@straiffi/archon 1.7.8 → 1.7.10

package/dist/server/lib/ticketAutomationCommit.js

@@ -12,7 +12,7 @@ import { getGitHubConnectionConfig } from './integrations/index.js';
 import { upsertBundlePullRequestFromGitHub, } from './bundlePullRequests.js';
 import { depthAtLeast, getBundleAutomationState, resolveAutomationConfig, } from './ticketAutomation.js';
 import { completeAutomationProgressionInTransaction, completeAutomationProgression, getAutomationProgression, waitAutomationProgressionInTransaction, waitAutomationProgression, } from './automationProgression.js';
-import { assertAutomationAuthorizationCurrent, authorizeAutomationBoundary, AutomationCheckGateError, } from './automationCheckGate.js';
+import { assertAutomationBoundaryNotRequired, assertAutomationAuthorizationCurrent, authorizeAutomationBoundary, AutomationCheckGateError, } from './automationCheckGate.js';
 import { AUTOMATION_STAGE_DETAILS_SCHEMA_VERSION, createAutomationStageDetails, ensureAutomationStageResult, getAutomationStageDetails, } from './automationStageDetails.js';
 import { getProjectById } from './projects.js';
 import { getExecutionRun, withExecutionRunTransaction } from './executionRuns.js';
@@ -160,7 +160,38 @@ const loadLiveState = (projectId, bundleId) => {
     }
     return { project, bundle, automationConfig: resolveAutomationConfig(bundle, project) };
 };
-const assertStageCanMutate = (projectId, bundleId, progressionRunId, requiredDepth) => {
+const toStageCheckAuthorization = (authorization) => authorization.requirement === 'required'
+    ? {
+        kind: 'required',
+        gateEvaluationId: authorization.evaluation.id,
+        policyFingerprint: authorization.policyFingerprint,
+        workspaceFingerprint: authorization.workspaceIdentity.fingerprint,
+    }
+    : {
+        kind: 'not_required',
+        policyFingerprint: authorization.policyFingerprint,
+    };
+const assertBoundaryAuthorizationCurrent = async ({ authorization, project, bundle, progressionRunId, cwd, boundaryKind, }) => {
+    if (authorization.requirement === 'required') {
+        await assertAutomationAuthorizationCurrent({
+            project,
+            bundle,
+            progressionRunId,
+            cwd,
+            evaluationId: authorization.evaluation.id,
+            boundaryKind,
+        });
+        return;
+    }
+    assertAutomationBoundaryNotRequired({
+        project,
+        bundle,
+        progressionRunId,
+        policyFingerprint: authorization.policyFingerprint,
+        boundaryKind,
+    });
+};
+const assertStageCanMutateWithPolicy = (projectId, bundleId, progressionRunId, ticket, mutationLabel, canMutateLive) => {
     const live = loadLiveState(projectId, bundleId);
     const progression = getAutomationProgression(projectId, bundleId);
     const state = getBundleAutomationState(projectId, bundleId);
@@ -169,12 +200,12 @@ const assertStageCanMutate = (projectId, bundleId, progressionRunId, requiredDep
         || progression.status !== 'running'
         || state?.automation_progression_run_id !== progressionRunId
         || state.automation_paused_reason !== null
-        || !depthAtLeast(live.automationConfig.depth, requiredDepth)) {
-        const mutation = requiredDepth === 'auto_commit' ? 'commit' : requiredDepth === 'auto_push' ? 'push' : 'pull-request';
-        throw new Error(`automation no longer permits ${mutation} mutation`);
+        || !canMutateLive(live, { ticket, progressionRunId })) {
+        throw new Error(`automation no longer permits ${mutationLabel} mutation`);
     }
     return live;
 };
+const assertStageCanMutate = (projectId, bundleId, progressionRunId, ticket, requiredDepth) => assertStageCanMutateWithPolicy(projectId, bundleId, progressionRunId, ticket, requiredDepth === 'auto_commit' ? 'commit' : requiredDepth === 'auto_push' ? 'push' : 'pull-request', live => depthAtLeast(live.automationConfig.depth, requiredDepth));
 const githubConfigMatchesIntent = (githubConfig, intent) => (githubConfig.host.toLowerCase() === intent.repoHost.toLowerCase()
     && githubConfig.repo_owner.toLowerCase() === intent.repoOwner.toLowerCase()
     && githubConfig.repo_name.toLowerCase() === intent.repoName.toLowerCase()
@@ -322,6 +353,181 @@ const pauseBeforeStage = ({ projectId, bundleId, progressionRunId, pauseCode, re
     pausedStageRunId: null,
     broadcaster,
 });
+export const runAutomationCommitOperation = async ({ ticket, io, progressionRunId, allowedActiveChildRunId, retryOfRunId, mutationLabel, canCommitLive, shouldCompleteProgression, failureMode = 'return', requiredProgressionPurpose, }) => {
+    if (!ticket.project_id || !ticket.worktree_bundle_id) {
+        return null;
+    }
+    const projectId = ticket.project_id;
+    const bundleId = ticket.worktree_bundle_id;
+    const progression = getAutomationProgression(projectId, bundleId);
