atris 3.33.3 → 3.35.0

package/lib/auto-accept-certified.js

@@ -3,9 +3,13 @@
 const { spawnSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
-const { taskProofState } = require('./task-proof');
+const { taskProofState, taskProofExecutionState } = require('./task-proof');
+const reviewIntegrity = require('./review-integrity');
 
 const AGENT_CERTIFICATION_REVIEW_PASSES = 2;
+// Kept for compat with older callers/tests; the pass-count landing lane it
+// once powered is gone. Passes alone never land work, an independent
+// reviewer does.
 const AUTO_ACCEPT_HIGH_CONFIDENCE_PASSES = 3;
 const DENIED_TAGS = new Set(['billing', 'deploy', 'feedback', 'voice', 'security', 'customer', 'external']);
 
@@ -182,13 +186,7 @@ function unmergedPullRequestBoundaryResult(ref, proof) {
 }
 
 function distinctReviewActors(task) {
-  const actors = new Set();
-  for (const event of task.events || []) {
-    if (!['proof_ready', 'reviewed'].includes(event.event_type)) continue;
-    const actor = event.actor || event.payload?.actor;
-    if (actor) actors.add(String(actor));
-  }
-  return actors;
+  return reviewIntegrity.reviewEventActors(task);
 }
 
 function parseVerifyCommand(verify) {
@@ -224,6 +222,10 @@ function parseVerifyCommand(verify) {
   return { ok: true, argv };
 }
 
+function isAutoCertifyVerifyCommandAllowed(verify) {
+  return parseVerifyCommand(verify).ok;
+}
+
 function runVerifyCommand(verify, workspaceRoot) {
   const parsed = parseVerifyCommand(verify);
   if (!parsed.ok) return parsed;
@@ -254,7 +256,7 @@ function strictVerifyMissingResult(ref) {
 }
 
 function evaluateAutoAccept(task, options = {}) {
-  const { strictVerify = false, minPasses = AGENT_CERTIFICATION_REVIEW_PASSES } = options;
+  const { strictVerify = true, minPasses = AGENT_CERTIFICATION_REVIEW_PASSES, acceptAll = false } = options;
   const ref = task.display_id || task.legacy_ref || task.id;
   if (task.status !== 'review') return { eligible: false, ref, reason: 'not_in_review' };
   const metadata = task.metadata || {};
@@ -265,8 +267,45 @@ function evaluateAutoAccept(task, options = {}) {
   }
   if (metadata.auto_accepted_at) return { eligible: false, ref, reason: 'already_auto_accepted' };
 
-  const tag = String(task.tag || '').toLowerCase();
-  if (DENIED_TAGS.has(tag)) return { eligible: false, ref, reason: `denied_tag_${tag}` };
+  // 'deploys', 'infra-deploy', and 'Billing ' are the same lanes as their
+  // exact-match cousins: match denied lanes on whole words with a plural
+  // strip, so a tag variant never slips money/deploy work past the human.
+  const tag = String(task.tag || '').trim().toLowerCase();
+  const deniedTag = [...DENIED_TAGS].find((d) =>
+    tag === d || tag.split(/[^a-z0-9]+/).some((w) => w === d || w.replace(/s$/, '') === d));
+  if (deniedTag) return { eligible: false, ref, reason: `denied_tag_${deniedTag}` };
+
+  // accept-all: the protected lanes above are the only human gate. No
+  // certification, pass-count, reviewer, or proof-quality bar — but work
+  // is never marked done against evidence it isn't: a proof naming an
+  // unmerged draft PR still blocks, and a recorded check that FAILS still
+  // blocks (absence of a check does not).
+  if (acceptAll) {
+    const proof = latestProof(task);
+    if (proofHasUnmergedPullRequestBoundary(proof)) {
+      return unmergedPullRequestBoundaryResult(ref, proof);
+    }
+    const verify = metadata.verify;
+    if (verify) {
+      const verifyResult = runVerifyCommand(verify, task.workspace_root || process.cwd());
+      // A check that runs and fails blocks. So does a check whose worktree
+      // is gone — otherwise the daily reap converts "has a failing check"
+      // into "lands unchecked" the morning after it clears the worktree.
+      // A check that merely isn't in the runnable allowlist counts as no
+      // check at all.
+      if (verifyResult.reason === 'verify_failed' || verifyResult.reason === 'verify_worktree_missing') {
+        return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
+      }
+    }
+    return {
+      eligible: true,
+      ref,
+      reason: 'accept_all_but_protected',
+      passes: reviewPassCount(task),
+      proof,
+      policy: 'all_but_protected',
+    };
+  }
 
