agent-merge-broker 0.5.0 → 0.6.0

package/README.md

@@ -45,7 +45,7 @@ It is deliberately **not** an agent framework and **not** a replacement for prot
 
 `0.3.0` was the first public release: the local broker core, the GitHub CLI publishing adapter with auto-merge, and the remote provenance verifier.
 
-`0.5.0` is current. Since the first release the lifecycle has been made recoverable — work can be resubmitted and rescoped after a failure, pre-flight validation runs the same validators integration does, and a publication interrupted partway through can be retried rather than reconciled by hand.
+`0.6.0` is current. Batch manifests are authenticated with a repository Ed25519 identity, post-assembly branch mutation is rejected, interrupted integration state recovers without rebuilding tasks, and the integration loop can run as a supervised per-user service.
 
 The on-disk state, receipt, and provenance formats are versioned, but compatibility is not guaranteed until `1.0.0`. Expect format migrations before then.
 
@@ -80,7 +80,10 @@ npm link
 - `.merge-broker/config.json` — repository policy and commands
 - `.merge-broker/agent-instructions.md` — a reusable worker contract
 
-Runtime state, receipt records, manifests, locks, and integration worktrees live under Git's common directory. Every linked worktree therefore sees the same broker state, while runtime artifacts do not pollute commits.
+It also creates an Ed25519 provenance private key, mode `0600`, under Git's common runtime directory.
+Only its public key is written to the committed configuration. Runtime state, receipt records,
+manifests, keys, locks, and integration worktrees therefore stay outside commits while every linked
+worktree sees the same broker authority.
 
 ## Quick start
 
@@ -88,6 +91,7 @@ Initialize an existing Git repository and edit its generated configuration:
 
 ```bash
 merge-broker init --base main --base-ref origin/main --remote origin
+git add .merge-broker && git commit -m 'Configure authenticated merge brokerage'
 merge-broker doctor
 ```
 
@@ -178,29 +182,49 @@ This sets `core.hooksPath`, so it refuses to run when the repository already has
 stop working, and `--uninstall` puts everything back. `MERGE_BROKER_ALLOW_DIRECT_PUSH=1` is the
 deliberate emergency bypass.
 
-A remote gate proves a pull request really is an unaltered broker batch. It reads only Git, so it
-can run before any dependency is installed and reject bypassed work for almost nothing:
+### Publishing without a terminal
+
+`serve` polls for verified batches and publishes them, but only while somebody keeps it running in a
+terminal. When nobody does, a submitted task sits in `submitted` indefinitely — and to the agent
+that submitted it, waiting forever is indistinguishable from being rejected. Install the loop as a
+per-user service instead:
+
+```bash
+merge-broker install-service
+```
+
+This writes a launchd agent on macOS or a systemd user unit on Linux, one per repository, and starts
+it. It is deliberately a *user* service on both platforms: a system daemon would need root and would
+run as the wrong user for the repository's SSH and forge credentials. `--uninstall` removes it, and
+the service writes to `$(git rev-parse --git-common-dir)/merge-broker/serve.log`, including when it
+was installed from a linked worktree whose `.git` is a file.
+
+A remote gate authenticates a pull request as an immutable broker batch. It reads the trusted public
+key from the protected base branch, so it can reject unsigned, forged, or post-assembly work before
+installing dependencies:
 
 ```yaml
 - uses: actions/checkout@v4
   with:
     ref: ${{ github.event.pull_request.head.sha }}
     fetch-depth: 0
-- uses: WeSpitfire/agent-merge-broker/verify@v1
+- uses: WeSpitfire/agent-merge-broker/verify@v0.6.0
 ```
 
-The check confirms that the branch is a broker integration branch, that its manifest was assembled
-on real base history, that the final commit changes nothing but that manifest, that the integrated
-diff matches exactly the paths the receipts account for, that every submitted commit is present, and
-that all recorded validations passed. It accepts the "update branch" merges a protected base
-produces, and rejects a merge that brings in anything the base does not already contain.
+The check verifies the Ed25519 signature, branch and batch identity, real base history, one-file
+manifest commit, integrated diff, submitted commit trail, and recorded validation results. The
+provenance commit must remain the branch head. Even a normal base-update merge can carry arbitrary
+conflict resolution, so any post-assembly merge is rejected; re-cut a stale batch with `batch
+refresh` instead.
 
