autonomous-sdlc-harness 0.6.2 → 0.6.4

package/dist/remote/githubActions.js

@@ -18,7 +18,7 @@
  * `LEGACY_TRIGGER_LABEL`)
  * and the run-control names (`WORKFLOW_CONTROL_*`, `COMMAND_*`, `COMMENT_MARKER`,
  * `REVIEW_ROUND_STATE`, `STATE_LABEL_PREFIX`, `RUN_STATES`, `STATE_LABELS`, `PR_CREATE_SETTING`,
- * `PR_CREATE_SETTING_PATH`) are gated tighter
+ * `PR_CREATE_SETTING_PATH`, `MENTION_*`) are gated tighter
  * still: they are consulted only where `forgeTriggerApplies(config)` is true.
  *
  * **Shell and YAML mirrors that must agree byte for byte.** The compiler cannot reach them, so each
@@ -41,6 +41,7 @@
  * It reads no configuration and writes nothing.
  */
 import { spawnSync } from 'node:child_process';
+import { PLUGIN_NAME } from '../core/pluginIdentity.js';
 import { unquoteYamlScalar } from '../core/yamlScalar.js';
 /** The adopter-side directory GitHub reads workflows from. */
 export const WORKFLOWS_DIR = '.github/workflows';
@@ -61,10 +62,43 @@ export const COMMAND_HANDLE = '@sdlc-harness';
  * replies with the run's state and changes no label and dispatches nothing.
  */
 export const COMMAND_VERBS = ['answer', 'pause', 'resume', 'stop', 'clear', 'status'];
+/**
+ * The `action` values a mention's decision may carry: `command` names one of {@link COMMAND_VERBS};
+ * `reply` and `clarify` carry the agent's text; `fixes` is a request for fixes, answered with the
+ * script's own text; `none` means the mention was not addressed to the harness.
+ */
+export const MENTION_ACTIONS = ['command', 'reply', 'clarify', 'fixes', 'none'];
+/**
+ * How a mention's `command` decision treats each verb; total, so a new verb fails to compile until it
+ * is classified. `act` is carried out through that verb's own arm. `confirm` is answered with a
+ * request to comment the command itself: `stop` because it is destructive, `clear` because on GitHub
+ * typing it is the confirmation `branch-resume` asks for.
+ */
+export const MENTION_VERB_HANDLING = {
+    answer: 'act',
+    pause: 'act',
+    resume: 'act',
+    stop: 'confirm',
+    clear: 'confirm',
+    status: 'act',
+};
+/** The verbs {@link MENTION_VERB_HANDLING} marks `act`, in {@link COMMAND_VERBS} order. */
+export const MENTION_ACT_VERBS = COMMAND_VERBS.filter((verb) => MENTION_VERB_HANDLING[verb] === 'act');
+/** The verbs {@link MENTION_VERB_HANDLING} marks `confirm`, in {@link COMMAND_VERBS} order. */
+export const MENTION_CONFIRM_VERBS = COMMAND_VERBS.filter((verb) => MENTION_VERB_HANDLING[verb] === 'confirm');
+/** The basename of the plugin slash command `plugin/commands/harness-read-mention.md`, the slash-command name verbatim. */
+export const MENTION_COMMAND_NAME = 'harness-read-mention';
+/**
+ * The plugin-qualified slash command `remote-run.sh control` passes as the session's `-p` prompt, the
+ * way `autonomous-watcher.sh` launches the plugin's commands as a session's first message. Built from
+ * {@link PLUGIN_NAME} rather than spelled; the CLI never prints it.
+ */
+export const MENTION_COMMAND = `/${PLUGIN_NAME}:${MENTION_COMMAND_NAME}`;
 /**
  * The prefix of the hidden line every harness comment carries; the whole line is
- * `<!-- sdlc-harness event=<event> branch=<branch>[ question=<n>] -->`. A comment containing the
- * prefix anywhere is never a command.
+ * `<!-- sdlc-harness event=<event> branch=<branch>[ question=<n>][ engine=<engine>] -->`, where
+ * `engine=` is carried only by a `reply` posted after a successful dispatch. A comment containing
+ * the prefix anywhere is never a command.
  */
 export const COMMENT_MARKER = '<!-- sdlc-harness';
 /** The `review.state` that starts a review round, lowercase as the webhook payload carries it. */
@@ -172,6 +206,14 @@ export function runActorAdmitted(actors, login) {
 export function carriesRunActors(workflowText) {
     return workflowText.includes(`vars.${RUN_ACTORS_VARIABLE}`);
 }
+/**
+ * Whether a workflow's text reads `secrets.CLAUDE_CODE_OAUTH_TOKEN` or `secrets.ANTHROPIC_API_KEY`;
+ * `false` marks a `harness-control.yml` written before a mention could be read. Pure — the caller
+ * reads the file.
+ */
+export function carriesMentionCredential(workflowText) {
+    return workflowText.includes(`secrets.${OAUTH_TOKEN_SECRET}`) || workflowText.includes(`secrets.${API_KEY_SECRET}`);
+}
 /** The `repository_dispatch` `event_type` the trigger workflow listens to. */
 export const TRIGGER_DISPATCH_EVENT_TYPE = 'harness-task';
 /** Repository secret for subscription billing. */

