@zq-silk/yui 0.15.11 → 0.16.0

package/dist/commands/taskPublicationAdoptCommand.js

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { parseRepeatable } from "../cli/parseRepeatable.js";
+import { contextContentDigest } from "../context/contextSnapshot.js";
+import { usageError } from "../errors/cliError.js";
+import { createTaskEvent } from "../event/taskEvent.js";
+import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
+import { PUBLICATION_ADOPTED_EVENT, publicationAdoption } from "../task/publicationAdoption.js";
+import { publicationExternalKey } from "../task/publicationReference.js";
+import { commitMap, completionEvent } from "../task/remoteDelivery.js";
+import { resolveTaskRecordReference } from "../task/taskRecordReference.js";
+import { assertTaskDeliveryAuthority, taskActor } from "../task/taskAuthority.js";
+/** Local read -> explicit semantic adoption of those exact bytes. No Git writes,
+ * provider reads, completion rewrite or implicit acceptance of Integration. */
+export async function runTaskPublicationAdoptCommand(args, store, options = {}) {
+    const [command, ...rest] = args;
+    const adopt = command === "adopt";
+    if (!adopt && command !== "diff")
+        throw usageError("Expected publication diff or adopt.");
+    const usage = adopt
+        ? "yui task publication adopt <task>/<publication> --reviewed-diff <sha256> --acceptance <text> [--integration <id>]"
+        : "yui task publication diff <task>/<publication> [--integration <id>]";
+    const parsed = parseRepeatable(rest, new Set(), new Set(adopt ? ["--reviewed-diff", "--acceptance", "--integration"] : ["--integration"]), usage);
+    if (parsed.positionals.length !== 1)
+        throw usageError(usage);
+    const ref = resolveTaskRecordReference(parsed.positionals[0], {
+        kind: "publicationReference", label: "Publication reference"
+    });
+    const acceptance = parsed.one.get("--acceptance")?.trim();
+    const reviewedDiff = parsed.one.get("--reviewed-diff");
+    if (adopt && (!acceptance || !/^[0-9a-f]{64}$/u.test(reviewedDiff ?? ""))) {
+        throw usageError(`Adoption requires a reviewed diff digest and explicit acceptance of the full delta. ${usage}`);
+    }
+    const integrationId = parsed.one.get("--integration");
+    const read = (reader) => {
+        // The reader addresses only this Task's managed Git objects. Workers and
+        // planning Sessions do not acquire publication-adoption authority.
+        const actor = adopt
+            ? assertTaskDeliveryAuthority(reader, options.environment, ref.taskId)
+            : taskActor(options.environment, ref.taskId);
+        const task = reader.getTask(ref.taskId);
+        if (task === null || task.status !== "completed") {
+            throw usageError("Publication candidate adoption/diff requires a completed, unarchived Task.");
+        }
+        const publication = reader.getPublicationReference(task.id, ref.localId);
+        if (publication === null || publication.localCommit === undefined) {
+            throw usageError("Publication must record an exact local candidate.");
+        }
+        const current = reader.findPublicationReferenceByExternalKey(publicationExternalKey(publication));
+        if (current?.taskId !== task.id || current.id !== publication.id) {
+            throw usageError("Publication is not the current record for its external identity.");
+        }
+        const completion = task.completedAt === undefined ? undefined
+            : completionEvent(reader.listEvents(task.id), task.completedAt);
+        const acceptedCommit = commitMap(completion?.payload.projectHeads).get(publication.projectId);
+        if (completion === undefined || acceptedCommit === undefined) {
+            throw usageError("Exact completion evidence is unavailable; it cannot be inferred or repaired by adoption.");
+        }
+        const workspace = reader.getTaskWorkspace(task.id);
+        const entry = workspace?.entries.find(e => e.projectId === publication.projectId);
+        if (workspace?.owner.type !== "task" || workspace.owner.taskId !== task.id
