@straiffi/archon 1.8.22 → 1.10.0

package/dist/server/lib/agentProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentProvider.js","sourceRoot":"","sources":["../../../server/lib/agentProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AACjH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAA;AAmDhF,MAAM,mBAAmB,GAAG,CAC1B,aAA4B,EAC5B,iBAA+C,EAC/C,OAA4B,EACX,EAAE;IACnB,MAAM,UAAU,GAAG,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAA2D,CAAA;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC;gBACjC,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC9B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,mBAAmB,EAAE,6BAA6B,EAAE;gBACpD,kBAAkB,EAAE;oBAClB,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,gBAAgB;oBAC7B,SAAS,EAAE,OAAO,CAAC,GAAG;iBACvB;gBACD,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,IAAI,OAAO,GAAG,KAAK,CAAA;QAEnB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE/E,KAAK,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YAEd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;YAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YACnG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,OAAO,CAAC,0BAA0B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;oBACpE,CAAC,CAAC,iCAAiC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACjD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACjB,OAAM;YACR,CAAC;YAED,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACtB,OAAM;YACR,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,4BAA4B,IAAI,EAAE,CAAA;YAClG,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,aAAa,CAAC,CAAA;YACjE,MAAM,CAAC,OAAO,CAAC,0BAA0B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBACpE,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;YAC/B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,aAA4B,EAC5B,iBAA+C,EAC/C,OAA4B,EACX,EAAE;IACnB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IAChF,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;AACrF,CAAC,CAAA"}
+{"version":3,"file":"agentProvider.js","sourceRoot":"","sources":["../../../server/lib/agentProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AACjH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAA;AAoDhF,MAAM,mBAAmB,GAAG,CAC1B,aAA4B,EAC5B,iBAA+C,EAC/C,OAA4B,EACX,EAAE;IACnB,MAAM,UAAU,GAAG,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAA2D,CAAA;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC;gBACjC,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC9B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,mBAAmB,EAAE,6BAA6B,EAAE;gBACpD,kBAAkB,EAAE;oBAClB,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,gBAAgB;oBAC7B,SAAS,EAAE,OAAO,CAAC,GAAG;iBACvB;gBACD,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,IAAI,OAAO,GAAG,KAAK,CAAA;QAEnB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE/E,KAAK,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YAEd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;YAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YACnG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,OAAO,CAAC,0BAA0B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;oBACpE,CAAC,CAAC,iCAAiC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACjD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACjB,OAAM;YACR,CAAC;YAED,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACtB,OAAM;YACR,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,4BAA4B,IAAI,EAAE,CAAA;YAClG,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,aAAa,CAAC,CAAA;YACjE,MAAM,CAAC,OAAO,CAAC,0BAA0B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBACpE,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;YAC/B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,aAA4B,EAC5B,iBAA+C,EAC/C,OAA4B,EACX,EAAE;IACnB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IAChF,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;AACrF,CAAC,CAAA"}

package/dist/server/lib/approvalReconciliation.js

@@ -4,7 +4,9 @@ import { expireApprovalRequests, getApprovalRequest, invalidateApprovalRequest }
 import { getActiveExecutionProfileRevision } from './executionProfileStore.js';
 import { getCheckDefinitionFingerprint } from './checkDefinitions.js';
 import { getProjectById, getProjectCheckDefinitions } from './projects.js';
-const invalidReason = (request) => {
+import { fingerprintConsequentialAction } from './consequentialActions.js';
+import { rebuildProductionCheckAction } from './productionCheckApprovals.js';
+const invalidReason = async (request) => {
     const activeProfile = getActiveExecutionProfileRevision(request.project_id);
     if (!activeProfile
         || activeProfile.id !== request.authority.selected_profile.revision_id
@@ -42,6 +44,16 @@ const invalidReason = (request) => {
             || getCheckDefinitionFingerprint(definition) !== target.check_definition_fingerprint) {
             return 'custom_check_definition_changed';
         }
+        try {
+            const current = await rebuildProductionCheckAction(request);
+            if (fingerprintConsequentialAction(current.action) !== request.action_fingerprint
+                || JSON.stringify(current.authority) !== JSON.stringify(request.authority)) {
+                return 'custom_check_action_or_authority_changed';
+            }
+        }
+        catch {
+            return 'custom_check_revalidation_failed';
+        }
     }
     return null;
 };
@@ -69,7 +81,7 @@ export const reconcileApprovalRequests = async (input = {}) => {
             await input.reconcileConsumed?.(request);
             continue;
         }
-        const reason = invalidReason(request);
+        const reason = await invalidReason(request);
         if (reason) {
             const invalidatedRequest = invalidateApprovalRequest({
                 projectId: request.project_id,

