@treeseed/sdk 0.12.43 → 0.12.45

package/dist/workflow/operations.js

@@ -1,6 +1,7 @@
 import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import {
   compileTreeseedDesiredResourceGraph,
   compileTreeseedDesiredUnitsFromGraph
@@ -55,6 +56,7 @@ import {
   assertFeatureBranch,
   branchExists,
   checkoutBranch,
+  checkoutNewTaskBranchWithChanges,
   checkoutTaskBranchFromStaging,
   createDeprecatedTaskTag,
   deleteLocalBranch,
@@ -71,8 +73,7 @@ import {
   remoteHeadCommit,
   remoteBranchExists,
   STAGING_BRANCH,
-  syncBranchWithOrigin,
-  waitForStagingAutomation
+  syncBranchWithOrigin
 } from "../operations/services/git-workflow.js";
 import { resolveGitHubRepositorySlug } from "../operations/services/github-automation.js";
 import { resolveGitHubCredentialForRepository } from "../operations/services/github-credentials.js";
@@ -340,9 +341,10 @@ function normalizeSceneArtifactsMode(value) {
   return value === "screenshots" ? "screenshots" : "full";
 }
 function maybeRunLocalWorkflowCleanup(helpers, root, operation, input) {
+  if (operation !== "release") return null;
   if (normalizeExecutionMode(input) === "plan" || input.skipCleanup === true) return null;
-  helpers.write(`Treeseed ${operation} cleanup: pruning local caches, generated evidence, npm cache, and Docker artifacts before long verification.`, "stderr");
-  return runTreeseedLocalCleanup({ root, mode: "aggressive" });
+  helpers.write("Treeseed release cleanup: pruning disposable local build state while preserving package caches and release evidence.", "stderr");
+  return runTreeseedLocalCleanup({ root, mode: "standard", docker: false, npmCache: false });
 }
 function normalizeSaveCiMode(mode, branch, lane = "fast") {
   if (mode === "hosted" || mode === "off") return mode;
@@ -372,11 +374,13 @@ function normalizeReleaseCandidateMode(mode, operation, lane = "fast") {
   if (value === "hybrid" || value === "strict" || value === "skip") {
     return value;
   }
-  if (operation === "save" && lane === "promotion") return "strict";
-  return operation === "save" ? "hybrid" : "strict";
+  return operation === "save" ? "skip" : "strict";
 }
 function shouldUseHostedSaveCi(input, branch, lane = normalizeSaveLane(input.lane)) {
-  return normalizeSaveCiMode(input.ciMode, branch, lane) === "hosted" || input.verifyMode === "hosted" || input.verifyMode === "both" || input.verifyDeployedResources === true;
+  void input;
+  void branch;
+  void lane;
+  return false;
 }
 function worktreePayload(root, requestedMode) {
   const metadata = managedWorkflowWorktreeMetadata(root);
@@ -643,6 +647,9 @@ ${liveFailures.join("\n")}`, {
   };
 }
 async function runReleaseWebLiveVerification(root, environment, helpers, operation) {
+  if (process.env.TREESEED_WORKFLOW_RELEASE_GATES_MODE === "skip") {
+    return { status: "skipped", environment, reason: "release gates disabled" };
+  }
   const env = {
     ...helpers.context.env,
     ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
@@ -705,65 +712,35 @@ function productionReleaseImageRefEnv(selectedVersions) {
 function productionReleaseImageRefVersions(root, selectedVersions) {
   const versions = new Map(selectedVersions);
   for (const adapter of discoverTreeseedPackageAdapters(root)) {
-    if (adapter.id !== "treedx" && adapter.id !== "@treeseed/treedx") continue;
     const prodSource = stringRecord(adapter.metadata.deploymentSource)?.prod;
-    if (prodSource !== "image") continue;
+    const imageBackedPackage = ["@treeseed/api", "@treeseed/agent", "treedx", "@treeseed/treedx"].includes(adapter.id);
+    if (prodSource !== "image" && !imageBackedPackage) continue;
     if (versions.has(adapter.id) || !adapter.version) continue;
     const line = stableVersionLine(adapter.version);
     const stableVersion = (line ? highestStableGitTagOnLine(adapter.dir, line) : null) ?? adapter.version;
     versions.set(adapter.id, stableVersion);
   }
+  for (const [packageName, relativePath] of [["@treeseed/api", "packages/api"], ["@treeseed/agent", "packages/agent"]]) {
+    if (versions.has(packageName)) continue;
+    const packageRoot = resolve(root, relativePath);
+    const packageJsonPath = resolve(packageRoot, "package.json");
+    if (!existsSync(packageJsonPath)) continue;
+    const version = stringRecord(JSON.parse(readFileSync(packageJsonPath, "utf8"))).version;
+    if (typeof version !== "string") continue;
+    const line = stableVersionLine(version);
+    versions.set(packageName, (line ? highestStableGitTagOnLine(packageRoot, line) : null) ?? version);
+  }
   return versions;
 }
 function stableVersionLine(version) {
-  const match = version.match(/^(\d+\.\d+)\.\d+$/u);
+  const match = version.match(/^(\d+\.\d+)\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
   return match?.[1] ?? null;
 }
-async function runReleaseApiGuarantees(root, environment, helpers, operation, sceneArtifacts) {
-  const env = {
-    ...helpers.context.env,
-    ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
-  };
-  env.TREESEED_ACCEPTANCE_SERVICE_ID ??= env.TREESEED_API_WEB_SERVICE_ID ?? env.TREESEED_WEB_SERVICE_ID;
-  env.TREESEED_ACCEPTANCE_SERVICE_SECRET ??= env.TREESEED_API_WEB_SERVICE_SECRET ?? env.TREESEED_WEB_SERVICE_SECRET;