+            || entry === undefined
+            || !task.projectBindings.some(b => b.projectId === publication.projectId)) {
+            throw usageError("The Publication Project has no Task-owned workspace for local Git evidence.");
+        }
+        const integration = integrationId === undefined ? null
+            : reader.getIntegrationAttempt(task.id, integrationId);
+        if (integrationId !== undefined && (integration === null
+            || integration.status !== "committed"
+            || integration.projectId !== publication.projectId
+            || integration.afterCommit !== publication.localCommit)) {
+            throw usageError("Integration must be this Task/Project's committed exact publication candidate.");
+        }
+        return { task, publication, completion, acceptedCommit, workspace, entry, integration, actor };
+    };
+    const facts = store.transaction(read);
+    const git = options.git ?? new NodeGitWorkspace();
+    const localCommit = facts.publication.localCommit;
+    const [acceptedTree, candidateTree, diff] = await Promise.all([
+        git.resolveTree(facts.entry.path, facts.acceptedCommit),
+        git.resolveTree(facts.entry.path, localCommit),
+        git.diffTextBetween({ repositoryPath: facts.entry.path,
+            fromCommit: facts.acceptedCommit, toCommit: localCommit, exact: true })
+    ]);
+    // Bind both endpoints even when the text diff is empty (equal trees).
+    const diffDigest = createHash("sha256").update(JSON.stringify({
+        acceptedCommit: facts.acceptedCommit, localCommit, acceptedTree, candidateTree, diff
+    })).digest("hex");
+    const evidence = {
+        projectId: facts.publication.projectId,
+        publicationId: facts.publication.id,
+        completionEventId: facts.completion.id,
+        acceptedCommit: facts.acceptedCommit,
+        localCommit, acceptedTree, candidateTree, diffDigest,
+        ...(facts.integration === null ? {} : {
+            integrationId: facts.integration.id, integrationDigest: contextContentDigest(facts.integration)
+        })
+    };
+    // No async Git/provider work under the transaction; fixed objects cannot move.
+    const event = store.transaction(tx => {
+        if (!isDeepStrictEqual(read(tx), facts)) {
+            throw usageError("Task, Publication or Integration changed while reading candidate evidence.");
+        }
+        if (!adopt)
+            return null;
+        if (reviewedDiff !== diffDigest) {
+            throw usageError(`Reviewed diff does not match this candidate. Read publication diff ${ref.taskId}/${ref.localId}.`);
+        }
+        const existing = publicationAdoption(facts.publication, facts.completion, facts.acceptedCommit, tx.listEvents(facts.task.id), tx.listPublicationReferences(facts.task.id), tx.listIntegrationAttempts(facts.task.id)).event;
+        if (existing !== null && existing.payload.diffDigest === diffDigest
+            && existing.payload.acceptance === acceptance
+            && existing.payload.integrationId === integrationId)
+            return existing;
+        const saved = createTaskEvent(tx.nextEventId(facts.task.id), facts.task.id, PUBLICATION_ADOPTED_EVENT, { ...evidence, acceptance: acceptance, by: facts.actor }, options.now?.() ?? new Date());
+        tx.saveEvent(facts.task.id, saved);
+        return saved;
+    });
+    return {
+        output: event === null
+            ? `Publication candidate: ${ref.taskId}/${ref.localId}\nAccepted: ${facts.acceptedCommit}\n`
+                + `Candidate: ${localCommit}\nReviewed diff digest: ${diffDigest}\n`
+                + "Review all removals, additions and conflict resolutions against the original acceptance before adoption.\n"
+                + `${diff}\n`
+            : `Adopted Publication candidate ${ref.taskId}/${ref.localId} (${event.id}); remote verification remains separate.\n`,
+        data: event === null ? { ...evidence, diff } : event
+    };
+}

package/dist/commands/taskPublicationCommands.js

@@ -1,5 +1,4 @@
 import { isDeepStrictEqual } from "node:util";