package/dist/remote/githubActions.js.map

@@ -1 +1 @@
-{"version":3,"file":"githubActions.js","sourceRoot":"","sources":["../../src/remote/githubActions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,aAAa,IAAI,iBAAiB,EAAE,CAAC;AAEzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,aAAa,IAAI,oBAAoB,EAAE,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,aAAa,IAAI,qBAAqB,EAAE,CAAC;AAEjF,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,aAAa,IAAI,qBAAqB,EAAE,CAAC;AAEjF,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAI/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,kGAAkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAIhG,yGAAyG;AACzG,MAAM,CAAC,MAAM,YAAY,GAAuC;IAC9D,OAAO,EAAE,GAAG,kBAAkB,SAAS;IACvC,MAAM,EAAE,GAAG,kBAAkB,QAAQ;IACrC,MAAM,EAAE,GAAG,kBAAkB,QAAQ;IACrC,IAAI,EAAE,GAAG,kBAAkB,MAAM;IACjC,MAAM,EAAE,GAAG,kBAAkB,QAAQ;IACrC,OAAO,EAAE,GAAG,kBAAkB,SAAS;CACxC,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,oGAAoG;AACpG,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAE1D,wHAAwH;AACxH,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAE9D,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C,MAAM,wBAAwB,GAAG,IAAI,MAAM,CAAC,iBAAiB,sBAAsB,gCAAgC,CAAC,CAAC;AAErH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,wOAAwO;AACxO,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAe3C;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB,EAAE,KAAkC;IAC9F,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACrH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,KAAa;IAC/D,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACvE,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QAC/C,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,mBAAmB,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAE1D,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG,0DAA0D,CAAC;AAC5F,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,wDAAwD,CAAC;AAE/F,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAE1D,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,WAAW,oBAAoB,sCAAsC,CAAC,CAAC;AAE3G;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC;;;;GAIG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC;AAS7B,2FAA2F;AAC3F,MAAM,UAAU,KAAK;IACnB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,IAAuB,EAAE,GAAW;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;QACtC,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,gGAAgG;IAChG,kFAAkF;IAClF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"githubActions.js","sourceRoot":"","sources":["../../src/remote/githubActions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,aAAa,IAAI,iBAAiB,EAAE,CAAC;AAEzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,aAAa,IAAI,oBAAoB,EAAE,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,aAAa,IAAI,qBAAqB,EAAE,CAAC;AAEjF,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,aAAa,IAAI,qBAAqB,EAAE,CAAC;AAEjF,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAI/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAIzF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqD;IACrF,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAA2B,aAAa,CAAC,MAAM,CAC3E,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,KAAK,CAChD,CAAC;AAEF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAA2B,aAAa,CAAC,MAAM,CAC/E,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,SAAS,CACpD,CAAC;AAEF,2HAA2H;AAC3H,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,WAAW,IAAI,oBAAoB,EAAE,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,kGAAkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAIhG,yGAAyG;AACzG,MAAM,CAAC,MAAM,YAAY,GAAuC;IAC9D,OAAO,EAAE,GAAG,kBAAkB,SAAS;IACvC,MAAM,EAAE,GAAG,kBAAkB,QAAQ;IACrC,MAAM,EAAE,GAAG,kBAAkB,QAAQ;IACrC,IAAI,EAAE,GAAG,kBAAkB,MAAM;IACjC,MAAM,EAAE,GAAG,kBAAkB,QAAQ;IACrC,OAAO,EAAE,GAAG,kBAAkB,SAAS;CACxC,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,oGAAoG;AACpG,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAE1D,wHAAwH;AACxH,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAE9D,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C,MAAM,wBAAwB,GAAG,IAAI,MAAM,CAAC,iBAAiB,sBAAsB,gCAAgC,CAAC,CAAC;AAErH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,wOAAwO;AACxO,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAe3C;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB,EAAE,KAAkC;IAC9F,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACrH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,KAAa;IAC/D,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACvE,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QAC/C,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,mBAAmB,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,OAAO,YAAY,CAAC,QAAQ,CAAC,WAAW,kBAAkB,EAAE,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,cAAc,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAE1D,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG,0DAA0D,CAAC;AAC5F,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,wDAAwD,CAAC;AAE/F,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAE1D,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,WAAW,oBAAoB,sCAAsC,CAAC,CAAC;AAE3G;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC;;;;GAIG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC;AAS7B,2FAA2F;AAC3F,MAAM,UAAU,KAAK;IACnB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,IAAuB,EAAE,GAAW;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;QACtC,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,gGAAgG;IAChG,kFAAkF;IAClF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAC7F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autonomous-sdlc-harness",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "The outer loop of the autonomous SDLC harness: init, doctor, config and daemon management for the harness Claude Code plugin, plus opt-in local docs retrieval.",
   "license": "Apache-2.0",
   "author": "firu-daniel",