   if (!isAgentCertified(task)) return { eligible: false, ref, reason: 'not_agent_certified' };
 
@@ -279,16 +318,28 @@ function evaluateAutoAccept(task, options = {}) {
   }
   const proofCheck = taskProofState(proof);
   if (!proofCheck.ok) return { eligible: false, ref, reason: proofCheck.reason, proof };
+  if (!strictVerify) {
+    const executionCheck = taskProofExecutionState(proof);
+    if (!executionCheck.ok) {
+      return {
+        eligible: false,
+        ref,
+        reason: executionCheck.reason,
+        detail: executionCheck.detail,
+        next_action: 'run an allowed verifier with `atris task ready --verify` or keep strict auto-accept enabled so the verifier executes before landing',
+        proof,
+      };
+    }
+  }
 
   const actors = distinctReviewActors(task);
-  const multiActor = actors.size >= 2;
-  const highConfidence = passes >= AUTO_ACCEPT_HIGH_CONFIDENCE_PASSES;
-  if (!multiActor && !highConfidence) {
+  if (!reviewIntegrity.hasIndependentReview(task)) {
     return {
       eligible: false,
       ref,
-      reason: 'needs_second_reviewer_or_third_pass',
+      reason: 'needs_independent_reviewer',
       passes,
+      builder: reviewIntegrity.taskBuilder(task),
       actors: [...actors],
     };
   }
@@ -306,13 +357,11 @@ function evaluateAutoAccept(task, options = {}) {
   return {
     eligible: true,
     ref,
-    reason: strictVerify
-      ? 'certified_strict_verify'
-      : (highConfidence ? 'certified_high_confidence' : 'certified_multi_actor'),
+    reason: strictVerify ? 'certified_strict_verify' : 'certified_independent_review',
     passes,
     actors: [...actors],
     proof,
-    policy: strictVerify ? 'strict_verify' : (highConfidence ? '3_passes' : '2_actors_2_passes'),
+    policy: strictVerify ? 'strict_verify' : 'independent_reviewer',
   };
 }
 
@@ -321,6 +370,8 @@ module.exports = {
   AUTO_ACCEPT_HIGH_CONFIDENCE_PASSES,
   DENIED_TAGS,
   evaluateAutoAccept,
+  isAutoCertifyVerifyCommandAllowed,
+  isAgentCertified,
   parseVerifyCommand,
   runVerifyCommand,
 };

package/lib/autoland.js

@@ -36,9 +36,23 @@ function writeJson(file, value) {
   fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
 }
 
+// Default is ON: agents are good enough that a growing review queue is
+// latency, not safety — the denied tags keep the irreversible lanes human.
+// A missing policy file means "on, owner inferred"; only an explicit
+// `atris autoland off` (enabled: false) turns it off.
+function inferOwner(root) {
+  const git = spawnSync('git', ['config', 'user.name'], { cwd: root, encoding: 'utf8' });
+  const name = git.status === 0 ? String(git.stdout || '').trim() : '';
+  return name || os.userInfo().username;
+}
+
+function defaultPolicy(root) {
+  return { enabled: true, enabled_by: inferOwner(root), enabled_at: null, default: true };
+}
+
 function readPolicy(root) {
   const policy = readJson(policyPath(root), null);
-  if (!policy || typeof policy !== 'object') return null;
+  if (!policy || typeof policy !== 'object') return defaultPolicy(root);
   return policy;
 }
 
