@open-mercato/cli 0.6.8-develop.6984.1.f0cf23f0f6 → 0.6.8-develop.6986.1.3adb0d0df6

package/dist/agentic/shared/AGENTS.md.template

@@ -111,7 +111,7 @@ Read `.agents/skills/<id>/SKILL.md` AND any `.ai/skills/<id>/SKILL.md` override.
 
 ## Module-Specific Facts
 
-Load facts for every named/targeted module, not incidental use. Mechanisms: events/subscribers→events; long operation/progress→progress; provider settings/health/OAuth→integrations; sync/import→data_sync. Hosts: session/auth→auth; customer/contact/deal/pipeline→customers; product/price/stock/inventory→catalog; currency/money→currencies; cart/checkout/shopper→checkout; portal→portal + customer_accounts; quote/order/invoice/sales assistant→sales; notification→notifications; webhook/callback→webhooks; schedule/reminder→scheduler; workflow/activity/user task→workflows; assistant→ai_assistant; maintained query index/reindex→query_index; search convergence→search. staff/employee≠optional staff; audit/record-who≠audit_logs unless extended. App primitives skip api_docs/search/query_index unless changed. Big fact-sheets: read in sections.
+Mechanisms: events/subscribers→events; long operation/progress→progress; provider settings/health/OAuth→integrations; sync/import→data_sync. Hosts: session/auth→auth; customer/contact/deal/pipeline→customers; product/price/stock/inventory→catalog; currency/money→currencies; cart/checkout/shopper→checkout; portal→portal+customer_accounts; quote/order/invoice/sales assistant→sales; notification→notifications; webhook/callback→webhooks; schedule/reminder→scheduler; workflow/activity/user task→workflows; assistant→ai_assistant; maintained query index/reindex→query_index; search convergence→search. staff/employee≠optional staff; audit/record-who≠audit_logs unless extended. App primitives skip api_docs/search/query_index unless changed. Big fact-sheets: read in sections.
 
 <!-- om:module-guides:start -->
 <!-- om:module-guides:end -->
@@ -121,4 +121,4 @@ Load facts for every named/targeted module, not incidental use. Mechanisms: even
 1. Route, then implement the smallest complete slice through real call sites.
 2. Discovery change: run `yarn generate`; then the smallest gate/integration paths.
 
-Precedence: root → BC → installed `AGENTS.md` → facts; stop on skew/conflict; never guess.
+Precedence: root→BC→installed `AGENTS.md`→facts; stop on skew/conflict; never guess.

package/dist/agentic/shared/ai/harness/README.md

@@ -1,6 +1,6 @@
 # Agent harness evaluations
 
-`cases.json` is the 231-case standalone-app contract. Run `yarn harness:validate --all` for the deterministic gate. Live routing uses a fresh read-only process per case:
+`cases.json` is the 233-case standalone-app contract. Run `yarn harness:validate --all` for the deterministic gate. Live routing uses a fresh read-only process per case:
 
 UMES routing is fact-first. The additive and unified-override audit evaluations, plus their targeted cases, resolve exact/pattern hosts, outgoing contributions, correlation provenance, round-trip groups, framework-owned targets, and override domain/key/mode from the generated module sheets and `.ai/guides/framework-extension-points.md` before bounded installed source. The repository UMES umbrella spec may appear as optional source-checkout provenance; it is never required in a standalone scaffold.
 
