@zaip-ai/cli 3.4.0 → 3.6.0

package/templates/.agents/runtime/checksums.sha256

@@ -1,11 +1,11 @@
 b146bd0c7c60b1ab43c4f71e0b1d2262c6df6da6f7053a0425f834ccb77a6b48  LICENSE
 bc02cba77e8d51e5c580f43668863dc868eda66f1ff663bfaa49fcf3ca16320e  THIRD_PARTY_NOTICES.md
-f5e3e93e58ffc2a20a3ca53e8025bc50d7c1dccbef4b34e2388aa9bbf8678466  VERSION
-8583ee1474bc30d9ac497c879729077aafaabc905422b9c738cb9632a7ebb013  bin/zaip.mjs
-ec9932ea72fc82824b5b472b252b0276797f7a52cc48db60c719ab828de53118  manifest.json
+138203e3f604a08fad0c4d0a297efe2c486219820dcdd053e72b7d843504c7a1  VERSION
+5ff46081c6dbcd011acdd6b6d182a512bc1263bc33d953a79e638aabcf12d740  bin/zaip.mjs
+2b8cc26507cc5108bb4f03f03b669f2119bcd9275a06fd67d476c2dfae94969d  manifest.json
 7f89219d7c567c82a51679ad136d84364bded7ac659492537e125d33b1d58a7a  migrations/001-layout-v1.json
 5f8c48b286d0b44d8fbb57a9a5d009a8a500439aa3148d750b8f193f72995c9f  migrations/002-layout-v2.json
 2d738247131a923ea6e3a32d0d1d6de763866fd96a8a8dc75d127a343809b0aa  pnpm-lock.sha256
-d1b096f8ae3e7e5b804205020a0e75d43e9393c0adc121fa362e2d64e9e11e39  provenance.json
-0b19f004d8af24f71fa1d47489529026c1d86391a74dbfe2d11612b6e494713a  sbom.cdx.json
+dcdf66aed406bf0028d0690b1717d4e27fec5331b05c7c93c2f22bc835366c9a  provenance.json
+58081aa9a5de145cf8aecdc6fb41fe57b7a8229aee48383081f0930be3a999f0  sbom.cdx.json
 b3ffedf9e146be802a15b4009f33e031dec3071ca1525e12c67606fd964a3067  schemas/contracts.schema.json

package/templates/.agents/runtime/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "zaip-aios",
-  "version": "3.4.0",
+  "version": "3.6.0",
   "node": ">=22",
   "files": [
     "LICENSE",

package/templates/.agents/runtime/provenance.json

@@ -2,10 +2,10 @@
   "schema_version": 1,
   "statement_type": "self_reported_build_integrity",
   "authenticity": "unverified",
-  "version": "3.4.0",
+  "version": "3.6.0",
   "source_origin": "zaip-aios:local-build",
   "lockfile_sha256": "f8557f3600849eb880b8f245b63b80fed9a3e9addf2c5f2c6d492547af900219",
-  "sbom_sha256": "0b19f004d8af24f71fa1d47489529026c1d86391a74dbfe2d11612b6e494713a",
-  "runtime_sha256": "7c1cff8714c83874e79830afb133628232a384512c066db3ffd9ae4abf247045",
-  "statement_sha256": "b025e30f1a337d75bf580808b164441310184e002d96345c7e3bafbc043f22ca"
+  "sbom_sha256": "58081aa9a5de145cf8aecdc6fb41fe57b7a8229aee48383081f0930be3a999f0",
+  "runtime_sha256": "caa822e66a147b9c767d37db827d6b5036d15992c27a2d7cc8d1c1ffbd3ae14b",
+  "statement_sha256": "9768509a13f540498ccc0e0427ce371334763a3f21cefa47e9d93e4b4c496d39"
 }

package/templates/.agents/runtime/sbom.cdx.json

@@ -6,7 +6,7 @@
     "component": {
       "type": "application",
       "name": "zaip-aios",
-      "version": "3.4.0"
+      "version": "3.6.0"
     }
   },
   "components": [

