@straiffi/archon 1.7.7 → 1.7.9

package/dist/server/lib/ticketAutomationCommit.js

@@ -1,19 +1,48 @@
 import { createHash } from 'crypto';
 import db from '../db.js';
+import { assertNoActiveAutomationChild } from './activeAutomationChild.js';
 import config from './config.js';
 import { buildCommitMessagePrompt, normalizeGeneratedCommitMessage, } from './commitMessage.js';
 import { commitPreparedAutomationChanges, computeGitTreeDeltaDigest, fetchRemoteBranchState, getAutomationCommitPaths, getAutomationRemoteIdentity, getGitHeadIdentity, getGitIndexTreeSha, getGitStatus, getReviewDiffData, getSelectedGitUnifiedDiff, prepareAutomationCommit, pushAutomationTarget, resolveWorktreePath, } from './git.js';
 import { runLightweightPrompt } from './lightweightPrompt.js';
 import { buildPullRequestContentPrompt, extractBodyFromRawOutput, parsePullRequestContent, } from './pullRequestContent.js';
-import { getBundle, getTicket, isProjectRootBundle } from './tickets.js';
+import { getBundle, getTicket, isProjectRootBundle, listTicketsInRunContext } from './tickets.js';
 import { createGitHubPullRequest, observeGitHubPullRequest, } from './integrations/github.js';
 import { getGitHubConnectionConfig } from './integrations/index.js';
 import { upsertBundlePullRequestFromGitHub, } from './bundlePullRequests.js';
 import { depthAtLeast, getBundleAutomationState, resolveAutomationConfig, } from './ticketAutomation.js';
 import { completeAutomationProgressionInTransaction, completeAutomationProgression, getAutomationProgression, waitAutomationProgressionInTransaction, waitAutomationProgression, } from './automationProgression.js';
-import { AUTOMATION_STAGE_DETAILS_SCHEMA_VERSION, createAutomationStageDetails, ensureAutomationStageResult, } from './automationStageDetails.js';
+import { assertAutomationBoundaryNotRequired, assertAutomationAuthorizationCurrent, authorizeAutomationBoundary, AutomationCheckGateError, } from './automationCheckGate.js';
+import { AUTOMATION_STAGE_DETAILS_SCHEMA_VERSION, createAutomationStageDetails, ensureAutomationStageResult, getAutomationStageDetails, } from './automationStageDetails.js';
 import { getProjectById } from './projects.js';
 import { getExecutionRun, withExecutionRunTransaction } from './executionRuns.js';
+export const resolveAutomationCheckGateResume = (projectId, progressionRunId) => {
+    const row = db.prepare(`
+    SELECT id, kind
+    FROM execution_runs
+    WHERE project_id = ? AND parent_run_id = ? AND status = 'completed'
+      AND kind IN ('automation_commit', 'automation_push')
+    ORDER BY rowid DESC
+    LIMIT 1
+  `).get(projectId, progressionRunId);
+    if (!row) {
+        return undefined;
+    }
+    const details = getAutomationStageDetails(projectId, row.id);
+    if (!details?.result) {
+        throw new Error('Completed automation stage has invalid result lineage');
+    }
+    if (row.kind === 'automation_push') {
+        const result = details.result;
+        if (!result.remoteSha) {
+            throw new Error('Completed automation push has invalid result lineage');
+        }
+        return { stageKind: row.kind, expectedHeadSha: result.remoteSha };
+    }
+    const result = details.result;
+    const expectedHeadSha = 'commitSha' in result ? result.commitSha : result.headSha;
+    return { stageKind: row.kind, expectedHeadSha };
+};
 const EMPTY_MESSAGE_DIGEST = `sha256:${createHash('sha256').update('').digest('hex')}`;
 const getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
 const digestCommitMessage = (message) => {
@@ -96,6 +125,20 @@ const emitUpdated = (io, ticketId) => {
         io.emit('ticket:updated', updated);
     }
 };
+const emitBundleUpdated = (io, ticket) => {
+    const tickets = listTicketsInRunContext(ticket, {
+        includeDetail: false,
+        includeMessages: false,
+        includeLogs: false,
+        includeUndo: false,
+        includeDiffStats: false,
+        includeStaleState: false,
+        includeWorktreeState: false,
+    });
+    for (const updated of tickets) {
+        io.emit('ticket:updated', updated);