@@ -18,7 +18,7 @@ yarn harness:release --runner codex --prepare-targets /absolute/empty-release-ta
 yarn harness:release --runner codex --portability-runner claude --prepare-targets /absolute/empty-release-targets --acknowledge-writes
 ```
 
-The primary runner owns all 231 routing cases, all 49 writable cases, and all generative-judge runs. No per-case fallback or mixed primary ownership is allowed. Omitting `--portability-runner` is valid and the sanitized report records `portabilityRunner: null`; explicitly requesting an unavailable or failing secondary runner fails that extended run.
+The primary runner owns all 233 routing cases, all 49 writable cases, and all generative-judge runs. No per-case fallback or mixed primary ownership is allowed. Omitting `--portability-runner` is valid and the sanitized report records `portabilityRunner: null`; explicitly requesting an unavailable or failing secondary runner fails that extended run.
 
 Writable evaluation is intentionally opt-in. The expanded catalog has a 49-case writable release target, but only cases registered in `release-matrix.json` and backed by controller-owned fixtures and oracles are executable. Copy or create a fresh standalone app for one registered case, then seed only that case and mark the target disposable:
 

package/dist/agentic/shared/ai/harness/RELEASE.md

@@ -6,7 +6,7 @@ Run the complete per-release gate from a generated standalone app with one comma
 yarn harness:release --runner codex --prepare-targets /absolute/empty-release-targets --acknowledge-writes
 ```
 
-Choose exactly one blocking primary runner with `--runner codex` or `--runner claude`. That runner owns the complete 231-case routing gate and every writable/review lane. To add cross-model portability evidence, explicitly pass the other runner as `--portability-runner claude` or `--portability-runner codex`; it runs only the exact 49-case representative read-only set. The two runners must differ. Omitting the portability option is valid and is recorded as `portabilityRunner: null`; no secondary result is claimed. There is no per-case fallback or mixed primary ownership. Once requested, a portability failure or unavailable runner fails that extended release run.
+Choose exactly one blocking primary runner with `--runner codex` or `--runner claude`. That runner owns the complete 233-case routing gate and every writable/review lane. To add cross-model portability evidence, explicitly pass the other runner as `--portability-runner claude` or `--portability-runner codex`; it runs only the exact 49-case representative read-only set. The two runners must differ. Omitting the portability option is valid and is recorded as `portabilityRunner: null`; no secondary result is claimed. There is no per-case fallback or mixed primary ownership. Once requested, a portability failure or unavailable runner fails that extended release run.
 
 `--prepare-targets` accepts only an absolute, new or empty regular directory outside the controller app. The controller must be a sanitized fresh scaffold: automatic preparation fails before copying when it finds `.env`, `.env.*` (except `.env.example`, `.env.sample`, and `.env.template`), credential files, or private-key files. Never use a configured development or production app as the controller. It copies the fresh scaffold once per catalog case whose `evaluationKind` is `implementation` or `regression`, while excluding `.git`, `node_modules`, build/cache/coverage output, `.ai/harness/results`, `.ai/reports`, and `.ai/framework-context`. Each target receives a guarded link to the controller's installed dependency tree. The OS sandbox resolves that link as read-only during both the writable model run and the target command gate. The release gate also hashes every dependency entry and regular-file body once before execution and once after the complete suite, and fails if any nested content or metadata changed. A generated `release-targets.json` records the local mapping.
 