package/templates/github/workflows/harness-control.yml

@@ -19,9 +19,13 @@
 # WHAT IT DOES. One job runs `remote-run.sh control`, which does everything
 # else: it authorises the actor — their write access, then the allow-list
 # HARNESS_RUN_ACTORS — finds the run's branch, carries out the
-# command or places the review round, and replies. Every decision lives in that
-# script; this file carries only the events, the permissions, a prefilter and
-# the concurrency group.
+# command or places the review round, and replies. A comment that mentions
+# `@sdlc-harness` anywhere, not in the exact command form, is read by one
+# read-only agent session running the plugin's mention-reading slash command,
+# which `remote-run.sh control` launches and whose decision it validates.
+# Every decision lives in that script; this file carries only the events, the
+# permissions, a prefilter, the concurrency group, and on a comment job the
+# credential, the agent CLI and the pinned plugin that session needs.
 # The `run-name` below is not harness-run.yml's `harness <action> <branch>`
 # title, so no run lookup `remote-run.sh` makes by that title can match it.
 #
@@ -73,8 +77,18 @@
 #   issues: write          reply on the issue or pull request, and label it
 #   pull-requests: write   read the pull request, its reviews and comments,
 #                          and label it
-# The job reads no repository secret: it needs only its own token, so the
-# credential secrets never reach the job that reads untrusted comment text.
+# Only an `issue_comment` event's act step receives a credential: its `env:`
+# passes CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY as IN_OAUTH and IN_API,
+# each through an expression that is the empty string unless the event is
+# `issue_comment`, and nothing at job level reads a secret. A
+# `pull_request_review`, `issues`, `pull_request` or `delete` event gets empty
+# strings. A `pull_request_review` job runs the pull request's merge-commit
+# copy of this file, which a same-repository head can edit to read the secret;
+# that writer could already read it through any workflow of their own
+# (docs/remote-execution.md, section 9, Credentials and billing), and a fork's
+# review job gets no secret (C2). The decision of record, its exposure and why
+# a comment's text cannot steer the session outside its closed set of actions:
+# docs/github-run-control.md, section 6.
 # Every reply is posted as github-actions[bot] and starts no workflow (S3).
 #
 # FORK PULL REQUESTS. Never `pull_request_target`, which would run with this
@@ -113,6 +127,20 @@
 #     harness-run.yml's `collect` job is the one such job today (DECLARED
 #     MIRRORS below).
 #
+# THE PLUGIN. This file carries no pin of its own. A comment job reads the
+# first HARNESS_CLI_VERSION in the checkout's harness-run.yml, clones the
+# release tag `autonomous-sdlc-harness--v<that version>` outside the checkout
+# as harness-run.yml's `Install the pinned plugin` step does, checks the
+# plugin manifest's version against it, and hands the plugin's directory to
+# the act step as HARNESS_MENTION_PLUGIN_DIR; the session loads it with
+# `--plugin-dir`, so nothing is installed. The plugin a mention runs under is
+# therefore the release the run job installs. A pinned release older than
+# mentions carries no mention-reading command and gets `control`'s no-plugin
+# reply; the route is `init --upgrade-workflows` (docs/remote-execution.md,