 Verification policy is read from the configuration committed on the *base* branch, never from the
-change under review.
+change under review. Repositories initialized before `0.6.0` must run `merge-broker provenance
+setup-signing`, commit the resulting public-key policy, and keep the private key outside the working
+tree. Until then verification reports structural-only rather than authenticated provenance.
 
 ## Automatic merging
 
-With `publish.mode` set to `pull-request` and `publish.autoMerge` enabled, the broker enables GitHub auto-merge on each published batch. GitHub lands the pull request once required status checks pass and updates the branch when the base branch requires it. The broker never pushes to the base branch itself, so branch protection remains the authority on what may merge.
+With `publish.mode` set to `pull-request` and `publish.autoMerge` enabled, the broker enables GitHub auto-merge on each published batch. GitHub lands the pull request once required status checks pass. The broker never pushes to the base branch itself, so branch protection remains the authority on what may merge. If the base moves first, re-cut the batch; do not use GitHub's update-branch merge because immutable provenance deliberately rejects it.
 
 Two configuration combinations cannot work and are rejected at load time rather than stalling silently:
 
@@ -250,7 +274,13 @@ forge that fails halfway leaves a published batch carrying a `publishWarning` ra
 whose pull request exists but whose state does not admit it. Running `batch publish` again finds the
 existing pull request and retries what is left.
 
-A process that dies mid-integration leaves its lock behind. A holder on this machine is reclaimed automatically once its process is gone, but a holder on another machine cannot be probed at all and would otherwise block integration for the full stale window. `merge-broker unlock` reports lock state and releases a lock whose owner is provably gone; `--force` overrides that check and should follow confirming that no integration is running.
+A process that dies mid-integration can leave both a lock and durable `running` state. A holder on
+this machine is reclaimed automatically once its process is gone; a holder on another machine cannot
+be probed and waits out the stale window. Once the integration lock is safely acquired, `serve` and
+`integrate` automatically mark the abandoned batch failed, clean its broker-owned worktree and
+branch, and return its tasks to `submitted` without spending their attempt budget. `merge-broker
+recover` performs that reconciliation explicitly. `unlock --force` remains only for an owner that
+cannot be proven gone and must follow confirming no integration is active.
 
 ## Housekeeping
 
@@ -298,7 +328,9 @@ The generated `.merge-broker/config.json` is intentionally explicit and reviewab
     "maxAttempts": 3,
     "provenance": {
       "enabled": true,
-      "directory": ".merge-broker/attestations"
+      "directory": ".merge-broker/attestations",
+      "requireSignature": true,
+      "publicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\n"
     }
   },
   "validation": {
@@ -330,8 +362,9 @@ The generated `.merge-broker/config.json` is intentionally explicit and reviewab
 Validator commands run inside the isolated integration worktree, under `/bin/sh` unless
 `validation.shell` names another interpreter. The shell is deliberately fixed and is never a login
 shell: an integration decision must not depend on whose machine assembled the batch. The environment
-is inherited from the process that invoked the broker, minus `MERGE_BROKER_TOKEN`, so PATH and
-toolchain managers work while worker credentials stay out of repository-defined commands.
+is inherited from the process that invoked the broker, minus `MERGE_BROKER_TOKEN`,
+`MERGE_BROKER_SIGNING_KEY`, and `MERGE_BROKER_SIGNING_KEY_FILE`, so PATH and toolchain managers work
+while broker credentials stay out of repository-defined commands.
 