-import { taskActor } from "./taskActor.js";
 import { dataError, taskNotFound, usageError } from "../errors/cliError.js";
 import { createTaskEvent } from "../event/taskEvent.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
@@ -7,6 +6,7 @@ import { formatTimestamp } from "../output/timePresentation.js";
 import { resolveProject } from "../repository/project.js";
 import { createPublicationReference } from "../task/publicationReference.js";
 import { resolveTaskRecordReference } from "../task/taskRecordReference.js";
+import { taskActor } from "../task/taskAuthority.js";
 const PROVIDERS = new Set(["github", "gitlab"]);
 const EXTERNAL_KINDS = new Set(["pull-request", "merge-request"]);
 const STATES = new Set(["open", "merged", "closed"]);
@@ -17,6 +17,7 @@ const INHERITED_METADATA_FIELDS = [
     "targetBranch"
 ];
 const INHERITED_EVIDENCE_FIELDS = [
+    "headCommit",
     "remoteCommit",
     "evidence",
     "mergedAt"
@@ -34,7 +35,7 @@ export function runPublicationCommand(args, store, options) {
     }
 }
 function upsertPublication(args, store, options) {
-    const usage = "Task publication upsert usage: yui task publication upsert <task> --project <project> --provider <github|gitlab> --repository <owner/name> --kind <pull-request|merge-request> --id <external-id> [--url <url>] [--title <text>] [--source-branch <branch>] [--target-branch <branch>] [--local-commit <sha>] [--remote-commit <sha>] [--state <open|merged|closed>] [--reported|--verified] [--evidence <text>] [--merged-at <iso-timestamp>].";
+    const usage = "Task publication upsert usage: yui task publication upsert <task> --project <project> --provider <github|gitlab> --repository <owner/name> --kind <pull-request|merge-request> --id <external-id> [--url <url>] [--title <text>] [--source-branch <branch>] [--target-branch <branch>] [--local-commit <sha>] [--head-commit <sha>] [--remote-commit <sha>] [--state <open|merged|closed>] [--reported|--verified] [--evidence <text>] [--merged-at <iso-timestamp>].";
     const parsed = parseUpsertArgs(args, usage);
     exactPositionals(parsed.positionals, 1, usage);
     const task = requireTask(store, parsed.positionals[0]);
@@ -72,6 +73,9 @@ function upsertPublication(args, store, options) {
         ...(parsed.options.has("--remote-commit")
             ? { remoteCommit: requiredOption(parsed.options, "--remote-commit", usage) }
             : {}),
+        ...(parsed.options.has("--head-commit")
+            ? { headCommit: requiredOption(parsed.options, "--head-commit", usage) }
+            : {}),
         ...(state === undefined ? {} : { state }),
         ...(verification === undefined ? {} : { verification }),
         ...(parsed.options.has("--evidence")
@@ -181,6 +185,7 @@ function renderPublication(reference, timeZone) {
             : [`Branches: ${reference.sourceBranch ?? "unknown"} -> ${reference.targetBranch ?? "unknown"}`]),
         `State: ${reference.state}`,
         `Verification: ${reference.verification}`,
+        ...(reference.headCommit === undefined ? [] : [`Remote head: ${reference.headCommit}`]),
         `Lineage: ${reference.localCommit ?? "unknown"} -> ${reference.externalId} -> ${reference.remoteCommit ?? "unknown"}`,
         ...(reference.mergedAt === undefined
             ? []
@@ -234,6 +239,10 @@ function inheritPublicationInput(existing, input) {
     const mergedAtChanged = input.mergedAt !== undefined
         && input.mergedAt !== existing.mergedAt;
     const evidenceContextChanged = localCommitChanged
+        || (input.headCommit !== undefined
+            && normalizeCommitForComparison(input.headCommit) !== existing.headCommit)
+        || input.projectId !== existing.projectId
+        || input.externalKind !== existing.externalKind
         || stateChanged
         || remoteCommitChanged
         || evidenceChanged
@@ -321,7 +330,7 @@ function parseUpsertArgs(args, usage) {
     const valueOptions = new Set([
         "--project", "--provider", "--repository", "--kind", "--id", "--url",
         "--title", "--source-branch", "--target-branch", "--local-commit",
