let a credential escape into an
+ * operator-visible display artifact; since the RAW value
+ * still reaches runtime unmodified and only the DISPLAY doc is affected, redacting more (through the
+ * last `@` before the path) is the safe direction (issue #778 review). The `?`/`#` exclusion is the
+ * INVERSE correction: a `[^/]` userinfo crossed a raw query/fragment delimiter — a `?token=…@tail` query
+ * (no userinfo; the `@` rides the query) collapsed to `//***@tail`, consuming the `?` marker so the
+ * follow-on `?query`/`#fragment` strip below found nothing and LEAKED `tail`. Bounding the userinfo at
+ * `?`/`#` keeps the marker so the query strip redacts the whole tail (issue #778 review — thread
+ * readiness.ts:1199). `[^/?#]*@` remains a
+ * single-quantifier match, so it is
+ * linear with no catastrophic backtracking. Callers that surface the result in a display artifact must
+ * first pass it through `stripXmlInvalidChars` so an XML-forbidden control (e.g. U+000B) inside the
+ * userinfo cannot split the `//…@` match and be re-joined at render. */
 export function redactString(s: string): string {
-  return s
-    .replace(/\/\/[^/@\s]*@/g, "//***@")
-    .replace(/[?#].*$/, (m) => `${m[0]}***`);
+  return redactEmbeddedCredential(s).replace(/[?#][\s\S]*$/, (m) => `${m[0]}***`);
+}
+
+/** Strip ONLY the embedded `//<userinfo>@` credential span(s) from a string, collapsing each to
+ * `//***@` and leaving everything else (including any `?query`/`#fragment`, which may be a MEANINGFUL
+ * opaque-token character rather than URL syntax) untouched. Shares the ONE canonical
+ * {@link EMBEDDED_CREDENTIAL_SRC} span so "what counts as an embedded credential" can never drift from
+ * the redactor ({@link redactString}) or the validator ({@link hasEmbeddedCredential}). A `//<userinfo>@`
+ * span is UNAMBIGUOUSLY a credential wherever it sits — a plain opaque identifier
+ * (`slack:#releases`, `owner/repo#42`, `pkg@version`) never contains one — so it is safe to strip
+ * regardless of the value's URL-shape or the span's position, which is why {@link redactConnectorValue}
+ * runs it on a NON-URL-shaped free-form value (a probe target / PR ref) whose credential rides AFTER a
+ * prefix (`prefix //user:pass@host#42`) that the anchored {@link isUrlShaped} check would miss (issue
+ * #778 review — thread deliveryGraph.ts:162/566). `[^/]*@` is a single-quantifier match — linear, no
+ * catastrophic backtracking. */
+export function redactEmbeddedCredential(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_CREDENTIAL_SRC, "g"), "//***@");
+}
+
+/** The ONE canonical embedded SCHEME-RELATIVE credential-URL token: a `//<userinfo>@authority…` run
+ * (bounded by the next literal space) whose `//` carries userinfo. The `@` UNAMBIGUOUSLY marks the run a
+ * URL — an opaque ref (`//host#42`, `slack:#releases`, `owner/repo#42`) never carries `//user@` — so its
+ * `?query`/`#fragment` IS URL syntax and may hide a token, exactly like an explicit-scheme
+ * {@link EMBEDDED_SCHEME_URL_SRC}. Distinct from the userinfo-ONLY {@link EMBEDDED_CREDENTIAL_SRC}, which
+ * strips just the `//user:pass@` span and (correctly, for an opaque `//host#42`) LEAVES the tail: a
+ * userinfo-bearing `//user:pass@host?token=secret` embedded after a non-URL prefix is scheme-relative,
+ * so the anchored whole-value {@link isUrlShaped} check misses it (non-URL prefix) and the userinfo-only
+ * strip leaks the `?token=secret` tail (issue #778 review — thread deliveryGraph.ts:188). Requiring the
+ * `@` keeps genuine opaque `//host#42` refs (no userinfo) untouched. The token runs to the next literal
+ * SPACE (`[^ ]*`), NOT the wider `\s` class, so it CROSSES an XML-valid internal TAB/LF/CR and still
+ * redacts a `?query` secret sitting past it. The userinfo class is `[^/?#]` (NOT the earlier `[^/]`):
+ * bounding it before a raw `?`/`#` stops the userinfo span crossing the query/fragment delimiter — a
+ * `//host?token=secret@tail` (no userinfo; the `@` rides the query) no longer collapses to `//***@tail`
+ * (leaking `tail`); it instead falls through to {@link redactEmbeddedSchemeRelativeUrl}, which strips the
+ * whole `?query` (issue #778 review — thread readiness.ts:1199, mirroring the {@link EMBEDDED_CREDENTIAL_SRC}
+ * fix). `[^/?#]*@` and `[^ ]*` are separated by the literal `@`
+ * anchor, so the match stays linear with no catastrophic backtracking. */
