dorfl 0.14.2 → 0.15.0

package/dist/intake.js

@@ -4,8 +4,10 @@ import { runAsync } from './git.js';
 import { workFolderRel, workFolderPrefix } from './work-layout.js';
 import { paramCase } from './brand.js';
 import { ensureSafeSlug } from './slug-safety.js';
-import { performIntegration, } from './integration-core.js';
+import { performIntegration, proposePointer, } from './integration-core.js';
+import { proposeRequestNotOpened, } from './integrator.js';
 import { integrationFromFlags } from './complete.js';
+import { assertFrontmatterFields, quoteYamlScalar, singleLineScalarProblem, } from './frontmatter.js';
 import { TASK_PLACEMENT_SLOTS, landingToSide } from './tasking.js';
 import { placementFolder, resolvePlacement, } from './placement.js';
 import { identityEnv, assertTransportAllowed, } from './identity.js';
@@ -154,20 +156,15 @@ export async function performIntake(options) {
     // silently pushing under an ambient credential. Resolve the arbiter URL softly
     // (a non-zero/unknown URL is skipped — the guard is a no-op without an identity
     // or a resolvable URL).
-    if (options.identity !== undefined) {
-        const urlRes = await runAsync('git', ['remote', 'get-url', arbiter], cwd, {
-            env,
-        });
-        if (urlRes.status === 0) {
-            try {
-                assertTransportAllowed(options.identity, urlRes.stdout.trim());
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                note(message);
-                return { exitCode: 1, outcome: 'usage-error', issueNumber, message };
-            }
-        }
+    const transportProblem = await intakeTransportProblem(options.identity, cwd, arbiter, env);
+    if (transportProblem !== undefined) {
+        note(transportProblem);
+        return {
+            exitCode: 1,
+            outcome: 'usage-error',
+            issueNumber,
+            message: transportProblem,
+        };
     }
     // 1. READ the issue + thread via the seam (the core never imports `gh`; only the
     //    adapter shells out). A read failure surfaces as a usage error — `intake`
@@ -350,14 +347,16 @@ function createLockReleaser(params) {
  * Split out so the lock release is a clean `try`/`finally` in the caller (the lock
  * MUST release on every terminal path — success or handled failure). The agent
  * DRAFTS only; the runner owns every git/seam side-effect here.
+ *
+ * It composes the SAME two halves the CI phases run in two jobs (task
+ * `ci-split-intake`, `ci-phase-intake.ts`): {@link decideIntake} (the agent half:
+ * the decision agent and the lone-task review, no write) and
+ * {@link applyIntakeDecision} (the write half: the comment, the close, or the
+ * document render + integrate + completion comment).
  */
 async function decideAndDispatch(options, cwd, issue, comments, ctx) {
     const { arbiter, issueProvider, note } = ctx;
     const issueNumber = issue.number;
-    // `env` here is the identity-scoped GIT/provider env (the runner's `gh`/git
-    // ops). The AGENT launches (decision agent, lone-task review) use the AMBIENT
-    // `options.env` — an agent must not act as the bot.
-    const env = ctx.gitEnv;
     // TRIAGE (deterministic, under the lock, BEFORE the prompt): decide whether to run
     // the decision at all, built ENTIRELY on intake's own MARKER on the thread (no
     // sidecar/cursor/bot-identity). It SKIPS when intake has the last word
@@ -367,158 +366,459 @@ async function decideAndDispatch(options, cwd, issue, comments, ctx) {
     // is excluded from the human-comment check by construction.
     const triage = triageIntake(comments);
     if (triage.action === 'skip') {
-        const message = triage.outcome === 'no-new-input'
-            ? `Intake of issue #${issueNumber} found nothing new: it has the last word ` +
-                `on the thread and has already seen every human comment up to it; doing ` +
-                `nothing (the decision prompt did not run).`
-            : `Intake of issue #${issueNumber} skipped: the issue was already ` +
-                `transformed (a terminal intake marker is on the thread); a later human ` +
-                `comment does not re-open it (the decision prompt did not run).`;
+        const message = intakeSkipMessage(issueNumber, triage.outcome);
         note(message);
         return { exitCode: 0, outcome: triage.outcome, issueNumber, message };
     }
-    // DECIDE: prompt → VERDICT. The agent DRAFTS only (no git, no seam ops). Tests
-    // inject a canned verdict (the dispatcher's testable seam); production wires the
-    // harness. The prompt's judgement is not unit-tested — only the dispatch.