+# `### Upgrading`). The three comment-only steps are `continue-on-error`, so a
+# failed install never blocks an exact-form command: `control` then finds no
+# agent binary or plugin and answers a mention with its exit-3 reply.
+#
 # A REFUSAL IS A SUCCESS. `remote-run.sh control` exits 2 for a refusal it has
 # already replied to; that exit code is the script's contract with every other
 # caller, so the step, not the script, maps it: `|| [ $? -eq 2 ]` turns a
@@ -141,23 +169,38 @@
 #                                     (`changes_requested`), HARNESS_RUNNER,
 #                                     HARNESS_REMOTE_STOP,
 #                                     HARNESS_TRIGGER_ALLOWED_BOTS,
-#                                     HARNESS_RUN_ACTORS
+#                                     HARNESS_RUN_ACTORS,
+#                                     OAUTH_TOKEN_SECRET
+#                                     (`CLAUDE_CODE_OAUTH_TOKEN`),
+#                                     API_KEY_SECRET (`ANTHROPIC_API_KEY`),
+#                                     CLI_VERSION_VARIABLE
+#                                     (`HARNESS_CLI_VERSION`, read from
+#                                     harness-run.yml)
+#   cli/src/generators/projectSettings.ts   MARKETPLACE_NAME
+#                                     (`autonomous-sdlc-harness`)
 #   cli/src/config/model.ts           DEFAULTS.scriptsDir
 #   harness-run.yml                   the concurrency group
 #                                     `harness-review-<branch>`, held by its
-#                                     `collect` job
+#                                     `collect` job; the release-tag shape
+#                                     `autonomous-sdlc-harness--v<version>`
+#                                     of its `Install the pinned plugin` step
+#   remote-run.sh (the scriptsDir copy) IN_OAUTH, IN_API and
+#                                     HARNESS_MENTION_PLUGIN_DIR, the env
+#                                     interface `control` reads (its MENTION
+#                                     paragraph)
 #
 # ACTION PINS.
 #   actions/checkout@v5
-# The lowest major whose own action.yml declares `runs.using: node24`, per a
-# maintainer's lookups of its action.yml and release notes on
-# 2026-09-29T08:21Z (UTC). That major's release notes require Actions Runner
-# 2.327.1 or newer; a GitHub-hosted runner already has it, and a self-hosted
-# one must run it (docs/remote-execution.md, section 8). A major tag, not a
-# commit sha: it is GitHub's own `actions/` organisation, the owner of the
-# runner and GITHUB_TOKEN this job already trusts, and a major tag takes the
-# action's own patch and security releases where a sha would freeze your copy.
-# Pin a sha in your copy if you want one.
+#   actions/setup-node@v5
+# Each is the lowest major whose own action.yml declares `runs.using: node24`,
+# per a maintainer's lookups of each action's action.yml and release notes on
+# 2026-09-29T08:21Z (UTC). Each of those majors' release notes requires
+# Actions Runner 2.327.1 or newer; a GitHub-hosted runner already has it, and
+# a self-hosted one must run it (docs/remote-execution.md, section 8). A major
+# tag, not a commit sha: every action here is GitHub's own `actions/`
+# organisation, the owner of the runner and GITHUB_TOKEN this job already
+# trusts, and a major tag takes the action's own patch and security releases
+# where a sha would freeze your copy. Pin shas in your copy if you want them.
 