package/templates/.agents/skills/zaip-skill-execution/SKILL.md

@@ -18,6 +18,7 @@ Use esta skill somente quando o usuário pedir execução. `prepare` não autori
 - Não encerre após criar/validar plano, sucessor, DAG ou Execution ativa. Não peça “continue execução” nem outra confirmação só porque a preparação consumiu tempo ou contexto; faça checkpoint/refresh e prossiga.
 - `spec execute`/`prd execute` ativam o macro e retornam `continuation.required`; isso é handoff obrigatório, não prova de implementação. Em runtime gerenciado, acione `execution run EXEC`; na colaboração nativa Codex, siga a seção de DAG nativa abaixo. Use somente um caminho de dispatch, com a mesma Execution e atribuição válida.
 - Depois de cada Task, execute as próximas elegíveis; ao terminar a DAG, realize os gates parentais e Gui. Só encerre com resultado observado ou impedimento concreto após recuperação permitida. Ramos independentes continuam somente quando a política de falha da DAG permitir.
+- Comandos longos permanecem em primeiro plano ou em sessão durável acompanhada até saída terminal. Antes de dizer que um processo “ainda está em execução”, consulte novamente seu PID/sessão e registre a saída mais recente; processo encerrado com falha exige diagnóstico e continuação autorizada, nunca uma resposta final baseada no estado antigo. O primeiro Stop de uma Task própria em `executing` ou `verifying` deve ser bloqueado mesmo quando seu registro pertence a outro worktree Git registrado.
 - Falta real de autoridade, informação essencial, capacidade do host ou gates continua sendo bloqueio. Informe a causa e a condição de retomada; não invente sucesso, nova autorização, identidade ou ancestralidade para continuar.
 
 Antes de encerrar com trabalho pendente ou responder a uma falha, aplique [continuidade automática e parada justificada](references/autonomous-continuation.md). O perfil congelado e seu ledger decidem recuperação; reparação elegível usa a autorização existente, sem pedir outro turno.

package/templates/.agents/skills/zaip-skill-github-deploy/SKILL.md

@@ -13,6 +13,7 @@ Read [the deployment workflow](references/deployment-workflow.md) for the detail
 
 - The exact command “faça deploy” authorizes commits covering all versionable pending changes in the selected worktree, followed by push and Release, after secret, size and ignore checks. The selected worktree is the complete publication scope; other worktrees remain outside it.
 - Resolve dirty state, untracked files, generated projections, branch divergence and repairable local/remote failures automatically within that scope. Limit repairs to the evidenced cause, with up to five repair cycles; stop when the same root cause remains after two repairs.
+- Treat the selected worktree's local branch, recovery branch or detached state as the source candidate only. The configured deploy branch is the remote target; a mismatch between source and target is not a blocker and never requires checking out the target locally.
 - Stop only for an unresolved index conflict after bounded repair, secrets, files at or above GitHub's 100 MB limit, unavailable authentication/authority, external outage, destructive requirement, or ambiguous scope expansion.
 - Never force push, rewrite history, replace remotes, change credentials or Git/SSH configuration, bypass checks, or deploy to another service.
 - Git-only publication of existing commits needs no artificial Task. Product edits or new product commits require real Task ownership; materialize missing authorized work before editing. Records/local-only snapshots are exempt.
@@ -24,9 +25,9 @@ Before the first Git mutation, retain sanitized authority in progress and the te
 ## Prepare the selected worktree
 