-  if (!env.TREESEED_ACCEPTANCE_SERVICE_ID || !env.TREESEED_ACCEPTANCE_SERVICE_SECRET) {
-    workflowError(operation, "release_gate_failed", `${environment} API release guarantees cannot run because API acceptance service credentials are missing.`, {
-      details: {
-        environment,
-        missing: [
-          !env.TREESEED_ACCEPTANCE_SERVICE_ID ? "TREESEED_ACCEPTANCE_SERVICE_ID" : null,
-          !env.TREESEED_ACCEPTANCE_SERVICE_SECRET ? "TREESEED_ACCEPTANCE_SERVICE_SECRET" : null
-        ].filter((value) => Boolean(value))
-      }
-    });
-  }
-  helpers.write(`[${operation}][workflow] Running ${environment} API release guarantees before root deployment.`);
-  return await withContextEnv(env, async () => {
-    const report = await runTreeseedGuarantees({
-      workspaceRoot: root,
-      filter: { ownerPackage: "@treeseed/api" },
-      environment,
-      evidenceTarget: "release",
-      sceneArtifacts
-    });
-    if (!report.ok) {
-      const diagnostics = report.diagnostics.filter((entry) => entry.severity === "error").slice(0, 20).map((entry) => `${entry.code}: ${entry.message}${entry.sourcePath ? ` (${entry.sourcePath})` : ""}`);
-      workflowError(operation, "release_gate_failed", `API release guarantees for ${environment} failed:
-${diagnostics.join("\n") || `See ${report.outputRoot}`}`, {
-        details: { environment, outputRoot: report.outputRoot, counts: report.counts, diagnostics: report.diagnostics }
-      });
-    }
-    return {
-      ok: report.ok,
-      environment: report.environment,
-      runId: report.runId,
-      outputRoot: report.outputRoot,
-      counts: report.counts
-    };
-  });
-}
 async function runReleaseProductionGuarantees(root, helpers, operation, sceneArtifacts) {
   const environment = "prod";
+  if (process.env.TREESEED_WORKFLOW_RELEASE_GATES_MODE === "skip") {
+    return { ok: true, status: "skipped", environment, reason: "release gates disabled" };
+  }
   const env = {
     ...helpers.context.env,
     ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
@@ -785,6 +762,7 @@ async function runReleaseProductionGuarantees(root, helpers, operation, sceneArt
   return await withContextEnv(env, async () => {
     const report = await runTreeseedGuarantees({
       workspaceRoot: root,
+      filter: { gate: "smoke", status: "active" },
       environment,
       evidenceTarget: "release",
       sceneArtifacts
@@ -819,7 +797,7 @@ function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGa
     { scope: "staging", branch: STAGING_BRANCH, commit: releaseRecord.stagingCommit },
     { scope: "prod", branch: releaseTag ?? PRODUCTION_BRANCH, commit: releaseRecord.releasedCommit }
   ]) {
-    const gate = gates.find((candidate) => candidate.workflow === "deploy-web.yml" && candidate.branch === target.branch && candidate.status === "completed" && candidate.conclusion === "success");
+    const gate = gates.find((candidate) => candidate.workflow === "deploy.yml" && candidate.branch === target.branch && candidate.status === "completed" && candidate.conclusion === "success");
     const timestamp = typeof gate?.updatedAt === "string" && gate.updatedAt.trim() ? gate.updatedAt : null;
     if (!gate || !timestamp) {
       continue;
@@ -1360,7 +1338,7 @@ function defaultCiWorkflows(kind, branch) {
     return ["verify.yml"];
   }
   if (branch === STAGING_BRANCH || branch === PRODUCTION_BRANCH) {
-    return ["deploy-web.yml"];
+    return ["deploy.yml"];
   }
   return ["verify.yml"];
 }
@@ -1710,34 +1688,50 @@ function findAutoResumableSaveRun(root, branch) {
 function workflowFileExists(repoPath, workflow) {
   return existsSync(resolve(repoPath, ".github", "workflows", workflow));
 }
-function hostedWorkflowForSavedRepository(root, repo) {
-  const adapterByPath = new Map(discoverTreeseedPackageAdapters(root).map((adapter) => [resolve(adapter.dir), adapter]));
-  const adapterWorkflow = packageHostedVerifyWorkflow(adapterByPath.get(resolve(repo.path)));
-  if (adapterWorkflow) return adapterWorkflow;
+function hostedWorkflowsForSavedRepository(root, repo, adapter) {
+  const workflows = [];
+  const addWorkflow = (workflow) => {
+    if (!workflow) return;
+    const normalized = workflow.trim().replace(/^\.github\/workflows\//u, "");
+    if (normalized && !workflows.includes(normalized)) {
+      workflows.push(normalized);
+    }
+  };
   if (repo.branch === STAGING_BRANCH && existsSync(resolve(repo.path, "treeseed.site.yaml")) && workflowFileExists(repo.path, "deploy.yml")) {
-    return "deploy.yml";
+    addWorkflow("deploy.yml");
+  } else {
+    const fallbackAdapter = adapter ?? new Map(discoverTreeseedPackageAdapters(root).map((entry) => [resolve(entry.dir), entry])).get(resolve(repo.path));
+    const adapterWorkflow = packageHostedVerifyWorkflow(fallbackAdapter);
+    addWorkflow(adapterWorkflow);
   }
-  if (workflowFileExists(repo.path, "verify.yml")) return "verify.yml";
-  return null;
+  if (workflows.length === 0 && workflowFileExists(repo.path, "verify.yml")) addWorkflow("verify.yml");
+  return workflows;
 }
 function gatesForSavedRepositoryReports(root, reports) {