+    // DECIDE: prompt → VERDICT (+ the lone-task review). The agent DRAFTS only (no
+    // git, no seam ops).
+    const decided = await decideIntake(options, cwd, issue, comments, triage, note);
+    if (!decided.ok) {
+        return decided.result;
+    }
+    // DISPATCH on the decision. The runner owns every git/seam side-effect (the
+    // in-band boundary). PER-OUTCOME integration (spec `issue-intake` US #9): the
+    // resolved mode is keyed on the runtime artifact TYPE. The per-run `seen=`
+    // DELTA (the HUMAN comment ids intake READ this run, excluding its own
+    // marker-comments + already-seen ids) rides every comment intake posts.
+    return applyIntakeDecision(decided.decision, {
+        issueNumber,
+        cwd,
+        arbiter,
+        issueProvider,
+        integration: options.integration ?? { task: 'propose', spec: 'propose' },
+        mergeRetries: options.mergeRetries,
+        // The origin-trust STAMP, passed IN (not resolved here). Unset ⇒ unstamped
+        // (a local intake ⇒ human/trusted).
+        originTrust: options.originTrust,
+        noPR: options.noPR,
+        placement: intakePlacementInputs(options),
+        providerInstance: options.providerInstance,
+        seen: computeSeenDelta(comments),
+        // The identity-scoped GIT/provider env (the `gh` ops, push, PR).
+        env: ctx.gitEnv,
+        note,
+    });
+}
+/** The message of a triage SKIP (the decision prompt did not run). */
+export function intakeSkipMessage(issueNumber, outcome) {
+    return outcome === 'no-new-input'
+        ? `Intake of issue #${issueNumber} found nothing new: it has the last word ` +
+            `on the thread and has already seen every human comment up to it; doing ` +
+            `nothing (the decision prompt did not run).`
+        : `Intake of issue #${issueNumber} skipped: the issue was already ` +
+            `transformed (a terminal intake marker is on the thread); a later human ` +
+            `comment does not re-open it (the decision prompt did not run).`;
+}
+/**
+ * The push-time transport-coherence guard (identity): the problem message when
+ * a configured identity forbids the arbiter's transport, else `undefined`. The
+ * arbiter URL is resolved softly (a non-zero/unknown URL is skipped); a no-op
+ * without an identity.
+ */
+export async function intakeTransportProblem(identity, cwd, arbiter, env) {
+    if (identity === undefined) {
+        return undefined;
+    }
+    const urlRes = await runAsync('git', ['remote', 'get-url', arbiter], cwd, {
+        env,
+    });
+    if (urlRes.status !== 0) {
+        return undefined;
+    }
+    try {
+        assertTransportAllowed(identity, urlRes.stdout.trim());
+        return undefined;
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : String(err);
+    }
+}
+/**
+ * The AGENT half of intake (task `ci-split-intake`): run the decision agent on the
+ * issue + thread, refuse a verdict whose title cannot be one frontmatter line,
+ * derive the content-derived slug, and (for a task) run the bounded lone-task
+ * review. Performs NO write (no git, no seam op); returns the
+ * {@link IntakeDecision} the write half acts on, or the failed
+ * {@link IntakeResult} (`agent-failed`, or `usage-error` for a verdict with no
+ * usable slug). The laptop `intake` and the CI agent job both run it.
+ */
+export async function decideIntake(options, cwd, issue, comments, triage, note) {
+    const issueNumber = issue.number;
+    const failed = (outcome, message) => {
+        // Not noted: every caller returns this result, whose message the CLI
+        // prints as the run's result line (task `ci-phase-logs-each-line-once`).
+        return { ok: false, result: { exitCode: 1, outcome, issueNumber, message } };
+    };
+    // DECIDE: prompt → VERDICT. Tests inject a canned verdict (the dispatcher's
+    // testable seam); production wires the harness. The prompt's judgement is not
+    // unit-tested; only the dispatch is.
     const prompt = buildIntakeDecisionSpec(issue, comments, triage);
     let verdict;
     try {
         verdict = await runDecision(options, cwd, issue, comments, prompt);
+        // The VERDICT BOUNDARY for the drafted title (task
+        // `intake-frontmatter-title-injection-strips-origin-stamp`): a title that is
+        // not one line, holds a control character, or is blank is refused HERE, so
+        // it degrades onto `agent-failed` like any malformed verdict (never a silent
+        // emit). Runs for the injected `decide` seam and the parsed harness verdict.