+    if (!progression || progression.id !== progressionRunId) {
+        return null;
+    }
+    const broadcaster = asBroadcaster(io);
+    let live = loadLiveState(projectId, bundleId);
+    if (!canCommitLive(live, { ticket, progressionRunId })) {
+        completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
+        emitUpdated(io, ticket.id);
+        return null;
+    }
+    const branch = live.bundle.branch;
+    const cwd = live.bundle.kind === 'project_root'
+        ? live.project.repo_path
+        : resolveWorktreePath(branch, live.project);
+    let commitRunId = null;
+    try {
+        const status = getGitStatus(cwd, branch, live.project);
+        const precondition = evaluateCommitPrecondition(status);
+        if (!precondition.ok) {
+            throw new Error(precondition.reason);
+        }
+        if (status.files.length === 0) {
+            const authorization = await authorizeAutomationBoundary({
+                project: live.project,
+                bundle: live.bundle,
+                progressionRunId,
+                cwd,
+                boundaryKind: 'automation_commit',
+                requiredProgressionPurpose,
+                broadcaster,
+                prepare: () => {
+                    const head = getGitHeadIdentity(cwd);
+                    return { head, indexTreeSha: getGitIndexTreeSha(cwd) };
+                },
+                resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                    kind: 'workspace', fingerprint: workspaceIdentity.fingerprint,
+                }),
+            });
+            const { head, indexTreeSha } = authorization.value;
+            const intent = {
+                branch,
+                preActionHeadSha: head.headSha,
+                preActionIndexTreeSha: indexTreeSha,
+                intendedTreeSha: head.treeSha,
+                commitMessageDigest: EMPTY_MESSAGE_DIGEST,
+                selectedContentDigest: computeGitTreeDeltaDigest(cwd, head.headSha, head.treeSha),
+                checkAuthorization: toStageCheckAuthorization(authorization),
+            };
+            commitRunId = startStage({
+                projectId,
+                bundleId,
+                ticketId: ticket.id,
+                ticketTitle: ticket.title,
+                progressionRunId,
+                allowedActiveChildRunId,
+                stageKind: 'automation_commit',
+                intent,
+                broadcaster,
+                retryOfRunId,
+            });
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_commit' });
+            live = loadLiveState(projectId, bundleId);
+            const result = {
+                outcome: 'no_changes',
+                headSha: head.headSha,
+                treeSha: head.treeSha,
+            };
+            finishStage({
+                projectId,
+                bundleId,
+                progressionRunId,
+                runId: commitRunId,
+                stageKind: 'automation_commit',
+                result,
+                outcome: 'no_changes',
+                completeProgression: shouldCompleteProgression(live, result),
+                broadcaster,
+            });
+            return { runId: commitRunId, ...result };
+        }
+        const selectedPaths = getAutomationCommitPaths(status.files);
+        const message = await generateCommitMessage(cwd, live.project, selectedPaths);
+        live = loadLiveState(projectId, bundleId);
+        if (!message) {
+            throw new Error('commit message generation produced an empty result');
+        }
+        if (!canCommitLive(live, { ticket, progressionRunId })) {
+            completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
+            emitUpdated(io, ticket.id);
+            return null;
+        }
+        const authorization = await authorizeAutomationBoundary({
+            project: live.project,
+            bundle: live.bundle,
+            progressionRunId,
+            cwd,
+            boundaryKind: 'automation_commit',
+            requiredProgressionPurpose,
+            broadcaster,
+            prepare: () => prepareAutomationCommit(cwd, branch, live.project, selectedPaths),
+            resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                kind: 'workspace', fingerprint: workspaceIdentity.fingerprint,
+            }),
+        });
+        const prepared = authorization.value;
+        const intent = {
+            branch,
+            preActionHeadSha: prepared.preActionHeadSha,
+            preActionIndexTreeSha: prepared.preActionIndexTreeSha,
+            intendedTreeSha: prepared.intendedTreeSha,
+            commitMessageDigest: digestCommitMessage(message),
+            selectedContentDigest: prepared.selectedContentDigest,