+const EMBEDDED_CREDENTIAL_URL_SRC = "\\/\\/[^/?#]*@[^ ]*";
+
+/** Redact each embedded SCHEME-RELATIVE credential-URL (`//<userinfo>@authority…`) token IN PLACE via
+ * {@link redactString} — stripping its `//user:pass@` userinfo AND any `?query`/`#fragment` — while
+ * leaving opaque `//host#42` refs (no userinfo) untouched. Lets {@link redactConnectorValue} catch a
+ * query/fragment secret riding a credential-bearing scheme-relative URL after a non-URL prefix
+ * (`prefix //user:pass@host?token=secret`) that the anchored {@link isUrlShaped} whole-value check AND
+ * the userinfo-only {@link redactEmbeddedCredential} both miss (issue #778 review — thread
+ * deliveryGraph.ts:188). Deterministic and total. */
+export function redactEmbeddedCredentialUrl(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_CREDENTIAL_URL_SRC, "g"), (m) => redactString(m));
+}
+
+/** The ONE canonical embedded ABSOLUTE-URL token: an EXPLICIT-scheme `scheme://authority…` run bounded
+ * by whitespace. Deliberately requires an explicit `scheme:` before the `//` (NOT the scheme-relative
+ * `//authority` {@link isUrlShaped} also accepts): an absolute URL's `?query`/`#fragment` are
+ * UNAMBIGUOUSLY URL syntax and may hide a token, so they are safe to strip; a scheme-relative
+ * `//host#42` (or an opaque `slack:#releases`, `owner/repo#42`) instead carries a MEANINGFUL opaque
+ * `#`/`?` (a `parsePrTarget` PR ref) that must survive, so it is left to the userinfo-only
+ * {@link redactEmbeddedCredential}. The scheme may be followed by XML-attribute whitespace
+ * (`\s*` — TAB/LF/CR/space) BEFORE the `//` authority, exactly like {@link isUrlShaped}: those are valid
+ * XML `Char`s that `stripXmlInvalidChars` does NOT remove, so an embedded `scheme<whitespace>//authority`
+ * after a non-URL prefix (`prefix https:\t//user:pass@host?token=secret`) is not whole-value URL-shaped,
+ * escapes the anchored {@link isUrlShaped} check, and — without this `\s*` — was missed here too, leaving
+ * the fallback {@link redactEmbeddedCredential} to strip only the `//…@` userinfo and LEAK the
+ * `?token=secret` tail. Keeping this token's `scheme:` + `\s*` + `//` shape aligned with `isUrlShaped`
+ * closes that gap (issue #778 review — thread readiness.ts:1239). The token then runs to the next literal
+ * (`[^ ]+`), NOT the wider `\s` class, so it CROSSES an XML-valid internal TAB/LF/CR (0x09/0x0A/0x0D —
+ * the only whitespace `stripXmlInvalidChars` keeps) and still redacts a `?query`/`#fragment` secret
+ * sitting past it (`https://host/pa\tth?token=secret`); a `\s`-bounded token stopped at that internal
+ * whitespace and leaked the tail (#778 review — thread deliveryGraph.ts:188). Over-redacting across an
+ * internal newline is the safe direction. `\s*` and `[^ ]+` are separated by the literal `:`/`//`
+ * anchors, so the match stays linear with no catastrophic backtracking. */
+const EMBEDDED_SCHEME_URL_SRC = "[a-z][a-z0-9+.-]*:\\s*\\/\\/[^ ]+";
+
+/** Redact each embedded ABSOLUTE-URL (explicit `scheme://…`) token in a free-form value IN PLACE via
+ * {@link redactString} — stripping that token's `user:pass@` userinfo AND `?query`/`#fragment` — while
+ * leaving surrounding prose and any scheme-relative/opaque `//…`/`#`/`?` run untouched (those are
+ * handled, credential-only, by {@link redactEmbeddedCredential}). Lets {@link redactConnectorValue}
+ * catch a query/fragment secret riding an embedded absolute URL after a non-URL prefix
+ * (`prefix https://host/path?token=secret`) that the anchored {@link isUrlShaped} whole-value check
+ * misses (issue #778 review — thread deliveryGraph.ts:181). Deterministic and total. */
+export function redactEmbeddedUrl(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_SCHEME_URL_SRC, "gi"), (m) => redactString(m));
+}
+
+/** The ONE canonical embedded SCHEME-RELATIVE URL token that carries a `?query`: a userinfo-LESS
+ * `//authority…?query…` run (bounded by the next literal space). Distinct from the userinfo-bearing
+ * {@link EMBEDDED_CREDENTIAL_URL_SRC} (which the `@` marks a URL) and the explicit-scheme
+ * {@link EMBEDDED_SCHEME_URL_SRC}: a `senior:feature //host?token=secret` embedded after a non-URL prefix
+ * has NO userinfo `@` and NO explicit `scheme:`, so the anchored {@link isUrlShaped} whole-value check,
+ * {@link redactEmbeddedCredentialUrl}, and {@link redactEmbeddedUrl} ALL miss it — leaking the