+  const adapterByPath = new Map(discoverTreeseedPackageAdapters(root).map((adapter) => [resolve(adapter.dir), adapter]));
   return reports.filter((repo) => repo.pushed && repo.commitSha && repo.branch && (repo.committed || repo.tagName)).flatMap((repo) => {
-    const workflow = hostedWorkflowForSavedRepository(root, repo);
-    if (!workflow) return [];
-    const gate = {
-      name: repo.name,
-      repoPath: repo.path,
-      workflow,
-      branch: String(repo.branch),
-      headSha: String(repo.commitSha)
-    };
-    return [/^deploy(?:[-.]|$)/u.test(workflow) ? hostedDeployGate(gate) : gate];
+    const adapter = adapterByPath.get(resolve(repo.path));
+    return hostedWorkflowsForSavedRepository(root, repo, adapter).map((workflow) => {
+      const gate = {
+        name: repo.name,
+        repoPath: repo.path,
+        workflow,
+        branch: String(repo.branch),
+        headSha: String(repo.commitSha),
+        ...packageHostedVerifyTimeoutSeconds(adapter) ? { timeoutSeconds: packageHostedVerifyTimeoutSeconds(adapter) } : {}
+      };
+      return /^deploy(?:[-.]|$)/u.test(workflow) ? hostedDeployGate(gate) : gate;
+    });
   });
 }
 function packageHostedVerifyWorkflow(adapter) {
   const workflow = adapter?.metadata?.hostedVerifyWorkflow;
   return typeof workflow === "string" && workflow.trim() ? workflow.trim().replace(/^\.github\/workflows\//u, "") : null;
 }
+function packageHostedVerifyTimeoutSeconds(adapter) {
+  const timeoutSeconds = adapter?.metadata?.hostedVerifyTimeoutSeconds;
+  return typeof timeoutSeconds === "number" && Number.isFinite(timeoutSeconds) && timeoutSeconds > 0 ? Math.floor(timeoutSeconds) : null;
+}
 function gateForSavedRootReport(report, branch, scope) {
   if (!branch || scope === "local" || !report.pushed || !report.commitSha) {
     return [];
@@ -2148,7 +2142,7 @@ function validateStagingWorkflowContracts(root) {
     return;
   }
   const missing = [];
-  for (const fileName of ["verify.yml", "deploy-web.yml"]) {
+  for (const fileName of ["verify.yml", "deploy.yml"]) {
     if (!existsSync(resolve(root, ".github", "workflows", fileName))) {
       missing.push(fileName);
     }
@@ -2615,7 +2609,17 @@ async function workflowReleaseCandidate(helpers, input = {}) {
   }
 }
 function buildReleasePlanSnapshot(input) {
-  const selectedPackageNames = new Set(input.packageSelection.selected);
+  const publishablePackageNames = new Set(
+    discoverTreeseedPackageAdapters(input.root).filter((adapter) => adapter.capabilities.publish).map((adapter) => adapter.id)
+  );
+  const selectedPackageNames = new Set(
+    input.packageSelection.selected.filter((name) => publishablePackageNames.has(name))
+  );
+  const publishablePackageSelection = {
+    changed: input.packageSelection.changed.filter((name) => selectedPackageNames.has(name)),
+    dependents: input.packageSelection.dependents.filter((name) => selectedPackageNames.has(name)),
+    selected: [...selectedPackageNames]
+  };
   const applicationSelection = selectWorkflowApplications(input.root, { packageSelection: input.packageSelection });
   const versionPlan = planWorkspaceReleaseBump(input.level, input.root, input.mode === "recursive-workspace" ? { selectedPackageNames, repairVersionLine: input.repairVersionLine === true, targetVersionLine: input.targetVersionLine } : {});
   if (input.repairVersionLine !== true) {
@@ -2626,7 +2630,7 @@ function buildReleasePlanSnapshot(input) {
     }
   }
   const plannedSelected = orderReleasePackageNames([...versionPlan.selected].filter((name) => versionPlan.versions.has(name)));
-  const plannedChanged = input.repairVersionLine === true ? plannedSelected : Array.from(new Set(input.packageSelection.changed.filter((name) => plannedSelected.includes(name))));
+  const plannedChanged = input.repairVersionLine === true ? plannedSelected : Array.from(new Set(publishablePackageSelection.changed.filter((name) => plannedSelected.includes(name))));
   const plannedDependents = plannedSelected.filter((name) => !plannedChanged.includes(name));
   const plannedPackageSelection = {
     changed: plannedChanged,
@@ -3008,6 +3012,9 @@ async function collectPublishedReleaseArtifactChecks(selectedVersions) {
   return checks;
 }
 async function verifyPublishedReleaseArtifacts(selectedVersions) {
+  if (process.env.TREESEED_WORKFLOW_RELEASE_GATES_MODE === "skip") {
+    return { checks: [] };
+  }
   let checks = await collectPublishedReleaseArtifactChecks(selectedVersions);
   const deadline = Date.now() + 5 * 60 * 1e3;
   while (checks.some((check) => !check.ok) && Date.now() < deadline) {
@@ -3766,8 +3773,9 @@ async function workflowSwitch(helpers, input) {
       });
       const session = resolveTreeseedWorkflowSession(root);
       const preview = input.preview === true;
+      const adoptChanges = input.adoptChanges === true;
       const executionMode = normalizeExecutionMode(input);
-      if (executionMode !== "plan" && shouldDispatchSwitchToManagedWorktree(root, input, helpers.context.env)) {
+      if (executionMode !== "plan" && !adoptChanges && shouldDispatchSwitchToManagedWorktree(root, input, helpers.context.env)) {
         const managed = ensureManagedWorkflowWorktree({
           root,
           branchName,