@@ -218,6 +232,15 @@ function dejargon(line) {
     .trim();
 }
 
+// The clarity gate in one call: strip what an operator can't act on (flag
+// dashes, task ids, snake_case) and close the sentence on a whole clause, so
+// any title or line borrowed from the queue reaches a human actionable at a
+// glance. One sentence in, one operator-ready sentence out — content always
+// ships, the gate only changes how it reads.
+function clarify(text, max = 160) {
+  return finishThought(dejargon(text), max);
+}
+
 // The mission loop files a check-off every time it stops instead of
 // inventing work; those all say the same thing, so they collapse into one line.
 function isCleanStop(item) {
@@ -230,7 +253,7 @@ function isCleanStop(item) {
 // because "7 things landed" tells the score, not the story — and it always
 // ends with what's waiting and what to do next, because those are the only
 // lines that ask anything of the reader.
-function composeDigest({ accepted, waiting, landed, project, nextMoves = [] }) {
+function composeDigest({ accepted, waiting, landed, project, nextMoves = [], acceptAll = false, reapError = null, janitor = null }) {
   const lines = [];
   lines.push(`atris ${project}: yesterday`);
   const autoCount = accepted.auto.length;
@@ -250,7 +273,11 @@ function composeDigest({ accepted, waiting, landed, project, nextMoves = [] }) {
     const visibleWork = [...ready, ...rough].slice(0, 3);
     const held = Math.max(0, work.length - visibleWork.length) + (stops.length > 0 ? 1 : 0);
     if (visibleWork.length > 0) {
-      lines.push('landed on their own (verified twice, proof on file):');
+      // The header states the actual bar: under accept-all the claim
+      // "verified twice" would be a lie the operator builds trust on.
+      lines.push(acceptAll
+        ? 'landed on their own (protected lanes held back for you):'
+        : 'landed on their own (verified twice, proof on file):');
       for (const { item, line } of visibleWork) {
         lines.push('');
         lines.push(`- ${line || item.ref}${item.member ? ` (${item.member})` : ''}`);
@@ -273,6 +300,14 @@ function composeDigest({ accepted, waiting, landed, project, nextMoves = [] }) {
   if (landed && landed.branches > 0) {
     lines.push(`in the air: ${plur(landed.branches, 'piece')}${landed.due > 0 ? `, ${landed.due} overdue` : ', all fresh'} (atris land)`);
   }
+  if (reapError) lines.push(`cleanup trouble: the daily sweep failed (${reapError}) — run: atris land --reap`);
+  // The janitor's day in one line: stale paused missions stopped and merged
+  // worktrees cleared since the last digest. Silence when it did nothing.
+  const missionsStopped = Number(janitor?.missions_stopped) || 0;
+  const worktreesReaped = Number(janitor?.worktrees_reaped) || 0;
+  if (missionsStopped > 0 || worktreesReaped > 0) {
+    lines.push(`tidied up: ${plur(missionsStopped, 'stale mission')} stopped, ${plur(worktreesReaped, 'merged worktree')} cleared`);
+  }
   // nextMoves: array of {title, owner}, or {moves, unexplained} where
   // unexplained counts queue items whose sentence carries no operator why.
   // Those are counted, not shown — a raw title the reader can't act on is
@@ -367,6 +402,7 @@ module.exports = {
   DEFAULT_DIGEST_HOUR,
   acceptedInLastDay,
   buildCronLine,
+  clarify,
   composeAlarm,
   composeDigest,
   composeLiveUpdate,

package/lib/fleet.js

@@ -15,6 +15,7 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const { RUNNER_PROFILE_DEFS, buildRunnerCommand } = require('./runner-command');
+const { listWorktrees } = require('../commands/worktree');
 
 // Lanes a fleet may never staff on its own: the human keeps irreversible
 // calls. Mirrors the autoland denied lanes.
@@ -43,6 +44,8 @@ function buildFleetPrompt(task, { worktreePath } = {}) {
   const title = String(task.title || '').trim();
   const { done, check } = parseDoneCheck(title);
   const lines = [
+    'First, run `atris worktree guard`; if it fails, stop immediately, report back, and do not edit anything. Do this before any file edit.',
+    '',
     `You are working task ${ref} in this repo checkout (an isolated git worktree${worktreePath ? ` at ${worktreePath}` : ''} — commit here, NEVER push).`,
     '',
     `Task: ${title}`,
@@ -70,6 +73,28 @@ function buildFleetPrompt(task, { worktreePath } = {}) {
 // their own permissions.
 const FLEET_ALLOWED_TOOLS = 'Bash,Read,Edit,Write,Grep,Glob';
 