+ * `?token=secret` tail (issue #778 review — thread deliveryGraph.ts:633). A scheme-relative `//authority`
+ * whose `?` is present is UNAMBIGUOUSLY URL syntax — an opaque ref (`owner/repo#42`, `//host#42`) uses a
+ * `#<digits>` fragment (`parsePrTarget`), never a `//…?…` query — so its query is safe to strip while a
+ * userinfo-less opaque `//host#42` (no `?`) is left to keep its meaningful `#42`. The token runs to the
+ * next literal SPACE (`[^ ]*`), NOT the wider `\s` class, so it CROSSES an XML-valid internal TAB/LF/CR
+ * and still redacts a `?query` secret sitting past it. `[^ ]*` before/after the literal `?` anchor keeps
+ * the match linear with no catastrophic backtracking. */
+const EMBEDDED_SCHEME_RELATIVE_URL_SRC = "\\/\\/[^ ]*\\?[^ ]*";
+
+/** Redact each embedded SCHEME-RELATIVE URL (`//authority…?query…`, no userinfo, no explicit scheme)
+ * token IN PLACE via {@link redactString} — stripping its `?query`/`#fragment` — while leaving a
+ * userinfo-less opaque `//host#42` PR ref (no `?`) untouched. Lets {@link redactConnectorValue} catch a
+ * query secret riding a scheme-relative URL after a non-URL prefix (`prefix //host?token=secret`) that
+ * the anchored {@link isUrlShaped} check, {@link redactEmbeddedCredentialUrl}, and {@link redactEmbeddedUrl}
+ * all miss (issue #778 review — thread deliveryGraph.ts:633). Deterministic and total. */
+export function redactEmbeddedSchemeRelativeUrl(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_SCHEME_RELATIVE_URL_SRC, "g"), (m) => redactString(m));
+}
+
+/** The canonical scheme-relative `//` authority marker — the `//` that opens an authority in ANY URL
+ * form (absolute `scheme://`, scheme-relative `//`, credential `//user@`). A worker-routing job type
+ * never legitimately contains it. */
+const SCHEME_RELATIVE_AUTHORITY_SRC = "\\/\\/";
+
+/** True when `value` embeds a scheme-relative `//authority` token (see {@link SCHEME_RELATIVE_AUTHORITY_SRC}).
+ * A plain worker-routing job type / opaque id NEVER contains `//` — so a match (whether it carries
+ * userinfo, an explicit scheme, a `?query`, a `#fragment`, or nothing) is illegitimate in an
+ * `agent.jobType` and must be rejected, closing the userinfo-less scheme-relative gap
+ * (`senior:feature //host?token=secret`) that {@link hasEmbeddedCredential} (needs `@`),
+ * {@link hasEmbeddedUrl} (needs an explicit scheme), and the anchored {@link isUrlShaped} (whole-value
+ * only) all miss (issue #778 review — thread deliveryGraph.ts:633). */
+export function hasSchemeRelativeAuthority(value: string): boolean {
+  return new RegExp(SCHEME_RELATIVE_AUTHORITY_SRC).test(value);
+}
+
+/** True when `value` embeds a `//<userinfo>@host` credential token (see {@link EMBEDDED_CREDENTIAL_SRC};
+ * the userinfo colon is optional, so a passwordless `//token@host` bearer token also matches).
+ * A plain worker-routing job type / opaque id never contains one, so a match is a credential leak to reject. */
+export function hasEmbeddedCredential(value: string): boolean {
+  return new RegExp(EMBEDDED_CREDENTIAL_SRC).test(value);
+}
+
+/** True when `value` embeds an absolute-URL token (`scheme://authority…`; see
+ * {@link EMBEDDED_SCHEME_URL_SRC}). A plain worker-routing job type / opaque id never contains one, so a
+ * match is a URL whose `?query`/`#fragment` can hide a token and which — since the executable
+ * `<zeebe:taskDefinition type=…>` carries the job type VERBATIM — would leak into the compiled BPMN.
+ * Distinct from {@link hasEmbeddedCredential}: that catches only a `//<userinfo>@` credential span and
+ * misses a userinfo-less `senior:feature https://host?token=secret` (issue #778 review — thread
+ * deliveryGraph.ts:602). */
+export function hasEmbeddedUrl(value: string): boolean {
+  return new RegExp(EMBEDDED_SCHEME_URL_SRC, "i").test(value);
+}
+
+/** The ONE canonical "is this value a URL?" classifier — a `scheme://authority` OR scheme-relative
+ * `//authority` form, either of which can hide a credential in userinfo/query/fragment. It is the single
+ * source of truth for URL-shape detection shared by the connector/jobType display redactor
+ * ({@link redactString} callers in the compiler) AND the semantic validation boundary
+ * (`validateDeliveryGraph`), so the "what counts as credential-bearing/URL-shaped" rule can never drift
+ * between the redact path and the reject path (issue #778 review — thread deliveryGraphCompiler.ts:1606).