@@ -34,17 +34,17 @@ For externally prepared apps, `--writable-targets /absolute/release-targets.json
 }
 ```
 
-The current catalog contains 231 cases, including 49 writable implementation/regression cases (21.2%). The command still derives all counts and case IDs from `cases.json`, `validators.json`, and `release-matrix.json`; those figures are documented release facts, not runner constants. The matrix keeps both supported runner model selectors, an exact all-case primary profile, an exact 49-case portability profile, and runner-neutral writable assignments. Run `yarn install-skills` first so the pinned external `om-code-review` skill and ownership evidence are present; the reusable local `om-judge-agent-session` skill ships with the scaffold. Before running a model or writing a fixture, the release command requires complete deterministic, primary live-routing, writable, trusted-oracle, target, generated-test, and generative-judge coverage. Every one of the 49 writable cases must have a judge assignment composing both skills. Missing business fixtures or release-matrix entries fail preflight and are listed by exact case ID in the report.
+The current catalog contains 233 cases, including 49 writable implementation/regression cases (21.0%). The command still derives all counts and case IDs from `cases.json`, `validators.json`, and `release-matrix.json`; those figures are documented release facts, not runner constants. The matrix keeps both supported runner model selectors, an exact all-case primary profile, an exact 49-case portability profile, and runner-neutral writable assignments. Run `yarn install-skills` first so the pinned external `om-code-review` skill and ownership evidence are present; the reusable local `om-judge-agent-session` skill ships with the scaffold. Before running a model or writing a fixture, the release command requires complete deterministic, primary live-routing, writable, trusted-oracle, target, generated-test, and generative-judge coverage. Every one of the 49 writable cases must have a judge assignment composing both skills. Missing business fixtures or release-matrix entries fail preflight and are listed by exact case ID in the report.
 
 ## PR #4529 remediation evidence
 
-The PR's focused remediation evidence is not a release-certification substitute. Fresh emitted controllers pass deterministic 192/192, and the field-tested OMH-188–192 generative cohort passes on default Codex, Claude Sonnet, and high-effort gpt-5.4-mini. Fresh OMH-185 writable attempts fixed concrete organization-scope, command-object, module-activation, command-snapshot, schema, custom-field, UI, and Jest guidance defects at their routed owners without relaxing trusted oracles. The final attempt reached the case's fixed 600-second ceiling and is excluded from pass evidence. Issue #4670 now owns the complete selected-primary 231-case routing and 49-case writable/generated-test/review certification, prioritizing the generative cohort and recording unavailable Claude lanes without fallback or mixed-runner ownership.
+The PR's focused remediation evidence is not a release-certification substitute. Fresh emitted controllers pass deterministic 192/192, and the field-tested OMH-188–192 generative cohort passes on default Codex, Claude Sonnet, and high-effort gpt-5.4-mini. Fresh OMH-185 writable attempts fixed concrete organization-scope, command-object, module-activation, command-snapshot, schema, custom-field, UI, and Jest guidance defects at their routed owners without relaxing trusted oracles. The final attempt reached the case's fixed 600-second ceiling and is excluded from pass evidence. Issue #4670 now owns the complete selected-primary 233-case routing and 49-case writable/generated-test/review certification, prioritizing the generative cohort and recording unavailable Claude lanes without fallback or mixed-runner ownership.
 
 After preflight it runs, in order:
 
 1. deterministic validation for the complete catalog;
 2. the release matrix's fixed `yarn generate`, `yarn typecheck`, `yarn lint`, and `yarn build` foundation;
-3. the selected primary runner across all 231 live-routing cases, followed by the optional distinct portability runner across the exact 49-case read-only sample when requested;
+3. the selected primary runner across all 233 live-routing cases, followed by the optional distinct portability runner across the exact 49-case read-only sample when requested;