 1. Inspect Git status, pending paths and diff summary. Review every inventoried versionable file for secrets, size and ignore policy.
-2. Read `.agents/config/project.yaml`. Resolve the explicit frontend/backend scope from `deploy.frontend.branch` or `deploy.backend.branch`; configured `main` is permitted. `deploy.database.branch` must remain literal `beta`. The legacy `deploy.branch` fallback remains non-production.
-3. Prove folder-scoped SSH using `scripts/preflight.mjs --repository . --remote origin --scope frontend` (or the actual authorized scope). Run at most once per cycle; recheck only after an evidenced repair or changed target. Require SSH origin, configured key, Git identity and successful `ls-remote`; no process overrides or credential/config edits.
-4. Fetch once per cycle and compute ahead/behind. Before reconciliation, create a recoverable branch reference and preserve tracked plus untracked changes in a named stash. Use bounded rebase by default. Restore with `git stash apply`; verify preservation, retain the stash until success, and combine conflicts from observed intent. Never reset or force.
+2. Read `.agents/config/project.yaml`. Resolve the explicit frontend/backend target from `deploy.frontend.branch` or `deploy.backend.branch`; configured `main` is permitted. `deploy.database.branch` must remain literal `beta`. The legacy `deploy.branch` fallback remains non-production. Record the local source branch or detached state separately from this target.
+3. Prove folder-scoped SSH using `scripts/preflight.mjs --repository . --remote origin --scope frontend` (or the actual authorized scope). Run at most once per cycle; recheck only after an evidenced repair or changed target. Require SSH origin, configured key, Git identity and successful `ls-remote`; no process overrides or credential/config edits. Preflight accepts a named recovery branch or detached source and returns it separately from the configured target.
+4. Fetch once per cycle and compute ahead/behind between the source candidate and configured remote target. Before reconciliation, create and verify a recoverable branch reference, including for detached HEAD, and preserve tracked plus untracked changes in a named stash. Use bounded rebase by default without switching to the target branch. Restore with `git stash apply`; verify preservation, retain the stash until success, and combine conflicts from observed intent. Never reset or force.
 5. Re-inventory after reconciliation. Stage the reviewed paths with `git add -- <explicit-pathspecs>`; never use `git add -A`, `git add -u`, broad globs or ignored files. Explicit deploy permits the whole inventoried selected worktree, without mandatory functional partitioning.
 6. Run required or evidenced gates only. Reuse unchanged valid evidence; bypass Turbo cache for the failed remote gate when repairing CI. A failed gate starts a new cycle only after a concrete repair or new remote evidence.
 
@@ -44,7 +45,7 @@ Every product commit requires causal Task/Change/Execution records and matching
 2. Resolve the previous Release, next canonical version and package identity using [release identity](references/release-identity.md). For the framework, `vN.N` maps to package `N.N.0`; only GitHub Actions publishes `@zaip-ai/cli` to npm.
 3. For `zaip-ai/zaip-aios`, use `scripts/local-release-deploy.mjs`. It prepares/verifies, pushes the exact SHA to configured `main`, uploads verified assets to a draft, then publishes the Release. Enable the thin publisher only after explicit rollout authority, public trust enrollment and signed local qualification. It validates published assets and runs one read-only installation smoke before npm; no private-draft pilot or write token is needed. GitHub Release publication and npm completion remain separate.
 4. Consumers use `scripts/consumer-release-preparation.mjs guarded-push` with their own policy and explicit branch, SHA and trusted receipt. They have no framework npm/TGZ requirement. See the preparation guide for bootstrap and guarded commands.
-5. Immediately before delivery, reread the configured target; if changed, restart preparation. Helpers bind the exact candidate to `HEAD:refs/heads/<configured branch>` (or its equivalent immutable-SHA refspec); do not bypass them with a manual push.
+5. Immediately before delivery, reread the configured target; if changed, restart preparation. Helpers bind the exact candidate to `HEAD:refs/heads/<configured branch>` (or its equivalent immutable-SHA refspec) independently of the local source branch; do not bypass them with a manual push.
 6. After qualification, a missing Release is normal. Unless explicitly push-only, automatically create the draft for that SHA or resume a verified draft for the same SHA. Verify an already-published exact Release as a no-op; an API/authentication error never proves absence. Refuse conflicting tags/assets without overwrite.
 7. Review complete categorized UTF-8 notes and their exact-range inventory under [release notes](references/release-notes.md). Never use `--generate-notes` as the Release body. Validate the notes, publish with the reviewed notes file, and compare the published body byte-for-byte on readback. Preserve a configured human-only review policy where applicable.
 

package/templates/.agents/skills/zaip-skill-github-deploy/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "ZAIP GitHub Deploy"
   short_description: "Publicacao GitHub explicita, Git-only e verificavel"
-  default_prompt: "Use $zaip-skill-github-deploy para pedidos explicitos de deploy, push, publicar ou publicacao GitHub; quando o usuario disser 'faca deploy', trate o worktree selecionado inteiro como escopo autorizado, incluindo arquivos novos, apos os gates de segredos, tamanho, conflitos e SSH; publique via SSH da pasta sem force push nem reescrita de historico."
+  default_prompt: "Use $zaip-skill-github-deploy para pedidos explicitos de deploy, push, publicar ou publicacao GitHub; quando o usuario disser 'faca deploy', trate o worktree selecionado inteiro como escopo autorizado, incluindo arquivos novos, apos os gates de segredos, tamanho, conflitos e SSH; trate a branch local ou detached como origem e a branch configurada como alvo remoto, publicando por refspec explicito via SSH da pasta sem force push nem reescrita de historico."
 policy:
   allow_implicit_invocation: true

package/templates/.agents/skills/zaip-skill-github-deploy/references/deployment-workflow.md