+            checkAuthorization: toStageCheckAuthorization(authorization),
+        };
+        commitRunId = startStage({
+            projectId,
+            bundleId,
+            ticketId: ticket.id,
+            ticketTitle: ticket.title,
+            progressionRunId,
+            allowedActiveChildRunId,
+            stageKind: 'automation_commit',
+            intent,
+            broadcaster,
+            retryOfRunId,
+        });
+        await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_commit' });
+        live = assertStageCanMutateWithPolicy(projectId, bundleId, progressionRunId, ticket, mutationLabel, canCommitLive);
+        const result = await commitPreparedAutomationChanges(cwd, branch, live.project, message, prepared);
+        live = loadLiveState(projectId, bundleId);
+        finishStage({
+            projectId,
+            bundleId,
+            progressionRunId,
+            runId: commitRunId,
+            stageKind: 'automation_commit',
+            result,
+            outcome: 'committed',
+            completeProgression: shouldCompleteProgression(live, result),
+            broadcaster,
+        });
+        return { outcome: 'committed', runId: commitRunId, ...result };
+    }
+    catch (error) {
+        if (error instanceof AutomationCheckGateError) {
+            if (commitRunId) {
+                failStageAuthorization({ projectId, bundleId, progressionRunId, runId: commitRunId, stageKind: 'automation_commit', error, broadcaster });
+            }
+            emitBundleUpdated(io, ticket);
+            if (failureMode === 'throw') {
+                throw error;
+            }
+            return null;
+        }
+        const reason = `commit failed: ${getErrorMessage(error)}`;
+        if (commitRunId) {
+            failStage({ projectId, bundleId, progressionRunId, runId: commitRunId, stageKind: 'automation_commit', pauseCode: 'commit', reason, ambiguous: true, broadcaster });
+        }
+        else {
+            pauseBeforeStage({ projectId, bundleId, progressionRunId, pauseCode: 'commit', reason, broadcaster });
+        }
+        emitUpdated(io, ticket.id);
+        if (failureMode === 'throw') {
+            throw error;
+        }
+        return null;
+    }
+};
 const remoteStatesEqual = (left, right) => (left.state === right.state && (left.state === 'absent' || (right.state === 'observed' && left.sha === right.sha)));
 export const runAutomationCommitChain = async (ticket, _project, _bundle, _automationConfig, io, progressionRunId, resumeFrom, triggeringReviewRunId) => {
     if (!ticket.project_id || !ticket.worktree_bundle_id) {
@@ -342,143 +548,30 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
         || (resumeFrom.stageKind === 'automation_push' && !isRetry)));
     let expectedHeadSha = resumeFrom?.expectedHeadSha ?? null;
     let live = loadLiveState(projectId, bundleId);
-    if (!depthAtLeast(live.automationConfig.depth, 'auto_commit')) {
-        completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
-        emitUpdated(io, ticket.id);
-        return;
-    }
     const branch = live.bundle.branch;
     const cwd = live.bundle.kind === 'project_root'
         ? live.project.repo_path
         : resolveWorktreePath(branch, live.project);
-    let commitRunId = null;
     if (!skipCommit) {
-        try {
-            const status = getGitStatus(cwd, branch, live.project);
-            const precondition = evaluateCommitPrecondition(status);
-            if (!precondition.ok) {
-                throw new Error(precondition.reason);
-            }
-            if (status.files.length === 0) {
-                const authorization = await authorizeAutomationBoundary({
-                    project: live.project,
-                    bundle: live.bundle,
-                    progressionRunId,
-                    cwd,
-                    boundaryKind: 'automation_commit',
-                    broadcaster,
-                    resolveIntendedIdentity: workspaceIdentity => {
-                        const head = getGitHeadIdentity(cwd);
-                        return {
-                            intendedIdentity: { kind: 'git_tree', treeSha: head.treeSha, workspaceFingerprint: workspaceIdentity.fingerprint },
-                            value: { head, indexTreeSha: getGitIndexTreeSha(cwd) },
-                        };
-                    },
-                });
-                const { head, indexTreeSha } = authorization.value;
-                const intent = {
-                    branch,
-                    preActionHeadSha: head.headSha,
-                    preActionIndexTreeSha: indexTreeSha,
-                    intendedTreeSha: head.treeSha,
-                    commitMessageDigest: EMPTY_MESSAGE_DIGEST,
-                    selectedContentDigest: computeGitTreeDeltaDigest(cwd, head.headSha, head.treeSha),