+function realpathOrResolve(value) {
+  const resolved = path.resolve(String(value));
+  try {
+    return fs.realpathSync(resolved);
+  } catch {
+    return resolved;
+  }
+}
+
+function assertIsolatedWorktree(worktreePath, root = process.cwd()) {
+  if (!worktreePath) {
+    throw new Error('fleet dispatch blocked: worktreePath is required; refusing to dispatch without an isolated worktree');
+  }
+  const resolvedWorktree = realpathOrResolve(worktreePath);
+  const worktrees = listWorktrees(root);
+  const primaryRoot = realpathOrResolve(worktrees[0]?.path || root);
+  if (resolvedWorktree === primaryRoot) {
+    throw new Error(`fleet dispatch blocked: worktreePath resolves to the primary repo checkout (${primaryRoot}); refusing to dispatch outside an isolated worktree`);
+  }
+  return { worktreePath: resolvedWorktree, primaryRoot };
+}
+
 function buildEngineCommand(engineName, promptFile) {
   if (!RUNNER_PROFILE_DEFS[engineName]) throw new Error(`unknown engine "${engineName}"`);
   const prev = process.env.ATRIS_RUNNER_PROFILE;
@@ -89,9 +114,12 @@ function buildEngineCommand(engineName, promptFile) {
 
 // Run one engine on one task in one worktree. Blocking; the conductor runs
 // dispatches in parallel via child processes, not threads. `runner` is
-// injectable for tests.
-function dispatchToEngine({ task, engine, worktreePath, timeoutMs = 900000, runner = null }) {
-  const prompt = buildFleetPrompt(task, { worktreePath });
+// injectable for tests. `prompt` is injectable too: a caller-supplied prompt
+// (e.g. `atris engine dispatch --prompt-file`) skips the generated
+// buildFleetPrompt text entirely.
+function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), timeoutMs = 900000, runner = null, prompt: promptOverride = '' }) {
+  assertIsolatedWorktree(worktreePath, root);
+  const prompt = promptOverride || buildFleetPrompt(task, { worktreePath });
   const promptFile = path.join(worktreePath, '.atris', `fleet-prompt-${task.display_id || 'task'}.md`);
   fs.mkdirSync(path.dirname(promptFile), { recursive: true });
   fs.writeFileSync(promptFile, prompt);
@@ -118,12 +146,24 @@ function dispatchToEngine({ task, engine, worktreePath, timeoutMs = 900000, runn
 
 function taskTags(task) {
   const fromTags = Array.isArray(task.tags) ? task.tags : [];
+  // Tags added after creation live in metadata.tags (`atris task tag`); a
+  // fleet that only read task.tags/title hashtags would ignore an owner-hold
+  // flag stamped on a live task and keep restaffing it (CLI-879).
+  const fromMeta = task && task.metadata && Array.isArray(task.metadata.tags) ? task.metadata.tags : [];
   const fromTitle = (String(task.title || '').match(/#([a-z0-9-]+)/gi) || []).map((t) => t.slice(1));
-  return [...fromTags, ...fromTitle].map((t) => String(t).toLowerCase());
+  return [...fromTags, ...fromMeta, ...fromTitle].map((t) => String(t).toLowerCase());
+}
+
+// A task flagged for a human decision is never fleet-staffable, whatever its
+// lane. Mirrors the sweep's needs-human hold so both loops agree.
+function isHumanHoldTag(tag) {
+  const normalized = String(tag).trim().toLowerCase().replace(/_/g, '-');
+  return normalized === 'needs-human' || normalized === 'needshuman';
 }
 
 function isSafeLane(task) {
   const tags = taskTags(task);
+  if (tags.some(isHumanHoldTag)) return false;
   return !tags.some((t) => DENIED_TAGS.includes(t));
 }
 