-        "--remote-commit", "--state", "--evidence", "--merged-at"
+        "--remote-commit", "--head-commit", "--state", "--evidence", "--merged-at"
     ]);
     const flags = new Set(["--reported", "--verified"]);
     const positionals = [];

package/dist/commands/taskPublicationVerifyCommand.js

@@ -1,7 +1,6 @@
 import { isDeepStrictEqual } from "node:util";
-import { taskActor } from "./taskActor.js";
+import { taskActor } from "../task/taskAuthority.js";
 import { upsertTaskPublication } from "./taskPublicationCommands.js";
-import { projectTaskRemoteDeliveryFromStore } from "./taskRemoteDeliveryCommand.js";
 import { dataError, runtimeError, taskNotFound, usageError, CliError } from "../errors/cliError.js";
 import { publicationExternalKey } from "../task/publicationReference.js";
 import { resolveTaskRecordReference } from "../task/taskRecordReference.js";
@@ -14,8 +13,7 @@ export async function runTaskPublicationVerifyCommand(args, store, options) {
         throw usageError(`Archived Task Publication cannot be verified: ${task.id}.`);
     }
     taskActor(options.environment, task.id);
-    const initialCandidate = await options.candidateForTask?.(reference.taskId) ?? null;
-    const request = preparePublicationVerification(store, reference.taskId, reference.localId, initialCandidate, options.environment);
+    const request = preparePublicationVerification(store, reference.taskId, reference.localId, options.environment);
     const verifier = options.verifiers[request.publication.provider];
     if (verifier === undefined) {
         throw usageError(`Publication verification is not supported for provider `
@@ -42,19 +40,22 @@ export async function runTaskPublicationVerifyCommand(args, store, options) {
             + `${error instanceof Error ? error.message : String(error)}`);
     }
     assertVerificationObservation(request, observation);
-    const finalCandidate = await options.candidateForTask?.(reference.taskId) ?? null;
-    const result = commitPublicationVerification(store, request, observation, finalCandidate, options.now?.() ?? new Date());
+    const result = commitPublicationVerification(store, request, observation, options.now?.() ?? new Date());
     return {
         kind: "output",
-        output: result.idempotent
-            ? `Publication ${result.reference.id} is already verified for `
-                + `${result.reference.repository}#${result.reference.externalId}.\n`
-            : `Verified publication ${result.reference.id} for `
-                + `${result.reference.repository}#${result.reference.externalId}.\n`,
+        output: result.reference.verification !== "verified"
+            ? `Recorded Publication ${result.reference.id}: remote state=${observation.state}; `
+                + `head=${observation.headCommit}; local=${request.expectedLocalCommit}. `
+                + "Not verified; prior verification is no longer current.\n"
+            : result.idempotent
+                ? `Publication ${result.reference.id} is already verified for `
+                    + `${result.reference.repository}#${result.reference.externalId}.\n`
+                : `Verified publication ${result.reference.id} for `
+                    + `${result.reference.repository}#${result.reference.externalId}.\n`,
         data: { publication: result.reference, observation }
     };
 }
-function preparePublicationVerification(store, taskId, publicationId, currentCandidate, environment) {
+function preparePublicationVerification(store, taskId, publicationId, environment) {
     return store.transaction((reader) => {
         const task = reader.getTask(taskId);
         if (task === null)
@@ -72,27 +73,19 @@ function preparePublicationVerification(store, taskId, publicationId, currentCan
             throw usageError(`Publication ${publication.id} is not the current unsuperseded record `
                 + `for ${publicationExternalKey(publication)}.`);
         }
-        const delivery = projectTaskRemoteDeliveryFromStore(reader, task, currentCandidate);