+ * Classify on the TRIMMED value so leading whitespace (` //user:pass@host` — the OpenAPI edge caps
+ * length but does not trim) cannot bypass the anchored check. The scheme may be followed by
+ * XML-attribute whitespace (TAB/LF/CR/space) before the `//` authority: those characters are valid XML
+ * `Char`s that `stripXmlInvalidChars` does NOT remove, so `https:\t//user:pass@host` must still classify
+ * as URL-shaped or its credential escapes redaction as "not a URL" (issue #778 review — thread
+ * readiness.ts:1191). Deterministic and total. */
+export function isUrlShaped(value: string): boolean {
+  return /^([a-z][a-z0-9+.-]*:\s*)?\/\//i.test(value.trim());
 }

package/db/migrations/113_delivery_graph_run_identity.sql

@@ -0,0 +1,37 @@
+-- Delivery Graphs: persist a LOSSLESS graph-identity fingerprint per run in a dedicated SIDE TABLE
+-- (issue #778 review — thread dispatchDeliveryGraph.ts:332).
+--
+-- A run is keyed by `run_key` (an explicit operator `idempotencyKey`, else the content `digest`). The
+-- `digest` is content-addressed over the REDACTED `semanticBpmn`, so two graphs differing ONLY in a
+-- redacted-away secret (a URL credential, a `command` target, a match secret, a free-form connector
+-- `payload`, …) SHARE one digest. When an operator supplies an explicit `idempotencyKey`, a re-dispatch
+-- short-circuits onto the existing running row — but the lossy `digest` on that row cannot prove the
+-- short-circuited run is THIS exact secret-bearing graph vs. a credential-different graph re-staged under
+-- the same key. The dispatch door therefore refused EVERY such short-circuit with 409, which also broke
+-- the idempotency contract for a legitimate SAME-payload retry (a lost response / double-click of the
+-- identical proposal): it received 409 and lingered `staged` instead of short-circuiting successfully.
+--
+-- `graph_fingerprint` stores the run's lossless content identity — `sha256(digest \0
+-- canonicalJson(digestInvisibleRawValues(graph)))` (the SAME identity `stableProposalRunKey` folds into
+-- the keyless run key) — captured at launch. On an explicit-key short-circuit the door compares the
+-- incoming graph's fingerprint against the stored one: a MATCH is a same-payload retry (allow the
+-- short-circuit + consume the proposal); a MISMATCH — or a MISSING row (a run that predates this table)
+-- — is unprovable, so the door refuses (the safe pre-existing 409 behaviour) and it self-heals once the
+-- run turns over.
+--
+-- WHY A SIDE TABLE, not a column on `delivery_graph_runs`: that base table is projected COLUMN-FOR-COLUMN
+-- by several drift-guarded surfaces — the `delivery_graph_runs__units` compat VIEW served from the
+-- `delivery_units` aggregate (091/098) and the `delivery_graph_read_model`/`__tracking` VIEWs (087/096),
+-- each of which asserts full base-column pass-through parity. This identity fingerprint is an INTERNAL
+-- dispatch concern surfaced to no read model, so it belongs off to the side rather than threaded through
+-- (and re-drift-guarded across) every projection.
+--
+-- Forward-only, additive (expand). The runner wraps each file in its own transaction — no BEGIN/COMMIT.
+-- Numbered after 112 (the current highest on origin/main; this branch forked before 103–112 and must not
+-- reuse a prefix main already occupies).
+
+CREATE TABLE IF NOT EXISTS delivery_graph_run_identity (
+  run_key TEXT PRIMARY KEY,
+  graph_fingerprint TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);

package/db/migrations/114_delivery_graph_proposals_stage_seq.sql

@@ -0,0 +1,21 @@
+-- A MONOTONIC per-write stage revision for delivery-graph proposals (issue #778 review, thread
+-- app/deliveryGraphProposals.ts:245). The supersede reconcile ("exactly one live proposal per logical
+-- graph, the LATEST stage wins") breaks a same-millisecond `updated_at` tie between two staged siblings
+-- with a deterministic secondary key. That key used to be SQLite's `rowid` (insertion order) — but a
+-- RE-STAGE of an existing digest is an `UPDATE` that bumps `updated_at` while LEAVING the `rowid`
+-- unchanged, so a re-stage that lands in the same millisecond as a different digest's fresh stage could
+-- be selected as the OLDER row (its stale, lower rowid) and be immediately superseded, inverting the
+-- "latest stage wins" invariant this tie-break exists to uphold.