 name: harness-control
 run-name: harness control ${{ github.event.issue.number || github.event.pull_request.number || github.event.ref }}
@@ -226,5 +269,60 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
+      - name: Set up Node
+        if: github.event_name == 'issue_comment'
+        continue-on-error: true
+        uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+          # As in harness-run.yml: no npm cache is used, and a lockfile-less repository must not fail this step.
+          package-manager-cache: false
+
+      - name: Install the claude CLI when absent
+        if: github.event_name == 'issue_comment'
+        continue-on-error: true
+        run: |
+          if ! command -v claude >/dev/null 2>&1; then
+            npm install -g @anthropic-ai/claude-code
+          fi
+          claude --version
+
+      - name: Fetch the pinned plugin
+        if: github.event_name == 'issue_comment'
+        continue-on-error: true
+        run: |
+          pin=$(awk '/^[[:space:]]*HARNESS_CLI_VERSION:/ { sub(/^[[:space:]]*HARNESS_CLI_VERSION:[[:space:]]*/, ""); sub(/[[:space:]]+#.*$/, ""); sub(/[[:space:]]+$/, ""); gsub(/["\047]/, ""); print; exit }' .github/workflows/harness-run.yml 2>/dev/null || true)
+          if [ -z "$pin" ]; then
+            echo "::warning::.github/workflows/harness-run.yml carries no HARNESS_CLI_VERSION, so no plugin was fetched and a mention gets the no-plugin reply."
+            exit 1
+          fi
+          source_repo=$(jq -r '.extraKnownMarketplaces["autonomous-sdlc-harness"].source.repo // empty' .claude/settings.json 2>/dev/null || true)
+          if [ -z "$source_repo" ]; then
+            echo "::warning::.claude/settings.json names no marketplace source for autonomous-sdlc-harness, so the plugin at $pin was not fetched."
+            exit 1
+          fi
+          tag="autonomous-sdlc-harness--v$pin"
+          marketplace_dir="$RUNNER_TEMP/harness-marketplace"
+          # --quiet does not cover the detached-HEAD advice a tag checkout prints; only advice.detachedHead gates it.
+          if ! git -c advice.detachedHead=false clone --quiet --depth 1 --branch "$tag" "https://github.com/$source_repo.git" "$marketplace_dir"; then
+            echo "::warning::$source_repo has no release tag $tag, so the plugin at $pin was not fetched."
+            exit 1
+          fi
+          plugin_source=$(jq -r '[.plugins[]? | select(.name == "autonomous-sdlc-harness") | .source | strings][0] // empty' "$marketplace_dir/.claude-plugin/marketplace.json" 2>/dev/null || true)
+          if [ -z "$plugin_source" ]; then
+            echo "::warning::$tag's .claude-plugin/marketplace.json has no readable autonomous-sdlc-harness entry, so the plugin at $pin was not handed to the mention session."
+            exit 1
+          fi
+          plugin_dir="$marketplace_dir/${plugin_source#./}"
+          version=$(jq -r '.version // empty' "$plugin_dir/.claude-plugin/plugin.json" 2>/dev/null || true)
+          if [ "$version" != "$pin" ]; then
+            echo "::warning::the plugin cloned at $tag is version '${version:-none}', not $pin, so it was not handed to the mention session."
+            exit 1
+          fi
+          echo "HARNESS_MENTION_PLUGIN_DIR=$plugin_dir" >> "$GITHUB_ENV"
+
       - name: Act on the comment, review, close or deletion
+        env:
+          IN_OAUTH: ${{ github.event_name == 'issue_comment' && secrets.CLAUDE_CODE_OAUTH_TOKEN || '' }}
+          IN_API: ${{ github.event_name == 'issue_comment' && secrets.ANTHROPIC_API_KEY || '' }}
         run: bash "$SCRIPTS_DIR/remote-run.sh" control || [ $? -eq 2 ]

package/templates/github/workflows/harness-resume.yml

@@ -34,12 +34,13 @@
 # cost nothing.
 #
 # WHAT IT READS.
-#   Secrets: HARNESS_PUSH_URL (optional notifications: the poller's own failed
-#     notice when it cannot resume a run).
+#   Secrets: HARNESS_PUSH_URL (optional notifications: the poller's own notice
+#     when it cannot resume a run or cannot download its bundle).
 #   Variables: HARNESS_RUNNER, HARNESS_REMOTE_STOP (any value: the tick
 #     dispatches nothing), HARNESS_MAX_CHAIN (the automatic-dispatch limit),
 #     HARNESS_POLL_MAX_DISPATCH_FAILURES (failed re-dispatches of one paused
-#     run before the poller gives up on it; 3 when unset) and
+#     run, or consecutive failed downloads of one run's listed bundle, before
+#     the poller gives up on it; 3 when unset) and
 #     HARNESS_POLL_GIVE_UP_AFTER_MINUTES (minutes after the usage reset past
 #     which it gives up; 360 when unset).
 #   harness.config.json, at run time: `scriptsDir` and `stateDir`. No
@@ -53,8 +54,8 @@
 # workflow-level `permissions:` block sets every permission it does not list to
 # `none`.
 #
-# WHAT IT WRITES. The `harness-poll-state` artifact: the failed-dispatch count
-#   `poll` carries to the next tick, kept 7 days.
+# WHAT IT WRITES. The `harness-poll-state` artifact: the failed-dispatch and
+#   failed-download counts `poll` carries to the next tick, kept 7 days.
 #
 # THE RULE EVERY EDIT KEEPS. Every GitHub expression has a space after its
 # opening braces, and every value reaches a shell line through `env:`. `init`