-        const project = delivery.projects.find(({ projectId }) => (projectId === publication.projectId));
+        const project = task.projectBindings.find(({ projectId }) => (projectId === publication.projectId));
         if (project === undefined) {
             throw usageError(`Publication ${publication.id} Project is not bound to Task ${task.id}: `
                 + `${publication.projectId}.`);
         }
-        if (project.expectedLocalCommit === null) {
-            throw usageError(`Task delivery head is unavailable for Publication ${publication.id}.`);
-        }
         if (publication.localCommit === undefined) {
             throw usageError(`Publication ${publication.id} must record a local commit before verification.`);
         }
-        if (publication.localCommit !== project.expectedLocalCommit) {
-            throw usageError(`Publication ${publication.id} local commit ${publication.localCommit} `
-                + `does not match Task delivery head ${project.expectedLocalCommit}.`);
-        }
         return {
             task: taskVerificationInvariant(task),
             actor,
             publication,
-            expectedLocalCommit: project.expectedLocalCommit
+            expectedLocalCommit: publication.localCommit
         };
     });
 }
@@ -104,22 +97,17 @@ function assertVerificationObservation(request, observation) {
         || observation.externalId !== publication.externalId) {
         throw usageError(`Provider returned mismatched Publication identity for ${publication.id}.`);
     }
-    if (observation.state !== "merged") {
-        throw usageError(`Remote ${publication.externalKind} ${publication.repository}#`
-            + `${publication.externalId} is ${observation.state}, not merged.`);
+    if (!/^[0-9a-f]{40}$/u.test(observation.headCommit)) {
+        throw usageError("Provider observation requires an exact remote head.");
     }
-    if (observation.headCommit !== request.expectedLocalCommit) {
-        throw usageError(`Remote ${publication.externalKind} head ${observation.headCommit} `
-            + `does not match Task delivery head ${request.expectedLocalCommit}.`);
-    }
-    if (observation.remoteCommit === undefined) {
+    if (observation.state === "merged" && observation.remoteCommit === undefined) {
         throw usageError(`Merged remote ${publication.externalKind} did not expose a remote commit.`);
     }
     if (observation.evidence.trim().length === 0) {
         throw usageError("Provider verification evidence is required.");
     }
 }
-function commitPublicationVerification(store, request, observation, currentCandidate, now) {
+function commitPublicationVerification(store, request, observation, now) {
     return store.transaction((tx) => {
         const task = tx.getTask(request.task.id);
         if (task === null)
@@ -134,12 +122,6 @@ function commitPublicationVerification(store, request, observation, currentCandi
             throw usageError(`Publication evidence changed during verification: `
                 + `${task.id}/${request.publication.id}.`);
         }
-        const delivery = projectTaskRemoteDeliveryFromStore(tx, task, currentCandidate);
-        const expectedLocalCommit = delivery.projects.find(({ projectId }) => (projectId === request.publication.projectId))?.expectedLocalCommit;
-        if (expectedLocalCommit !== request.expectedLocalCommit) {
-            throw usageError(`Task delivery head changed during Publication verification: `
-                + `${request.publication.projectId}@${expectedLocalCommit ?? "unavailable"}.`);
-        }
         return upsertTaskPublication(tx, task, {
             projectId: request.publication.projectId,
             provider: request.publication.provider,
@@ -150,9 +132,11 @@ function commitPublicationVerification(store, request, observation, currentCandi
                 ? {}
                 : { externalUrl: observation.externalUrl }),
             localCommit: request.expectedLocalCommit,
-            remoteCommit: observation.remoteCommit,
-            state: "merged",
-            verification: "verified",