+    }
+};
 const clearStoppedStagePointer = (projectId, bundleId, runId) => {
     db.prepare(`
     UPDATE bundle_automation_state
@@ -117,7 +160,37 @@ const loadLiveState = (projectId, bundleId) => {
     }
     return { project, bundle, automationConfig: resolveAutomationConfig(bundle, project) };
 };
-const assertStageCanMutate = (projectId, bundleId, progressionRunId, requiredDepth) => {
+const toStageCheckAuthorization = (authorization) => authorization.requirement === 'required'
+    ? {
+        kind: 'required',
+        gateEvaluationId: authorization.evaluation.id,
+        policyFingerprint: authorization.policyFingerprint,
+        workspaceFingerprint: authorization.workspaceIdentity.fingerprint,
+    }
+    : {
+        kind: 'not_required',
+        policyFingerprint: authorization.policyFingerprint,
+    };
+const assertBoundaryAuthorizationCurrent = async ({ authorization, project, bundle, progressionRunId, cwd, boundaryKind, }) => {
+    if (authorization.requirement === 'required') {
+        await assertAutomationAuthorizationCurrent({
+            project,
+            bundle,
+            progressionRunId,
+            cwd,
+            evaluationId: authorization.evaluation.id,
+            boundaryKind,
+        });
+        return;
+    }
+    assertAutomationBoundaryNotRequired({
+        project,
+        bundle,
+        progressionRunId,
+        policyFingerprint: authorization.policyFingerprint,
+    });
+};
+const assertStageCanMutateWithPolicy = (projectId, bundleId, progressionRunId, ticket, mutationLabel, canMutateLive) => {
     const live = loadLiveState(projectId, bundleId);
     const progression = getAutomationProgression(projectId, bundleId);
     const state = getBundleAutomationState(projectId, bundleId);
@@ -126,11 +199,12 @@ const assertStageCanMutate = (projectId, bundleId, progressionRunId, requiredDep
         || progression.status !== 'running'
         || state?.automation_progression_run_id !== progressionRunId
         || state.automation_paused_reason !== null
-        || !depthAtLeast(live.automationConfig.depth, requiredDepth)) {
-        throw new Error(`automation no longer permits ${requiredDepth === 'auto_push' ? 'push' : 'pull-request'} mutation`);
+        || !canMutateLive(live, { ticket, progressionRunId })) {
+        throw new Error(`automation no longer permits ${mutationLabel} mutation`);
     }
     return live;
 };
+const assertStageCanMutate = (projectId, bundleId, progressionRunId, ticket, requiredDepth) => assertStageCanMutateWithPolicy(projectId, bundleId, progressionRunId, ticket, requiredDepth === 'auto_commit' ? 'commit' : requiredDepth === 'auto_push' ? 'push' : 'pull-request', live => depthAtLeast(live.automationConfig.depth, requiredDepth));
 const githubConfigMatchesIntent = (githubConfig, intent) => (githubConfig.host.toLowerCase() === intent.repoHost.toLowerCase()
     && githubConfig.repo_owner.toLowerCase() === intent.repoOwner.toLowerCase()
     && githubConfig.repo_name.toLowerCase() === intent.repoName.toLowerCase()
@@ -140,17 +214,7 @@ const startStage = ({ projectId, bundleId, ticketId, ticketTitle, progressionRun
     if (!progression || progression.id !== progressionRunId) {
         throw new Error('Automation stage has no active progression owner');
     }
-    const activeChild = db.prepare(`
-    SELECT id
-    FROM execution_runs
-    WHERE project_id = ? AND parent_run_id = ? AND id <> ?
-      AND kind IN ('review', 'automation_review_fix', 'automation_commit', 'automation_push', 'automation_pull_request')
-      AND status IN ('queued', 'running', 'waiting')
-    LIMIT 1
-  `).get(projectId, progressionRunId, allowedActiveChildRunId ?? '');
-    if (activeChild) {
-        throw new Error('Automation progression already has an active child');
-    }
+    assertNoActiveAutomationChild(projectId, progressionRunId, allowedActiveChildRunId);
     const progressionTicketLink = db.prepare(`
     SELECT 1 FROM execution_run_links
     WHERE execution_run_id = ? AND project_id = ? AND entity_type = 'ticket' AND entity_id = ?