+        assertIntakeVerdictTitle(verdict);
     }
     catch (err) {
         const detail = err instanceof Error ? err.message : String(err);
-        const message = `Intake decision failed for issue #${issueNumber}: ${detail}`;
-        note(message);
-        return { exitCode: 1, outcome: 'agent-failed', issueNumber, message };
+        return failed('agent-failed', `Intake decision failed for issue #${issueNumber}: ${detail}`);
     }
-    // DISPATCH on the verdict — the FULL four-outcome decision table (spec
-    // `issue-intake`). The agent only DRAFTED the verdict; the runner owns every
-    // git/seam side-effect below (the in-band boundary): the write + integrate
-    // (task/spec) and the `postIssueComment` (ask/bounce).
-    //
-    // PER-OUTCOME integration (spec `issue-intake` US #9): the resolved mode is keyed on the runtime
-    // artifact TYPE — a `task` verdict integrates with the task mode, a `spec`
-    // verdict with the spec mode. Unset ⇒ propose for both. ask/bounce never
-    // integrate, so the modes are no-ops for them.
-    const modes = options.integration ?? { task: 'propose', spec: 'propose' };
-    // The per-run `seen=` DELTA (the HUMAN comment ids intake READ this run, excluding
-    // its own marker-comments + already-seen ids) the marker records on every comment
-    // intake posts — the chain-model primitive the TRIAGE unions into `seenSet`.
-    const seenDelta = computeSeenDelta(comments);
     switch (verdict.outcome) {
-        case 'task':
-            return dispatchTask({
-                verdict,
-                issueNumber,
-                cwd,
-                arbiter,
-                integration: modes.task,
-                // The resolved cross-job CAS-retry cap (config `mergeRetries`) — threaded so
-                // intake's lone-task emit lands under the same per-repo cap the build path uses.
-                mergeRetries: options.mergeRetries,
-                // The origin-trust STAMP, passed IN (not resolved here): the emitted task
-                // carries `origin: issue` + this verdict so the becomes-code checkpoint is
-                // not laundered. Unset ⇒ unstamped (a local intake ⇒ human/trusted).
-                originTrust: options.originTrust,
-                noPR: options.noPR,
-                // RUNNER-DETERMINISTIC PLACEMENT for the DIRECT-from-issue task (ADR
-                // `untrusted-origin-carries-via-stamp-not-forced-staging`): the
-                // configured-default + explicit-flag rungs, fed into the SHARED placement
-                // resolver alongside the `originTrust` stamp above — the TASK twin of the
-                // spec dispatch below. `dispatchTask` selects the untrusted-side default
-                // (`untrustedTasksLandIn`) when the stamp is `untrusted`, else
-                // `tasksLandIn`; the resolver decides `tasks/backlog/` (staging) vs
-                // `tasks/ready/` (the pool). `intake` never places itself.
-                tasksLandIn: options.tasksLandIn,
-                untrustedTasksLandIn: options.untrustedTasksLandIn,
-                explicitTasksLandIn: options.explicitTasksLandIn,
-                providerInstance: options.providerInstance,
-                issueProvider,
-                // The bounded lone-task review seam (tests inject a canned verdict;
-                // production wires the harness via the default below).
-                reviewTask: resolveLoneTaskReviewGate(options),
-                seen: seenDelta,
-                env,
-                // The lone-task review AGENT launches AMBIENT (an agent must not act as
-                // the bot); `env` above is the identity-scoped git/provider env.
-                agentEnv: options.env,
-                note,
-            });
-        // The `spec` outcome is the parent-spec verdict; it dispatches through
-        // `modes.spec`. HARD CUTOVER: the legacy ''prd'' outcome case is GONE.
-        case 'spec':
-            return dispatchSpec({
-                verdict,
-                issueNumber,
-                cwd,
-                arbiter,
-                integration: modes.spec,
-                // The resolved cross-job CAS-retry cap (config `mergeRetries`) — threaded so
-                // intake's spec emit lands under the same per-repo cap the build path uses.
-                mergeRetries: options.mergeRetries,
-                // Same origin-trust stamp on the spec outcome (propagated onto its tasks
-                // later by the tasker). Passed IN; not resolved here.
-                originTrust: options.originTrust,
-                noPR: options.noPR,
-                // RUNNER-DETERMINISTIC PLACEMENT (task
-                // `pre-prd-staging-pool-split-and-untrusted-prd-placement`): the
-                // configured-default + explicit-flag rungs, fed into the SHARED placement
-                // resolver alongside the `originTrust` stamp above. The resolver decides
-                // `specs/proposed/` (staging) vs `specs/ready/` (the tasking pool); `intake` never
-                // places itself.