+            headCommit: observation.headCommit,
+            ...(observation.remoteCommit === undefined ? {} : { remoteCommit: observation.remoteCommit }),
+            state: observation.state,
+            verification: observation.state === "merged"
+                && observation.headCommit === request.expectedLocalCommit ? "verified" : "reported",
             evidence: observation.evidence,
             ...(observation.mergedAt === undefined
                 ? {}

package/dist/commands/taskRemoteDeliveryCommand.js

@@ -1,6 +1,5 @@
-import { isDeepStrictEqual } from "node:util";
 import { taskNotFound, usageError } from "../errors/cliError.js";
-import { projectTaskRemoteDelivery } from "../task/remoteDelivery.js";
+import { projectTaskRemoteDeliveryFromStore } from "../task/remoteDeliveryService.js";
 export function runTaskRemoteDeliveryCommand(args, store, currentCandidate = null) {
     const usage = "Task remote-delivery usage: yui task remote-delivery <task> [--json].";
     const asJson = args.includes("--json");
@@ -9,7 +8,7 @@ export function runTaskRemoteDeliveryCommand(args, store, currentCandidate = nul
         throw usageError(usage);
     }
     const taskId = positionals[0].trim();
-    const data = store.transaction((reader) => {
+    const data = store.readTransaction((reader) => {
         const task = reader.getTask(taskId);
         if (task === null)
             throw taskNotFound(taskId);
@@ -23,76 +22,6 @@ export function runTaskRemoteDeliveryCommand(args, store, currentCandidate = nul
         data
     };
 }
-export function projectTaskRemoteDeliveryFromStore(store, task, currentCandidate = null) {
-    return projectTaskRemoteDelivery({
-        task,
-        events: store.listEvents(task.id),
-        publications: store.listPublicationReferences(task.id),
-        managedWorkspaces: store.listManagedWorkspaces(task.id),
-        runs: store.listRuns(task.id),
-        currentCandidate
-    });
-}
-export function createTaskRemoteDeliveryProof(store, task, currentCandidate = null) {
-    const publications = store.listPublicationReferences(task.id);
-    const delivery = projectTaskRemoteDelivery({
-        task,
-        events: store.listEvents(task.id),
-        publications,
-        managedWorkspaces: store.listManagedWorkspaces(task.id),
-        runs: store.listRuns(task.id),
-        currentCandidate
-    });
-    return {
-        schemaVersion: 1,
-        task: taskRemoteDeliveryProofTask(task),
-        publications,
-        delivery
-    };
-}
-export function assertTaskRemoteDeliveryProof(store, task, proof) {
-    if (proof === undefined || proof.schemaVersion !== 1) {
-        throw usageError(`Task remote-delivery preflight proof is required: ${task.id}.`);
-    }
-    if (!isDeepStrictEqual(proof.task, taskRemoteDeliveryProofTask(task))) {
-        throw usageError(`Task changed after remote-delivery preflight: ${task.id}.`);
-    }
-    if (!isDeepStrictEqual(proof.publications, store.listPublicationReferences(task.id))) {
-        throw usageError(`Task Publication evidence changed after remote-delivery preflight: ${task.id}.`);
-    }
-    assertTaskRemoteDeliveryIntegrated(proof.delivery);
-    return proof.delivery;
-}
-export function assertTaskRemoteDeliveryIntegrated(delivery) {
-    if (!delivery.allMerged) {
-        const headUnavailable = delivery.projects.filter((project) => (project.codeDelivery !== "none"
-            && project.coverage === "head-unavailable"));
-        if (headUnavailable.length > 0 && delivery.source === "task-completed") {
-            throw usageError(`Task ${delivery.taskId} has no frozen completion heads for: ${headUnavailable.map(({ projectId }) => projectId).join(", ")}. Reopen and complete it again to record exact heads before archiving; `
-                + "An explicitly authorized --force archive retains this evidence gap.");
-        }
-        const uncovered = delivery.projects
-            .filter((project) => project.codeDelivery !== "none" && !project.merged)
-            .map((project) => (`${project.projectId}/${project.coverage}`