+--
+-- `stage_seq` fixes that: it is reassigned to `MAX(stage_seq)+1` on EVERY stage write — a fresh insert
+-- AND a re-stage update alike — so the most-recently-written row always holds the strictly-highest value
+-- regardless of its rowid or a coincident `updated_at`. Additive/expand (nullable-equivalent `DEFAULT 0`,
+-- no data rewrite): existing rows read as `0` and are re-sequenced the next time they are staged.
+ALTER TABLE delivery_graph_proposals ADD COLUMN stage_seq INTEGER NOT NULL DEFAULT 0;
+
+-- Index `stage_seq` so the atomic `MAX(stage_seq)+1` allocation in `stageProposal` (issue #778 review,
+-- thread app/deliveryGraphProposals.ts:237) is an O(1) reverse-index seek of the single highest value
+-- rather than a full scan of the retained proposal history (staged + terminal rows accumulate; a bare
+-- aggregate would grow linearly with them).
+CREATE INDEX IF NOT EXISTS idx_delivery_graph_proposals_stage_seq
+  ON delivery_graph_proposals (stage_seq);

package/operations/dispatchDeliveryGraph.test.ts

@@ -13,8 +13,10 @@ import { join, resolve } from "node:path";
 import { after, describe, test } from "node:test";
 import assert from "node:assert/strict";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
+import { redactFreeText } from "../app/deliveryGraphCompiler.ts";
 import { deliveryGraphProposals } from "../app/deliveryGraphProposals.ts";
 import { deliveryGraphRuns } from "../app/deliveryGraphRun.ts";
+import { isEquivalentReStage, stableProposalRunKey } from "./dispatchDeliveryGraph.ts";
 
 const APP_ROOT = resolve(import.meta.dirname, "..");
 const GITHUB_ENV: Record<string, string> = { NANO_PR_GITHUB_TRANSPORT: "token", GITHUB_TOKEN: "" };
@@ -32,6 +34,74 @@ const SIDE_EFFECTING = {
   edges: [{ from: "open-b", to: "publish" }],
 };
 
+test("stableProposalRunKey: digest identity + secret disambiguation (issue #778 review)", () => {
+  // The run key is derived from the proposal's semantic `digest` (which the compiler already normalises
+  // — collapsing omitted-vs-default fields and top-level node/edge REORDER) PLUS a fingerprint of the
+  // digest-invisible raw values. So a re-stage of the SAME logical graph in ANY encoding sharing the
+  // digest short-circuits, while a credential-differing graph (same digest, different secret) diverges.
+  const D1 = "sha-aaa";
+  const D2 = "sha-bbb";
+  const credA = {
+    name: "g",
+    nodes: [{ id: "n", kind: "connector", connector: { target: "//user:pass@host" } }],
+    edges: [],
+  };
+  // Same digest + identical graph → same key (a double-click / re-dispatch short-circuits).
+  assert.equal(stableProposalRunKey(D1, credA), stableProposalRunKey(D1, credA));
+  // Same digest but a DIFFERENT redacted-away credential — both redact to the same `//***@host` display
+  // so they SHARE the digest — must yield a DIFFERENT key, else the second dispatch collapses onto the
+  // first's still-running instance.
+  const credB = { name: "g", nodes: [{ id: "n", kind: "connector", connector: { target: "//other:secret@host" } }], edges: [] };
+  assert.notEqual(stableProposalRunKey(D1, credA), stableProposalRunKey(D1, credB));
+  // A genuinely different semantic graph carries a DIFFERENT digest → a different key even with no secrets.
+  const plain = { name: "g", nodes: [{ id: "n", kind: "human", human: { prompt: "x" } }], edges: [] };
+  assert.notEqual(stableProposalRunKey(D1, plain), stableProposalRunKey(D2, plain));
+  // A graph with NO digest-invisible content has an EMPTY fingerprint, so its key is a pure function of
+  // the digest: a re-stage in a DIFFERENT object-key encoding (same digest) short-circuits.
+  const plainReordered = { edges: [], name: "g", nodes: [{ human: { prompt: "x" }, kind: "human", id: "n" }] };
+  assert.equal(stableProposalRunKey(D1, plain), stableProposalRunKey(D1, plainReordered));
+  assert.ok(stableProposalRunKey(D1, credA).startsWith("staged-"), "the key is self-describing");
+});
+
+test("stableProposalRunKey: node-ORDER of digest-invisible content does not fork the key (issue #778 review)", () => {
+  // The compiler SORTS nodes before emitting `semanticBpmn`, so two graphs differing ONLY in top-level
+  // node order share one digest. Their digest-invisible raw values (`digestInvisibleRawValues`) must
+  // therefore fingerprint identically too — else a re-stage of the same logical graph in a different
+  // node encoding forks a DISTINCT run-key and double-launches instead of short-circuiting. The
+  // fingerprint is code-unit sorted at its source, making it reorder-invariant like the digest.