 Validators receive these environment variables:
 
@@ -353,8 +386,8 @@ The JSON schemas in [`schemas/`](schemas/) can be used by editors, adapters, and
 ### One authoritative CI pass
 
 Repositories that make GitHub the authoritative validator can leave broker
-authoritative validators empty, keep provenance enabled, and reject any PR
-without a valid broker manifest before installing dependencies. The full lint,
+authoritative validators empty, require signed provenance, and reject any PR
+without an authenticated broker manifest before installing dependencies. The full lint,
 type, test, and build suite then runs exactly once on the assembled broker PR.
 Task worktrees retain only fast changed-scope feedback, while deployment builds
 the already-checked revision without repeating the whole suite.
@@ -364,7 +397,9 @@ the already-checked revision without repeating the whole suite.
 ```text
 merge-broker init
 merge-broker doctor
+merge-broker provenance setup-signing [--private-key <path>] [--rotate]
 merge-broker install-hooks [--force] [--uninstall]
+merge-broker install-service [--uninstall] [--interval <seconds>] [--no-eager]
 merge-broker verify-provenance --branch <ref> --head <sha> --base <sha>
 merge-broker validate [--task <id>] [--scope focused|authoritative|all] [--base <ref>] [--cwd <path>]
 merge-broker task register|claim|extend|heartbeat|submit|retry|release|cancel|show
@@ -377,6 +412,7 @@ merge-broker metrics
 merge-broker events
 merge-broker prune [--older-than <days>] [--dry-run]
 merge-broker unlock [state|integration] [--force]
+merge-broker recover
 merge-broker serve [--publish] [--eager]
 ```
 

package/dist/broker.d.ts

@@ -1,7 +1,8 @@
 import { GitRepository } from "./git.js";
 import { StateStore, type LockStatus } from "./store.js";
 import { type HookInstallation } from "./hooks.js";
-import type { BatchRecord, BrokerConfig, BrokerState, IntegrationOptions, IntegrationResult, LocalValidationResult, RefreshResult, PruneOptions, PruneResult, SchedulePlan, TaskRecord } from "./types.js";
+import { type ServiceInstallation } from "./service.js";
+import type { BatchRecord, BrokerConfig, BrokerState, IntegrationOptions, IntegrationResult, LocalValidationResult, RefreshResult, RecoveryResult, PruneOptions, PruneResult, SchedulePlan, TaskRecord } from "./types.js";
 export interface RegisterTaskInput {
     id: string;
     title?: string;
@@ -35,6 +36,19 @@ export declare class MergeBroker {
         configPath: string;
         created: boolean;
     }>;
+    /**
+     * Enables authenticated provenance for an existing repository or rotates/imports its identity.
+     * The private key stays in Git's runtime state; configuration receives only the public key.
+     */
+    setupProvenanceSigning(options?: {
+        privateKeyFile?: string;
+        rotate?: boolean;
+    }): Promise<{
+        publicKey: string;
+        keyId: string;
+        keyPath: string;
+    }>;
+    private provenanceSigningPrivateKey;
     registerTask(input: RegisterTaskInput): Promise<TaskRecord>;
     claimTask(input: ClaimTaskInput): Promise<{
         task: TaskRecord;
@@ -81,6 +95,12 @@ export declare class MergeBroker {
         cwd?: string;
     }): Promise<LocalValidationResult>;
     integrate(options?: IntegrationOptions): Promise<IntegrationResult>;
+    private recoverAbandonedIntegrationsLocked;
+    /**
+     * Recovers durable `running` state left by a killed integration process. Acquiring the integration
+     * lock is the proof that the former process is no longer allowed to make progress.
+     */
+    recoverAbandonedIntegrations(): Promise<RecoveryResult>;
     publishBatch(id: string): Promise<BatchRecord>;
     syncBatch(id: string): Promise<BatchRecord>;
     syncPublishedBatches(): Promise<{
@@ -136,6 +156,26 @@ export declare class MergeBroker {
         force?: boolean;
         uninstall?: boolean;
     }): Promise<HookInstallation>;
+    /**
+     * Installs the integration loop as a per-user service.
+     *
+     * Without it `serve` only runs while a terminal is open, so a submitted task
+     * waits for a human to notice — indistinguishable, to the agent that
+     * submitted it, from the broker rejecting the work.
+     */
+    installService(options?: {
+        uninstall?: boolean;
+        intervalSeconds?: number;
+        eager?: boolean;
+        nodePath?: string;
+        cliPath?: string;
+        pathEntries?: string[];
+        logFile?: string;
+    }): Promise<ServiceInstallation | {
+        name: string;
+        file: string;
+        removed: boolean;
+    }>;
     inspectLocks(): Promise<LockStatus[]>;
     releaseLock(name: string, options?: {
         force?: boolean;