@@ -30,12 +30,12 @@ For publication of existing commits, the conversation and terminal deploy report
 ## Multiple worktrees and divergent history
 
 1. Resolve the selected publishing worktree and inspect its `git status --porcelain`; use `git worktree list --porcelain` only to detect a path collision, never to scan every worktree.
-2. Select exactly one publishing worktree. A clean worktree on another branch or a detached verification worktree does not join the deploy. The selected worktree is the complete publication scope.
-3. Report a detected path collision, but do not block solely because the selected worktree is dirty or contains mixed changes; the explicit “faça deploy” authorization includes those changes. Stop only for an unresolved index conflict, secret/oversize file, authentication failure, or destructive/rewrite requirement.
-4. Prunable or missing worktrees are reported but never pruned automatically. Dirty detached or temporary worktrees are never deleted, reset, stashed or copied into the publishing worktree implicitly.
-5. Fetch once and compute ahead/behind for the publishing branch. If it is behind or diverged, automatically reconcile only the selected branch under this deploy authorization and continue; divergence is not a blocker by itself.
+2. Select exactly one publishing worktree. Its named branch, recovery branch or detached HEAD is the source candidate; `deploy.<scope>.branch` is the remote target. A different local branch or detached source does not join another worktree and is not a blocker. The selected worktree is the complete publication scope.
+3. Report a detected path collision, but do not block solely because the selected worktree is dirty, detached, on a recovery branch or contains mixed changes; the explicit “faça deploy” authorization includes those changes. Stop only for an unresolved index conflict, secret/oversize file, authentication failure, or destructive/rewrite requirement.
+4. Prunable or missing worktrees are reported but never pruned automatically. Unselected dirty detached or temporary worktrees are never deleted, reset, stashed or copied into the publishing worktree implicitly.
+5. Fetch once and compute ahead/behind between the source candidate and the configured remote target. If it is behind or diverged, automatically reconcile only the selected source under this deploy authorization and continue; divergence is not a blocker by itself.
 6. Before reconciliation, create a recoverable branch reference and preserve tracked plus untracked changes in a named stash. Verify both references before proceeding. Use `rebase` unless the user explicitly selected `merge`.
-7. Apply the bounded reconciliation without force. Restore with `git stash apply`, retain the stash until publication succeeds, and resolve generated aggregate conflicts by regenerating them from canonical sources. For ordinary textual conflicts, combine both sides when safe; use the selected worktree's intended version only when the diff and commit history establish that it supersedes the remote version.
+7. Apply the bounded reconciliation without force and without checking out the configured target branch locally. Restore with `git stash apply`, retain the stash until publication succeeds, and resolve generated aggregate conflicts by regenerating them from canonical sources. For ordinary textual conflicts, combine both sides when safe; use the selected worktree's intended version only when the diff and commit history establish that it supersedes the remote version.
 8. After restoration, prove that no unmerged paths remain, re-inventory the diff, and only then begin functional partitioning. Continue automatically through recoverable conflicts and pending repairs; stop only for a genuine terminal blocker defined below.
 
 ## Repair-loop integrity
@@ -49,7 +49,7 @@ For publication of existing commits, the conversation and terminal deploy report
 
 ## Prove folder-scoped SSH first
 
-From the repository root, read `.agents/config/project.yaml` immediately before deployment. `deploy.frontend.branch` and `deploy.backend.branch` are persistent authorization and may be `main`; pass their explicit `--scope`. `deploy.database.branch` is literal `beta`, never falls back to `main`, and requires `--scope database`. The internal `--scope framework` and a legacy preflight without `--scope` use `deploy.branch`, which must remain non-production. A malformed config is a terminal preflight failure. Preflight never creates, renames, or switches a branch.
+From the repository root, read `.agents/config/project.yaml` immediately before deployment. `deploy.frontend.branch` and `deploy.backend.branch` are persistent authorization and may be `main`; pass their explicit `--scope`. `deploy.database.branch` is literal `beta`, never falls back to `main`, and requires `--scope database`. The internal `--scope framework` and a legacy preflight without `--scope` use `deploy.branch`, which must remain non-production. A malformed config is a terminal preflight failure. Preflight reports the local source branch or detached state separately, treats the configured branch only as the remote target, and never creates, renames or switches a branch.
 