@@ -177,6 +217,20 @@ function assignEngines(staffed, engines) {
 // Land one arrival: rebase onto latest base first; a conflict pauses the
 // landing (never auto-resolve) and reports which files collided so the
 // conductor or a human can take it. `git` is injectable for tests.
+// Fleet landings always target master. Without the explicit --target, ship
+// falls back to the launcher branch's atris-base — a flight launched from a
+// feature-branch checkout would merge PRs into that branch while the receipt
+// and land board define "landed" as in-master (PRs #207/#208, 2026-07-04).
+function fleetShipArgs(entry, check) {
+  return [
+    'worktree', 'ship',
+    '--message', `${String(entry.task.title || '').split(/[.:]/)[0].slice(0, 90)} (${entry.task.display_id}, built by ${entry.engine})`,
+    '--verify', check,
+    '--target', 'origin/master',
+    '--merge',
+  ];
+}
+
 function landArrival({ worktreePath, git = null }) {
   const run = git || ((args) => spawnSync('git', args, { cwd: worktreePath, encoding: 'utf8' }));
   const fetch = run(['fetch', 'origin']);
@@ -199,17 +253,22 @@ module.exports = {
   get FLEET_CAPABLE() { return FLEET_CAPABLE; },
   get runFleetFlight() { return runFleetFlight; },
   get focusedCheck() { return focusedCheck; },
+  get dispatchCheck() { return dispatchCheck; },
+  get runDispatchFlight() { return runDispatchFlight; },
   parseDoneCheck,
   buildFleetPrompt,
+  assertIsolatedWorktree,
   buildEngineCommand,
   dispatchToEngine,
   taskTags,
+  isHumanHoldTag,
   isSafeLane,
   fileSurface,
   surfacesOverlap,
   staffFlight,
   assignEngines,
   landArrival,
+  fleetShipArgs,
 };
 
 // ---------------------------------------------------------------------------
@@ -245,8 +304,46 @@ function defaultOwnCli(root) {
 // gates (npm test, CI) stay at the ship gate, not per-arrival.
 function focusedCheck(task) {
   const { check } = parseDoneCheck(task.title);
-  const m = check.match(/node --test [^,;.]+/);
-  return m ? m[0].trim() : '';
+  const m = check.match(/node --test \S+/);
+  if (!m) return '';
+  let cmd = m[0].trim();
+  // Board convention often ends the Check: sentence with a trailing period
+  // right after the test file path (e.g. "node --test test/x.test.js."). A
+  // naive [^.]+ stop would also truncate the ".test.js" extension itself, so
+  // only strip the LAST period, and only when the path still ends in a real
+  // extension without it (otherwise the period is part of the path).
+  if (cmd.endsWith('.')) {
+    const stripped = cmd.slice(0, -1);
+    if (/\.(js|mjs|cjs|ts|tsx)$/.test(stripped)) cmd = stripped;
+  }
+  return cmd;
+}
+
+// One-command dispatch runs a single explicit task, so the wide-gate caution
+// behind focusedCheck (many staffed tasks, keep per-arrival checks narrow)
+// does not apply: fall back to the task's whole Check: text so the operator's
+// actual check command is what gets re-run as verification.
+function dispatchCheck(task) {
+  const narrow = focusedCheck(task);
+  if (narrow) return narrow;
+  const { check } = parseDoneCheck(task.title);
+  return check;
+}
+
+function readTaskById(cli, taskId) {
+  const result = cli(['task', 'show', String(taskId), '--json']);
+  if (!result || result.status !== 0) return null;
+  try {
+    const parsed = JSON.parse(result.stdout);
+    return parsed && parsed.display_id ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function defaultVerifyRunner(command, cwd) {
+  const result = spawnSync(command, { cwd, encoding: 'utf8', shell: true });
+  return { status: result.status, stdout: String(result.stdout || ''), stderr: String(result.stderr || '') };
 }
 