package/dist/broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../src/broker.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AASzD,OAAO,EAAgC,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,UAAU,EAEX,MAAM,YAAY,CAAC;AAmMpB,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,WAAW;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B,OAAO,eAIN;IAED,OAAa,IAAI,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAM3D;IAED,OAAa,UAAU,CACrB,GAAG,SAAgB,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GACxF,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAUrE;IAEK,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BhE;IAEK,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAwEvG;IAEK,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBlE;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2B5F;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBxG;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAyBvG;IAEK,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BnE;IAEK,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GACpC,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAuHpD;IAEK,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CAElC;IAEK,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE9C;IAEK,IAAI,CAAC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAKzF;IAED;;;;;;;;;;OAUG;IACG,mBAAmB,CACvB,OAAO,GAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,KAAK,CAAC;QAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;KACT,GACL,OAAO,CAAC,qBAAqB,CAAC,CAkDhC;IAEK,SAAS,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuQ5E;IAEK,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA2EnD;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BhD;IAEK,oBAAoB,IAAI,OAAO,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,CAAC;QACtB,MAAM,EAAE,WAAW,EAAE,CAAC;QACtB,SAAS,EAAE,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACnD,CAAC,CAkBD;IAED;;;OAGG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BjE;IAED;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC,aAAa,CAAC,CAuExB;IAEK,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,SAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBjG;IAEK,cAAc,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACjG,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,qBAAqB,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC,CAgCD;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAoC5D;IAEK,YAAY,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAOpG;IAEK,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAE1C;IAEK,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAStF;IAEK,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyChD;IAEK,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsC/C;CACF"}
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../src/broker.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAezD,OAAO,EAAgC,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,UAAU,EAEX,MAAM,YAAY,CAAC;AAmMpB,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,WAAW;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B,OAAO,eAIN;IAED,OAAa,IAAI,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAM3D;IAED,OAAa,UAAU,CACrB,GAAG,SAAgB,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GACxF,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAiBrE;IAED;;;OAGG;IACG,sBAAsB,CAAC,OAAO,GAAE;QACpC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;KACb,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAiBtE;YAEa,2BAA2B;IAqCnC,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BhE;IAEK,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAwEvG;IAEK,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBlE;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2B5F;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBxG;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAyBvG;IAEK,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BnE;IAEK,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GACpC,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAuHpD;IAEK,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CAElC;IAEK,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE9C;IAEK,IAAI,CAAC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAKzF;IAED;;;;;;;;;;OAUG;IACG,mBAAmB,CACvB,OAAO,GAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,KAAK,CAAC;QAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;KACT,GACL,OAAO,CAAC,qBAAqB,CAAC,CAkDhC;IAEK,SAAS,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmR5E;YAEa,kCAAkC;IAyFhD;;;OAGG;IACG,4BAA4B,IAAI,OAAO,CAAC,cAAc,CAAC,CAE5D;IAEK,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA2EnD;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BhD;IAEK,oBAAoB,IAAI,OAAO,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,CAAC;QACtB,MAAM,EAAE,WAAW,EAAE,CAAC;QACtB,SAAS,EAAE,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACnD,CAAC,CAkBD;IAED;;;OAGG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BjE;IAED;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC,aAAa,CAAC,CA8ExB;IAEK,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,SAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBjG;IAEK,cAAc,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACjG,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,qBAAqB,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC,CAgCD;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAoC5D;IAEK,YAAY,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAOpG;IAED;;;;;;OAMG;IACG,cAAc,CAAC,OAAO,GAAE;QAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,mBAAmB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CA+BvF;IAEK,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAE1C;IAEK,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAStF;IAEK,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyChD;IAEK,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmE/C;CACF"}