package/templates/github/workflows/harness-run.yml

@@ -49,7 +49,13 @@
 #                                     job's status by that name
 #   harness-control.yml               the concurrency group
 #                                     `harness-review-<branch>`, shared by its
-#                                     review jobs and the `collect` job here
+#                                     review jobs and the `collect` job here;
+#                                     and, read by its `Fetch the pinned
+#                                     plugin` step, the first
+#                                     `HARNESS_CLI_VERSION:` env line (key, then
+#                                     the quoted version) and the release-tag
+#                                     shape `autonomous-sdlc-harness--v<version>`
+#                                     of the `Install the pinned plugin` step
 #
 # THE COLLECT JOB. When a run ends, `remote-run.sh collect` starts the next
 # user-review round from every review requesting changes that `control`
@@ -60,8 +66,11 @@
 # the two never place a round at once; and the settledness test reads "the
 # `run` job is completed", which no step inside that job could see. Under
 # `!cancelled()` a failed `run` job still reaches it, and the run's state bundle
-# decides whether the run ended or only paused or parked; a cancelled or
-# stopped run skips it. The group name mirrors harness-control.yml's, and
+# decides whether the run ended or only paused or parked. A `run` job GitHub
+# cancelled before any step ran, for example one no runner acquired, reaches it
+# too, and `collect` reports that run once (remote-run.sh's header, its
+# `collect` paragraph), because the job itself could report nothing; a workflow
+# run cancelled or stopped as a whole skips it. The group name mirrors harness-control.yml's, and
 # RUN_JOB_NAME in remote-run.sh mirrors the `run` job's key (DECLARED MIRRORS
 # above). It reads no secret: its own token pushes the round, dispatches it and
 # comments. It checks out the default branch, as harness-control.yml's review
@@ -123,8 +132,9 @@
 #   Secrets: CLAUDE_CODE_OAUTH_TOKEN and/or ANTHROPIC_API_KEY (one is required;
 #     billing follows the API key when both are set), HARNESS_GIT_TOKEN (optional:
 #     a personal or App token, so the job's pushes trigger your own CI, which
-#     GITHUB_TOKEN pushes never do; it also opens the run's draft pull request,
-#     so your CI runs on it without an approval click), HARNESS_PUSH_URL
+#     GITHUB_TOKEN pushes never do; it also opens the run's draft pull request
+#     when the run starts, and `deliver` opens one only when none is open at
+#     completion, so your CI runs on it without an approval click), HARNESS_PUSH_URL
 #     (optional notifications).
 #   Variables: HARNESS_RUNNER, HARNESS_REMOTE_STOP (any value stops every job
 #     before it launches anything), HARNESS_RUN_ACTORS (THE RUN-ACTOR GATE),
@@ -141,7 +151,7 @@
 #   actions        to dispatch, poll and enable the poller
 #   issues         to comment and set labels on the issue and the pull request,
 #                  which both use the issues API
-#   pull-requests  to open the draft pull request and label it
+#   pull-requests  to open the run's pull request, update it and label it
 #
 # WHY THE REPORT STEP MAY FAIL. `Open the pull request and report` runs
 # `remote-run.sh deliver` after the push, so the pull request's head carries the
@@ -149,6 +159,17 @@
 # this file without `init --force` still runs scripts with no `deliver` verb,
 # and a finished run must not be marked failed for its report.
 #
+# WHY THE OPEN STEP RUNS ONLY WHEN chain IS 0. `Open the draft pull request`
+# runs `remote-run.sh open` before the harness, so the run's draft pull request
+# exists from its first job. `chain` counts automatic dispatches since the last
+# user action, so 0 is a job a person's action started: the first job, a
+# resume, an answer, a round. An automatic continuation therefore never retries
+# a create that failed, and the attempts per run stay bounded by people's
+# actions; `deliver`'s fallback at completion is the last attempt, and its
+# `completed` comment names the error. It is `continue-on-error` for the report
+# step's reason above: scripts older than this file carry no `open` verb, and a
+# run must not fail for its pull request.
+#
 # THE SELF-PAUSE POINT, MEASURED. On a hosted runner the job drops its own PAUSE
 # REMOTE_SELF_PAUSE_AFTER_SECS after it started, the run yields at its next
 # dispatch boundary, and `remote-run.sh continue` chains a new job.
@@ -364,7 +385,7 @@ jobs:
           else
             why="it is unset, and this repository has no single owner to admit (its owner type is ${IN_OWNER_TYPE:-unreadable}), so it admits nobody."
           fi
-          echo "::error::@${actor:-(no actor)} dispatched or re-ran this run, and the repository variable HARNESS_RUN_ACTORS does not admit them: $why Nothing was launched and no credential was read. Add the login to the comma-separated repository variable HARNESS_RUN_ACTORS, or set it to * for every writer (docs/remote-execution.md, section 9)."
+          echo "::error::@${actor:-(no actor)} dispatched or re-ran this run, and the repository variable HARNESS_RUN_ACTORS does not admit them: $why Nothing was launched and no credential was read. Add the login to the comma-separated repository variable HARNESS_RUN_ACTORS, or set it to * for every writer (docs/remote-execution.md, section 7 step 4, and section 11)."
           exit 1
 