-                specsLandIn: options.specsLandIn,
-                // The UNTRUSTED-side default, selected in `dispatchSpec` when the
-                // `originTrust` stamp is `untrusted` (ADR
-                // `untrusted-origin-carries-via-stamp-not-forced-staging`).
-                untrustedSpecsLandIn: options.untrustedSpecsLandIn,
-                explicitSpecsLandIn: options.explicitSpecsLandIn,
-                providerInstance: options.providerInstance,
-                issueProvider,
-                seen: seenDelta,
-                env,
-                note,
-            });
+        case 'task': {
+            // A content-derived slug, NEVER a counter (spec `issue-intake` US #8).
+            const slug = resolveSlug(verdict);
+            if (slug === '') {
+                return failed('usage-error', `Intake produced a 'task' verdict for issue #${issueNumber} with no usable ` +
+                    `slug/title to derive a content-derived slug from (never a counter).`);
+            }
+            // BOUNDED INTERNAL REVIEW (observation
+            // `intake-lone-task-skips-adversarial-review-the-prd-path-gets`, rulings
+            // A/B/C): AFTER the `task` verdict and BEFORE the write/integrate, run a
+            // bounded (3-round, HARD-CAPPED) adversarial self-review on the SINGLE
+            // drafted task. It mutates the candidate body IN MEMORY. A launch/parse
+            // failure degrades onto `agent-failed` (never a silent emit of the
+            // un-reviewed task).
+            let review;
+            try {
+                review = await runLoneTaskReview({
+                    slug,
+                    issueNumber,
+                    draftTitle: verdict.taskTitle ?? slug,
+                    draftBody: verdict.taskBody,
+                    gate: resolveLoneTaskReviewGate(options),
+                    cwd,
+                    // The review AGENT launches AMBIENT (never the identity-scoped env).
+                    env: options.env,
+                    note,
+                });
+            }
+            catch (err) {
+                const detail = err instanceof Error ? err.message : String(err);
+                return failed('agent-failed', `Intake lone-task review failed for issue #${issueNumber}: ${detail}`);
+            }
+            if (review.outcome === 'non-converge') {
+                // NON-CONVERGE (ruling C): FLIP the verdict TASK→ASK, reusing the EXISTING
+                // `asked` outcome + `kind=ask` marker. The ASK comment carries BOTH the
+                // proposed task DRAFT and the open question(s) in its BODY. NEVER write
+                // the task; the next intake run resumes via the triage gate.
+                note(`Intake's lone-task review did not converge for issue #${issueNumber} ` +
+                    `(${review.passes} round(s)); flipping TASK→ASK with the draft + open ` +
+                    `question(s) in the comment body.`);
+                return {
+                    ok: true,
+                    decision: {
+                        kind: 'ask',
+                        body: composeLoneTaskAskComment({
+                            issueNumber,
+                            slug,
+                            draftTitle: review.title,
+                            draftBody: review.body,
+                            questions: review.questions,
+                        }),
+                    },
+                };
+            }
+            // CONVERGED: the (possibly edited) task is emitted; the refined body
+            // replaces the agent's first draft.
+            return {
+                ok: true,
+                decision: { kind: 'task', slug, title: review.title, body: review.body },
+            };
+        }
+        // The `spec` outcome is the parent-spec verdict. HARD CUTOVER: the legacy
+        // ''prd'' outcome case is GONE.
+        case 'spec': {
+            const slug = resolveSpecSlug(verdict);
+            if (slug === '') {
+                return failed('usage-error', `Intake produced a 'spec' verdict for issue #${issueNumber} with no usable ` +
+                    `slug/title to derive a content-derived slug from (never a counter).`);
+            }
+            return {
+                ok: true,
+                decision: {
+                    kind: 'spec',
+                    slug,
+                    title: verdict.specTitle ?? slug,
+                    body: verdict.specBody,
+                    humanOnly: verdict.specHumanOnly,
+                    needsAnswers: verdict.specNeedsAnswers,
+                },
+            };
+        }
+        case 'ask':
+            // The drafted clarifying question; a thin fallback keeps the comment
+            // non-empty if the agent left it blank.