package/dist/broker.js

@@ -1,15 +1,17 @@
 import path from "node:path";
 import { createHash, randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
 import { BrokerError, CommandError, ValidationError } from "./errors.js";
 import { GitRepository } from "./git.js";
-import { initializeConfig, loadConfig } from "./config.js";
+import { initializeConfig, loadConfig, writeConfig } from "./config.js";
 import { patternSetsMayOverlap, unexpectedPaths } from "./patterns.js";
 import { scheduleTasks } from "./scheduler.js";
 import { StateStore } from "./store.js";
 import { runValidators } from "./validation.js";
 import { closePullRequest, enableAutoMerge, inspectPullRequest, publishBatch as publishPreparedBatch, } from "./publisher.js";
-import { buildBatchProvenance, provenancePath } from "./provenance.js";
+import { buildBatchProvenance, provenanceKeyId, provenancePath, publicKeyFromPrivate, signBatchProvenance, } from "./provenance.js";
 import { installHooks, uninstallHooks } from "./hooks.js";
+import { installService, uninstallService, } from "./service.js";
 function now() {
     return new Date().toISOString();
 }
@@ -189,8 +191,62 @@ export class MergeBroker {
         const initialized = await initializeConfig(repo.root, options);
         const store = new StateStore(repo.commonGitDir, initialized.config.stateDirectory, initialized.config.leases.lockTimeoutSeconds);
         await store.initialize();
+        const provenance = initialized.config.integration.provenance;
+        if (initialized.created && provenance?.enabled) {
+            const identity = await store.provisionProvenanceSigningKey();
+            provenance.requireSignature = true;
+            provenance.publicKey = identity.publicKey;
+            await writeConfig(repo.root, initialized.config);
+        }
         return { repoRoot: repo.root, configPath: initialized.path, created: initialized.created };
     }
+    /**
+     * Enables authenticated provenance for an existing repository or rotates/imports its identity.
+     * The private key stays in Git's runtime state; configuration receives only the public key.
+     */
+    async setupProvenanceSigning(options = {}) {
+        const privateKey = options.privateKeyFile
+            ? await readFile(path.resolve(options.privateKeyFile), "utf8")
+            : undefined;
+        const identity = await this.store.provisionProvenanceSigningKey({
+            ...(privateKey ? { privateKey } : {}),
+            rotate: options.rotate ?? false,
+        });
+        this.config.integration.provenance ??= {
+            enabled: true,
+            directory: ".merge-broker/attestations",
+        };
+        this.config.integration.provenance.enabled = true;
+        this.config.integration.provenance.requireSignature = true;
+        this.config.integration.provenance.publicKey = identity.publicKey;
+        await writeConfig(this.repo.root, this.config);
+        return identity;
+    }
+    async provenanceSigningPrivateKey() {
+        const provenance = this.config.integration.provenance;
+        if (!provenance?.enabled || !provenance.publicKey) {
+            if (provenance?.requireSignature) {
+                throw new BrokerError("SIGNING_KEY_REQUIRED", "Signed provenance is required, but configuration has no trusted public key. Run `merge-broker provenance setup-signing`.");
+            }
+            return undefined;
+        }
+        const fromEnvironment = process.env.MERGE_BROKER_SIGNING_KEY;
+        const fromFile = process.env.MERGE_BROKER_SIGNING_KEY_FILE
+            ? await readFile(path.resolve(process.env.MERGE_BROKER_SIGNING_KEY_FILE), "utf8")
+            : undefined;
+        const privateKey = fromEnvironment ?? fromFile ?? (await this.store.readProvenanceSigningKey(provenance.publicKey));
+        if (!privateKey) {
+            if (!provenance.requireSignature)
+                return undefined;
+            throw new BrokerError("SIGNING_KEY_REQUIRED", `Signed provenance is required, but the private key is unavailable. Restore ${this.store.provenanceSigningKeyFile}, set MERGE_BROKER_SIGNING_KEY_FILE, or import it with \`merge-broker provenance setup-signing --private-key <path>\`.`);
+        }
+        const expectedKeyId = provenanceKeyId(provenance.publicKey);
+        const actualKeyId = provenanceKeyId(publicKeyFromPrivate(privateKey));
+        if (expectedKeyId !== actualKeyId) {
+            throw new BrokerError("SIGNING_KEY_MISMATCH", "The available provenance private key does not match the public key committed in configuration.", { expectedKeyId, actualKeyId });