 4. fixture preparation and the selected primary runner for every writable case, including the controller-owned AST/behavior oracles and target typecheck;
 5. `yarn generate`, `yarn typecheck`, `yarn lint`, and `yarn build` in every writable target, after its trusted oracles;
 6. real generated-code execution for OMH-163 and OMH-192 through fixed Jest, OMH-164 through API-only Playwright, and OMH-165 through real-browser Playwright; and

package/dist/agentic/shared/ai/harness/cases.json

@@ -1560,7 +1560,9 @@
       ],
       "allowedExtra": [
         ".ai/guides/extensions.md",
-        ".ai/skills/om-system-extension/SKILL.md"
+        ".ai/skills/om-system-extension/SKILL.md",
+        ".ai/guides/modules/push_notifications/index.md",
+        ".ai/guides/modules/devices/index.md"
       ],
       "forbidden": [
         ".env*",
@@ -3090,7 +3092,10 @@
         ".ai/guides/modules/channel_imap/index.md"
       ],
       "allowedExtra": [
-        ".ai/guides/modules/integrations/index.md"
+        ".ai/guides/modules/integrations/index.md",
+        ".ai/guides/modules/channel_fcm/index.md",
+        ".ai/guides/modules/channel_apns/index.md",
+        ".ai/guides/modules/channel_expo/index.md"
       ],
       "forbidden": [
         ".env*",
@@ -20924,5 +20929,173 @@
     "maxTotalContextBytes": 196608,
     "relatedCases": ["OMH-003", "OMH-222"],
     "source": { "paths": [".ai/specs/2026-08-14-standalone-harness-optimizations.md"] }
+  },
+  {
+    "id": "OMH-232",
+    "title": "Reach a customer's phone when an order ships without a private device table",
+    "family": "architecture",
+    "mode": "analysis",
+    "evaluationKind": "routing",
+    "risk": "high",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, the business wants a shipment update to reach the customer's phone as a notification, and the mobile client already has a provider token per install. Before proposing any schema, establish whether installed modules already own the device registry and the push delivery path, and name them, or state positively that none does. Then decide the smallest safe design against what the installed modules already provide: where a per-user device and its provider token live and how that token is protected at rest and kept out of responses and logs, how one notification fans out to that user's devices, what happens when a provider reports a token that no longer exists, and how a user's per-type and per-channel opt-out is honoured before anything is sent. Keep tenant and organization boundaries intact, state the access-control posture for a user registering their own device versus an administrator reading the fleet, and identify the smallest relevant validation. Do not model your own device, token, or delivery-log tables, and do not call a provider SDK directly from a request handler, before that check is done.",
+    "tags": [
+      "architecture",
+      "module-facts",
+      "reuse-installed",
+      "device-registry",
+      "push-delivery"
+    ],
+    "owner": {
+      "kind": "facts",
+      "path": ".ai/guides/modules/push_notifications/index.md",
+      "ruleIds": [
+        "BC-01",
+        "BC-04"
+      ]
+    },
+    "expectedRouter": {
+      "required": [
+        "architecture"
+      ],
+      "allowedExtra": [
+        "module-data",
+        "integration",
+        "umes",
+        "framework-context",
+        "backend-ui"
+      ]
+    },
+    "requiredSkills": [
+      "om-help"
+    ],
+    "context": {
+      "required": [
+        "AGENTS.md",
+        ".ai/guides/architecture.md",
+        ".ai/skills/om-help/SKILL.md",
+        ".ai/guides/modules/devices/index.md",
+        ".ai/guides/modules/push_notifications/index.md"
+      ],
+      "allowedExtra": [
+        ".ai/guides/contracts.md",
+        ".ai/guides/modules/notifications/index.md"
+      ],
+      "forbidden": [
+        ".env*",
+        ".git/**"
+      ]
+    },
+    "requiredDecisions": [
+      "facts-first",
+      "tenant-scope",
+      "acl-features",
+      "encrypted-credentials",
+      "smallest-validation"
+    ],
+    "forbiddenPatterns": [
+      "node_modules.{0,40}(?:write|edit|patch)",
+      "(?:tenant|organization).{0,30}(?:unscoped|scope optional)",
+      "(?:token|secret|password).{0,20}(?:console|log)"
+    ],
+    "validators": [
+      "catalog.schema",