+  const D = "sha-order";
+  const ab = {
+    name: "g",
+    nodes: [
+      { id: "a", kind: "connector", connector: { target: "//user:pass@host" } },
+      { id: "b", kind: "connector", connector: { target: "//other:secret@host" } },
+    ],
+    edges: [],
+  };
+  const ba = {
+    name: "g",
+    nodes: [
+      { id: "b", kind: "connector", connector: { target: "//other:secret@host" } },
+      { id: "a", kind: "connector", connector: { target: "//user:pass@host" } },
+    ],
+    edges: [],
+  };
+  assert.equal(stableProposalRunKey(D, ab), stableProposalRunKey(D, ba), "a top-level node reorder must not fork the run-key");
+});
+
+test("isEquivalentReStage: only a live staged row whose RAW graph JSON is byte-identical to the launched graph is an equivalent re-stage — a credential-different re-stage (same digest) is NOT, and a retired/consumed row (null) is NOT (issue #778 review — thread dispatchDeliveryGraph.ts:320)", () => {
+  const launched = JSON.stringify({ name: "g", nodes: [{ id: "n", kind: "connector", connector: { target: "//user:pass@host" } }], edges: [] });
+  // A byte-identical re-stage IS equivalent — the door consumes the duplicate at its bumped revision.
+  assert.equal(isEquivalentReStage({ graph: launched }, launched), true);
+  // A credential-different re-stage shares the redacted digest but its RAW graph differs, so it is a
+  // newer, never-launched revision the door must leave `staged`.
+  const credDifferent = JSON.stringify({ name: "g", nodes: [{ id: "n", kind: "connector", connector: { target: "//other:secret@host" } }], edges: [] });
+  assert.equal(isEquivalentReStage({ graph: credDifferent }, launched), false);
+  // No live staged row (consumed/dismissed/superseded/expired) → not equivalent, nothing to consume.
+  assert.equal(isEquivalentReStage(null, launched), false);
+  assert.equal(isEquivalentReStage(undefined, launched), false);
+});
+
 describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest", () => {
   const dirs: string[] = [];
   const apps: TestApp[] = [];
@@ -165,6 +235,138 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
   });
 
+  test("a SAME-payload retry of a secret-bearing graph under the SAME idempotencyKey (a lost response / double-click) → 202 short-circuit, the proposal IS consumed and NO second run launches — the persisted identity fingerprint PROVES the running run is this exact graph, so the idempotency contract holds instead of a spurious 409 (issue #778 review — thread dispatchDeliveryGraph.ts:332)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    let agentFired = 0;
+    await app.engine.registerWorker("senior:demo", async () => {
+      agentFired++;
+      return {};
+    });
+
+    // Stage + dispatch a SECRET-BEARING graph (SIDE_EFFECTING carries redacted-away secret material —
+    // the same graph the cross-graph 409 case above refuses) under an explicit idempotencyKey. It
+    // launches and parks on its human node, so its run stays `running`.
+    const first = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SIDE_EFFECTING });
+    const dispatched = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
+      body: { digest: first.body.digest, idempotencyKey: "retry-key", repoless: true },
+    });
+    assert.equal(dispatched.status, 202);
+    await app.settle();
+    assert.equal(agentFired, 1, "the side effect fired exactly once on the first dispatch");
+    assert.equal((await deliveryGraphProposals(app.db).get(first.body.digest))?.status, "dispatched");
+
+    // Re-stage the IDENTICAL graph (byte-for-byte the same → same digest) and re-dispatch under the
+    // SAME key — the caller retrying a lost/duplicated request. The running run's persisted fingerprint
+    // matches this graph, so the door short-circuits onto it (202, alreadyRunning) and CONSUMES the
+    // re-staged proposal — it does NOT 409 as a cross-graph collision would.
+    const restaged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SIDE_EFFECTING });
+    assert.equal(restaged.body.digest, first.body.digest);
+    assert.equal((await deliveryGraphProposals(app.db).get(restaged.body.digest))?.status, "staged");
+    const retry = await api.call<{ ok: boolean; status: string; alreadyRunning?: boolean }>("dispatchDeliveryGraph", {
+      body: { digest: restaged.body.digest, idempotencyKey: "retry-key", repoless: true },
+    });
+    assert.equal(retry.status, 202);
+    assert.equal(retry.body.ok, true);
+    assert.equal(retry.body.alreadyRunning, true);
+    await app.settle();
+    // The retry short-circuited onto the existing run — the side effect did NOT fire a second time and
+    // no second run launched.
+    assert.equal(agentFired, 1, "a same-payload retry does not re-fire the side effect");
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
+    // The re-staged proposal was consumed (marked dispatched), not left lingering.