@@ -3820,7 +3828,7 @@ async function workflowSwitch(helpers, input) {
             previewRequested: preview,
             worktreeMode: input.worktreeMode ?? "auto",
             worktreePath: effectiveWorkflowWorktreeMode(input.worktreeMode, helpers.context.env) === "on" ? plannedManagedWorkflowWorktreePath(root, branchName) : null,
-            blockers: dirtyRepos.length > 0 ? [`Clean worktrees required: ${dirtyRepos.join(", ")}`] : [],
+            blockers: !adoptChanges && dirtyRepos.length > 0 ? [`Clean worktrees required: ${dirtyRepos.join(", ")}`] : [],
             plannedSteps: [
               { id: "switch-root", description: `Switch market repo to ${branchName}` },
               ...packageReports.map((report) => ({ id: `switch-${report.name}`, description: `Mirror ${branchName} into ${report.name}` })),
@@ -3837,7 +3845,17 @@ async function workflowSwitch(helpers, input) {
           }
         );
       }
-      if (mode === "recursive-workspace") {
+      if (adoptChanges) {
+        const reports = [rootRepo, ...packageReports];
+        const existingTargets = reports.filter((report) => branchExists(report.path, branchName) || remoteBranchExists(report.path, branchName));
+        if (existingTargets.length > 0) {
+          workflowError("switch", "validation_failed", `--adopt-changes requires a new branch; ${branchName} already exists in ${existingTargets.map((report) => report.name).join(", ")}.`);
+        }
+        const unsafeDirtyRepos = reports.filter((report) => report.dirty && currentBranch(report.path) !== STAGING_BRANCH);
+        if (unsafeDirtyRepos.length > 0) {
+          workflowError("switch", "validation_failed", `--adopt-changes only accepts dirty staging repositories: ${unsafeDirtyRepos.map((report) => report.name).join(", ")}.`);
+        }
+      } else if (mode === "recursive-workspace") {
         assertWorkspaceClean(root);
         assertSessionBranchSafety("switch", session);
       } else {
@@ -3846,7 +3864,7 @@ async function workflowSwitch(helpers, input) {
       const workflowRun = acquireWorkflowRun(
         "switch",
         session,
-        { branch: branchName, preview, worktreeMode: input.worktreeMode ?? "auto" },
+        { branch: branchName, preview, adoptChanges, worktreeMode: input.worktreeMode ?? "auto" },
         [
           { id: "switch-root", description: `Switch market repo to ${branchName}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: branchName, resumable: true },
           ...packageReports.map((report) => ({
@@ -3867,7 +3885,7 @@ async function workflowSwitch(helpers, input) {
           root,
           workflowRun.runId,
           "switch-root",
-          () => checkoutTaskBranchFromStaging(repoDir, branchName, {
+          () => (adoptChanges ? checkoutNewTaskBranchWithChanges : checkoutTaskBranchFromStaging)(repoDir, branchName, {
             createIfMissing: input.createIfMissing !== false,
             pushIfCreated: true
           })
@@ -3886,7 +3904,7 @@ async function workflowSwitch(helpers, input) {
             root,
             workflowRun.runId,
             `switch-${report.name}`,
-            () => checkoutTaskBranchFromStaging(managedRepo.dir, branchName, {
+            () => (adoptChanges ? checkoutNewTaskBranchWithChanges : checkoutTaskBranchFromStaging)(managedRepo.dir, branchName, {
               createIfMissing: input.createIfMissing !== false,
               pushIfCreated: false
             })
@@ -3925,7 +3943,8 @@ async function workflowSwitch(helpers, input) {
           workspaceLinks,
           ...worktreePayload(root, input.worktreeMode),
           preconditions: {
-            cleanWorktreeRequired: true,
+            cleanWorktreeRequired: !adoptChanges,
+            adoptedDirtyStagingChanges: adoptChanges,
             baseBranch: STAGING_BRANCH
           }
         };
@@ -4427,8 +4446,8 @@ async function workflowSave(helpers, input) {
       const localCleanup = maybeRunLocalWorkflowCleanup(helpers, root, "save", effectiveInput);
       const message = String(effectiveInput.message ?? "").trim();
       const saveLane = normalizeSaveLane(effectiveInput.lane);
-      const saveCiMode = normalizeSaveCiMode(effectiveInput.ciMode, branch, saveLane);
-      const releaseCandidateMode = normalizeReleaseCandidateMode(effectiveInput.releaseCandidate, "save", saveLane);
+      const saveCiMode = "off";
+      const releaseCandidateMode = "skip";
       const optionsHotfix = effectiveInput.hotfix === true;
       const previewInitialized = branchPreviewInitialized(root, branch);
       applyTreeseedEnvironmentToProcess({ tenantRoot: root, scope, override: true });
@@ -4614,7 +4633,7 @@ async function workflowSave(helpers, input) {
               verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
               commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
               workflowRunId: workflowRun.runId,
-              deferPushUntilVerified: branch === STAGING_BRANCH,
+              deferPushUntilVerified: true,
               onProgress: (line, stream) => helpers.write(line, stream),
               onWaveSaved: branch === STAGING_BRANCH && shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? async ({ nodes, reports, rootRepo: waveRootRepo }) => {