+        }
+        return privateKey;
+    }
     async registerTask(input) {
         assertTaskId(input.id);
         if (input.priority !== undefined && !Number.isInteger(input.priority)) {
@@ -589,6 +645,13 @@ export class MergeBroker {
     }
     async integrate(options = {}) {
         return await this.store.withIntegrationLock(async () => {
+            // A killed process can leave durable state at `running`/`integrating` after its lock is gone.
+            // Owning the integration lock proves nobody else can still be advancing that transaction, so
+            // recover it before planning. This also lets the recovered tasks participate immediately.
+            await this.recoverAbandonedIntegrationsLocked();
+            // Key problems are operator/configuration failures, not task failures. Resolve them before
+            // tasks move to `integrating`, so a missing key cannot spend a worker's retry budget.
+            const signingPrivateKey = await this.provenanceSigningPrivateKey();
             // One batch in flight at a time.
             //
             // A batch is cut from the base branch tip so it is born mergeable. Cutting a second one while
@@ -705,13 +768,19 @@ export class MergeBroker {
                     const integratedHeadSha = headSha;
                     const integratedPaths = await this.repo.changedFilesBetween(baseSha, integratedHeadSha);
                     const relativePath = provenancePath(provenance.directory, id);
-                    const record = buildBatchProvenance({
+                    let record = buildBatchProvenance({
                         batch,
                         tasks: plan.selected,
                         integratedHeadSha,
                         integratedPaths,
                         history: this.config.integration.history,
                     });
+                    if (signingPrivateKey && provenance.publicKey) {
+                        record = signBatchProvenance(record, signingPrivateKey, provenance.publicKey);
+                    }
+                    else if (provenance.requireSignature) {
+                        throw new BrokerError("SIGNING_KEY_REQUIRED", "Signed provenance is required for this batch.");
+                    }
                     headSha = await this.repo.commitGeneratedFile(worktree, relativePath, `${JSON.stringify(record, null, 2)}\n`, `Record Merge Broker batch ${id}`);
                     batch.integratedHeadSha = integratedHeadSha;
                     batch.provenancePath = relativePath;
@@ -837,6 +906,104 @@ export class MergeBroker {
             };
         });
     }
+    async recoverAbandonedIntegrationsLocked() {
+        const snapshot = await this.store.read();
+        const running = Object.values(snapshot.batches).filter((batch) => batch.status === "running");
+        if (running.length === 0) {
+            return {
+                batches: [],
+                tasks: [],
+                worktreesRemoved: [],
+                branchesRemoved: [],
+                cleanupWarnings: [],
+            };
+        }
+        const recovered = await this.store.transaction((state, audit) => {
+            const batches = [];
+            const tasks = [];
+            for (const candidate of running) {
+                const batch = state.batches[candidate.id];
+                if (!batch || batch.status !== "running")
+                    continue;
+                batch.status = "failed";
+                batch.error = "Integration process stopped before the transaction completed; tasks were recovered for retry.";
+                batch.finishedAt = now();
+                batches.push(batch.id);
+                const requeued = [];
+                for (const taskId of batch.taskIds) {
+                    const task = state.tasks[taskId];
+                    if (!task || task.status !== "integrating" || task.batchId !== batch.id)
+                        continue;
+                    task.status = "submitted";
+                    task.updatedAt = now();
+                    delete task.batchId;
+                    delete task.lastError;
+                    tasks.push(taskId);
+                    requeued.push(taskId);
+                }
+                audit("batch.recovered", {
+                    batchId: batch.id,
+                    details: { requeued, reason: "abandoned integration transaction" },
+                });
+            }
+            return { batches, tasks };
+        });
+        const worktreesRemoved = [];