       - name: Compute the time budget
@@ -529,6 +550,13 @@ jobs:
         if: env.HARNESS_STOPPED != '1'
         run: bash "$SCRIPTS_DIR/remote-run.sh" restore "$HARNESS_INPUT_BRANCH" --resume "$HARNESS_INPUT_RESUME"
 
+      - name: Open the draft pull request
+        if: env.HARNESS_STOPPED != '1' && inputs.chain == 0
+        continue-on-error: true
+        env:
+          HARNESS_PR_TOKEN: ${{ secrets.HARNESS_GIT_TOKEN }}
+        run: bash "$SCRIPTS_DIR/remote-run.sh" open "$HARNESS_INPUT_BRANCH"
+
       - name: Run the harness
         if: env.HARNESS_STOPPED != '1'
         timeout-minutes: ${{ fromJSON(env.HARNESS_STEP_TIMEOUT_MINUTES || env.HARNESS_HOSTED_JOB_LIMIT_MINUTES) }}
@@ -541,6 +569,9 @@ jobs:
           unset IN_OAUTH IN_API
           bash "$SCRIPTS_DIR/autonomous-watcher.sh" job "$HARNESS_INPUT_BRANCH" "$HARNESS_INPUT_ENGINE" "$HARNESS_INPUT_RESUME"
 
+      # Runs under always(), so a cancelled or failed job still pushes its commits. push-branch.sh
+      # pushes nothing back for a branch origin no longer has, so a run stopped by its branch's
+      # deletion does not re-create it (Gate 12 round 9, finding 1).
       - name: Push the branch
         if: always() && env.SCRIPTS_DIR != ''
         run: bash "$SCRIPTS_DIR/push-branch.sh"
@@ -634,7 +665,7 @@ jobs:
           else
             why="it is unset, and this repository has no single owner to admit (its owner type is ${IN_OWNER_TYPE:-unreadable}), so it admits nobody."
           fi
-          echo "::error::@${actor:-(no actor)} dispatched or re-ran this run, and the repository variable HARNESS_RUN_ACTORS does not admit them: $why Nothing was launched and no credential was read. Add the login to the comma-separated repository variable HARNESS_RUN_ACTORS, or set it to * for every writer (docs/remote-execution.md, section 9)."
+          echo "::error::@${actor:-(no actor)} dispatched or re-ran this run, and the repository variable HARNESS_RUN_ACTORS does not admit them: $why Nothing was launched and no credential was read. Add the login to the comma-separated repository variable HARNESS_RUN_ACTORS, or set it to * for every writer (docs/remote-execution.md, section 7 step 4, and section 11)."
           exit 1
 
       - name: Check out the default branch for collecting