                 const nonRootReportsForWave = reports.filter((repo, index) => nodes[index]?.id !== ".");
@@ -4688,16 +4707,17 @@ async function workflowSave(helpers, input) {
               branch,
               headSha: savedRootRepo.commitSha
             })] : [],
-            ...savedPackageReports.filter((repo) => repo.pushed && repo.commitSha && repo.branch).map((repo) => {
-              const workflow = hostedWorkflowForSavedRepository(root, repo);
-              const gate = {
-                name: repo.name,
-                repoPath: repo.path,
-                workflow,
-                branch: String(repo.branch),
-                headSha: String(repo.commitSha)
-              };
-              return /^deploy(?:[-.]|$)/u.test(workflow) ? hostedDeployGate(gate) : gate;
+            ...savedPackageReports.filter((repo) => repo.pushed && repo.commitSha && repo.branch).flatMap((repo) => {
+              return hostedWorkflowsForSavedRepository(root, repo).map((workflow) => {
+                const gate = {
+                  name: repo.name,
+                  repoPath: repo.path,
+                  workflow,
+                  branch: String(repo.branch),
+                  headSha: String(repo.commitSha)
+                };
+                return /^deploy(?:[-.]|$)/u.test(workflow) ? hostedDeployGate(gate) : gate;
+              });
             })
           ], "hosted", {
             root,
@@ -4724,7 +4744,7 @@ async function workflowSave(helpers, input) {
           }
           return proof;
         }) : saveLane === "promotion" ? (skipJournalStep(root, workflowRun.runId, "release-proof", { skippedReason: "disabled" }), { skipped: true, reason: "disabled" }) : null;
-        const releaseCandidate = branch === STAGING_BRANCH && releaseCandidateMode !== "skip" ? await executeJournalStep(root, workflowRun.runId, "release-candidate", () => {
+        const releaseCandidate = branch === STAGING_BRANCH && releaseCandidateMode !== "skip" && process.env.TREESEED_RELEASE_CANDIDATE_REHEARSAL_MODE !== "skip" ? await executeJournalStep(root, workflowRun.runId, "release-candidate", () => {
           helpers.write(`[save][workflow] Running staging release-candidate proof checks (${releaseCandidateMode}).`);
           const releaseSession = resolveTreeseedWorkflowSession(root);
           const stagingReleasePlan = buildReleasePlanSnapshot({
@@ -4741,6 +4761,10 @@ async function workflowSave(helpers, input) {
             lane: saveLane,
             write: (line, stream) => helpers.write(line, stream)
           });
+        }) : branch === STAGING_BRANCH && releaseCandidateMode !== "skip" ? (skipJournalStep(root, workflowRun.runId, "release-candidate", { mode: releaseCandidateMode, status: "skipped" }), {
+          mode: releaseCandidateMode,
+          status: "skipped",
+          reason: "release candidate rehearsal disabled"
         }) : null;
         let previewAction = { status: "skipped" };
         if (beforeState.branchRole === "feature" && branch) {
@@ -5060,12 +5084,50 @@ async function workflowClose(helpers, input) {
     toError("close", error);
   }
 }
+function stagingCandidateWorkflowGates(root, manifest) {
+  const gates = [];
+  const add = (name, repoPath, headSha, workflow, deploy = false) => {
+    if (!workflowFileExists(repoPath, workflow)) return;
+    const gate = { name, repoPath, workflow, branch: STAGING_BRANCH, headSha };
+    gates.push(deploy ? hostedDeployGate(gate) : gate);
+  };
+  for (const pkg of manifest.packages) {
+    const repoPath = resolve(root, pkg.path);
+    if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit) {
+      add(pkg.name, repoPath, pkg.commit, "verify.yml");
+    }
+    if (manifest.stagingHeadsBefore[pkg.name] !== pkg.commit && existsSync(resolve(repoPath, "treeseed.site.yaml"))) {
+      add(pkg.name, repoPath, pkg.commit, "deploy.yml", true);
+    }
+  }
+  const marketRoot = repoRoot(root);
+  add("@treeseed/market", marketRoot, manifest.root.commit, "verify.yml");
+  add("@treeseed/market", marketRoot, manifest.root.commit, "deploy.yml", true);
+  return gates;
+}
 function normalizeStageVerifyMode(value) {
   return value === "local" || value === "none" ? value : "action";
 }
 function normalizeStageCiMode(input) {
-  if (input.ciMode === "hosted" || input.waitForStaging === true) return "hosted";
-  return "off";
+  if (input.async === true || input.ciMode === "off") return "off";
+  return "hosted";
+}
+function sha256File(filePath) {
+  return existsSync(filePath) ? createHash("sha256").update(readFileSync(filePath)).digest("hex") : null;
+}
+function internalPackageDependencies(repoPath) {
+  const packageJsonPath = resolve(repoPath, "package.json");
+  if (!existsSync(packageJsonPath)) return [];
+  const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies"]) {
+    const values = packageJson[field];
+    if (!values || typeof values !== "object" || Array.isArray(values)) continue;
+    for (const name of Object.keys(values)) {
+      if (name.startsWith("@treeseed/")) names.add(name);
+    }
+  }
+  return [...names].sort();
 }