@@ -237,7 +301,7 @@ const finishStage = ({ projectId, bundleId, progressionRunId, runId, stageKind,
         }
     }, broadcaster);
 };
-const failStage = ({ projectId, bundleId, progressionRunId, runId, stageKind, pauseCode, reason, ambiguous, broadcaster, }) => withExecutionRunTransaction(transaction => {
+const failStage = ({ projectId, bundleId, progressionRunId, runId, stageKind, pauseCode, reason, ambiguous, reasonCode, pausedStageRunId = runId, broadcaster, }) => withExecutionRunTransaction(transaction => {
     const existing = getExecutionRun(projectId, runId);
     if (!existing || !['queued', 'running', 'waiting'].includes(existing.status)) {
         return;
@@ -247,7 +311,7 @@ const failStage = ({ projectId, bundleId, progressionRunId, runId, stageKind, pa
         runId,
         status: 'failed',
         domainStatus: ambiguous ? 'ambiguous' : 'failed',
-        failure: { code: ambiguous ? 'side_effect_ambiguous' : 'stage_failed', message: reason },
+        failure: { code: reasonCode ?? (ambiguous ? 'side_effect_ambiguous' : 'stage_failed'), message: reason },
         eventType: `${stageKind}_failed`,
     });
     if (!ambiguous) {
@@ -261,11 +325,23 @@ const failStage = ({ projectId, bundleId, progressionRunId, runId, stageKind, pa
             progressionRunId,
             pauseCode,
             pauseReason: reason,
-            reasonCode: ambiguous ? 'side_effect_ambiguous' : 'stage_failed',
-            pausedStageRunId: runId,
+            reasonCode: reasonCode ?? (ambiguous ? 'side_effect_ambiguous' : 'stage_failed'),
+            pausedStageRunId,
         });
     }
 }, broadcaster);
+const failStageAuthorization = ({ projectId, bundleId, progressionRunId, runId, stageKind, error, broadcaster, }) => failStage({
+    projectId,
+    bundleId,
+    progressionRunId,
+    runId,
+    stageKind,
+    pauseCode: 'required_checks',
+    reason: `Required-check authorization expired before ${stageKind.replace('automation_', '').replaceAll('_', ' ')}`,
+    reasonCode: error.reasonCode,
+    pausedStageRunId: null,
+    broadcaster,
+});
 const pauseBeforeStage = ({ projectId, bundleId, progressionRunId, pauseCode, reason, ambiguous, broadcaster, }) => waitAutomationProgression({
     projectId,
     bundleId,
@@ -276,6 +352,181 @@ const pauseBeforeStage = ({ projectId, bundleId, progressionRunId, pauseCode, re
     pausedStageRunId: null,
     broadcaster,
 });
+export const runAutomationCommitOperation = async ({ ticket, io, progressionRunId, allowedActiveChildRunId, retryOfRunId, mutationLabel, canCommitLive, shouldCompleteProgression, failureMode = 'return', requiredProgressionPurpose, }) => {
+    if (!ticket.project_id || !ticket.worktree_bundle_id) {
+        return null;
+    }
+    const projectId = ticket.project_id;
+    const bundleId = ticket.worktree_bundle_id;
+    const progression = getAutomationProgression(projectId, bundleId);
+    if (!progression || progression.id !== progressionRunId) {
+        return null;
+    }
+    const broadcaster = asBroadcaster(io);
+    let live = loadLiveState(projectId, bundleId);
+    if (!canCommitLive(live, { ticket, progressionRunId })) {
+        completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
+        emitUpdated(io, ticket.id);
+        return null;
+    }
+    const branch = live.bundle.branch;
+    const cwd = live.bundle.kind === 'project_root'
+        ? live.project.repo_path
+        : resolveWorktreePath(branch, live.project);
+    let commitRunId = null;
+    try {
+        const status = getGitStatus(cwd, branch, live.project);
+        const precondition = evaluateCommitPrecondition(status);
+        if (!precondition.ok) {
+            throw new Error(precondition.reason);
+        }
+        if (status.files.length === 0) {
+            const authorization = await authorizeAutomationBoundary({
+                project: live.project,
+                bundle: live.bundle,
+                progressionRunId,
+                cwd,
+                boundaryKind: 'automation_commit',
+                requiredProgressionPurpose,
+                broadcaster,
+                prepare: () => {
+                    const head = getGitHeadIdentity(cwd);
+                    return { head, indexTreeSha: getGitIndexTreeSha(cwd) };
+                },
+                resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                    kind: 'workspace', fingerprint: workspaceIdentity.fingerprint,
+                }),
+            });
+            const { head, indexTreeSha } = authorization.value;
+            const intent = {
+                branch,
+                preActionHeadSha: head.headSha,
+                preActionIndexTreeSha: indexTreeSha,
+                intendedTreeSha: head.treeSha,
+                commitMessageDigest: EMPTY_MESSAGE_DIGEST,
+                selectedContentDigest: computeGitTreeDeltaDigest(cwd, head.headSha, head.treeSha),
+                checkAuthorization: toStageCheckAuthorization(authorization),