-            + (project.publication === null ? "" : `/${project.publication.id}`)))
-            .join(", ");
-        throw usageError(`Task ${delivery.taskId} is not fully merged into remote delivery: ${uncovered || "expected Project heads are unavailable"}. Record confirmed current-head evidence with task publication upsert, `
-            + "or use task archive --abandon for an intentional non-merge.");
-    }
-    if (delivery.allVerified)
-        return;
-    const unverified = delivery.projects
-        .filter((project) => (project.codeDelivery !== "none"
-        && project.merged
-        && !project.verified))
-        .map((project) => (`${project.projectId}/${project.coverage}`
-        + (project.publication === null ? "" : `/${project.publication.id}`)))
-        .join(", ");
-    throw usageError(`Task ${delivery.taskId} has merged Publication evidence that is not verified: `
-        + `${unverified || "verification evidence is unavailable"}. Run task publication verify `
-        + "for each Publication, or repeat task archive --integrated --force to explicitly "
-        + "archive despite evidence gaps, retaining the original delivery facts.");
-}
 export function renderTaskRemoteDelivery(delivery, indent = "") {
     const source = `${delivery.source}${delivery.provisional ? " (provisional)" : ""}`;
     const lines = [
@@ -108,27 +37,17 @@ export function renderTaskRemoteDelivery(delivery, indent = "") {
         `${indent}Projects:${delivery.projects.length === 0 ? " none" : ""}`,
         ...delivery.projects.map((project) => (`${indent}- ${project.directory} (${project.projectId}): `
             + `expected=${shortCommit(project.expectedLocalCommit)}; `
+            + `candidate=${shortCommit(project.deliveryLocalCommit)}; `
+            + `adoption=${project.adoption?.id ?? "none"}; `
             + `base=${shortCommit(project.baseCommit)}; `
             + `publication=${project.publication?.id ?? "none"}; `
             + `state=${project.state ?? "none"}; `
             + `verification=${project.verification ?? "none"}; `
             + `remote=${shortCommit(project.remoteCommit)}; `
-            + `coverage=${project.coverage}`))
+            + `coverage=${project.coverage}\n${indent}  ${project.reason}`))
     ];
     return `${lines.join("\n")}\n`;
 }
 function shortCommit(commit) {
     return commit === null ? "unknown" : commit.slice(0, 12);
 }
-function taskRemoteDeliveryProofTask(task) {
-    return {
-        id: task.id,
-        status: task.status,
-        projectBindings: task.projectBindings,
-        ...(task.workspaceIdentity === undefined
-            ? {}
-            : { workspaceIdentity: task.workspaceIdentity }),
-        ...(task.completedAt === undefined ? {} : { completedAt: task.completedAt }),
-        ...(task.retiredAt === undefined ? {} : { retiredAt: task.retiredAt })
-    };
-}

package/dist/commands/taskUpstreamCommands.js

@@ -1,11 +1,11 @@
+import { parseRepeatable } from "../cli/parseRepeatable.js";
 import { usageError } from "../errors/cliError.js";
 import { GitIntegrationService } from "../integration/gitIntegrationService.js";
 import { createIntegrationAttempt } from "../integration/integrationAttempt.js";
 import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
 import { FileTaskWorkspacePreparer } from "../repository/taskWorkspacePreparer.js";
 import { workspaceProjectEntry } from "../worktree/managedWorkspace.js";
-import { parseRepeatable } from "./taskIntegrationCommands.js";
-import { taskLocalActor } from "./taskActor.js";
+import { taskLocalActor } from "../task/taskAuthority.js";
 export async function runTaskUpstreamCommand(args, store, home, options = {}) {
     const [command, ...rest] = args;
     if (command === "integrate")
@@ -15,7 +15,7 @@ export async function runTaskUpstreamCommand(args, store, home, options = {}) {
         : `Unknown command: task upstream ${command}`);
 }
 async function integrateUpstream(args, store, home, options) {
-    const usage = "Task upstream integrate usage: yui task upstream integrate <task> (--latest|--project <project>) [--check <command> ...].";