-                    gateEvaluationId: authorization.evaluation.id,
-                    policyFingerprint: authorization.policyFingerprint,
-                    workspaceFingerprint: authorization.workspaceIdentity.fingerprint,
-                };
-                commitRunId = startStage({ projectId, bundleId, ticketId: ticket.id, ticketTitle: ticket.title, progressionRunId, allowedActiveChildRunId: triggeringReviewRunId, stageKind: 'automation_commit', intent, broadcaster, retryOfRunId: resumeFrom?.stageKind === 'automation_commit' ? resumeFrom.retryOfRunId : undefined });
-                await assertAutomationAuthorizationCurrent({ project: live.project, bundle: live.bundle, progressionRunId, cwd, evaluationId: authorization.evaluation.id, boundaryKind: 'automation_commit' });
-                live = loadLiveState(projectId, bundleId);
-                finishStage({
-                    projectId,
-                    bundleId,
-                    progressionRunId,
-                    runId: commitRunId,
-                    stageKind: 'automation_commit',
-                    result: { outcome: 'no_changes', headSha: head.headSha, treeSha: head.treeSha },
-                    outcome: 'no_changes',
-                    completeProgression: !depthAtLeast(live.automationConfig.depth, 'auto_push'),
-                    broadcaster,
-                });
-                expectedHeadSha = head.headSha;
-            }
-            else {
-                const selectedPaths = getAutomationCommitPaths(status.files);
-                const message = await generateCommitMessage(cwd, live.project, selectedPaths);
-                live = loadLiveState(projectId, bundleId);
-                if (!message) {
-                    throw new Error('commit message generation produced an empty result');
-                }
-                if (!depthAtLeast(live.automationConfig.depth, 'auto_commit')) {
-                    completeAutomationProgression({ projectId, bundleId, progressionRunId, broadcaster });
-                    emitUpdated(io, ticket.id);
-                    return;
-                }
-                const authorization = await authorizeAutomationBoundary({
-                    project: live.project,
-                    bundle: live.bundle,
-                    progressionRunId,
-                    cwd,
-                    boundaryKind: 'automation_commit',
-                    broadcaster,
-                    resolveIntendedIdentity: workspaceIdentity => {
-                        const prepared = prepareAutomationCommit(cwd, branch, live.project, selectedPaths);
-                        return {
-                            intendedIdentity: { kind: 'git_tree', treeSha: prepared.intendedTreeSha, workspaceFingerprint: workspaceIdentity.fingerprint },
-                            value: prepared,
-                        };
-                    },
-                });
-                const prepared = authorization.value;
-                const intent = {
-                    branch,
-                    preActionHeadSha: prepared.preActionHeadSha,
-                    preActionIndexTreeSha: prepared.preActionIndexTreeSha,
-                    intendedTreeSha: prepared.intendedTreeSha,
-                    commitMessageDigest: digestCommitMessage(message),
-                    selectedContentDigest: prepared.selectedContentDigest,
-                    gateEvaluationId: authorization.evaluation.id,
-                    policyFingerprint: authorization.policyFingerprint,
-                    workspaceFingerprint: authorization.workspaceIdentity.fingerprint,
-                };
-                commitRunId = startStage({ projectId, bundleId, ticketId: ticket.id, ticketTitle: ticket.title, progressionRunId, allowedActiveChildRunId: triggeringReviewRunId, stageKind: 'automation_commit', intent, broadcaster, retryOfRunId: resumeFrom?.stageKind === 'automation_commit' ? resumeFrom.retryOfRunId : undefined });
-                await assertAutomationAuthorizationCurrent({ project: live.project, bundle: live.bundle, progressionRunId, cwd, evaluationId: authorization.evaluation.id, boundaryKind: 'automation_commit' });
-                live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_commit');
-                const result = await commitPreparedAutomationChanges(cwd, branch, live.project, message, prepared);
-                live = loadLiveState(projectId, bundleId);
-                finishStage({
-                    projectId,
-                    bundleId,
-                    progressionRunId,
-                    runId: commitRunId,
-                    stageKind: 'automation_commit',
-                    result,
-                    outcome: 'committed',
-                    completeProgression: !depthAtLeast(live.automationConfig.depth, 'auto_push'),