+        const branchesRemoved = [];
+        const cleanupWarnings = [];
+        const registeredWorktrees = new Set((await this.repo.listWorktrees()).map((worktree) => path.resolve(worktree.path)));
+        const worktreeRoot = `${path.resolve(this.store.worktreesDirectory)}${path.sep}`;
+        for (const batchId of recovered.batches) {
+            const candidate = running.find((batch) => batch.id === batchId);
+            const worktree = candidate?.worktree ? path.resolve(candidate.worktree) : undefined;
+            if (worktree && registeredWorktrees.has(worktree)) {
+                if (!worktree.startsWith(worktreeRoot)) {
+                    cleanupWarnings.push(`Refused to remove recovery worktree outside broker state: ${worktree}`);
+                }
+                else {
+                    try {
+                        await this.repo.removeWorktree(worktree);
+                        worktreesRemoved.push(worktree);
+                    }
+                    catch (error) {
+                        cleanupWarnings.push(errorMessage(error));
+                    }
+                }
+            }
+            const branchName = cleanBranchFragment(`${this.config.integration.branchPrefix}${batchId}`);
+            const branch = await this.repo.git(["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`], this.repo.root, true);
+            if (branch.exitCode === 0) {
+                const deleted = await this.repo.git(["branch", "-D", "--", branchName], this.repo.root, true);
+                if (deleted.exitCode === 0)
+                    branchesRemoved.push(branchName);
+                else
+                    cleanupWarnings.push(`Could not remove recovery branch ${branchName}: ${deleted.stderr.trim()}`);
+            }
+        }
+        await this.store.transaction((state, audit) => {
+            for (const batchId of recovered.batches) {
+                const batch = state.batches[batchId];
+                if (!batch)
+                    continue;
+                if (worktreesRemoved.includes(path.resolve(batch.worktree ?? "")))
+                    delete batch.worktree;
+                if (cleanupWarnings.length > 0) {
+                    batch.error = `${batch.error ?? "Integration was recovered."} Cleanup: ${cleanupWarnings.join("; ")}`;
+                }
+            }
+            audit("integration.recovery_completed", {
+                details: { ...recovered, worktreesRemoved, branchesRemoved, cleanupWarnings },
+            });
+        });
+        return { ...recovered, worktreesRemoved, branchesRemoved, cleanupWarnings };
+    }
+    /**
+     * Recovers durable `running` state left by a killed integration process. Acquiring the integration
+     * lock is the proof that the former process is no longer allowed to make progress.
+     */
+    async recoverAbandonedIntegrations() {
+        return await this.store.withIntegrationLock(async () => await this.recoverAbandonedIntegrationsLocked());
+    }
     async publishBatch(id) {
         const state = await this.store.read();
         const batch = requireBatch(state, id);
@@ -1045,6 +1212,9 @@ export class MergeBroker {
         let pullRequestClosed;
         if (batch.pullRequestUrl) {
             pullRequestClosed = await closePullRequest(this.repo.root, batch.pullRequestUrl, `Superseded: the base branch moved to ${currentBase.slice(0, 7)}, so this batch was re-cut from the current tip.`);
+            if (!pullRequestClosed) {
+                throw new BrokerError("PULL_REQUEST_CLOSE_FAILED", `Could not close superseded pull request ${batch.pullRequestUrl}. The existing batch and its tasks were left unchanged so two mergeable copies cannot exist. Retry when the forge responds.`, { batchId: id, pullRequestUrl: batch.pullRequestUrl });
+            }
         }
         if (batch.branchName)
             await this.repo.deleteBranch(batch.branchName);
@@ -1188,6 +1358,43 @@ export class MergeBroker {
             force: options.force ?? false,
         });
     }
+    /**
+     * Installs the integration loop as a per-user service.
+     *
+     * Without it `serve` only runs while a terminal is open, so a submitted task
+     * waits for a human to notice — indistinguishable, to the agent that
+     * submitted it, from the broker rejecting the work.
+     */
+    async installService(options = {}) {
+        if (options.uninstall)
+            return await uninstallService(this.repo.root);
+        const nodePath = options.nodePath ?? process.execPath;
+        const cliPath = options.cliPath ?? process.argv[1] ?? "";