 For a database migration request, the database worktree may push only `HEAD:refs/heads/request/<id>` to open its PR against `beta`. That route never targets `main`, never applies SQL, and does not provision a beta branch or Supabase resource.
 
@@ -105,7 +105,7 @@ For a consumer repository, bootstrap its own Ed25519 trust store and define `con
 
 ## Synchronize and publish each cycle
 
-Fetch the selected remote and configured branch once per publication cycle, without SSH overrides. Compute ahead/behind against `<selected remote>/<configured branch>`. When local is behind or diverged, apply the recorded bounded reconciliation strategy and continue after successful verification; stop only if it cannot be completed safely within the bounded repair cycles. Never reset or force.
+Fetch the selected remote and configured target branch once per publication cycle, without SSH overrides. Compute ahead/behind from the selected source candidate against `<selected remote>/<configured branch>`. When the source is behind or diverged, apply the recorded bounded reconciliation strategy in place and continue after successful verification; do not switch to the target branch merely to satisfy publication. Stop only if reconciliation cannot be completed safely within the bounded repair cycles. Never reset or force.
 
 Commits created during Task execution use `[CODEX|CLAUDE] [P:XXXX] [S:XXXX] [T:XXXX] <Task title>`: the effective executing-agent prefix followed by compact lineage.
 

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.mjs

@@ -185,8 +185,7 @@ export async function prepare(input) {
     fail("SHA and GitHub version vN.N are required");
   const repository = resolve(input.repository),
     branch = await configuredBranch(repository, input.scope ?? "frontend");
-  if (branch !== input.branch || git(repository, ["branch", "--show-current"]) !== branch)
-    fail("checked out branch does not match configured branch");
+  if (branch !== input.branch) fail("requested target branch does not match configured branch");
   const policyDigest = await hash(input.policy),
     before = identity(repository, input.sha),
     required = policyFor(await json(input.policy), input);

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.test.mjs

@@ -46,7 +46,7 @@ test("resolves only the selected application scope from nested deploy configurat
   }
 });
 
-test("GitHub-only guard binds parsed config, policy, receipt expiry and fixed refspec", async () => {
+test("GitHub-only guard binds target config and fixed refspec independently of source branch", async () => {
   const root = await mkdtemp(join(tmpdir(), "zaip-consumer-"));
   try {
     const repo = join(root, "repo");
@@ -96,6 +96,10 @@ test("GitHub-only guard binds parsed config, policy, receipt expiry and fixed re
       }),
     );
     await bootstrap({ trustStore: trust, publicKey: pub, keyId: "consumer" });
+    git(repo, "checkout", "-qb", "codex/recovery");
+    const recoveryPrepared = await prepare(input);
+    await verifyPreparation({ ...input, receipt: recoveryPrepared.receiptPath });
+    git(repo, "checkout", "--detach", sha);
     const prepared = await prepare(input);
     await verifyPreparation({ ...input, receipt: prepared.receiptPath });
     const calls = [];
@@ -105,6 +109,10 @@ test("GitHub-only guard binds parsed config, policy, receipt expiry and fixed re
       ["preflight", "push"],
     );
     assert.equal(calls[1].refspec, sha + ":refs/heads/main");
+    await assert.rejects(
+      () => prepare({ ...input, branch: "beta" }),
+      /requested target branch does not match configured branch/,
+    );
     await assert.rejects(
       () => prepare({ ...input, commands: [{ command: "node", args: ["-e", "process.exit(2)"] }] }),
       /differ/,

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/github-deploy-contract.test.mjs

@@ -1,10 +1,32 @@
 import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import test from "node:test";
 
 const root = resolve(import.meta.dirname, "..", "..", "..");
 const skillRoot = resolve(root, "skills", "zaip-skill-github-deploy");
+const managedDeployFiles = [
+  "rules/workflow.md",
+  "skills/zaip-skill-github-deploy/SKILL.md",
+  "skills/zaip-skill-github-deploy/agents/openai.yaml",
+  "skills/zaip-skill-github-deploy/references/deployment-workflow.md",
+  "skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.mjs",
+  "skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.test.mjs",
+  "skills/zaip-skill-github-deploy/scripts/github-deploy-contract.test.mjs",
+  "skills/zaip-skill-github-deploy/scripts/preflight.mjs",
+  "skills/zaip-skill-github-deploy/scripts/preflight.test.mjs",
+];
+
+test("framework lock matches the deploy guidance and executable contract", async () => {
+  const lock = await readFile(resolve(root, "config", "framework.lock.yaml"), "utf8");
+  for (const path of managedDeployFiles) {
+    const digest = createHash("sha256")
+      .update(await readFile(resolve(root, path)))
+      .digest("hex");
+    assert.ok(lock.includes(`  .agents/${path}: ${digest}\n`), `${path} lock hash is stale`);
+  }
+});
 