+    assert.equal((await deliveryGraphProposals(app.db).get(restaged.body.digest))?.status, "dispatched");
+  });
+
+  test("an explicit idempotencyKey short-circuit onto a running SECRET-BEARING run, re-dispatched from a graph authored AS the redacted form (graphCarriesRedactedSecrets === false) that SHARES the digest → 409; the proposal is NOT consumed (the refusal must not be gated on the INCOMING graph's redaction side — identity is unprovable whenever !identityConfirmed) (thread dispatchDeliveryGraph.ts:320)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+
+    // Graph 1 CARRIES a redacted-away credential in its human prompt — its content-addressed digest is
+    // over the REDACTED display, so it is NOT a faithful identity. It parks on its human node and stays
+    // running under an explicit idempotencyKey.
+    const secretPrompt = "click done: https://user:pass@host";
+    const SECRET = { name: "manual gate", nodes: [{ id: "ack", kind: "human", human: { prompt: secretPrompt } }] };
+    // Graph 2 is authored LITERALLY as the redacted form of graph 1's prompt. Redaction is a no-op on it,
+    // so `graphCarriesRedactedSecrets` is FALSE, yet it SHARES graph 1's digest (both digest over the same
+    // redacted display). It is a DIFFERENT graph from the running secret-bearing run.
+    const redactedTwin = { name: "manual gate", nodes: [{ id: "ack", kind: "human", human: { prompt: redactFreeText(secretPrompt) } }] };
+
+    // Stage + dispatch the SECRET-bearing graph FIRST (before the twin re-stages over its same-digest
+    // row) under an explicit key — it launches and parks (running), stamping its LOSSLESS fingerprint.
+    const g1 = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SECRET });
+    const first = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
+      body: { digest: g1.body.digest, idempotencyKey: "shared-key", repoless: true },
+    });
+    assert.equal(first.status, 202);
+    await app.settle();
+    assert.equal((await deliveryGraphProposals(app.db).get(g1.body.digest))?.status, "dispatched");
+
+    // Now re-stage the redacted-twin at the SAME digest (a DIFFERENT graph re-staged over the consumed
+    // row) and dispatch it under the SAME key. It short-circuits onto the still-running SECRET run — but
+    // that run is a different graph, so its persisted fingerprint does NOT match (identityConfirmed ===
+    // false). The digest COLLISION is the crux: the twin shares graph 1's digest yet carries no redacted
+    // secret. The refusal must fire even though the INCOMING graph carries no redacted secret; otherwise
+    // the twin's proposal is marked `dispatched` while it never launched.
+    const twin = await api.call<{ digest: string }>("compileDeliveryGraph", { body: redactedTwin });
+    assert.equal(twin.body.digest, g1.body.digest);
+    assert.equal((await deliveryGraphProposals(app.db).get(twin.body.digest))?.status, "staged");
+    const second = await api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: twin.body.digest, idempotencyKey: "shared-key", repoless: true },
+    });
+    assert.equal(second.status, 409);
+    assert.equal(second.body.ok, false);
+    await app.settle();
+    // The twin proposal is still staged — it was never launched (the running run is the secret graph).
+    assert.equal((await deliveryGraphProposals(app.db).get(twin.body.digest))?.status, "staged");
+    // Only the single secret run exists — the twin dispatch launched nothing.
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
+  });
+
+  test("a KEYLESS short-circuit onto a running graph whose run key equals the shared digest (an earlier explicit `idempotencyKey === digest`), re-dispatched from a redacted-twin that SHARES the digest → 409; the proposal is NOT consumed. The ambiguous-identity refusal must gate EVERY `alreadyRunning && !identityConfirmed`, not only explicit-key requests — a keyless faithful-digest dispatch collides on the digest run key just the same (thread dispatchDeliveryGraph.ts:325)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+
+    // Graph 1 CARRIES a redacted-away credential — its digest is over the REDACTED display, NOT a faithful
+    // identity. Dispatch it under an explicit `idempotencyKey` set to its OWN digest, so the run is keyed
+    // by the digest itself and parks running, stamping graph 1's LOSSLESS fingerprint.
+    const secretPrompt = "click done: https://user:pass@host";
+    const SECRET = { name: "manual gate", nodes: [{ id: "ack", kind: "human", human: { prompt: secretPrompt } }] };
+    // Graph 2 is authored LITERALLY as the redacted form — redaction is a no-op on it, so
+    // `graphCarriesRedactedSecrets` is FALSE. Because it is faithful, a KEYLESS dispatch leaves the run key
+    // undefined and the core falls back to the digest — which it SHARES with graph 1, colliding onto that
+    // still-running secret run even though NO explicit key was supplied.