 function normalizeStageCleanupMode(input) {
   if (input.cleanupMode === "success" || input.deleteBranch === true) return "success";
@@ -5077,6 +5139,25 @@ function stageCandidateManifestPath(root, runId) {
     run: resolve(root, ".treeseed", "workflow", "runs", runId, "stage-candidate.json")
   };
 }
+function readJsonFile(filePath) {
+  if (!existsSync(filePath)) return null;
+  try {
+    return JSON.parse(readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function stageCandidateAttestationBlockers(root) {
+  const manifest = readJsonFile(stageCandidateManifestPath(root, "unused").latest);
+  if (!manifest) return ["No staging candidate manifest is available. Run `trsd stage` and wait for staging verification and deployment workflows."];
+  const blockers = [];
+  if (manifest.root.commit !== headCommit(repoRoot(root))) blockers.push("The local Market staging head no longer matches the latest staged candidate.");
+  for (const pkg of manifest.packages) {
+    const repoPath = resolve(root, pkg.path);
+    if (!existsSync(repoPath) || headCommit(repoPath) !== pkg.commit) blockers.push(`${pkg.name} no longer matches staged commit ${pkg.commit}.`);
+  }
+  return blockers;
+}
 function writeStageCandidateManifest(root, runId, manifest) {
   const paths = stageCandidateManifestPath(root, runId);
   for (const filePath of [paths.latest, paths.run]) {
@@ -5198,17 +5279,24 @@ function stageConflictError(message, details) {
 }
 function createStageCandidateManifest(root, runId, branchName, plan, verification) {
   const gitRoot = repoRoot(root);
-  const packageRepos = plan.repos.filter((repo) => repo.kind === "managed" && repo.remoteSourceExists);
+  const packageRepos = plan.repos.filter((repo) => repo.kind === "managed");
+  const rootCommit = headCommit(gitRoot);
+  const submodules = packageRepos.map((repo) => `${relative(root, repo.path).replaceAll("\\", "/")}:${headCommit(repo.path)}`).sort();
+  const candidateId = createHash("sha256").update(JSON.stringify({
+    rootSha: rootCommit,
+    submodules
+  })).digest("hex");
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     kind: "treeseed.stage-candidate",
+    candidateId,
     runId,
     branchName,
     targetBranch: STAGING_BRANCH,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     root: {
       repo: "@treeseed/market",
-      commit: headCommit(gitRoot),
+      commit: rootCommit,
       verified: verification.status === "passed" || verification.status === "skipped"
     },
     packages: packageRepos.map((repo) => ({
@@ -5216,6 +5304,8 @@ function createStageCandidateManifest(root, runId, branchName, plan, verificatio
       path: repo.path,
       repoKind: repo.repoKind,
       commit: headCommit(repo.path),
+      lockfileHash: sha256File(resolve(repo.path, "package-lock.json")),
+      dependencies: internalPackageDependencies(repo.path),
       remote: (() => {
         try {
           return originRemoteUrl(repo.path);
@@ -5507,8 +5597,17 @@ ${currentBlockers.map((entry) => `- ${entry}`).join("\n")}`, {
           refs["@treeseed/market"] = rootObserved;
           return { status: "verified", refs };
         });
-        const hostedCi = ciMode === "hosted" ? await executeJournalStep(root, workflowRun.runId, "hosted-ci", () => waitForStagingAutomation(repoRoot(root))) : (skipJournalStep(root, workflowRun.runId, "hosted-ci", { skippedReason: "ci off" }), { status: "skipped", reason: "ci off" });
+        const hostedCi = ciMode === "hosted" ? await executeJournalStep(root, workflowRun.runId, "hosted-ci", () => waitForWorkflowGates(
+          "stage",
+          stagingCandidateWorkflowGates(root, typedManifest),
+          "hosted",
+          { root, runId: workflowRun.runId, onProgress: (line, stream) => helpers.write(line, stream) }
+        )) : (skipJournalStep(root, workflowRun.runId, "hosted-ci", { skippedReason: "ci off" }), { status: "skipped", reason: "ci off" });
         const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link-restore", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
+        for (const repo of checkedOutStagePromotionRepos(root)) {
+          syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+        }
+        syncBranchWithOrigin(repoRoot(root), STAGING_BRANCH);
         const cleanup = cleanupMode === "success" ? await executeJournalStep(root, workflowRun.runId, "cleanup-source", () => cleanupStageSourceBranches(root, featureBranch, typedManifest)) : (skipJournalStep(root, workflowRun.runId, "cleanup-source", { skippedReason: "manual cleanup selected" }), { status: "skipped", reason: "manual cleanup selected" });
         const payload = {
           ...basePayload,
@@ -5521,10 +5620,11 @@ ${currentBlockers.map((entry) => `- ${entry}`).join("\n")}`, {
           promotion,
           stagingRefs,
           hostedCi,
+          stagingGuarantees: null,
           cleanup,
           workspaceLinks,
-          finalBranch: cleanupMode === "success" ? STAGING_BRANCH : currentBranch(repoRoot(root)) || featureBranch,
-          summary: "Stage promoted refs only. Hosted CI/CD was not waited on by default. Run `npx trsd ci --branch staging --json` or assign the staging release agent for CI/CD repair."