+      "owner.reference",
+      "skills.reference",
+      "router.contract",
+      "context.budget",
+      "context.forbidden",
+      "patterns.forbidden"
+    ],
+    "maxContextFiles": 8,
+    "maxInitialContextBytes": 57344,
+    "maxTotalContextBytes": 98304,
+    "relatedCases": [
+      "OMH-020",
+      "OMH-194"
+    ]
+  },
+  {
+    "id": "OMH-233",
+    "title": "Add tenant-wide push provider credentials without a bespoke integration",
+    "family": "architecture",
+    "mode": "analysis",
+    "evaluationKind": "routing",
+    "risk": "high",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, operations hold a Firebase service account for Android, an APNs signing key for iOS, and an Expo access token for the managed client, and want each one connected once for the whole tenant so push can be sent. Before proposing any schema, establish whether installed provider modules already own these three connections and name them, or state positively that none does. Then decide the smallest safe design against what the installed modules already provide: where such credentials are stored and validated at connect time, why they belong to the tenant rather than to the person who connected them and what that means for a caller whose selected organization differs, and how a provider's permanent token rejection is distinguished from a retryable failure. Keep tenant and organization boundaries intact, state the access-control posture for connecting a tenant-wide provider versus reading its health, and identify the smallest relevant validation. Do not write your own credential store, and do not build a bespoke provider integration, before that check is done.",
+    "tags": [
+      "architecture",
+      "module-facts",
+      "reuse-installed",
+      "push-provider",
+      "encrypted-credentials"
+    ],
+    "owner": {
+      "kind": "facts",
+      "path": ".ai/guides/modules/channel_fcm/index.md",
+      "ruleIds": [
+        "BC-01",
+        "BC-04"
+      ]
+    },
+    "expectedRouter": {
+      "required": [
+        "architecture"
+      ],
+      "allowedExtra": [
+        "integration",
+        "module-data",
+        "umes",
+        "framework-context"
+      ]
+    },
+    "requiredSkills": [
+      "om-help"
+    ],
+    "context": {
+      "required": [
+        "AGENTS.md",
+        ".ai/guides/architecture.md",
+        ".ai/skills/om-help/SKILL.md",
+        ".ai/guides/modules/channel_fcm/index.md",
+        ".ai/guides/modules/channel_apns/index.md",
+        ".ai/guides/modules/channel_expo/index.md"
+      ],
+      "allowedExtra": [
+        ".ai/guides/integrations.md",
+        ".ai/guides/modules/push_notifications/index.md"
+      ],
+      "forbidden": [
+        ".env*",
+        ".git/**"
+      ]
+    },
+    "requiredDecisions": [
+      "facts-first",
+      "tenant-scope",
+      "acl-features",
+      "encrypted-credentials",
+      "smallest-validation"
+    ],
+    "forbiddenPatterns": [
+      "node_modules.{0,40}(?:write|edit|patch)",
+      "(?:tenant|organization).{0,30}(?:unscoped|scope optional)",
+      "(?:token|secret|password).{0,20}(?:console|log)"
+    ],
+    "validators": [
+      "catalog.schema",
+      "owner.reference",
+      "skills.reference",
+      "router.contract",
+      "context.budget",
+      "context.forbidden",
+      "patterns.forbidden"
+    ],
+    "maxContextFiles": 9,
+    "maxInitialContextBytes": 57344,
+    "maxTotalContextBytes": 98304,
+    "relatedCases": [
+      "OMH-039",
+      "OMH-232"
+    ]
   }
 ]

package/dist/agentic/shared/ai/harness/cases.schema.json

@@ -3,8 +3,8 @@
   "$id": "https://open-mercato.dev/schemas/standalone-harness-cases.schema.json",
   "title": "Open Mercato standalone harness case catalog",
   "type": "array",
-  "minItems": 231,
-  "maxItems": 231,
+  "minItems": 233,
+  "maxItems": 233,
   "items": {
     "type": "object",
     "additionalProperties": false,
@@ -15,7 +15,7 @@
       "maxTotalContextBytes", "relatedCases"
     ],
     "properties": {
-      "id": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[01])$" },
+      "id": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[0-3])$" },
       "title": { "type": "string", "minLength": 12, "maxLength": 180 },
       "family": { "enum": ["architecture", "module", "umes", "integration", "ai-workflow", "bugfix", "business", "testing"] },