 test("explicit Git publication verbs select the guarded deploy skill", async () => {
   const [skill, openai, core] = await Promise.all([
@@ -49,7 +71,10 @@ test("deploy permission and reconciliation remain explicit and recoverable", asy
   assert.match(skill, /recoverable branch reference/);
   assert.match(skill, /preserve tracked plus untracked changes in a named stash/);
   assert.match(skill, /Restore with `git stash apply`/);
+  assert.match(skill, /local branch, recovery branch or detached state as the source candidate/);
+  assert.match(skill, /configured deploy branch is the remote target/);
   assert.match(openai, /worktree selecionado inteiro como escopo autorizado/);
+  assert.match(openai, /branch local ou detached como origem/);
 });
 
 test("workflow retains the explicit publication routing contract", async () => {

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs

@@ -31,12 +31,7 @@ try {
     );
     process.exit(0);
   }
-  const checkedOutBranch = git(repository, ["branch", "--show-current"]).trim();
-  if (checkedOutBranch === "") fail("detached HEAD is not deployable");
-  if (checkedOutBranch !== configuredBranch)
-    fail(
-      `checked out branch ${checkedOutBranch} does not match validation deploy.branch ${configuredBranch}; switch or create the configured validation branch manually before publishing`,
-    );
+  const checkedOutBranch = git(repository, ["branch", "--show-current"]).trim() || null;
 
   for (const variable of ["GIT_SSH", "GIT_SSH_COMMAND"]) {
     if (process.env[variable]?.trim()) fail(`${variable} overrides folder-scoped Git SSH config`);
@@ -90,6 +85,7 @@ try {
         configured_branch: configuredBranch,
         production_branch: deployment.productionBranch,
         checked_out_branch: checkedOutBranch,
+        source_detached: checkedOutBranch === null,
         caller_branch: options.branch,
         upstream: upstream || null,
         remote: {

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.test.mjs

@@ -23,6 +23,8 @@ test("standalone consumer resolves fresh project targets without node_modules",
         windowsHide: true,
         env: { ...process.env, NODE_PATH: "" },
       });
+    const git = (...args) =>
+      spawnSync("git", args, { cwd: root, encoding: "utf8", windowsHide: true });
     const target = () => {
       const result = run("--resolve-branch");
       assert.equal(result.status, 0, result.stderr);
@@ -90,7 +92,19 @@ test("standalone consumer resolves fresh project targets without node_modules",
       assert.match(run("--resolve-branch").stderr, /non-empty|unsupported keys|malformed/);
     }
     config("deploy: { branch: staging, production_branch: production }\n");
-    assert.match(run().stderr, /checked out branch codex\/working does not match/);
+    const recoveryBranch = run();
+    assert.notEqual(recoveryBranch.status, 0);
+    assert.doesNotMatch(recoveryBranch.stderr, /checked out branch|detached HEAD/i);
+    assert.match(recoveryBranch.stderr, /No such remote|remote get-url|push URL|core\.sshCommand/i);
+    assert.equal(git("config", "user.email", "x@y.invalid").status, 0);
+    assert.equal(git("config", "user.name", "x").status, 0);
+    assert.equal(git("add", ".").status, 0);
+    assert.equal(git("commit", "--quiet", "-m", "fixture").status, 0);
+    assert.equal(git("checkout", "--detach", "HEAD").status, 0);
+    const detached = run();
+    assert.notEqual(detached.status, 0);
+    assert.doesNotMatch(detached.stderr, /checked out branch|detached HEAD/i);
+    assert.match(detached.stderr, /No such remote|remote get-url|push URL|core\.sshCommand/i);
     for (const branch of [
       "bad..branch",
       "bad.lock/child",

package/templates/.agents/zaip-aios/VERSION

@@ -1 +1 @@
-3.4
+3.6