-                    broadcaster,
-                });
-                expectedHeadSha = result.commitSha;
-            }
-        }
-        catch (error) {
-            if (error instanceof AutomationCheckGateError) {
-                if (commitRunId) {
-                    failStageAuthorization({ projectId, bundleId, progressionRunId, runId: commitRunId, stageKind: 'automation_commit', error, broadcaster });
-                }
-                emitBundleUpdated(io, ticket);
-                return;
-            }
-            const reason = `commit failed: ${getErrorMessage(error)}`;
-            if (commitRunId) {
-                failStage({ projectId, bundleId, progressionRunId, runId: commitRunId, stageKind: 'automation_commit', pauseCode: 'commit', reason, ambiguous: true, broadcaster });
-            }
-            else {
-                pauseBeforeStage({ projectId, bundleId, progressionRunId, pauseCode: 'commit', reason, broadcaster });
-            }
-            emitUpdated(io, ticket.id);
+        const commitResult = await runAutomationCommitOperation({
+            ticket,
+            io,
+            progressionRunId,
+            allowedActiveChildRunId: triggeringReviewRunId,
+            retryOfRunId: resumeFrom?.stageKind === 'automation_commit' ? resumeFrom.retryOfRunId : undefined,
+            mutationLabel: 'commit',
+            canCommitLive: current => depthAtLeast(current.automationConfig.depth, 'auto_commit'),
+            shouldCompleteProgression: current => !depthAtLeast(current.automationConfig.depth, 'auto_push'),
+        });
+        if (!commitResult) {
             return;
         }
+        if (commitResult.outcome === 'committed') {
+            expectedHeadSha = commitResult.commitSha;
+        }
+        else {
+            expectedHeadSha = commitResult.headSha;
+        }
     }
     live = loadLiveState(projectId, bundleId);
     if (getAutomationProgression(projectId, bundleId)?.id !== progressionRunId) {
@@ -515,24 +608,23 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
                 cwd,
                 boundaryKind: 'automation_push',
                 broadcaster,
-                resolveIntendedIdentity: workspaceIdentity => {
+                prepare: () => {
                     const head = getGitHeadIdentity(cwd);
                     if (head.headSha !== target) {
                         throw new Error('HEAD changed while required checks were evaluated for push');
                     }
-                    return {
-                        intendedIdentity: { kind: 'commit', commitSha: target, workspaceFingerprint: workspaceIdentity.fingerprint },
-                        value: head,
-                    };
+                    return head;
                 },
+                resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                    kind: 'commit', commitSha: target, workspaceFingerprint: workspaceIdentity.fingerprint,
+                }),
             });
             const intent = {
                 branch,
                 originIdentity,
                 targetLocalSha: target,
                 preActionRemote,
-                gateEvaluationId: authorization.evaluation.id,
-                policyFingerprint: authorization.policyFingerprint,
+                checkAuthorization: toStageCheckAuthorization(authorization),
                 intendedTreeSha: authorization.value.treeSha,
                 resultingCommitSha: target,
             };
@@ -540,14 +632,14 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             const current = await fetchRemoteBranchState(cwd, branch, originIdentity);
             live = loadLiveState(projectId, bundleId);
             if (current.state === 'observed' && current.sha === target) {
-                await assertAutomationAuthorizationCurrent({ project: live.project, bundle: live.bundle, progressionRunId, cwd, evaluationId: authorization.evaluation.id, boundaryKind: 'automation_push' });
-                live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_push');
+                await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_push' });
+                live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_push');
                 finishStage({ projectId, bundleId, progressionRunId, runId: pushRunId, stageKind: 'automation_push', result: { remoteSha: target }, outcome: 'already_current', completeProgression: !depthAtLeast(live.automationConfig.depth, 'auto_pr'), broadcaster });
                 expectedHeadSha = target;
             }
             else if (remoteStatesEqual(current, preActionRemote)) {
-                await assertAutomationAuthorizationCurrent({ project: live.project, bundle: live.bundle, progressionRunId, cwd, evaluationId: authorization.evaluation.id, boundaryKind: 'automation_push' });