 // One flight. Staff -> dispatch in parallel -> land serially -> receipt.
@@ -261,6 +358,7 @@ async function runFleetFlight({
   ownCli = null,
   dispatcher = null,
   lander = null,
+  checkoutBase = 'origin/master',
 } = {}) {
   const cli = ownCli || defaultOwnCli(root);
   const roster = engines || (() => {
@@ -269,6 +367,9 @@ async function runFleetFlight({
   })();
 
   const staffed = assignEngines(staffFlight(readProjectionTasks(root), { slots }), roster);
+  // The receipt path is decided BEFORE landings so each task's ready-proof
+  // can cite it — the proof policy certifies receipt-backed proofs agent-side.
+  const receiptPath = path.join(root, 'atris', 'runs', `fleet-${nowStamp()}.json`);
   const flight = {
     at: new Date().toISOString(),
     root,
@@ -292,13 +393,20 @@ async function runFleetFlight({
 
   // Claim + cut a worktree per assignment, then dispatch all in parallel.
   const dispatch = dispatcher || ((entry) => new Promise((resolve) => {
-    resolve(dispatchToEngine({ task: entry.task, engine: entry.engine, worktreePath: entry.worktreePath }));
+    resolve(dispatchToEngine({ task: entry.task, engine: entry.engine, worktreePath: entry.worktreePath, root }));
   }));
 
+  // Cut every build worktree from origin/master by default, not the launcher's
+  // HEAD. A flight launched from a long-lived feature-branch checkout would
+  // otherwise stack all that branch's commits onto the build branch, so
+  // rebase-before-ship replays them onto master and pauses at rebase_conflict
+  // (three backend pauses on members.py, 2026-07-05). --base overrides only
+  // when the operator explicitly wants launcher-HEAD.
+  const startBaseArgs = checkoutBase ? ['--base', checkoutBase] : [];
   const prepared = [];
   for (const entry of staffed) {
     cli(['task', 'claim', String(entry.task.display_id), '--as', `fleet-${entry.engine}`]);
-    const started = cli(['worktree', 'start', '--agent', entry.engine, '--task', `fleet-${String(entry.task.display_id).toLowerCase()}`]);
+    const started = cli(['worktree', 'start', '--agent', entry.engine, '--task', `fleet-${String(entry.task.display_id).toLowerCase()}`, ...startBaseArgs]);
     const wt = (started.stdout.match(/next: cd (.+)/) || [])[1];
     if (!wt) {
       flight.paused.push({ task: entry.task.display_id, stage: 'worktree_start', detail: started.stderr.slice(0, 200) });
@@ -318,7 +426,7 @@ async function runFleetFlight({
     const rebased = landArrival({ worktreePath: entry.worktreePath });
     if (!rebased.ok) return rebased;
     const check = focusedCheck(entry.task) || 'git log -1 --oneline';
-    const shipped = cli(['worktree', 'ship', '--message', `${String(entry.task.title || '').split(/[.:]/)[0].slice(0, 90)} (${entry.task.display_id}, built by ${entry.engine})`, '--verify', check, '--merge'], entry.worktreePath);
+    const shipped = cli(fleetShipArgs(entry, check), entry.worktreePath);
     if (shipped.status !== 0 || !/done: worktree shipped/.test(shipped.stdout)) {
       return { ok: false, stage: 'ship', detail: (shipped.stderr || shipped.stdout).slice(-300) };
     }
@@ -335,7 +443,7 @@ async function runFleetFlight({
     const landed = land({ entry, result });
     if (landed.ok) {
       flight.landed.push({ task: entry.task.display_id, engine: entry.engine });
-      cli(['task', 'ready', String(entry.task.display_id), '--proof', `Built by ${entry.engine} engine in fleet flight, landed via worktree ship gate (rebase-before-ship, verify re-run). Report tail: ${String(result.report || '').slice(-300).replace(/\n/g, ' ')}`, '--as', `fleet-${entry.engine}`]);
+      cli(['task', 'ready', String(entry.task.display_id), '--proof', `Built by ${entry.engine} engine in fleet flight, landed via worktree ship gate (rebase-before-ship, verify re-run). Receipt saved at ${path.relative(root, receiptPath)}. Report tail: ${String(result.report || '').slice(-300).replace(/\n/g, ' ')}`, '--as', `fleet-${entry.engine}`]);
       log(`    ${entry.engine.padEnd(8)} ✓ landed ${entry.task.display_id}`);
     } else {
       flight.paused.push({ task: entry.task.display_id, engine: entry.engine, ...landed });
@@ -343,12 +451,147 @@ async function runFleetFlight({
     }
   }
 