+    const redactedTwin = { name: "manual gate", nodes: [{ id: "ack", kind: "human", human: { prompt: redactFreeText(secretPrompt) } }] };
+
+    const g1 = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SECRET });
+    const first = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
+      body: { digest: g1.body.digest, idempotencyKey: g1.body.digest, repoless: true },
+    });
+    assert.equal(first.status, 202);
+    await app.settle();
+    assert.equal((await deliveryGraphProposals(app.db).get(g1.body.digest))?.status, "dispatched");
+
+    // Re-stage the twin at the SAME digest and dispatch it WITHOUT a key. It short-circuits onto the
+    // running secret run (same digest run key), but that run is a different graph → identityConfirmed is
+    // false. The refusal must fire despite the request being keyless; otherwise the twin is marked
+    // `dispatched` while it never launched.
+    const twin = await api.call<{ digest: string }>("compileDeliveryGraph", { body: redactedTwin });
+    assert.equal(twin.body.digest, g1.body.digest);
+    assert.equal((await deliveryGraphProposals(app.db).get(twin.body.digest))?.status, "staged");
+    const second = await api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: twin.body.digest, repoless: true },
+    });
+    assert.equal(second.status, 409);
+    assert.equal(second.body.ok, false);
+    await app.settle();
+    // The twin proposal is still staged — nothing new launched.
+    assert.equal((await deliveryGraphProposals(app.db).get(twin.body.digest))?.status, "staged");
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
+  });
+
   test("a proposal whose stored graph is corrupt JSON → 400 AND the proposal is retired (expired), never lingering staged", async () => {
     const app = await boot();
     assert.ok(app.api);
@@ -251,6 +453,59 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "dispatched");
   });
 
+  test("a SECRET-BEARING staged graph dispatches through the cockpit UI WITHOUT an idempotencyKey — the door supplies a stable server-side key (#778)", async () => {
+    // Regression: Option C's dispatch gate refuses a keyless dispatch of a graph whose digest is lossy,
+    // but the cockpit staged-proposals UI posts no idempotency-key field. The door must therefore derive
+    // a stable server-side key from the stored proposal so these proposals remain launchable.
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const SECRET = { name: "deploy", nodes: [{ id: "d", kind: "agent", agent: { jobType: "senior:demo", prompt: "push to https://user:pass@host.example/repo" } }] };
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SECRET });
+    // No idempotencyKey in the body — exactly what the staged UI posts.
+    const res = await api.call<{ ok: boolean; status: string; runKey: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, repoless: true },
+    });
+    assert.equal(res.status, 202);
+    assert.equal(res.body.ok, true);
+    assert.equal(res.body.status, "running");
+    assert.ok(res.body.runKey.startsWith("staged-"), `expected a server-side staged- key, got ${res.body.runKey}`);
+    await app.settle();
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "dispatched");
+  });
+
+  test("an explicit idempotencyKey re-used across two SECRET-differing graphs that SHARE a digest is refused at short-circuit → 409; the re-staged proposal is NOT consumed and nothing new launches (#778 review — thread dispatchDeliveryGraph.ts:282)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    // Two graphs differing ONLY in a redacted-away credential redact to the SAME `semanticBpmn`, so they
+    // share ONE content digest and therefore ONE digest-keyed proposal row.
+    const SECRET_A = { name: "deploy", nodes: [{ id: "d", kind: "agent", agent: { jobType: "senior:demo", prompt: "push to https://user:AAAsecret@host.example/repo" } }] };
+    const SECRET_B = { name: "deploy", nodes: [{ id: "d", kind: "agent", agent: { jobType: "senior:demo", prompt: "push to https://user:BBBsecret@host.example/repo" } }] };
+    const a = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SECRET_A });
+    // Dispatch A under an explicit shared key — it launches and parks (running).
+    const first = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
+      body: { digest: a.body.digest, idempotencyKey: "shared-key", repoless: true },
+    });
+    assert.equal(first.status, 202);
+    await app.settle();
+    // B re-stages the SAME digest-keyed proposal row (its credential differs, but the digest is identical).
+    const b = await api.call<{ digest: string }>("compileDeliveryGraph", { body: SECRET_B });
+    assert.equal(b.body.digest, a.body.digest, "the two secret-differing graphs must share one redacted digest");
+    // Dispatch B under the SAME shared key — it short-circuits onto A's still-running run. Because the
+    // digest cannot prove the running run is THIS (secret-bearing) graph, B must NOT be consumed: 409.
+    const second = await api.call<{ ok: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: b.body.digest, idempotencyKey: "shared-key", repoless: true },
+    });
+    assert.equal(second.status, 409);
+    assert.equal(second.body.ok, false);
+    await app.settle();
+    // The proposal is still staged (never falsely consumed) and only A's single run exists.
+    assert.equal((await deliveryGraphProposals(app.db).get(b.body.digest))?.status, "staged");
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
+  });
+
   test("a malformed `repository` is rejected at submit → 400, nothing launched (#684/#686)", async () => {
     const app = await boot();
     assert.ok(app.api);