+    const usage = "Task upstream integrate usage: yui task upstream integrate <task> (--latest|--project <project>) [--check <command> ...] [--rerun-checks].";
     let latest = false;
     const normalized = [];
     for (const arg of args) {
@@ -29,7 +29,7 @@ async function integrateUpstream(args, store, home, options) {
             ? ["--project", arg.slice("--project=".length)]
             : [arg]));
     }
-    const parsed = parseRepeatable(normalized, new Set(["--check"]), new Set(["--project"]), usage);
+    const parsed = parseRepeatable(normalized, new Set(["--check"]), new Set(["--project"]), usage, new Set(["--rerun-checks"]));
     if (parsed.positionals.length !== 1)
         throw usageError(usage);
     const taskId = parsed.positionals[0];
@@ -59,7 +59,7 @@ async function integrateUpstream(args, store, home, options) {
     if (workspace === null || workspace.owner.type !== "task") {
         throw usageError(`Task has no authoritative main clone: ${task.id}.`);
     }
-    const service = new GitIntegrationService(store.rootDirectory(), store, git, now);
+    const service = new GitIntegrationService(store.rootDirectory(), store, git, now, options.environment, undefined, options.jobPort);
     const results = [];
     for (const binding of task.projectBindings) {
         if (projectRef !== undefined && binding.projectId !== projectRef)
@@ -99,20 +99,31 @@ async function integrateUpstream(args, store, home, options) {
                     taskBaseCommit: binding.baseCommit,
                     strategy: "rebase"
                 },
-                checkCommands: parsed.many.get("--check") ?? []
+                checkCommands: parsed.many.get("--check") ?? [],
+                rerunChecks: parsed.one.has("--rerun-checks")
             }, now());
             tx.saveIntegrationAttempt(task.id, created);
             return created;
         });
         const result = await service.integrate(task.id, attempt.id);
         results.push(result);
-        if (result.status !== "committed")
+        // Each Project has an independent candidate and Job. --latest admits all
+        // requested Projects, then the Agent continues the returned exact attempts.
+        if (result.status !== "committed" && result.status !== "checks-running")
             break;
     }
     if (projectRef !== undefined && results.length === 0) {
         throw usageError(`Task Project not found: ${task.id}/${projectRef}.`);
     }
-    const lines = results.map(({ attempt, status }) => (`  ${attempt.projectId}: ${attempt.beforeCommit.slice(0, 12)} -> ${(attempt.afterCommit ?? attempt.candidateCommit ?? attempt.beforeCommit).slice(0, 12)} (${status})`));
+    const lines = results.flatMap(result => {
+        const { attempt, status } = result;
+        return [
+            `  ${attempt.id} ${attempt.projectId}: ${attempt.beforeCommit.slice(0, 12)} -> ${(attempt.afterCommit ?? attempt.candidateCommit ?? attempt.beforeCommit).slice(0, 12)} (${status})`,
+            ...(status === "checks-running" ? [
+                `    Job ${result.job.id}; continue with yui task integration continue ${task.id}/${attempt.id}`
+            ] : [])
+        ];
+    });
     return {
         output: `Upstream Integration results for Task ${task.id}:\n${lines.join("\n")}\n`,
         data: { taskId: task.id, integrations: results }

package/dist/commands/workflowCommands.js

@@ -103,7 +103,12 @@ export async function runWorkflowCommandAsync(args, store, options) {
         // failure so the caller knows this path was compromised.
         if (typeof store.rootDirectory === "function") {
             const auditStore = openConfiguredTaskStore(store.rootDirectory());
-            recordTaskEvent(auditStore, taskId, "release-workflow.run", eventPayload, eventNow);
+            try {
+                recordTaskEvent(auditStore, taskId, "release-workflow.run", eventPayload, eventNow);
+            }
+            finally {
+                auditStore.close();
+            }
         }
         throw error;
     }