+            return {
+                ok: true,
+                decision: {
+                    kind: 'ask',
+                    body: verdict.question && verdict.question.trim() !== ''
+                        ? verdict.question
+                        : `Could you clarify issue #${issueNumber} so it can be acted on?`,
+                },
+            };
+        case 'bounce':
+            // The drafted bounce message; a thin fallback restates the "file separate
+            // issues" ask. A bounce is TERMINAL: the issue is CLOSED atomically.
+            return {
+                ok: true,
+                decision: {
+                    kind: 'bounce',
+                    body: verdict.bounceMessage && verdict.bounceMessage.trim() !== ''
+                        ? verdict.bounceMessage
+                        : `This issue looks like multiple unrelated concerns — please file ` +
+                            `separate issues so each can be intaken on its own.`,
+                },
+            };
+        default:
+            // Unreachable from the parsed harness verdict (`parseIntakeVerdict` refuses
+            // any other token); an injected decider could still name one (the dead
+            // ''prd'' token). It dispatches NOTHING.
+            return failed('agent-failed', `Intake decision failed for issue #${issueNumber}: the verdict outcome ` +
+                `${JSON.stringify(verdict.outcome)} is not one of ask|task|spec|bounce.`);
+    }
+}
+/** The {@link IntakePlacementInputs} of a run's options. */
+export function intakePlacementInputs(options) {
+    return {
+        tasksLandIn: options.tasksLandIn,
+        untrustedTasksLandIn: options.untrustedTasksLandIn,
+        explicitTasksLandIn: options.explicitTasksLandIn,
+        specsLandIn: options.specsLandIn,
+        untrustedSpecsLandIn: options.untrustedSpecsLandIn,
+        explicitSpecsLandIn: options.explicitSpecsLandIn,
+    };
+}
+/**
+ * RUNNER-DETERMINISTIC PLACEMENT of an intake document (ADR
+ * `untrusted-origin-carries-via-stamp-not-forced-staging`): the folder the
+ * document is written into. The SAME shared resolver and precedence chain the
+ * tasker uses (`explicit > configured default > built-in staging`); only the
+ * lifecycle SLOTS differ between a task (`tasks/backlog` vs `tasks/ready`) and a
+ * spec (`specs/proposed` vs `specs/ready`). The `originTrust` stamp selects the
+ * untrusted-side configured default (`untrusted*LandIn`) over the trusted one.
+ * Safety for an untrusted document landing in `ready` flows through its carried
+ * stamp at BUILD / tasking time, not the folder.
+ */
+export function intakePlacementDir(kind, originTrust, placement) {
+    const untrusted = originTrust === 'untrusted';
+    if (kind === 'task') {
+        const configured = untrusted
+            ? placement.untrustedTasksLandIn
+            : placement.tasksLandIn;
+        const decision = resolvePlacement({
+            explicit: landingToSide(placement.explicitTasksLandIn),
+            configuredDefault: landingToSide(configured),
+        });
+        return placementFolder(TASK_PLACEMENT_SLOTS, decision.choice);
+    }
+    const configured = untrusted
+        ? placement.untrustedSpecsLandIn
+        : placement.specsLandIn;
+    const decision = resolvePlacement({
+        explicit: specLandingToSide(placement.explicitSpecsLandIn),
+        configuredDefault: specLandingToSide(configured),
+    });
+    return placementFolder(SPEC_PLACEMENT_SLOTS, decision.choice);
+}
+/**
+ * The WRITE half of intake (task `ci-split-intake`): act on a decision. An ask
+ * posts the question and leaves the issue open; a bounce closes the issue
+ * atomically with the bounce text; a task or spec is rendered (the title
+ * quoted, the frontmatter re-parsed), written onto a `work/intake-<type>-<slug>`
+ * branch and integrated, then the completion comment is posted. A render
+ * failure maps onto `agent-failed` (the input came from the agent) with nothing
+ * written. Runs no agent.
+ */
+export async function applyIntakeDecision(decision, ctx) {
+    const { issueNumber, cwd, issueProvider, seen, env, note } = ctx;
+    switch (decision.kind) {
         case 'ask':
+            // STAMP the MARKER recording `kind=ask` (non-terminal: the TRIAGE owns
+            // that) + the `seen=` delta, so a re-run recognises this as intake's own
+            // turn and resumes only on genuine new human input.
             return dispatchComment({
                 outcome: 'asked',
                 cwd,
                 issueNumber,
                 issueProvider,
-                // The drafted clarifying question; a thin fallback keeps the comment
-                // non-empty if the agent left it blank.