+          finalBranch: STAGING_BRANCH,
+          summary: ciMode === "hosted" ? `Staging candidate ${typedManifest.candidateId} passed all exact-SHA verification and deployment workflows.` : `Staging candidate ${typedManifest.candidateId} was promoted asynchronously; hosted verification is pending.`
         };
         completeWorkflowRun(root, workflowRun.runId, payload);
         return buildWorkflowResult("stage", root, payload, {
@@ -5564,7 +5664,7 @@ async function runReleaseGateReconcileFacade(operation, helpers, root, target, i
     resourceKind: ["release-gate"],
     provider: ["treeseed"]
   };
-  const desiredGraph = compileTreeseedDesiredResourceGraph({ tenantRoot: root, target });
+  const desiredGraph = await withContextEnv(reconcileEnv, () => compileTreeseedDesiredResourceGraph({ tenantRoot: root, target }));
   const rawUnits = compileTreeseedDesiredUnitsFromGraph(desiredGraph).filter((unit) => unit.provider === "treeseed" && (unit.unitType === "package-manifest" || unit.unitType.startsWith("release-gate:")) && unit.unitType !== "release-gate:npm-publish" && unit.unitType !== "release-gate:image-publish" && (includeHostedReleaseGates || unit.unitType !== "release-gate:hosted-reconcile" && unit.unitType !== "release-gate:live-verify") || unit.provider === "github" && (unit.unitType === "github-environment" || unit.unitType === "github-secret-binding" || unit.unitType === "github-variable-binding"));
   const unitsWithReleaseImageRefs = appendReleaseImageRefGitHubVariableBindings(rawUnits, input.releaseImageRefs ?? {});
   const rawUnitIds = new Set(unitsWithReleaseImageRefs.map((unit) => unit.unitId));
@@ -5676,33 +5776,23 @@ function appendReleaseImageRefGitHubVariableBindings(units, releaseImageRefs) {
 async function workflowRelease(helpers, input) {
   try {
     return await withContextEnv(helpers.context.env, async () => {
-      const traceReleaseStartup = (phase) => {
-        console.error(`[release][startup] ${phase}`);
-      };
-      traceReleaseStartup("resolve workspace");
       const root = workspaceRoot(resolveProjectRootOrThrow("release", helpers.cwd()));
-      traceReleaseStartup("resolve session");
       const session = resolveTreeseedWorkflowSession(root);
       const executionMode = normalizeExecutionMode(input);
-      traceReleaseStartup("inspect root repo");
       const rootRepo = createWorkspaceRootRepoReport(root);
-      traceReleaseStartup("inspect package repos");
       const packageReports = createWorkspacePackageReports(root);
       const releaseHelperRepos = checkedOutReleaseHelperRepos(root);
       const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? null;
-      traceReleaseStartup("check auto resume");
       const autoResumeRun = executionMode === "execute" && !explicitResumeRunId && input.fresh !== true ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports, { archiveStale: false }) : null;
       const planAutoResumeRun = executionMode === "plan" && input.fresh !== true ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports) : null;
       const effectiveInput = autoResumeRun ? {
         ...autoResumeRun.input,
         ciMode: input.ciMode ?? autoResumeRun.input.ciMode
       } : input;
-      traceReleaseStartup("local cleanup");
       const localCleanup = maybeRunLocalWorkflowCleanup(helpers, root, "release", effectiveInput);
       const level = effectiveInput.bump ?? "patch";
       const ciMode = normalizeCiMode(effectiveInput.ciMode, "release");
       const packageSelection = session.packageSelection;
-      traceReleaseStartup("build release plan");
       const plannedRelease = buildReleasePlanSnapshot({
         root,
         mode: session.mode,
@@ -5715,21 +5805,20 @@ async function workflowRelease(helpers, input) {
         blockers: []
       });
       const selectedPackageNames = releasePlanPackageSelection(plannedRelease.packageSelection).selected;
-      traceReleaseStartup("collect blockers");
       const blockers = collectReleasePlanBlockers(session, session.mode, selectedPackageNames, {
         level,
         repairVersionLine: effectiveInput.repairVersionLine === true
       });
       blockers.push(...collectReleaseHelperRepoBlockers(root));
+      blockers.push(...stageCandidateAttestationBlockers(root));
       const selectedVersions = releasePlanVersionMap(plannedRelease.plannedVersions);
       const releaseImageVersions = productionReleaseImageRefVersions(root, selectedVersions);
       const releaseImageRefs = productionReleaseImageRefEnv(releaseImageVersions);
-      traceReleaseStartup("collect production readiness");
-      const plannedReadiness = collectTreeseedDeploymentReadiness({
+      const plannedReadiness = await withContextEnv({ ...helpers.context.env, ...releaseImageRefs }, () => collectTreeseedDeploymentReadiness({
         tenantRoot: root,
         environment: "prod",
         appId: singleSelectedWorkflowAppId(plannedRelease.applicationSelection)
-      });
+      }));
       blockers.push(...plannedReadiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`));
       plannedRelease.blockers = blockers;
       const releaseBasePayload = {
@@ -5769,16 +5858,13 @@ async function workflowRelease(helpers, input) {
           releaseBasePayload
         );
       }
-      traceReleaseStartup("validate blockers");
       if (blockers.length > 0) {
         workflowError("release", "validation_failed", `Treeseed release cannot continue until blockers are resolved:
 ${blockers.join("\n")}`, {
           details: { blockers, releasePlan: plannedRelease }
         });
       }
-      traceReleaseStartup("prepare fresh release");
       const freshPreparation = input.fresh === true ? prepareFreshReleaseRun(root, session.branchName, rootRepo, packageReports) : { archived: [], blockers: [] };
-      traceReleaseStartup("compute versions");