+            };
+            commitRunId = startStage({
+                projectId,
+                bundleId,
+                ticketId: ticket.id,
+                ticketTitle: ticket.title,
+                progressionRunId,
+                allowedActiveChildRunId,
+                stageKind: 'automation_commit',
+                intent,
+                broadcaster,
+                retryOfRunId,
+            });
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_commit' });
+            live = loadLiveState(projectId, bundleId);
+            const result = {
+                outcome: 'no_changes',
+                headSha: head.headSha,
+                treeSha: head.treeSha,
+            };
+            finishStage({
+                projectId,
+                bundleId,
+                progressionRunId,
+                runId: commitRunId,
+                stageKind: 'automation_commit',
+                result,
+                outcome: 'no_changes',
+                completeProgression: shouldCompleteProgression(live, result),
+                broadcaster,
+            });
+            return { runId: commitRunId, ...result };
+        }
+        const selectedPaths = getAutomationCommitPaths(status.files);
+        const message = await generateCommitMessage(cwd, live.project, selectedPaths);
+        live = loadLiveState(projectId, bundleId);
+        if (!message) {
+            throw new Error('commit message generation produced an empty result');
+        }
+        if (!canCommitLive(live, { ticket, progressionRunId })) {
+            completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
+            emitUpdated(io, ticket.id);
+            return null;
+        }
+        const authorization = await authorizeAutomationBoundary({
+            project: live.project,
+            bundle: live.bundle,
+            progressionRunId,
+            cwd,
+            boundaryKind: 'automation_commit',
+            requiredProgressionPurpose,
+            broadcaster,
+            prepare: () => prepareAutomationCommit(cwd, branch, live.project, selectedPaths),
+            resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                kind: 'workspace', fingerprint: workspaceIdentity.fingerprint,
+            }),
+        });
+        const prepared = authorization.value;
+        const intent = {
+            branch,
+            preActionHeadSha: prepared.preActionHeadSha,
+            preActionIndexTreeSha: prepared.preActionIndexTreeSha,
+            intendedTreeSha: prepared.intendedTreeSha,
+            commitMessageDigest: digestCommitMessage(message),
+            selectedContentDigest: prepared.selectedContentDigest,
+            checkAuthorization: toStageCheckAuthorization(authorization),
+        };
+        commitRunId = startStage({
+            projectId,
+            bundleId,
+            ticketId: ticket.id,
+            ticketTitle: ticket.title,
+            progressionRunId,
+            allowedActiveChildRunId,
+            stageKind: 'automation_commit',
+            intent,
+            broadcaster,
+            retryOfRunId,
+        });
+        await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_commit' });
+        live = assertStageCanMutateWithPolicy(projectId, bundleId, progressionRunId, ticket, mutationLabel, canCommitLive);
+        const result = await commitPreparedAutomationChanges(cwd, branch, live.project, message, prepared);
+        live = loadLiveState(projectId, bundleId);
+        finishStage({
+            projectId,
+            bundleId,
+            progressionRunId,
+            runId: commitRunId,
+            stageKind: 'automation_commit',
+            result,
+            outcome: 'committed',
+            completeProgression: shouldCompleteProgression(live, result),
+            broadcaster,
+        });
+        return { outcome: 'committed', runId: commitRunId, ...result };
+    }
+    catch (error) {
+        if (error instanceof AutomationCheckGateError) {
+            if (commitRunId) {
+                failStageAuthorization({ projectId, bundleId, progressionRunId, runId: commitRunId, stageKind: 'automation_commit', error, broadcaster });
+            }
+            emitBundleUpdated(io, ticket);
+            if (failureMode === 'throw') {
+                throw error;
+            }
+            return null;
+        }
+        const reason = `commit failed: ${getErrorMessage(error)}`;
+        if (commitRunId) {
+            failStage({ projectId, bundleId, progressionRunId, runId: commitRunId, stageKind: 'automation_commit', pauseCode: 'commit', reason, ambiguous: true, broadcaster });
+        }
+        else {
+            pauseBeforeStage({ projectId, bundleId, progressionRunId, pauseCode: 'commit', reason, broadcaster });
+        }
+        emitUpdated(io, ticket.id);
+        if (failureMode === 'throw') {
+            throw error;
+        }
+        return null;
+    }