package/dist/server/lib/approvalReconciliation.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvalReconciliation.js","sourceRoot":"","sources":["../../../server/lib/approvalReconciliation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,MAAM,UAAU,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAC7G,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAA;AAG9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAU1E,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAiB,EAAE;IAChE,MAAM,aAAa,GAAG,iCAAiC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3E,IACE,CAAC,aAAa;WACX,aAAa,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW;WACnE,aAAa,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ;WACtE,aAAa,CAAC,WAAW,KAAK,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,EAC/E,CAAC;QACD,OAAO,qCAAqC,CAAA;IAC9C,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,OAAO,8BAA8B,CAAA;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;KAK9B,CAAC,CAAC,GAAG,CACJ,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAChC,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,EACtC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,CACrD,CAAA;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,6CAA6C,CAAA;QACtD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;QACpC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAA;QAC3D,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5G,MAAM,aAAa,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAA;QACnE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,qBAAqB,aAAa,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACjH,OAAO,2BAA2B,CAAA;QACpC,CAAC;QACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;aAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACjE,IACE,CAAC,UAAU;eACR,UAAU,CAAC,QAAQ,KAAK,QAAQ;eAChC,UAAU,CAAC,WAAW,KAAK,YAAY;eACvC,6BAA6B,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,4BAA4B,EACpF,CAAC;YACD,OAAO,iCAAiC,CAAA;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,QAO3C,EAAE,EAAyC,EAAE;IAChD,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAClF,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;uBAEH,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,mCAAmC;;GAEnH,CAAC,CAAC,GAAG,EAA+C,CAAA;IACrD,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,kBAAkB,CAChC,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,EAAE,EACN,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC3C,CAAA;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,iBAAiB,IAAI,CAAC,CAAA;YACtB,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;gBACnD,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,MAAM;gBACN,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAA;YACF,WAAW,IAAI,CAAC,CAAA;YAChB,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,CAAA;YACjD,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,iBAAiB,IAAI,CAAC,CAAA;YACtB,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,WAAW;QACX,OAAO;QACP,kBAAkB,EAAE,iBAAiB;QACrC,kBAAkB,EAAE,iBAAiB;KACtC,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"approvalReconciliation.js","sourceRoot":"","sources":["../../../server/lib/approvalReconciliation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,MAAM,UAAU,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAC7G,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAA;AAG9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAU5E,MAAM,aAAa,GAAG,KAAK,EAAE,OAAwB,EAA0B,EAAE;IAC/E,MAAM,aAAa,GAAG,iCAAiC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3E,IACE,CAAC,aAAa;WACX,aAAa,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW;WACnE,aAAa,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ;WACtE,aAAa,CAAC,WAAW,KAAK,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,EAC/E,CAAC;QACD,OAAO,qCAAqC,CAAA;IAC9C,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,OAAO,8BAA8B,CAAA;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;KAK9B,CAAC,CAAC,GAAG,CACJ,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAChC,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,EACtC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,CACrD,CAAA;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,6CAA6C,CAAA;QACtD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;QACpC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAA;QAC3D,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5G,MAAM,aAAa,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAA;QACnE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,qBAAqB,aAAa,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACjH,OAAO,2BAA2B,CAAA;QACpC,CAAC;QACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;aAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACjE,IACE,CAAC,UAAU;eACR,UAAU,CAAC,QAAQ,KAAK,QAAQ;eAChC,UAAU,CAAC,WAAW,KAAK,YAAY;eACvC,6BAA6B,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,4BAA4B,EACpF,CAAC;YACD,OAAO,iCAAiC,CAAA;QAC1C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAA;YAC3D,IACE,8BAA8B,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,kBAAkB;mBAC1E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAC1E,CAAC;gBACD,OAAO,0CAA0C,CAAA;YACnD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,kCAAkC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,QAO3C,EAAE,EAAyC,EAAE;IAChD,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAClF,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;uBAEH,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,mCAAmC;;GAEnH,CAAC,CAAC,GAAG,EAA+C,CAAA;IACrD,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,kBAAkB,CAChC,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,EAAE,EACN,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC3C,CAAA;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,iBAAiB,IAAI,CAAC,CAAA;YACtB,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;gBACnD,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,MAAM;gBACN,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAA;YACF,WAAW,IAAI,CAAC,CAAA;YAChB,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,CAAA;YACjD,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,iBAAiB,IAAI,CAAC,CAAA;YACtB,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,WAAW;QACX,OAAO;QACP,kBAAkB,EAAE,iBAAiB;QACrC,kBAAkB,EAAE,iBAAiB;KACtC,CAAA;AACH,CAAC,CAAA"}

package/dist/server/lib/buildExecutionEnvironment.js

@@ -1,6 +1,8 @@
 import db from '../db.js';
+import { isDeepStrictEqual } from 'node:util';
 import { ExecutionEnvironmentFailure, } from './executionEnvironment.js';
-import { QUALIFIED_DOCKER_SANDBOX_TEMPLATES, QUALIFIED_SBX_VERSION, DockerSandboxNetworkRollbackFailure, proveScopedDestinationAccess, removeScopedRulesBestEffort, } from './dockerSandboxExecutionEnvironment.js';
+import { DockerSandboxNetworkRollbackFailure, proveScopedDestinationAccess, removeScopedRulesBestEffort, } from './dockerSandboxExecutionEnvironment.js';
+import { resolveDockerSandboxReleaseForPersistedEnvironment } from './dockerSandboxReleaseProfiles.js';
 import { createDockerSandboxExecutionProvider } from './dockerSandboxExecutionProvider.js';
 import { createDockerSandboxOpencodeSessionOperations } from './dockerSandboxOpencodeSessionOperations.js';
 import { defaultDockerSandboxEnvironmentDependencies, dockerSandboxRunner, ensureDockerSandboxRuntimeReady, reconnectAndInspectDockerSandbox, resolveExpectedDockerSandboxIdentity, stopAndVerifyDockerSandbox, } from './dockerSandboxEnvironmentOperations.js';
@@ -9,8 +11,9 @@ import { validateExecutionEnvironmentSkills } from './executionEnvironmentValida
 import { acquireExecutionEnvironmentLease, appendExecutionEnvironmentEvent, captureExecutionEnvironmentPlacement, getExecutionEnvironment, getExecutionEnvironmentBindingForRun, listExecutionEnvironments, releaseExecutionEnvironmentLease, transitionExecutionEnvironment, } from './executionEnvironments.js';
 import { hostExecutionEnvironment } from './hostExecutionEnvironment.js';
 import { getModelProvider, normalizeModelId } from './models.js';
-import { createExecutionRunAuthority, persistExecutionRunAuthority, resolveEnvironmentCredentialEvidence, resolveExecutionRunProfile, } from './executionRunAuthority.js';
+import { createExecutionRunAuthority, getExecutionRunAuthority, persistExecutionRunAuthority, resolveEnvironmentCredentialEvidence, resolveExecutionRunProfile, } from './executionRunAuthority.js';
 import { fingerprintCredentialRequirements } from './executionProfiles.js';
+import { isExecutionProfileEligibleForWorkload, resolveExecutionCredentialRequirements, resolveExecutionTemplateAgent, } from './executionWorkloads.js';
 import { normalizeExecutionEnvironmentDestinations } from './executionEnvironmentLifecycle.js';
 import { createDockerSandboxLauncherEnvironment, createGovernedHostRuntimeEnvironment, createHostLauncherEnvironment, createLegacyHostRuntimeEnvironment, createProviderManagedRuntimeEnvironment, } from './workspaceProcessEnvironment.js';
 export class BuildExecutionEnvironmentFailure extends Error {
@@ -29,13 +32,14 @@ const describePreparationFailure = (error) => {
     }
     return '';
 };
-const getLatestValidation = (projectId, environmentId, agent, provider) => db.prepare(`
+const getLatestValidation = (projectId, environmentId, agent, provider, workload) => db.prepare(`
     SELECT run.id, run.status, run.domain_status, run.metadata_json
     FROM execution_environment_run_bindings binding
     JOIN execution_runs run ON run.id = binding.execution_run_id AND run.project_id = binding.project_id
     WHERE binding.project_id = ? AND binding.environment_id = ?
       AND binding.relationship = 'validation' AND run.kind = 'environment_validation'
       AND json_extract(run.metadata_json, '$.agent') = ?
+      AND COALESCE(json_extract(run.metadata_json, '$.workload'), 'build') = ?
       AND (
         (? IS NULL AND json_extract(run.metadata_json, '$.provider') IS NULL AND json_extract(run.metadata_json, '$.model') IS NULL)
         OR json_extract(run.metadata_json, '$.provider') = ?
@@ -44,7 +48,7 @@ const getLatestValidation = (projectId, environmentId, agent, provider) => db.pr
       )
     ORDER BY run.created_at DESC, run.id DESC
     LIMIT 1
-  `).get(projectId, environmentId, agent, provider, provider, provider, provider ? `${provider}/%` : null, provider) ?? null;
+  `).get(projectId, environmentId, agent, workload, provider, provider, provider, provider ? `${provider}/%` : null, provider) ?? null;
 const validationAgent = (row) => {
     if (!row.metadata_json) {
         return null;
@@ -86,7 +90,7 @@ const validationProvider = (row) => {
         return null;
     }
 };
-const getValidationCredentialCapability = (projectId, environmentId, validationRunId) => {
+const getValidationCredentialCapability = (projectId, environmentId, validationRunId, workload) => {
     const row = db.prepare(`
     SELECT metadata_json
     FROM execution_environment_events
@@ -111,7 +115,7 @@ const getValidationCredentialCapability = (projectId, environmentId, validationR
         const capability = value;
         if ((capability.execution_provider !== 'host' && capability.execution_provider !== 'docker_sandbox')
             || (capability.agent !== 'opencode' && capability.agent !== 'claude')
-            || capability.workload !== 'build'
+            || capability.workload !== workload
             || typeof capability.satisfies_requested_protection !== 'boolean'
             || !capability.inventory
             || !capability.destination
@@ -125,40 +129,50 @@ const getValidationCredentialCapability = (projectId, environmentId, validationR
     }
 };
 const findExecutionEnvironment = (project, agent, target, profileRevision, pinnedEnvironmentId, pinnedEnvironmentRevision, pinnedEnvironmentValidationFingerprint) => {
-    const fingerprint = currentExecutionEnvironmentValidationFingerprint(agent);
-    return listExecutionEnvironments(project.id).find(candidate => ((!pinnedEnvironmentId || candidate.id === pinnedEnvironmentId)
-        && (pinnedEnvironmentRevision === undefined || candidate.environment_revision === pinnedEnvironmentRevision)
-        && (pinnedEnvironmentValidationFingerprint === undefined
-            || candidate.environment_validation_fingerprint === pinnedEnvironmentValidationFingerprint)
-        &&
-            candidate.provider_kind === 'docker_sandbox'
-        && candidate.provider_version === QUALIFIED_SBX_VERSION
-        && candidate.target_kind === target.identity.kind
-        && candidate.target_key === target.identity.key
-        && candidate.target_workspace_path === target.workspacePath
-        && candidate.environment_validation_fingerprint === fingerprint
-        && (candidate.execution_profile_fingerprint === profileRevision.fingerprint
-            || (profileRevision.revision === 0 && candidate.execution_profile_fingerprint == null))
-        && (candidate.credential_requirements_fingerprint === fingerprintCredentialRequirements(profileRevision.profile.credential_requirements)
-            || (profileRevision.revision === 0 && candidate.credential_requirements_fingerprint == null))
-        && candidate.retirement_requested_at == null
-        && candidate.template_identity === QUALIFIED_DOCKER_SANDBOX_TEMPLATES[agent]
-        && candidate.agent_identity === agent
-        && candidate.compatible_agents.length === 1
-        && candidate.compatible_agents[0] === agent
-        && ['ready', 'running', 'stopped'].includes(candidate.lifecycle_state))) ?? null;
+    return listExecutionEnvironments(project.id).find(candidate => {
+        const releaseProfile = resolveDockerSandboxReleaseForPersistedEnvironment(candidate.provider_version, candidate.template_identity, candidate.agent_identity);
+        if (!releaseProfile) {
+            return false;
+        }
+        const fingerprint = currentExecutionEnvironmentValidationFingerprint(agent, releaseProfile);
+        return ((!pinnedEnvironmentId || candidate.id === pinnedEnvironmentId)
+            && (pinnedEnvironmentRevision === undefined || candidate.environment_revision === pinnedEnvironmentRevision)
+            && (pinnedEnvironmentValidationFingerprint === undefined
+                || candidate.environment_validation_fingerprint === pinnedEnvironmentValidationFingerprint)
+            && candidate.provider_kind === 'docker_sandbox'
+            && candidate.provider_version === releaseProfile.version
+            && candidate.target_kind === target.identity.kind
+            && candidate.target_key === target.identity.key
+            && candidate.target_workspace_path === target.workspacePath
+            && candidate.environment_validation_fingerprint === fingerprint
+            && (candidate.execution_profile_fingerprint === profileRevision.fingerprint
+                || (profileRevision.revision === 0 && candidate.execution_profile_fingerprint == null))
+            && (candidate.credential_requirements_fingerprint === fingerprintCredentialRequirements(profileRevision.profile.credential_requirements)
+                || (profileRevision.revision === 0 && candidate.credential_requirements_fingerprint == null))
+            && candidate.retirement_requested_at == null
+            && candidate.template_identity === releaseProfile.templates[agent]
+            && candidate.agent_identity === agent
+            && candidate.compatible_agents.length === 1
+            && candidate.compatible_agents[0] === agent
+            && ['ready', 'running', 'stopped'].includes(candidate.lifecycle_state));
+    }) ?? null;
 };
-const resolveValidatedEnvironment = (project, agent, target, model, profileRevision, pinnedEnvironmentId, pinnedEnvironmentRevision, pinnedEnvironmentValidationFingerprint) => {
+const resolveValidatedEnvironment = (project, agent, target, model, profileRevision, workload, pinnedEnvironmentId, pinnedEnvironmentRevision, pinnedEnvironmentValidationFingerprint) => {
     const requestedModel = agent === 'opencode' ? normalizeModelId(model) : null;
-    const requestedProvider = agent === 'opencode' ? getModelProvider(requestedModel) : 'anthropic';
-    if (agent === 'opencode' && !requestedProvider) {
+    const requestedProvider = workload === 'check'
+        ? null
+        : agent === 'opencode' ? getModelProvider(requestedModel) : 'anthropic';
+    if (workload !== 'check' && agent === 'opencode' && !requestedProvider) {
         throw new BuildExecutionEnvironmentFailure('validation_provider_missing', 'OpenCode Build requires a model with a provider before a Docker Sandbox can be used.', 'Choose a provider-backed OpenCode model for this ticket, then retry Build.');
     }
     const environment = findExecutionEnvironment(project, agent, target, profileRevision, pinnedEnvironmentId, pinnedEnvironmentRevision, pinnedEnvironmentValidationFingerprint);
     if (!environment) {
         throw new BuildExecutionEnvironmentFailure('environment_missing', 'No validated Docker Sandbox matches this exact Build target and agent.', `Select this target and validate its ${agent} Docker Sandbox before starting Build.`);
     }
-    const validation = getLatestValidation(project.id, environment.id, agent, requestedProvider);
+    if (workload === 'check') {
+        return environment;
+    }
+    const validation = getLatestValidation(project.id, environment.id, agent, requestedProvider, workload);
     if (!validation) {
         throw new BuildExecutionEnvironmentFailure('validation_missing', 'The matching Docker Sandbox has no durable validation evidence.', `Validate the environment for ${agent} before starting Build.`);
     }
@@ -184,6 +198,7 @@ const validateBuildProvider = async (input) => {
         initiatedBy: 'automation',
         signal: input.signal,
         profileRevision: input.profileRevision,
+        workload: input.workload,
     }, {
         adapter: input.dependencies.adapter,
         runtimeController: input.dependencies.runtimeController,
@@ -326,6 +341,102 @@ export const resolveBuildLineage = (projectId, ticketId, currentRunId, sessionId
     return parseBuildLineage(row);
 };
 export const resolveBuildLineageProvider = (projectId, ticketId, currentRunId, sessionId) => resolveBuildLineage(projectId, ticketId, currentRunId, sessionId)?.provider ?? null;
+const resolveChatLineageRow = (projectId, chatSessionId, currentRunId, sessionId) => db.prepare(`${buildLineageSelect}
+  INNER JOIN agent_runs agent_run
+    ON agent_run.execution_run_id = run.id
+    AND agent_run.parent_type = 'chat'
+    AND agent_run.parent_id = run.source_id
+    AND agent_run.role = 'main'
+    AND agent_run.session_id = ?
+  WHERE run.project_id = ? AND run.source_kind = 'chat_session' AND run.source_id = ?
+    AND run.id <> ? AND run.kind = 'chat_turn'
+    AND json_extract(run.metadata_json, '$.retry_mode') = 'build'
+  ORDER BY run.created_at DESC, run.id DESC
+  LIMIT 1
+`).get(sessionId, projectId, chatSessionId, currentRunId);
+const resolveChatLineageForRow = (projectId, row) => {
+    const lineage = parseBuildLineage(row);
+    if (!lineage || !row) {
+        return null;
+    }
+    const authority = getExecutionRunAuthority(projectId, row.id);
+    if (!authority || authority.workload !== 'chat_build') {
+        throw new BuildExecutionEnvironmentFailure('environment_identity_invalid', 'The historical Chat Build authority is unavailable or belongs to another workload.', 'Start a fresh Chat Build session under the selected execution profile.');
+    }
+    if (authority.effective.provider !== lineage.provider
+        || authority.effective.environment_id !== lineage.environmentId
+        || authority.effective.environment_revision !== lineage.environmentRevision
+        || authority.effective.environment_validation_fingerprint !== lineage.environmentValidationFingerprint) {
+        throw new BuildExecutionEnvironmentFailure('environment_identity_invalid', 'The historical Chat Build provider metadata does not match its immutable authority.', 'Start a fresh Chat Build session under the selected execution profile.');
+    }
+    let metadata = null;
+    try {
+        metadata = row.metadata_json ? JSON.parse(row.metadata_json) : null;
+    }
+    catch {
+        metadata = null;
+    }
+    const historicalAgent = metadata?.retry_tool;
+    const historicalModel = typeof metadata?.retry_model === 'string' ? metadata.retry_model : null;
+    const modelProvider = historicalAgent === 'claude' ? 'anthropic' : getModelProvider(historicalModel);
+    if ((historicalAgent !== 'opencode' && historicalAgent !== 'claude')
+        || authority.agent.agent !== historicalAgent
+        || !modelProvider) {
+        throw new BuildExecutionEnvironmentFailure('environment_identity_invalid', 'The historical Chat Build agent or model provider authority is incomplete.', 'Start a fresh Chat Build session under the selected agent and model provider.');
+    }
+    return {
+        ...lineage,
+        agent: authority.agent.agent,
+        modelProvider,
+        target: {
+            kind: authority.target.kind,
+            key: authority.target.key,
+            workspacePath: authority.target.workspace_path,
+        },
+    };
+};
+export const resolveChatLineage = (projectId, chatSessionId, currentRunId, sessionId) => resolveChatLineageForRow(projectId, resolveChatLineageRow(projectId, chatSessionId, currentRunId, sessionId));
+export const resolvePlanChatProviderSession = (projectId, chatSessionId, sessionId) => {
+    const row = db.prepare(`
+    SELECT run.metadata_json
+    FROM execution_runs run
+    INNER JOIN agent_runs agent_run
+      ON agent_run.execution_run_id = run.id
+      AND agent_run.parent_type = 'chat'
+      AND agent_run.parent_id = run.source_id
+      AND agent_run.role = 'main'
+      AND agent_run.session_id = ?
+    WHERE run.project_id = ? AND run.source_kind = 'chat_session' AND run.source_id = ?
+      AND run.kind = 'chat_turn'
+      AND json_extract(run.metadata_json, '$.retry_mode') = 'plan'
+    ORDER BY run.created_at DESC, run.id DESC
+    LIMIT 1
+  `).get(sessionId, projectId, chatSessionId);
+    if (!row?.metadata_json) {
+        return null;
+    }
+    try {
+        const metadata = JSON.parse(row.metadata_json);
+        const agent = metadata.retry_tool;
+        const model = typeof metadata.retry_model === 'string' ? metadata.retry_model : null;
+        const modelProvider = agent === 'claude' ? 'anthropic' : getModelProvider(model);
+        if ((agent !== 'opencode' && agent !== 'claude') || !modelProvider) {
+            return null;
+        }
+        return { agent, modelProvider };
+    }
+    catch {
+        return null;
+    }
+};
+export const resolveChatLineageForRun = (projectId, executionRunId) => {
+    const row = db.prepare(`${buildLineageSelect}
+    WHERE run.project_id = ? AND run.id = ? AND run.kind = 'chat_turn'
+      AND json_extract(run.metadata_json, '$.retry_mode') = 'build'
+    LIMIT 1
+  `).get(projectId, executionRunId);
+    return resolveChatLineageForRow(projectId, row);
+};
 export const recordBuildExecutionProvider = (projectId, executionRunId, provider) => {
     const updated = db.prepare(`
     UPDATE execution_runs
@@ -337,9 +448,40 @@ export const recordBuildExecutionProvider = (projectId, executionRunId, provider
         throw new Error('Build execution provider lineage could not be recorded');
     }
 };
-export const resolveBuildExecutionEnvironment = async (input) => {
+export const recordChatExecutionProvider = (projectId, executionRunId, provider) => {
+    const updated = db.prepare(`
+    UPDATE execution_runs
+    SET metadata_json = json_set(COALESCE(metadata_json, '{}'), '$.build_execution_provider', ?),
+      updated_at = CURRENT_TIMESTAMP
+    WHERE id = ? AND project_id = ? AND kind = 'chat_turn'
+      AND json_extract(metadata_json, '$.retry_mode') = 'build'
+  `).run(provider, executionRunId, projectId);
+    if (updated.changes !== 1) {
+        throw new Error('Chat Build execution provider lineage could not be recorded');
+    }
+};
+export const resolveWorkloadExecutionEnvironment = async (input) => {
     const profileRevision = resolveExecutionRunProfile(input.project, input.executionRunId);
-    const selectedProvider = profileRevision.profile.provider_preference;
+    if (!isExecutionProfileEligibleForWorkload(profileRevision.profile, input.workload)) {
+        throw new Error(`The selected execution profile is not eligible for ${input.workload} workloads`);
+    }
+    const templateAgent = resolveExecutionTemplateAgent({
+        profile: profileRevision.profile,
+        workload: input.workload,
+        agent: input.agent,
+    });
+    if (!templateAgent || templateAgent !== input.agent) {
+        throw new Error(`The selected execution profile has no matching template for ${input.workload} and ${input.agent}`);
+    }
+    const selectedProvider = input.pinnedProvider ?? profileRevision.profile.provider_preference;
+    if (input.pinnedProvider
+        && input.pinnedProvider !== profileRevision.profile.provider_preference
+        && !(input.pinnedProvider === 'host'
+            && profileRevision.profile.provider_preference === 'docker_sandbox'
+            && profileRevision.profile.fallback === 'explicit_host'
+            && profileRevision.profile.isolation === 'host_process_allowed')) {
+        throw new BuildExecutionEnvironmentFailure('environment_identity_invalid', 'The historical execution provider conflicts with the selected execution profile.', 'Start a fresh execution under the selected profile.');
+    }
     const hasPinnedEnvironmentLineage = input.pinnedEnvironmentId !== undefined
         || input.pinnedEnvironmentRevision !== undefined
         || input.pinnedEnvironmentValidationFingerprint !== undefined;
@@ -350,7 +492,9 @@ export const resolveBuildExecutionEnvironment = async (input) => {
             || !input.pinnedEnvironmentValidationFingerprint)) {
         throw new BuildExecutionEnvironmentFailure('environment_identity_invalid', 'The historical Docker Sandbox lineage is incomplete or conflicts with the selected execution profile.', 'Retry as a fresh Build instead of resuming this historical provider session.');
     }
-    const modelProvider = input.agent === 'opencode' ? getModelProvider(input.model) || null : 'anthropic';
+    const modelProvider = input.workload === 'check'
+        ? null
+        : input.agent === 'opencode' ? getModelProvider(input.model) || null : 'anthropic';
     const resolveHostEnvironment = (fallback) => {
         const runAuthority = createExecutionRunAuthority({
             profileRevision,
@@ -360,6 +504,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
             target: input.target,
             environment: null,
             fallback: fallback ? { used: true, from: fallback.from, reason: fallback.reason } : undefined,
+            workload: input.workload,
         });
         persistExecutionRunAuthority({
             projectId: input.project.id,
@@ -368,7 +513,14 @@ export const resolveBuildExecutionEnvironment = async (input) => {
             authority: runAuthority,
         });
         if (fallback) {
-            recordBuildExecutionProvider(input.project.id, input.executionRunId, 'host');
+            const runKind = db.prepare('SELECT kind FROM execution_runs WHERE id = ? AND project_id = ?')
+                .get(input.executionRunId, input.project.id);
+            if (runKind?.kind === 'chat_turn') {
+                recordChatExecutionProvider(input.project.id, input.executionRunId, 'host');
+            }
+            else if (runKind?.kind !== 'service') {
+                recordBuildExecutionProvider(input.project.id, input.executionRunId, 'host');
+            }
         }
         return {
             provider: hostExecutionEnvironment,
@@ -383,10 +535,17 @@ export const resolveBuildExecutionEnvironment = async (input) => {
         };
     };
     if (selectedProvider !== 'docker_sandbox') {
-        return resolveHostEnvironment();
+        return resolveHostEnvironment(input.pinnedProvider === 'host' && profileRevision.profile.provider_preference === 'docker_sandbox'
+            ? { from: 'docker_sandbox', reason: 'historical_provider_lineage' }
+            : undefined);
     }
     const dependencies = input.dependencies ?? defaultDockerSandboxEnvironmentDependencies;
-    const applicableRequirements = profileRevision.profile.credential_requirements.filter(requirement => (requirement.agent === input.agent && requirement.model_provider === modelProvider));
+    const applicableRequirements = resolveExecutionCredentialRequirements({
+        profile: profileRevision.profile,
+        workload: input.workload,
+        agent: input.agent,
+        modelProvider,
+    });
     const canFallback = profileRevision.profile.fallback === 'explicit_host'
         && !hasPinnedEnvironmentLineage
         && profileRevision.profile.isolation === 'host_process_allowed'
@@ -407,12 +566,13 @@ export const resolveBuildExecutionEnvironment = async (input) => {
     let validatedDuringResolution = false;
     try {
         try {
-            environment = resolveValidatedEnvironment(input.project, input.agent, input.target, input.model ?? null, profileRevision, input.pinnedEnvironmentId, input.pinnedEnvironmentRevision, input.pinnedEnvironmentValidationFingerprint);
+            environment = resolveValidatedEnvironment(input.project, input.agent, input.target, input.model ?? null, profileRevision, input.workload, input.pinnedEnvironmentId, input.pinnedEnvironmentRevision, input.pinnedEnvironmentValidationFingerprint);
         }
         catch (error) {
             if (error instanceof BuildExecutionEnvironmentFailure
                 && error.code === 'environment_missing'
-                && !input.pinnedEnvironmentId) {
+                && !input.pinnedEnvironmentId
+                && input.workload !== 'check') {
                 const requestedProvider = input.agent === 'opencode' ? getModelProvider(input.model) : 'anthropic';
                 try {
                     await prepareAndValidateExecutionEnvironmentForTarget({
@@ -424,6 +584,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
                         initiatedBy: 'automation',
                         signal: input.signal,
                         profileRevision,
+                        workload: input.workload,
                     }, {
                         adapter: dependencies.adapter,
                         runtimeController: dependencies.runtimeController,
@@ -434,7 +595,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
                 catch (preparationError) {
                     throw new BuildExecutionEnvironmentFailure('validation_stale', `The exact ticket Build target could not be prepared for Docker Sandbox execution.${describePreparationFailure(preparationError)}`, 'Review the reported Docker Sandbox preparation failure, resolve it, then retry Build.', { cause: preparationError });
                 }
-                environment = resolveValidatedEnvironment(input.project, input.agent, input.target, input.model ?? null, profileRevision, input.pinnedEnvironmentId, input.pinnedEnvironmentRevision, input.pinnedEnvironmentValidationFingerprint);
+                environment = resolveValidatedEnvironment(input.project, input.agent, input.target, input.model ?? null, profileRevision, input.workload, input.pinnedEnvironmentId, input.pinnedEnvironmentRevision, input.pinnedEnvironmentValidationFingerprint);
             }
             else if (!shouldRetryValidation(error)) {
                 throw error;
@@ -454,6 +615,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
                         signal: input.signal,
                         dependencies,
                         profileRevision,
+                        workload: input.workload,
                     });
                     validatedDuringResolution = true;
                 }
@@ -463,7 +625,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
                     }
                     throw new BuildExecutionEnvironmentFailure('validation_stale', 'The Docker Sandbox provider preflight failed before Build could start.', `Resolve ${input.agent} authentication and provider access, then retry Build.`, { cause: validationError });
                 }
-                environment = resolveValidatedEnvironment(input.project, input.agent, input.target, input.model ?? null, profileRevision, input.pinnedEnvironmentId, input.pinnedEnvironmentRevision, input.pinnedEnvironmentValidationFingerprint);
+                environment = resolveValidatedEnvironment(input.project, input.agent, input.target, input.model ?? null, profileRevision, input.workload, input.pinnedEnvironmentId, input.pinnedEnvironmentRevision, input.pinnedEnvironmentValidationFingerprint);
             }
         }
     }
@@ -476,7 +638,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
             || environment.environment_validation_fingerprint !== input.pinnedEnvironmentValidationFingerprint)) {
         throw new BuildExecutionEnvironmentFailure('environment_identity_invalid', 'The resolved Docker Sandbox does not match the historical environment lineage.', 'Restore the exact historical environment or retry as a fresh Build.');
     }
-    if (!validatedDuringResolution) {
+    if (!validatedDuringResolution && input.workload !== 'check') {
         try {
             await validateBuildProvider({
                 project: input.project,
@@ -487,29 +649,46 @@ export const resolveBuildExecutionEnvironment = async (input) => {
                 signal: input.signal,
                 dependencies,
                 profileRevision,
+                workload: input.workload,
             });
         }
         catch (error) {
             return resolveFallback(new BuildExecutionEnvironmentFailure('validation_stale', 'The Docker Sandbox provider preflight could not refresh credential and destination evidence before Build.', `Resolve ${input.agent} authentication and provider access, then retry Build.`, { cause: error }));
         }
     }
-    const validation = getLatestValidation(input.project.id, environment.id, input.agent, modelProvider);
+    const validation = getLatestValidation(input.project.id, environment.id, input.agent, modelProvider, input.workload);
     const credentialCapability = validation
-        ? getValidationCredentialCapability(input.project.id, environment.id, validation.id)
+        ? getValidationCredentialCapability(input.project.id, environment.id, validation.id, input.workload)
         : null;
     const authority = createAuthority(environment, input.agent, resolveEnvironmentCredentialEvidence({
         profileRevision,
         agent: input.agent,
         modelProvider,
         credentialCapability,
+        workload: input.workload,
     }));
     try {
-        acquireExecutionEnvironmentLease({
-            projectId: input.project.id,
-            environmentId: environment.id,
-            executionRunId: input.executionRunId,
-            authority,
-        });
+        const existingBinding = getExecutionEnvironmentBindingForRun(input.project.id, input.executionRunId);
+        if (existingBinding?.released_at === null) {
+            const existingAuthority = existingBinding.authority_json
+                ? JSON.parse(existingBinding.authority_json)
+                : null;
+            if (existingBinding.environment_id !== environment.id
+                || existingBinding.environment_revision !== environment.environment_revision
+                || existingBinding.environment_validation_fingerprint !== environment.environment_validation_fingerprint
+                || existingBinding.execution_profile_fingerprint !== environment.execution_profile_fingerprint
+                || !isDeepStrictEqual(existingAuthority, authority)) {
+                throw new Error('The retained execution environment lease does not match current authority');
+            }
+        }
+        else {
+            acquireExecutionEnvironmentLease({
+                projectId: input.project.id,
+                environmentId: environment.id,
+                executionRunId: input.executionRunId,
+                authority,
+            });
+        }
     }
     catch (error) {
         return resolveFallback(new BuildExecutionEnvironmentFailure('environment_leased', 'The selected Docker Sandbox is already leased by another run.', 'Wait for the active Build or reconciliation to release the environment.', { cause: error }));
@@ -584,6 +763,16 @@ export const resolveBuildExecutionEnvironment = async (input) => {
     try {
         await ensureDockerSandboxRuntimeReady(dependencies, input.signal);
         await reconnectAndInspectDockerSandbox(environment, dependencies, input.signal);
+        if (environment.lifecycle_state === 'stopped') {
+            transitionExecutionEnvironment({
+                projectId: input.project.id,
+                environmentId: environment.id,
+                state: 'ready',
+                eventType: 'environment_execution_reconnected',
+                message: 'Docker Sandbox was reconnected for workload execution.',
+                metadata: { executionRunId: input.executionRunId },
+            });
+        }
     }
     catch (error) {
         if (input.signal?.aborted) {
@@ -721,6 +910,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
             environment,
             credentialCapability,
             networkEvidence,
+            workload: input.workload,
         });
     }
     catch (error) {
@@ -744,6 +934,7 @@ export const resolveBuildExecutionEnvironment = async (input) => {
         binding: {
             environmentId: environment.id,
             environmentRevision: environment.environment_revision,
+            providerVersion: environment.provider_version,
             executionRunId: input.executionRunId,
             target: input.target,
             sandbox: expected,
@@ -766,12 +957,14 @@ export const resolveBuildExecutionEnvironment = async (input) => {
                     return null;
                 }
                 try {
-                    captureExecutionEnvironmentPlacement({
-                        projectId: input.project.id,
-                        environmentId: environment.id,
-                        executionRunId: input.executionRunId,
-                        placement,
-                    });
+                    if (placement.executionRunId === input.executionRunId) {
+                        captureExecutionEnvironmentPlacement({
+                            projectId: input.project.id,
+                            environmentId: environment.id,
+                            executionRunId: input.executionRunId,
+                            placement,
+                        });
+                    }
                     transitionExecutionEnvironment({
                         projectId: input.project.id,
                         environmentId: environment.id,
@@ -816,4 +1009,5 @@ export const resolveBuildExecutionEnvironment = async (input) => {
         release,
     };
 };
+export const resolveBuildExecutionEnvironment = (input) => resolveWorkloadExecutionEnvironment({ ...input, workload: 'build' });
 //# sourceMappingURL=buildExecutionEnvironment.js.map