+        if (!path.isAbsolute(cliPath)) {
+            throw new BrokerError("SERVICE_CLI_PATH", "Could not determine an absolute path to the broker CLI. Pass --cli-path.");
+        }
+        return await installService({
+            repositoryRoot: this.repo.root,
+            nodePath,
+            cliPath,
+            intervalSeconds: options.intervalSeconds ?? 15,
+            eager: options.eager ?? true,
+            // node's own directory is included because a version-managed node is not
+            // on the default PATH a login-less agent receives.
+            pathEntries: options.pathEntries ?? [
+                path.dirname(nodePath),
+                "/opt/homebrew/bin",
+                "/usr/local/bin",
+                "/usr/bin",
+                "/bin",
+                "/usr/sbin",
+                "/sbin",
+            ],
+            // `.git` is a file in linked worktrees. Runtime state already resolves Git's common directory,
+            // which is the one log location every checkout can safely create and inspect.
+            logFile: options.logFile ?? path.join(this.store.directory, "serve.log"),
+        });
+    }
     async inspectLocks() {
         return await Promise.all(["state", "integration"].map(async (name) => await this.store.inspectLock(name)));
     }
@@ -1240,15 +1447,40 @@ export class MergeBroker {
         };
     }
     async doctor() {
-        const [baseSha, clean, worktrees, locks] = await Promise.all([
+        const [baseSha, clean, worktrees, locks, state] = await Promise.all([
             this.repo.resolveCommit(this.config.baseRef),
             this.repo.isClean(),
             this.repo.listWorktrees(),
             this.inspectLocks(),
+            this.store.read(),
         ]);
         const warnings = [];
+        let ok = true;
+        const provenance = this.config.integration.provenance;
+        let signingKeyId;
+        if (provenance?.enabled && provenance.requireSignature) {
+            try {
+                await this.provenanceSigningPrivateKey();
+                if (provenance.publicKey)
+                    signingKeyId = provenanceKeyId(provenance.publicKey);
+            }
+            catch (error) {
+                ok = false;
+                warnings.push(errorMessage(error));
+            }
+        }
+        else if (provenance?.enabled) {
+            warnings.push("Provenance signatures are not required, so remote verification can confirm structure but cannot authenticate which broker created it. Run `merge-broker provenance setup-signing`.");
+        }
         if (this.config.validation.focused.length === 0 && this.config.validation.authoritative.length === 0) {
-            warnings.push("No validators are configured, so batches are assembled without being checked. Configure validation.authoritative, or rely on a remote gate that verifies broker provenance.");
+            warnings.push("No validators are configured, so batches are assembled without being checked. Configure validation.authoritative or require an authoritative remote CI suite on every batch PR.");
+        }
+        const runningBatches = Object.values(state.batches)
+            .filter((batch) => batch.status === "running")
+            .map((batch) => batch.id);
+        if (runningBatches.length > 0) {
+            ok = false;
+            warnings.push(`Integration state is incomplete for ${runningBatches.join(", ")}. Run \`merge-broker recover\` after confirming no broker process is active.`);
         }
         for (const lock of locks) {
             if (!lock.held)
@@ -1256,7 +1488,7 @@ export class MergeBroker {
             warnings.push(`The ${lock.name} lock is held${lock.owner?.host ? ` by ${lock.owner.host}` : ""} and is ${Math.round((lock.ageMs ?? 0) / 1_000)}s old${lock.abandoned ? "; its owning process is gone, so \"merge-broker unlock\" can clear it" : ""}.`);
         }
         return {
-            ok: true,
+            ok,
             warnings,
             locks,
             repository: this.repo.root,
@@ -1271,6 +1503,9 @@ export class MergeBroker {
             publishMode: this.config.publish.mode,
             focusedValidators: this.config.validation.focused.map((validator) => validator.name),
             authoritativeValidators: this.config.validation.authoritative.map((validator) => validator.name),
+            provenanceAuthenticated: Boolean(provenance?.enabled && provenance.requireSignature && signingKeyId),
+            provenanceKeyId: signingKeyId,
+            runningBatches,
         };
     }
 }