+};
 const remoteStatesEqual = (left, right) => (left.state === right.state && (left.state === 'absent' || (right.state === 'observed' && left.sha === right.sha)));
 export const runAutomationCommitChain = async (ticket, _project, _bundle, _automationConfig, io, progressionRunId, resumeFrom, triggeringReviewRunId) => {
     if (!ticket.project_id || !ticket.worktree_bundle_id) {
@@ -296,97 +547,30 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
         || (resumeFrom.stageKind === 'automation_push' && !isRetry)));
     let expectedHeadSha = resumeFrom?.expectedHeadSha ?? null;
     let live = loadLiveState(projectId, bundleId);
-    if (!depthAtLeast(live.automationConfig.depth, 'auto_commit')) {
-        completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
-        emitUpdated(io, ticket.id);
-        return;
-    }
     const branch = live.bundle.branch;
     const cwd = live.bundle.kind === 'project_root'
         ? live.project.repo_path
         : resolveWorktreePath(branch, live.project);
-    let commitRunId = null;
     if (!skipCommit) {
-        try {
-            const status = getGitStatus(cwd, branch, live.project);
-            const precondition = evaluateCommitPrecondition(status);
-            if (!precondition.ok) {
-                throw new Error(precondition.reason);
-            }
-            if (status.files.length === 0) {
-                const head = getGitHeadIdentity(cwd);
-                const intent = {
-                    branch,
-                    preActionHeadSha: head.headSha,
-                    preActionIndexTreeSha: getGitIndexTreeSha(cwd),
-                    intendedTreeSha: head.treeSha,
-                    commitMessageDigest: EMPTY_MESSAGE_DIGEST,
-                    selectedContentDigest: computeGitTreeDeltaDigest(cwd, head.headSha, head.treeSha),
-                };
-                commitRunId = startStage({ projectId, bundleId, ticketId: ticket.id, ticketTitle: ticket.title, progressionRunId, allowedActiveChildRunId: triggeringReviewRunId, stageKind: 'automation_commit', intent, broadcaster, retryOfRunId: resumeFrom?.stageKind === 'automation_commit' ? resumeFrom.retryOfRunId : undefined });
-                live = loadLiveState(projectId, bundleId);
-                finishStage({
-                    projectId,
-                    bundleId,
-                    progressionRunId,
-                    runId: commitRunId,
-                    stageKind: 'automation_commit',
-                    result: { outcome: 'no_changes', headSha: head.headSha, treeSha: head.treeSha },
-                    outcome: 'no_changes',
-                    completeProgression: !depthAtLeast(live.automationConfig.depth, 'auto_push'),
-                    broadcaster,
-                });
-                expectedHeadSha = head.headSha;
-            }
-            else {
-                const selectedPaths = getAutomationCommitPaths(status.files);
-                const message = await generateCommitMessage(cwd, live.project, selectedPaths);
-                live = loadLiveState(projectId, bundleId);
-                if (!message) {
-                    throw new Error('commit message generation produced an empty result');
-                }
-                if (!depthAtLeast(live.automationConfig.depth, 'auto_commit')) {
-                    completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
-                    emitUpdated(io, ticket.id);
-                    return;
-                }
-                const prepared = prepareAutomationCommit(cwd, branch, live.project, selectedPaths);
-                const intent = {
-                    branch,
-                    preActionHeadSha: prepared.preActionHeadSha,
-                    preActionIndexTreeSha: prepared.preActionIndexTreeSha,
-                    intendedTreeSha: prepared.intendedTreeSha,
-                    commitMessageDigest: digestCommitMessage(message),
-                    selectedContentDigest: prepared.selectedContentDigest,
-                };
-                commitRunId = startStage({ projectId, bundleId, ticketId: ticket.id, ticketTitle: ticket.title, progressionRunId, allowedActiveChildRunId: triggeringReviewRunId, stageKind: 'automation_commit', intent, broadcaster, retryOfRunId: resumeFrom?.stageKind === 'automation_commit' ? resumeFrom.retryOfRunId : undefined });
-                const result = await commitPreparedAutomationChanges(cwd, branch, live.project, message, prepared);
-                live = loadLiveState(projectId, bundleId);
-                finishStage({
-                    projectId,
-                    bundleId,
-                    progressionRunId,
-                    runId: commitRunId,
-                    stageKind: 'automation_commit',
-                    result,
-                    outcome: 'committed',
-                    completeProgression: !depthAtLeast(live.automationConfig.depth, 'auto_push'),
-                    broadcaster,