       const stableVersions = new Map([
         ...releasePlanStableDependencyVersionMap(plannedRelease).entries(),
         ...selectedVersions.entries()
@@ -5788,7 +5874,6 @@ ${blockers.join("\n")}`, {
         ...stableVersions.entries()
       ]);
       const selectedPackageSet = new Set(selectedPackageNames);
-      traceReleaseStartup("acquire workflow run");
       const workflowRun = acquireWorkflowRun(
         "release",
         session,
@@ -5824,12 +5909,8 @@ ${blockers.join("\n")}`, {
           },
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "production-hosting", description: "Reconcile and live-verify production hosted resources before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "production-api-guarantees", description: "Run production API release guarantees before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "production-web-live-verification", description: "Run production web live verification after root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "production-final-guarantees", description: "Run final production release guarantees after all production deploys", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "workspace-link", description: "Restore local workspace links after release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }
         ],
@@ -5960,8 +6041,6 @@ ${rendered}`);
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates }));
         });
-        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", releaseImageRefs, { liveAppId: "api" }));
-        const productionApiGuarantees = await executeJournalStep(root, workflowRun.runId, "production-api-guarantees", () => runReleaseApiGuarantees(root, "prod", helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
@@ -5997,14 +6076,9 @@ ${rendered}`);
           hostedDeployGate({
             name: "@treeseed/market",
             repoPath: repoRoot(root),
-            workflow: "deploy-web.yml",
-            branch: PRODUCTION_BRANCH,
-            headSha: String(rootRelease.commit.commitSha ?? ""),
-            dispatchIfMissing: true,
-            dispatchInputs: {
-              environment: "prod",
-              action_kind: "deploy_web"
-            }
+            workflow: "deploy.yml",
+            branch: plannedRelease.releaseTag,
+            headSha: String(rootRelease.commit.commitSha ?? "")
           })
         ].filter((gate) => gate.headSha);
         const publishWait = await executeJournalStep(root, workflowRun.runId, "publish-wait", () => waitForWorkflowGates("release", publishGates, ciMode, {
@@ -6012,8 +6086,6 @@ ${rendered}`);
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
-        const productionWebVerification = await executeJournalStep(root, workflowRun.runId, "production-web-live-verification", () => runReleaseWebLiveVerification(root, "prod", helpers, "release"));
-        const productionFinalGuarantees = await executeJournalStep(root, workflowRun.runId, "production-final-guarantees", () => runReleaseProductionGuarantees(root, helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
           const packageBackMerges = selectedPackageNames.map((name) => packageRepoByName.get(name)).filter((pkg) => Boolean(pkg)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
             subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
@@ -6042,10 +6114,6 @@ ${rendered}`);
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionPackageDeployWorkflows,
-          productionHosting,
-          productionApiGuarantees,
-          productionWebVerification,
-          productionFinalGuarantees,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),
@@ -6173,6 +6241,30 @@ async function workflowRecover(helpers, input = {}) {
         inspection: inspectWorkflowLock(root, { scope })
       }));
       const lock = locks.find((entry) => entry.inspection.active)?.inspection ?? locks.find((entry) => entry.inspection.stale)?.inspection ?? locks[0].inspection;
+      const hasActiveLock = locks.some((entry) => entry.inspection.active);
+      const orphanedRunningRuns = hasActiveLock ? [] : listWorkflowRunJournals(root).filter((journal) => journal.status === "running");
+      const prunedOrphanedRuns = input.pruneStale === true ? orphanedRunningRuns.map((journal) => {
+        const classification = {
+          state: "stale",
+          reasons: ["workflow journal was left running without an active workflow lock"],
+          classifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        archiveWorkflowRun(root, journal.runId, classification);
+        return { runId: journal.runId, command: journal.command, status: journal.status, classification };
+      }) : orphanedRunningRuns.map((journal) => {
+        updateWorkflowRunJournal(root, journal.runId, (current) => ({
+          ...current,
+          status: "failed",
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          failure: {
+            code: "interrupted",
+            message: "Workflow process ended without finalizing its journal.",
+            details: { recovery: { resumable: current.resumable, runId: current.runId, resumeCommand: `treeseed resume ${current.runId}` } },
+            at: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        }));
+        return null;
+      }).filter((entry) => entry !== null);
       const journals = listWorkflowRunJournals(root);
       const session = resolveTreeseedWorkflowSession(root);
       const currentHeads = Object.fromEntries(
@@ -6248,7 +6340,7 @@ async function workflowRecover(helpers, input = {}) {
           interruptedRuns,
           staleRuns,
           obsoleteRuns,
-          prunedRuns,
+          prunedRuns: [...prunedOrphanedRuns, ...prunedRuns],
           markedObsoleteRun,
           selectedRun,
           runCount: journals.length