-                live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_push');
+                await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_push' });
+                live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_push');
                 await pushAutomationTarget(cwd, branch, target, originIdentity);
                 live = loadLiveState(projectId, bundleId);
                 const observed = await fetchRemoteBranchState(cwd, branch, originIdentity);
@@ -613,16 +705,16 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             cwd,
             boundaryKind: 'automation_pull_request',
             broadcaster,
-            resolveIntendedIdentity: workspaceIdentity => {
+            prepare: () => {
                 const head = getGitHeadIdentity(cwd);
                 if (head.headSha !== headSha) {
                     throw new Error('HEAD changed while required checks were evaluated for pull request');
                 }
-                return {
-                    intendedIdentity: { kind: 'commit', commitSha: headSha, workspaceFingerprint: workspaceIdentity.fingerprint },
-                    value: head,
-                };
+                return head;
             },
+            resolveIntendedIdentity: (_value, workspaceIdentity) => ({
+                kind: 'commit', commitSha: headSha, workspaceFingerprint: workspaceIdentity.fingerprint,
+            }),
         });
         const intent = {
             provider: 'github',
@@ -632,8 +724,7 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             baseBranch: githubConfig.default_base_branch,
             headBranch: branch,
             headSha,
-            gateEvaluationId: authorization.evaluation.id,
-            policyFingerprint: authorization.policyFingerprint,
+            checkAuthorization: toStageCheckAuthorization(authorization),
             intendedTreeSha: authorization.value.treeSha,
             resultingCommitSha: headSha,
         };
@@ -643,8 +734,8 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
         let pullRequest;
         let outcome;
         if (observation.outcome === 'exact') {
-            await assertAutomationAuthorizationCurrent({ project: live.project, bundle: live.bundle, progressionRunId, cwd, evaluationId: authorization.evaluation.id, boundaryKind: 'automation_pull_request' });
-            live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_pr');
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_pull_request' });
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
             pullRequest = observation.pullRequest;
             outcome = 'already_exists';
         }
@@ -655,8 +746,8 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             if (!currentConfig || !githubConfigMatchesIntent(currentConfig, intent)) {
                 throw new Error('GitHub configuration changed while the pull-request stage was active');
             }
-            live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_pr');
-            await assertAutomationAuthorizationCurrent({ project: live.project, bundle: live.bundle, progressionRunId, cwd, evaluationId: authorization.evaluation.id, boundaryKind: 'automation_pull_request' });
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_pull_request' });
             if (getGitHeadIdentity(cwd).headSha !== intent.headSha) {
                 throw new Error('HEAD changed while the pull-request stage was active');
             }
@@ -668,12 +759,12 @@ export const runAutomationCommitChain = async (ticket, _project, _bundle, _autom
             if (!mutationConfig || !githubConfigMatchesIntent(mutationConfig, intent)) {
                 throw new Error('GitHub configuration changed while the pull-request stage was active');
             }
-            live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_pr');
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
             if (getGitHeadIdentity(cwd).headSha !== intent.headSha) {
                 throw new Error('HEAD changed before pull-request creation');
             }
-            await assertAutomationAuthorizationCurrent({ project: live.project, bundle: live.bundle, progressionRunId, cwd, evaluationId: authorization.evaluation.id, boundaryKind: 'automation_pull_request' });
-            live = assertStageCanMutate(projectId, bundleId, progressionRunId, 'auto_pr');
+            await assertBoundaryAuthorizationCurrent({ authorization, project: live.project, bundle: live.bundle, progressionRunId, cwd, boundaryKind: 'automation_pull_request' });
+            live = assertStageCanMutate(projectId, bundleId, progressionRunId, ticket, 'auto_pr');
             pullRequest = await createGitHubPullRequest(mutationConfig, {
                 title: content.title,
                 body: content.body,