-                });
-                expectedHeadSha = result.commitSha;
-            }
-        }
-        catch (error) {
-            const reason = `commit failed: ${getErrorMessage(error)}`;
-            if (commitRunId) {
-                failStage({ projectId, bundleId, progressionRunId, runId: commitRunId, stageKind: 'automation_commit', pauseCode: 'commit', reason, ambiguous: true, broadcaster });
-            }
-            else {
-                pauseBeforeStage({ projectId, bundleId, progressionRunId, pauseCode: 'commit', reason, broadcaster });
-            }
-            emitUpdated(io, ticket.id);
+        const commitResult = await runAutomationCommitOperation({
+            ticket,
+            io,
+            progressionRunId,
+            allowedActiveChildRunId: triggeringReviewRunId,
+            retryOfRunId: resumeFrom?.stageKind === 'automation_commit' ? resumeFrom.retryOfRunId : undefined,
+            mutationLabel: 'commit',
+            canCommitLive: current => depthAtLeast(current.automationConfig.depth, 'auto_commit'),
+            shouldCompleteProgression: current => !depthAtLeast(current.automationConfig.depth, 'auto_push'),
+        });
+        if (!commitResult) {
             return;
         }
+        if (commitResult.outcome === 'committed') {
+            expectedHeadSha = commitResult.commitSha;
+        }
+        else {
+            expectedHeadSha = commitResult.headSha;
+        }
     }
     live = loadLiveState(projectId, bundleId);
     if (getAutomationProgression(projectId, bundleId)?.id !== progressionRunId) {
@@ -416,16 +600,45 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             if (getGitHeadIdentity(cwd).headSha !== target) {
                 throw new Error('HEAD changed while the push stage was being prepared');
             }
-            const intent = { branch, originIdentity, targetLocalSha: target, preActionRemote };
+            const authorization = await authorizeAutomationBoundary({
+                project: live.project,
+                bundle: live.bundle,
+                progressionRunId,
+                cwd,
+                boundaryKind: 'automation_push',
+                broadcaster,
+                prepare: () => {
+                    const head = getGitHeadIdentity(cwd);
+                    if (head.headSha !== target) {
+                        throw new Error('HEAD changed while required checks were evaluated for push');
+                    }
+                    return head;
+                },
+                resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                    kind: 'commit', commitSha: target, workspaceFingerprint: workspaceIdentity.fingerprint,
+                }),
+            });
+            const intent = {
+                branch,
+                originIdentity,
+                targetLocalSha: target,
+                preActionRemote,
+                checkAuthorization: toStageCheckAuthorization(authorization),
+                intendedTreeSha: authorization.value.treeSha,
+                resultingCommitSha: target,
+            };
             pushRunId = startStage({ projectId, bundleId, ticketId: ticket.id, ticketTitle: ticket.title, progressionRunId, allowedActiveChildRunId: triggeringReviewRunId, stageKind: 'automation_push', intent, broadcaster, retryOfRunId: resumeFrom?.stageKind === 'automation_push' ? resumeFrom.retryOfRunId : undefined });
             const current = await fetchRemoteBranchState(cwd, branch, originIdentity);
             live = loadLiveState(projectId, bundleId);
             if (current.state === 'observed' && current.sha === target) {
+                await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_push' });
+                live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_push');
                 finishStage({ projectId, bundleId, progressionRunId, runId: pushRunId, stageKind: 'automation_push', result: { remoteSha: target }, outcome: 'already_current', completeProgression: !depthAtLeast(live.automationConfig.depth, 'auto_pr'), broadcaster });
                 expectedHeadSha = target;
             }
             else if (remoteStatesEqual(current, preActionRemote)) {
-                live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_push');
+                await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_push' });
+                live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_push');
                 await pushAutomationTarget(cwd, branch, target, originIdentity);
                 live = loadLiveState(projectId, bundleId);
                 const observed = await fetchRemoteBranchState(cwd, branch, originIdentity);
@@ -441,6 +654,13 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             }
         }
         catch (error) {
+            if (error instanceof AutomationCheckGateError) {
+                if (pushRunId) {