       "mode": { "enum": ["analysis", "one-shot", "spec", "bugfix", "review"] },
@@ -168,7 +168,7 @@
       "maxInitialContextBytes": { "type": "integer", "minimum": 4096, "maximum": 98304 },
       "maxTotalContextBytes": { "type": "integer", "minimum": 8192, "maximum": 1048576 },
       "timeoutMs": { "type": "integer", "minimum": 1000, "maximum": 600000 },
-      "relatedCases": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[01])$" } },
+      "relatedCases": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-9]|21[0-9]|22[0-9]|23[0-3])$" } },
       "source": {
         "type": "object",
         "additionalProperties": false,

package/dist/agentic/shared/ai/harness/validators.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "catalog": {
-    "expectedCaseCount": 231,
+    "expectedCaseCount": 233,
     "maxContextFiles": 16,
     "maxInitialContextBytes": 98304,
     "maxTotalContextBytes": 1048576,

package/dist/lib/testing/integration.js

@@ -1467,6 +1467,18 @@ function buildReusableEnvironment(baseUrl, databaseUrl, queueBaseDir, captureScr
     OM_TEST_MODE: "1",
     OM_TEST_EMAIL_CAPTURE_PATH: EPHEMERAL_EMAIL_CAPTURE_PATH,
     OM_TEST_AUTH_RATE_LIMIT_MODE: "opt-in",
+    // Register the test-only `push_stub` channel adapter in the reused Playwright
+    // process (and any drain/worker child it spawns) so push integration specs can
+    // drive real delivery. Production-safe + inert unless a delivery row carries
+    // `provider='push_stub'`. Mirrors the fresh-environment app server env below.
+    OM_ENABLE_PUSH_STUB_ADAPTER: process.env.OM_ENABLE_PUSH_STUB_ADAPTER ?? "1",
+    // Swap the FCM/APNs/Expo SDK clients for network-free fakes so the REAL provider
+    // adapters run end-to-end. Unlike `push_stub` (which replaces the whole adapter),
+    // this replaces only each SDK client. Mirrors the fresh-environment env below.
+    OM_PUSH_FAKE_PROVIDERS: process.env.OM_PUSH_FAKE_PROVIDERS ?? "1",
+    // Expo's receipt reaper ignores rows younger than 15 minutes by default, which no
+    // integration test can wait out. Poll immediately instead.
+    OM_PUSH_RECEIPT_MIN_AGE_MINUTES: process.env.OM_PUSH_RECEIPT_MIN_AGE_MINUTES ?? "0",
     // Tests assert on access_logs immediately after CRUD reads; keep the
     // blocking write path on inside the integration runtime so tests do
     // not have to call flushPendingCrudAccessLogs() explicitly.
@@ -2648,6 +2660,24 @@ async function startEphemeralEnvironment(options) {
       OM_TEST_MODE: "1",
       OM_TEST_EMAIL_CAPTURE_PATH: EPHEMERAL_EMAIL_CAPTURE_PATH,
       OM_TEST_AUTH_RATE_LIMIT_MODE: "opt-in",
+      // Register the network-free `push_stub` channel adapter so push integration
+      // specs (TC-PUSH-003) can drive the strategy → delivery-row → send-push worker
+      // → sendMessage chain end-to-end without a real FCM/APNs/Expo provider. The
+      // adapter is production-safe (registered only under this flag) and inert unless
+      // a delivery row carries `provider='push_stub'` — i.e. a test seeded a matching
+      // push channel + device. Applies to the app server, the Playwright process, and
+      // any drain/worker child that inherits this environment.
+      OM_ENABLE_PUSH_STUB_ADAPTER: process.env.OM_ENABLE_PUSH_STUB_ADAPTER ?? "1",
+      // Swap the FCM/APNs/Expo SDK clients for network-free fakes (TC-CHANNEL-PUSH-005+) so the REAL
+      // provider adapters — native message construction, credential parsing, client caching, and every
+      // error → `device_unregistered` mapping — run end-to-end without live keys. Unlike
+      // `push_stub`, which replaces the whole adapter, this replaces only each SDK client, and is
+      // registered only under this flag. Applies to the app server, the Playwright process, and any
+      // drain/worker child that inherits this environment.
+      OM_PUSH_FAKE_PROVIDERS: process.env.OM_PUSH_FAKE_PROVIDERS ?? "1",
+      // Expo's receipt reaper ignores rows younger than 15 minutes by default (it polls a real
+      // provider's async receipts). No integration test can wait that out — poll immediately.
+      OM_PUSH_RECEIPT_MIN_AGE_MINUTES: process.env.OM_PUSH_RECEIPT_MIN_AGE_MINUTES ?? "0",
       OM_DISABLE_EMAIL_DELIVERY: "1",
       OM_WEBHOOKS_ALLOW_PRIVATE_URLS: process.env.OM_WEBHOOKS_ALLOW_PRIVATE_URLS ?? "1",
       // Read at build time as well as at runtime, so this block has to carry it: