@tokenfactory/acc-runner 0.42.0 → 0.43.0

package/dist/serve-scope/index.d.ts

@@ -0,0 +1,130 @@
+/**
+ * AX-H2 (SERVE-SCOPE-CONSENT): the machine's own half of the consent.
+ * AUTH_APPROVAL_BRIEF.md §7.2, Phase H, gap G-18.
+ *
+ * `acc-runner serve-scope` is where the person sitting at the machine decides
+ * whether it serves only their work or the whole org's. That placement is the
+ * point, not a convenience: the thing being consented to — this laptop's gh
+ * credential, git identity and Claude subscription — is in front of them, and
+ * migration 0314 §5 will only accept the answer from the machine's bound owner
+ * anyway. A web form an admin could fill in on their behalf would be a checkbox,
+ * not a consent.
+ *
+ * THREE RULES THIS MODULE ENFORCES ON ITS CALLERS
+ * ----------------------------------------------------------------------------
+ *  1. WIDENING IS NEVER SILENT. {@link planServeScopeChange} refuses to widen to
+ *     `org` unless the caller passed an explicit confirmation. `--yes` is
+ *     accepted for scripted enrolment, but the DEFAULT of a bare
+ *     `acc-runner serve-scope org` is a refusal with the consequences printed,
+ *     not a shrug-and-apply.
+ *  2. NARROWING IS ALWAYS ALLOWED. Revoking needs no confirmation and no flag.
+ *     Withdrawal must never be harder than the grant — that asymmetry is
+ *     deliberate and it matches 0314 §5's server-side rule.
+ *  3. THE SERVER IS THE GATE. Everything here is a convenience over
+ *     `acc.set_runner_serve_scope`, which re-checks ownership in the database.
+ *     A refusal printed by this file is courtesy; a refusal from the RPC is
+ *     security.
+ *
+ * The command is fully injectable (transport / stdout / confirm) so the whole
+ * decision tree is asserted with no network, no keychain and no database.
+ */
+/** The vocabulary, mirroring `acc.runner_serve_scopes()` (0314 §2). */
+export declare const SERVE_SCOPES: readonly ["owner", "org"];
+export type ServeScope = (typeof SERVE_SCOPES)[number];
+/** What a machine is until somebody decides otherwise. */
+export declare const DEFAULT_SERVE_SCOPE: ServeScope;
+/** The RPC surface this module needs — a supabase-js client satisfies it. */
+export interface ServeScopeTransport {
+    rpc(fn: string, args: Record<string, unknown>): PromiseLike<{
+        data?: unknown;
+        error?: {
+            message: string;
+        } | null;
+    }>;
+}
+/**
+ * True when a PostgREST error means "migration 0314 is not applied here yet"
+ * rather than a genuine fault. The HALT-before-apply rule guarantees this window
+ * exists on every environment between merge and promotion, and the two cases
+ * have different remedies — "a human runs psql" versus "something is broken".
+ * PostgREST reports an unknown column as 42703 and an unknown relation as 42P01;
+ * the message check is the belt for clients that do not surface the code.
+ */
+export declare function isMigrationPending(error: unknown): boolean;
+/** The row shape `acc.runners` hands back for this machine. */
+export interface ServeScopeRunnerRow {
+    id: string;
+    machine?: string | null;
+    bound_user_id?: string | null;
+    serve_scope?: unknown;
+    serve_scope_source?: unknown;
+    serve_scope_consent_at?: string | null;
+}
+/** Narrow an unknown to a ServeScope, or null when it is not one. */
+export declare function parseServeScope(value: unknown): ServeScope | null;
+/**
+ * The scope to treat a row as having. Anything unreadable folds to `owner`, NOT
+ * to `org`: an unreadable consent is an ungiven consent. The fold direction is
+ * the safety property — a CLI talking to a server that predates migration 0314
+ * (no column, `undefined`) must report owner-only rather than invent agreement.
+ */
+export declare function serveScopeOf(value: unknown): ServeScope;
+/** What one `serve-scope` invocation should do, before anything is sent. */
+export type ServeScopePlan = 
+/** Print the current posture; no write. */
+{
+    action: "show";
+}
+/** Widening was asked for without confirmation — refuse and explain. */
+ | {
+    action: "refuse";
+    reason: string;
+}
+/** Already there. Still sent, so the re-affirmation is recorded (0314 §5). */
+ | {
+    action: "reaffirm";
+    scope: ServeScope;
+} | {
+    action: "grant";
+    scope: "org";
+} | {
+    action: "revoke";
+    scope: "owner";
+};
+export interface ServeScopeChangeInput {
+    /** The scope the operator asked for. Absent ⇒ show. */
+    requested?: string | null;
+    /** The machine's current scope, as the server reports it. */
+    current: ServeScope;
+    /** The operator passed --yes (or answered an interactive prompt). */
+    confirmed?: boolean;
+    /** True when the signed-in session owns this machine. */
+    viewerIsOwner: boolean;
+}
+/**
+ * The whole decision tree, as a pure function. Ordered most-refusing first, so a
+ * case that falls through has been considered rather than defaulted into.
+ */
+export declare function planServeScopeChange(input: ServeScopeChangeInput): ServeScopePlan;
+/** What the RPC hands back (0314 §5's RETURNS TABLE). */
+export interface ServeScopeResult {
+    runner_id: string;
+    serve_scope: ServeScope;
+    previous_scope: ServeScope | null;
+    decision: string;
+    consent_at: string | null;
+}
+/**
+ * Send one decision. Thin by design: the argument names are the RPC's, so a
+ * signature change is a compile-time break here rather than a runtime error on
+ * somebody's laptop.
+ */
+export declare function submitServeScope(transport: ServeScopeTransport, args: {
+    runnerId: string;
+    scope: ServeScope;
+    reason?: string | null;
+    source?: string;
+}): Promise<ServeScopeResult>;
+/** The one-line posture a person reads at the terminal. */
+export declare function describeServeScope(row: ServeScopeRunnerRow): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/serve-scope/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/serve-scope/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,uEAAuE;AACvE,eAAO,MAAM,YAAY,2BAA4B,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,EAAE,UAAoB,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEvD;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc;AACxB,2CAA2C;AACzC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB,wEAAwE;GACtE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACtC,8EAA8E;GAC5E;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,OAAO,EAAE,UAAU,CAAC;IACpB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,cAAc,CAkCjF;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,mBAAmB,EAC9B,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrF,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAUnE"}

package/dist/serve-scope/index.js

@@ -0,0 +1,148 @@
+/**
+ * AX-H2 (SERVE-SCOPE-CONSENT): the machine's own half of the consent.
+ * AUTH_APPROVAL_BRIEF.md §7.2, Phase H, gap G-18.
+ *
+ * `acc-runner serve-scope` is where the person sitting at the machine decides
+ * whether it serves only their work or the whole org's. That placement is the
+ * point, not a convenience: the thing being consented to — this laptop's gh
+ * credential, git identity and Claude subscription — is in front of them, and
+ * migration 0314 §5 will only accept the answer from the machine's bound owner
+ * anyway. A web form an admin could fill in on their behalf would be a checkbox,
+ * not a consent.
+ *
+ * THREE RULES THIS MODULE ENFORCES ON ITS CALLERS
+ * ----------------------------------------------------------------------------
+ *  1. WIDENING IS NEVER SILENT. {@link planServeScopeChange} refuses to widen to
+ *     `org` unless the caller passed an explicit confirmation. `--yes` is
+ *     accepted for scripted enrolment, but the DEFAULT of a bare
+ *     `acc-runner serve-scope org` is a refusal with the consequences printed,
+ *     not a shrug-and-apply.
+ *  2. NARROWING IS ALWAYS ALLOWED. Revoking needs no confirmation and no flag.
+ *     Withdrawal must never be harder than the grant — that asymmetry is
+ *     deliberate and it matches 0314 §5's server-side rule.
+ *  3. THE SERVER IS THE GATE. Everything here is a convenience over
+ *     `acc.set_runner_serve_scope`, which re-checks ownership in the database.
+ *     A refusal printed by this file is courtesy; a refusal from the RPC is
+ *     security.
+ *
+ * The command is fully injectable (transport / stdout / confirm) so the whole
+ * decision tree is asserted with no network, no keychain and no database.
+ */
+/** The vocabulary, mirroring `acc.runner_serve_scopes()` (0314 §2). */
+export const SERVE_SCOPES = ["owner", "org"];
+/** What a machine is until somebody decides otherwise. */
+export const DEFAULT_SERVE_SCOPE = "owner";
+/**
+ * True when a PostgREST error means "migration 0314 is not applied here yet"
+ * rather than a genuine fault. The HALT-before-apply rule guarantees this window
+ * exists on every environment between merge and promotion, and the two cases
+ * have different remedies — "a human runs psql" versus "something is broken".
+ * PostgREST reports an unknown column as 42703 and an unknown relation as 42P01;
+ * the message check is the belt for clients that do not surface the code.
+ */
+export function isMigrationPending(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const e = error;
+    if (e.code === "42703" || e.code === "42P01" || e.code === "PGRST204")
+        return true;
+    const msg = typeof e.message === "string" ? e.message.toLowerCase() : "";
+    return (msg.includes("serve_scope") &&
+        (msg.includes("does not exist") ||
+            msg.includes("could not find") ||
+            msg.includes("schema cache")));
+}
+/** Narrow an unknown to a ServeScope, or null when it is not one. */
+export function parseServeScope(value) {
+    if (typeof value !== "string")
+        return null;
+    const v = value.trim().toLowerCase();
+    // The two spellings a person actually types at a terminal.
+    if (v === "owner-only" || v === "owner_only" || v === "me")
+        return "owner";
+    if (v === "org-wide" || v === "org_wide" || v === "team")
+        return "org";
+    return SERVE_SCOPES.includes(v) ? v : null;
+}
+/**
+ * The scope to treat a row as having. Anything unreadable folds to `owner`, NOT
+ * to `org`: an unreadable consent is an ungiven consent. The fold direction is
+ * the safety property — a CLI talking to a server that predates migration 0314
+ * (no column, `undefined`) must report owner-only rather than invent agreement.
+ */
+export function serveScopeOf(value) {
+    return parseServeScope(value) ?? DEFAULT_SERVE_SCOPE;
+}
+/**
+ * The whole decision tree, as a pure function. Ordered most-refusing first, so a
+ * case that falls through has been considered rather than defaulted into.
+ */
+export function planServeScopeChange(input) {
+    const requested = input.requested == null ? null : parseServeScope(input.requested);
+    if (input.requested != null && requested == null) {
+        return {
+            action: "refuse",
+            reason: `unknown serve scope "${input.requested}" — expected "owner" or "org"`,
+        };
+    }
+    if (requested == null)
+        return { action: "show" };
+    if (requested === "org") {
+        if (!input.viewerIsOwner) {
+            return {
+                action: "refuse",
+                reason: "only this machine's owner can consent to serving the whole org — sign in as the owner on this machine (`acc-runner login`)",
+            };
+        }
+        if (!input.confirmed) {
+            return {
+                action: "refuse",
+                reason: "org-wide serving lends this machine's gh credential, git identity and Claude subscription to everyone in the org. " +
+                    "Re-run with --yes to consent, or leave it owner-only.",
+            };
+        }
+        return input.current === "org" ? { action: "reaffirm", scope: "org" } : { action: "grant", scope: "org" };
+    }
+    // Narrowing. No confirmation, no flag, no owner check beyond what the server
+    // does — withdrawal must never be harder than the grant.
+    return input.current === "owner"
+        ? { action: "reaffirm", scope: "owner" }
+        : { action: "revoke", scope: "owner" };
+}
+/**
+ * Send one decision. Thin by design: the argument names are the RPC's, so a
+ * signature change is a compile-time break here rather than a runtime error on
+ * somebody's laptop.
+ */
+export async function submitServeScope(transport, args) {
+    const { data, error } = await transport.rpc("set_runner_serve_scope", {
+        p_runner_id: args.runnerId,
+        p_scope: args.scope,
+        p_reason: args.reason ?? null,
+        p_source: args.source ?? "cli",
+    });
+    if (error) {
+        throw new Error(`serve-scope update refused: ${error.message}`);
+    }
+    const row = Array.isArray(data) ? data[0] : undefined;
+    return {
+        runner_id: typeof row?.runner_id === "string" ? row.runner_id : args.runnerId,
+        serve_scope: serveScopeOf(row?.serve_scope),
+        previous_scope: parseServeScope(row?.previous_scope),
+        decision: typeof row?.decision === "string" ? row.decision : "unknown",
+        consent_at: typeof row?.consent_at === "string" ? row.consent_at : null,
+    };
+}
+/** The one-line posture a person reads at the terminal. */
+export function describeServeScope(row) {
+    const scope = serveScopeOf(row.serve_scope);
+    const machine = row.machine ?? row.id;
+    if (scope === "org") {
+        const consented = row.serve_scope_source === "owner_consent";
+        return consented
+            ? `${machine}: serving the WHOLE ORG — consented${row.serve_scope_consent_at ? ` ${row.serve_scope_consent_at.slice(0, 10)}` : ""}.`
+            : `${machine}: serving the WHOLE ORG — carried over from before consent was recorded, never explicitly agreed.`;
+    }
+    return `${machine}: serving its OWNER ONLY. Other people's tasks are not dispatched here.`;
+}
+//# sourceMappingURL=index.js.map

package/dist/serve-scope/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/serve-scope/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,KAAK,CAAU,CAAC;AAGtD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAe,OAAO,CAAC;AAUvD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAA8C,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3B,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC;AAYD,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,2DAA2D;IAC3D,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC3E,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,OAAQ,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;AACvD,CAAC;AAwBD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA4B;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,wBAAwB,KAAK,CAAC,SAAS,+BAA+B;SAC/E,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EACJ,4HAA4H;aAC/H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EACJ,oHAAoH;oBACpH,uDAAuD;aAC1D,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5G,CAAC;IAED,6EAA6E;IAC7E,yDAAyD;IACzD,OAAO,KAAK,CAAC,OAAO,KAAK,OAAO;QAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;QACxC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAA8B,EAC9B,IAAsF;IAEtF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,wBAAwB,EAAE;QACpE,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;KAC/B,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,OAAO;QACL,SAAS,EAAE,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;QAC7E,WAAW,EAAE,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC;QAC3C,cAAc,EAAE,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC;QACpD,QAAQ,EAAE,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,GAAwB;IACzD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,KAAK,eAAe,CAAC;QAC7D,OAAO,SAAS;YACd,CAAC,CAAC,GAAG,OAAO,sCAAsC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;YACpI,CAAC,CAAC,GAAG,OAAO,mGAAmG,CAAC;IACpH,CAAC;IACD,OAAO,GAAG,OAAO,yEAAyE,CAAC;AAC7F,CAAC"}

package/dist/task-runner.d.ts

@@ -13,6 +13,7 @@ import { type ConflictResolutionDeps } from "./runtime/conflict-resolver.js";
 import { type ReconcileResult, type ReconcileReworkOptions } from "./runtime/rework.js";
 import { type AssertResolutionOptions, type ResolutionIntegrityDeps, type ResolutionIntegrityResult } from "./runtime/resolution-integrity.js";
 import { type PreprGateResult } from "./prepr-gate.js";
+import { type SeqGuardOptions, type SeqGuardResult } from "./migration-seq-guard.js";
 import type { RunnerSupabaseClient } from "./supabase.js";
 export interface CostEventPayload extends NormalizedUsage {
     task_id: string;
@@ -191,6 +192,16 @@ export interface RunTaskDeps {
      * tests inject a stub so the rework path doesn't shell out to a real merge.
      */
     reconcileReworkBranch?: (opts: ReconcileReworkOptions) => Promise<ReconcileResult>;
+    /**
+     * MIG-SEQ-GUARD: re-validate this branch's NEW migration sequence against a
+     * FRESHLY-FETCHED integration head immediately before push, and auto-renumber
+     * it when a sibling migration merged and took the number since this worktree
+     * forked. Runs on BOTH push paths (fresh + rework). Defaults to
+     * `revalidateMigrationSeq`; tests inject a stub so the unit suite never
+     * fetches. Fail-open — it can only ever turn a PR CI would reject into one it
+     * accepts, never block a push.
+     */
+    revalidateMigrationSeq?: (workdir: string, opts: SeqGuardOptions) => Promise<SeqGuardResult>;
 }
 export interface RunTaskController {
     taskId: string;

package/dist/task-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-runner.d.ts","sourceRoot":"","sources":["../src/task-runner.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAAsE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACxI,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEzD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAI1D,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,OAAO,EAAK,MAAM,CAAC;IACnB,KAAK,EAAO,MAAM,CAAC;IACnB,SAAS,EAAG,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd;;;;;;;oDAOgD;IAChD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,iBAAiB,CAAC;IACnE;;;;0CAIsC;IACtC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,uBAAuB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,KAC3B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9F;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,uBAAuB,GACvB,OAAO,GAIP,OAAO,GACP,eAAe,GACf,KAAK,GACL,aAAa,GAKb,YAAY,GACZ,MAAM,GAIN,QAAQ,GAIR,YAAY,GAMZ,iBAAiB,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;qCAEiC;IACjC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAYD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA+B3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhD;AAsBD,iFAAiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AA0ElE;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpB,GACL,OAAO,CAAC,wBAAwB,CAAC,CAkEnC;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,EACjC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BnB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAkBD,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAEzF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD;AAED,MAAM,WAAW,yBAAyB;IACxC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,yBAAyB,CAgB9E;AA6DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM3E;AA8ED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,gBAAgB,CAWlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB/E;AA+KD,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,GAChB,iBAAiB,CAi4DnB"}
+{"version":3,"file":"task-runner.d.ts","sourceRoot":"","sources":["../src/task-runner.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAAsE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACxI,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEzD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAI1D,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,OAAO,EAAK,MAAM,CAAC;IACnB,KAAK,EAAO,MAAM,CAAC;IACnB,SAAS,EAAG,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd;;;;;;;oDAOgD;IAChD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,iBAAiB,CAAC;IACnE;;;;0CAIsC;IACtC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,uBAAuB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,KAC3B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9F;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACnF;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,eAAe,KAClB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,uBAAuB,GACvB,OAAO,GAIP,OAAO,GACP,eAAe,GACf,KAAK,GACL,aAAa,GAKb,YAAY,GACZ,MAAM,GAIN,QAAQ,GAIR,YAAY,GAMZ,iBAAiB,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;qCAEiC;IACjC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAYD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA+B3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhD;AAsBD,iFAAiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AA0ElE;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpB,GACL,OAAO,CAAC,wBAAwB,CAAC,CAkEnC;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,EACjC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BnB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAkBD,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAEzF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD;AAED,MAAM,WAAW,yBAAyB;IACxC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,yBAAyB,CAgB9E;AA6DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM3E;AA8ED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,gBAAgB,CAWlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB/E;AA+KD,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,GAChB,iBAAiB,CA08DnB"}

package/dist/task-runner.js

@@ -46,6 +46,7 @@ import { parseConflictMeta, resolveConflict, MAX_CONFLICT_ATTEMPTS, } from "./ru
 import { parseReworkMeta, renderReworkPrompt, reconcileReworkBranch as defaultReconcileReworkBranch, fetchPrHeadRef as defaultFetchPrHeadRef, } from "./runtime/rework.js";
 import { assertResolutionIntegrity, isConflictResolutionTask, summariseFailures, } from "./runtime/resolution-integrity.js";
 import { runPreprGate as defaultRunPreprGate, } from "./prepr-gate.js";
+import { revalidateMigrationSeq as defaultRevalidateMigrationSeq, } from "./migration-seq-guard.js";
 import { commitGuardSkipRequested, gitConfigHooksEnv, installCommitGuardSync, } from "./commit-guard.js";
 import { readLiveAllowedGlobs } from "./locks/index.js";
 const LOG_BATCH_BYTES = 4 * 1024;
@@ -727,6 +728,8 @@ export function runTask(taskId, deps) {
     const runPreprGate = deps.runPreprGate ??
         ((workdir, baseRef) => defaultRunPreprGate(workdir, { baseRef }));
     const reconcileRework = deps.reconcileReworkBranch ?? defaultReconcileReworkBranch;
+    const revalidateSeq = deps.revalidateMigrationSeq ??
+        ((workdir, opts) => defaultRevalidateMigrationSeq(workdir, opts));
     // FU-9: default seeds the worktree from the warm parent clone (see
     // ensureWorktreeNodeModules); logs via the runner's stderr so a doctor can see it.
     const ensureWorktreeDeps = deps.ensureWorktreeDeps ??
@@ -1318,6 +1321,62 @@ export function runTask(taskId, deps) {
                     error: `conflict-resolution integrity guardrail rejected resolution (${summary})`,
                 };
             };
+            /**
+             * MIG-SEQ-GUARD: last thing before `git push`, re-validate this branch's
+             * NEW migration seq against a FRESHLY-FETCHED integration head. The seq was
+             * chosen at worktree-fork time; by push time a sibling migration may have
+             * merged and taken it, and until now that only surfaced as a migration-lint
+             * failure on the PR — a whole run spent on a rename the runner can do
+             * itself. When the number is gone the migration is renumbered to the next
+             * free contiguous seq (filename + self-record + verify messages + every
+             * test that reads it by path) and committed, so the push carries the fix.
+             *
+             * Never blocks: the guard is fail-open by construction and this returns
+             * void. A renumber emits `migration.seq_renumbered` so the move is visible
+             * on the History tab rather than being a silent rewrite.
+             */
+            const runMigrationSeqGuard = async (rework) => {
+                let result;
+                try {
+                    result = await revalidateSeq(workdir, {
+                        integrationBranch,
+                        baseRef: resolvedBaseRef,
+                        remote: "origin",
+                    });
+                }
+                catch (err) {
+                    // The guard already fails open internally; this catches a stub/dep that
+                    // throws so a seq check can never be the reason a push does not happen.
+                    process.stderr.write(`[acc-runner] migration seq guard crashed (push proceeds): ` +
+                        `${err.message?.slice(0, 200)}\n`);
+                    return;
+                }
+                if (!result.renumbered || !result.move) {
+                    // Quiet on the no-op path — the overwhelming majority of pushes touch
+                    // no migration at all, and an event per push would be pure noise.
+                    if (result.skipped && result.skipped !== "no-new-migrations") {
+                        process.stderr.write(`[acc-runner] migration seq guard: ${result.detail}\n`);
+                    }
+                    return;
+                }
+                await appendEvent(deps.supabase, taskId, "log", {
+                    phase: "push",
+                    stream: "stdout",
+                    event: "migration.seq_renumbered",
+                    branch,
+                    rework,
+                    integration_branch: integrationBranch,
+                    from_seq: result.move.fromSeq,
+                    to_seq: result.move.toSeq,
+                    file: result.move.file,
+                    new_file: result.move.newFile,
+                    remote_max_seq: result.remoteMaxSeq ?? null,
+                    message: result.detail,
+                    renumber_output: result.move.output,
+                    runner_id: deps.session.runnerId,
+                });
+                process.stderr.write(`[acc-runner] migration seq guard: ${result.detail}\n`);
+            };
             try {
                 // POOL-P1b: clone-on-demand source provisioning. When the flag is on and
                 // repoPath resolved to the per-repo cache path above, clone the task's
@@ -2166,6 +2225,11 @@ export function runTask(taskId, deps) {
                             return { taskId, status: "failed", phase: "push", error: msg };
                         }
                     }
+                    // MIG-SEQ-GUARD: after the no-advance check (which compares heads) and
+                    // immediately before the push, so the freshest possible integration head
+                    // decides the seq. A renumber adds a commit, which is also what makes the
+                    // advance check above meaningful on a rework that only moved a number.
+                    await runMigrationSeqGuard(true);
                     try {
                         await git.push(workdir, branch);
                     }
@@ -2325,6 +2389,11 @@ export function runTask(taskId, deps) {
                         runner_id: deps.session.runnerId,
                     });
                 }
+                // MIG-SEQ-GUARD: the LAST thing before the push. It deliberately runs
+                // after the pre-PR gate rather than inside it — the gate's own MIGFIX-01
+                // renumber reads the fork-time worktree snapshot, and only a fresh fetch
+                // here can see a sibling that merged while the gate was running.
+                await runMigrationSeqGuard(false);
                 // 5. Push + open PR. Both run from the worktree so the operator's
                 // shared clone never has the task branch checked out.
                 let prUrl = "";