+                    failStageAuthorization({ projectId, bundleId, progressionRunId, runId: pushRunId, stageKind: 'automation_push', error, broadcaster });
+                }
+                emitBundleUpdated(io, ticket);
+                return;
+            }
             const reason = `push ambiguous: ${getErrorMessage(error)}`;
             if (pushRunId) {
                 failStage({ projectId, bundleId, progressionRunId, runId: pushRunId, stageKind: 'automation_push', pauseCode: 'push', reason, ambiguous: true, broadcaster });
@@ -477,6 +697,24 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             throw new Error('HEAD no longer matches the exact automation push result');
         }
         const headSha = expectedHeadSha;
+        const authorization = await authorizeAutomationBoundary({
+            project: live.project,
+            bundle: live.bundle,
+            progressionRunId,
+            cwd,
+            boundaryKind: 'automation_pull_request',
+            broadcaster,
+            prepare: () => {
+                const head = getGitHeadIdentity(cwd);
+                if (head.headSha !== headSha) {
+                    throw new Error('HEAD changed while required checks were evaluated for pull request');
+                }
+                return head;
+            },
+            resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                kind: 'commit', commitSha: headSha, workspaceFingerprint: workspaceIdentity.fingerprint,
+            }),
+        });
         const intent = {
             provider: 'github',
             repoHost: githubConfig.host,
@@ -485,6 +723,9 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             baseBranch: githubConfig.default_base_branch,
             headBranch: branch,
             headSha,
+            checkAuthorization: toStageCheckAuthorization(authorization),
+            intendedTreeSha: authorization.value.treeSha,
+            resultingCommitSha: headSha,
         };
         pullRequestRunId = startStage({ projectId, bundleId, ticketId: ticket.id, ticketTitle: ticket.title, progressionRunId, allowedActiveChildRunId: triggeringReviewRunId, stageKind: 'automation_pull_request', intent, broadcaster, retryOfRunId: resumeFrom?.stageKind === 'automation_pull_request' ? resumeFrom.retryOfRunId : undefined });
         let observation = await observeGitHubPullRequest(githubConfig, intent);
@@ -492,6 +733,8 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
         let pullRequest;
         let outcome;
         if (observation.outcome === 'exact') {
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_pull_request' });
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
             pullRequest = observation.pullRequest;
             outcome = 'already_exists';
         }
@@ -502,7 +745,8 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             if (!currentConfig || !githubConfigMatchesIntent(currentConfig, intent)) {
                 throw new Error('GitHub configuration changed while the pull-request stage was active');
             }
-            live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_pr');
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_pull_request' });
             if (getGitHeadIdentity(cwd).headSha !== intent.headSha) {
                 throw new Error('HEAD changed while the pull-request stage was active');
             }
@@ -514,10 +758,12 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             if (!mutationConfig || !githubConfigMatchesIntent(mutationConfig, intent)) {
                 throw new Error('GitHub configuration changed while the pull-request stage was active');
             }
-            live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_pr');
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
             if (getGitHeadIdentity(cwd).headSha !== intent.headSha) {
                 throw new Error('HEAD changed before pull-request creation');
             }
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_pull_request' });
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
             pullRequest = await createGitHubPullRequest(mutationConfig, {
                 title: content.title,
                 body: content.body,
@@ -557,6 +803,13 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
         });
     }
     catch (error) {
+        if (error instanceof AutomationCheckGateError) {
+            if (pullRequestRunId) {
+                failStageAuthorization({ projectId, bundleId, progressionRunId, runId: pullRequestRunId, stageKind: 'automation_pull_request', error, broadcaster });
+            }
+            emitBundleUpdated(io, ticket);
+            return;
+        }
         const reason = `pull request ambiguous: ${getErrorMessage(error)}`;
         if (pullRequestRunId) {
             failStage({ projectId, bundleId, progressionRunId, runId: pullRequestRunId, stageKind: 'automation_pull_request', pauseCode: 'pull_request', reason, ambiguous: true, broadcaster });