-  const receiptDir = path.join(root, 'atris', 'runs');
-  fs.mkdirSync(receiptDir, { recursive: true });
-  flight.receipt = path.join(receiptDir, `fleet-${nowStamp()}.json`);
+  fs.mkdirSync(path.dirname(receiptPath), { recursive: true });
+  flight.receipt = receiptPath;
   fs.writeFileSync(flight.receipt, `${JSON.stringify(flight, null, 2)}\n`);
   log('');
   log(`  flight over: ${flight.landed.length} landed, ${flight.paused.length} paused · receipt: ${path.relative(root, flight.receipt)}`);
   log('');
   return flight;
 }
+
+// ---------------------------------------------------------------------------
+// T5 — one-command dispatch: `atris engine dispatch <task-id> --engine <name>`
+
+// The manual version of this loop took 6 Bash calls per task the night this
+// was written: claim, worktree start, prompt file, engine -p, verify, ship.
+// One or more explicit task ids build in parallel isolated worktrees on ONE
+// named engine; landings are serial, reusing the same rebase-before-ship,
+// never-auto-resolve contract as the fleet. Unlike the fleet, dispatch
+// re-runs the task's own Check: command directly (not just via the ship
+// gate) and captures its real output for the ready proof, so proof text cites
+// an actual re-runnable verifier instead of an engine's self-report.
+async function runDispatchFlight({
+  root = process.cwd(),
+  taskIds = [],
+  engine,
+  prompt: promptOverride = '',
+  log = console.log,
+  ownCli = null,
+  dispatcher = null,
+  lander = null,
+  verifier = null,
+  rebase = null,
+  checkoutBase = 'origin/master',
+} = {}) {
+  if (!engine) throw new Error('runDispatchFlight: engine is required');
+  if (!FLEET_CAPABLE.includes(engine)) {
+    throw new Error(`runDispatchFlight: engine "${engine}" cannot build headlessly (capable: ${FLEET_CAPABLE.join(', ')})`);
+  }
+  const ids = [...new Set((taskIds || []).map((id) => String(id).trim()).filter(Boolean))];
+  if (!ids.length) throw new Error('runDispatchFlight: at least one task id is required');
+  if (promptOverride && ids.length > 1) {
+    throw new Error('runDispatchFlight: --prompt-file only supports a single task id');
+  }
+
+  const cli = ownCli || defaultOwnCli(root);
+  const verify = verifier || defaultVerifyRunner;
+  const receiptPath = path.join(root, 'atris', 'runs', `dispatch-${nowStamp()}.json`);
+  const flight = { at: new Date().toISOString(), root, engine, tasks: ids, results: [], landed: [], paused: [] };
+
+  log('');
+  log(`  dispatch — ${ids.length} task${ids.length === 1 ? '' : 's'} -> ${engine}`);
+  log('');
+
+  // Same rule as the fleet: dispatch worktrees cut from origin/master by
+  // default so rebase-before-ship never replays a launcher feature branch.
+  const startBaseArgs = checkoutBase ? ['--base', checkoutBase] : [];
+  const prepared = [];
+  for (const taskId of ids) {
+    const task = readTaskById(cli, taskId);
+    if (!task) {
+      flight.paused.push({ task: taskId, stage: 'task_lookup', detail: 'task not found' });
+      log(`    ✗ ${taskId} not found`);
+      continue;
+    }
+    cli(['task', 'claim', taskId, '--as', `fleet-${engine}`]);
+    const started = cli(['worktree', 'start', '--agent', engine, '--task', `dispatch-${taskId.toLowerCase()}`, ...startBaseArgs]);
+    const wt = (started.stdout.match(/next: cd (.+)/) || [])[1];
+    if (!wt) {
+      flight.paused.push({ task: taskId, stage: 'worktree_start', detail: String(started.stderr || '').slice(0, 200) });
+      log(`    ✗ ${taskId} worktree start failed`);
+      continue;
+    }
+    prepared.push({ task, taskId, worktreePath: wt.trim() });
+    log(`    building ${taskId} in ${path.basename(wt.trim())}`);
+  }
+
+  const dispatch = dispatcher || ((entry) => new Promise((resolve) => {
+    resolve(dispatchToEngine({
+      task: entry.task,
+      engine,
+      worktreePath: entry.worktreePath,
+      root,
+      prompt: promptOverride || undefined,
+    }));
+  }));
+
+  const results = await Promise.all(prepared.map((entry) =>
+    dispatch(entry).then((r) => ({ entry, result: r })).catch((err) => ({ entry, result: { exitCode: 1, report: '', stderr: String(err && err.message || err) } }))
+  ));
+  flight.results = results.map(({ entry, result }) => ({ task: entry.taskId, exitCode: result.exitCode }));
+
+  // Land serially: rebase, re-run Check: for real, ship gate re-verifies,
+  // conflict/verify failure pauses (never auto-resolve).
+  const rebaseArrival = rebase || landArrival;
+  const land = lander || (({ entry }) => {
+    const rebased = rebaseArrival({ worktreePath: entry.worktreePath });
+    if (!rebased.ok) return rebased;
+    const check = dispatchCheck(entry.task) || 'git log -1 --oneline';
+    const verified = verify(check, entry.worktreePath);
+    if (verified.status !== 0) {
+      return {
+        ok: false,
+        stage: 'verify_failed',
+        detail: `${verified.stdout}${verified.stderr}`.slice(-500),
+        verifyOutput: `${verified.stdout}${verified.stderr}`,
+      };
+    }
+    const shipped = cli(fleetShipArgs({ task: entry.task, engine }, check), entry.worktreePath);
+    if (shipped.status !== 0 || !/done: worktree shipped/.test(shipped.stdout)) {
+      return { ok: false, stage: 'ship', detail: (shipped.stderr || shipped.stdout).slice(-500) };
+    }
+    return { ok: true, stage: 'shipped', check, verifyOutput: `${verified.stdout}${verified.stderr}` };
+  });
+
+  for (const { entry, result } of results) {
+    if (result.exitCode !== 0) {
+      flight.paused.push({ task: entry.taskId, stage: 'build', detail: String(result.stderr || '').slice(0, 300) });
+      log(`    ✗ build failed ${entry.taskId} — worktree kept for takeover`);
+      continue;
+    }
+    log(`    landing ${entry.taskId}...`);
+    const landed = land({ entry, result });
+    if (landed.ok) {
+      flight.landed.push({ task: entry.taskId, engine, check: landed.check });
+      const verifyTail = String(landed.verifyOutput || '').trim().slice(-1200).replace(/\n/g, ' ');
+      cli([
+        'task', 'ready', entry.taskId,
+        '--proof', `Built by ${engine} engine via atris engine dispatch, landed via worktree ship gate (rebase-before-ship, verify re-run). Check re-run: ${landed.check}. Verify output: ${verifyTail || '(command produced no output, exit 0)'}. Receipt saved at ${path.relative(root, receiptPath)}.`,
+        '--as', `fleet-${engine}`,
+      ]);
+      log(`    ✓ landed ${entry.taskId}`);
+    } else {
+      flight.paused.push({ task: entry.taskId, engine, ...landed });
+      log(`    ⏸ paused ${entry.taskId} at ${landed.stage}${landed.conflicts ? ` (${landed.conflicts.join(', ')})` : ''} — worktree kept`);
+    }
+  }
+
+  fs.mkdirSync(path.dirname(receiptPath), { recursive: true });
+  flight.receipt = receiptPath;
+  fs.writeFileSync(flight.receipt, `${JSON.stringify(flight, null, 2)}\n`);
+  log('');
+  log(`  dispatch over: ${flight.landed.length} landed, ${flight.paused.length} paused · receipt: ${path.relative(root, flight.receipt)}`);
+  log('');
+  return flight;
+}