-                body: verdict.question && verdict.question.trim() !== ''
-                    ? verdict.question
-                    : `Could you clarify issue #${issueNumber} so it can be acted on?`,
-                // STAMP the MARKER recording `kind=ask` (non-terminal — the TRIAGE owns
-                // that) + the `seen=` delta, so a re-run recognises this as intake's own
-                // turn and resumes only on genuine new human input.
+                body: decision.body,
                 markerKind: 'ask',
-                seen: seenDelta,
+                seen,
                 env,
                 note,
             });
         case 'bounce':
+            // STAMP `kind=bounced` (TERMINAL: the TRIAGE then SKIPS
+            // `already-terminal` on a later human comment) + the `seen=` delta.
             return dispatchComment({
                 outcome: 'bounced',
                 cwd,
                 issueNumber,
                 issueProvider,
-                // The drafted bounce message; a thin fallback restates the "file separate
-                // issues" ask. A bounce is TERMINAL: the issue is CLOSED atomically (this
-                // text as the closing comment + reason not planned).
-                body: verdict.bounceMessage && verdict.bounceMessage.trim() !== ''
-                    ? verdict.bounceMessage
-                    : `This issue looks like multiple unrelated concerns — please file ` +
-                        `separate issues so each can be intaken on its own.`,
-                // STAMP `kind=bounced` (TERMINAL — the TRIAGE then SKIPS `already-terminal`
-                // on a later human comment) + the `seen=` delta.
+                body: decision.body,
                 markerKind: 'bounced',
-                seen: seenDelta,
+                seen,
                 env,
                 note,
             });
+        case 'task':
+        case 'spec': {
+            // RENDER before any git: the renderer quotes the agent title and re-parses
+            // its own output, THROWING on anything that does not read back as
+            // written. That maps onto `agent-failed` with nothing written and no
+            // branch cut.
+            let content;
+            try {
+                content = renderIntakeDocument(decision, {
+                    issueNumber,
+                    originTrust: ctx.originTrust,
+                });
+            }
+            catch (err) {
+                const detail = err instanceof Error ? err.message : String(err);
+                const message = `Intake could not render the ${decision.kind} for issue #${issueNumber}: ${detail}`;
+                note(message);
+                return { exitCode: 1, outcome: 'agent-failed', issueNumber, message };
+            }
+            return emitIntakeDocument(decision, content, ctx);
+        }
     }
 }
+/**
+ * Render an intake document from a decision and the TRUSTED issue number and
+ * origin-trust stamp ({@link renderBacklogTask} / {@link renderSpec}: the title
+ * quoted, every runner-owned key re-parsed), then assert once more, through
+ * the shared frontmatter reader, that `origin`, `originTrust`, `slug` and
+ * `issue` read back as the trusted values ({@link assertIntakeDocumentStamp}).
+ * THROWS on any disagreement. The CI apply job calls this on the verdict it
+ * received, so the stamp never comes from the agent job.
+ */
+export function renderIntakeDocument(doc, trusted) {
+    const { issueNumber, originTrust } = trusted;
+    const rendered = doc.kind === 'task'
+        ? renderBacklogTask({
+            slug: doc.slug,
+            title: doc.title,
+            body: doc.body,
+            issueNumber,
+            originTrust,
+        })
+        : renderSpec({
+            slug: doc.slug,
+            title: doc.title,
+            body: doc.body,
+            issueNumber,
+            humanOnly: doc.humanOnly,
+            needsAnswers: doc.needsAnswers,
+            originTrust,
+        });
+    assertIntakeDocumentStamp(rendered, {
+        slug: doc.slug,
+        issueNumber,
+        originTrust,
+    });
+    return rendered;
+}
+/**
+ * The stamp check of a rendered intake document: its frontmatter must read back
+ * `slug`, `issue`, `origin` and `originTrust` EXACTLY as the trusted values
+ * (`origin: issue` + `originTrust` when a stamp is given, both absent
+ * otherwise). THROWS a `FrontmatterRenderError` otherwise.
+ */
+export function assertIntakeDocumentStamp(rendered, trusted) {
+    assertFrontmatterFields(rendered, {
+        slug: trusted.slug,
+        issue: String(trusted.issueNumber),
+        origin: trusted.originTrust === undefined ? undefined : 'issue',
+        originTrust: trusted.originTrust,
+    });
+}
+/**
+ * Emit a RENDERED intake document: place it (runner-deterministic, from the
+ * trusted stamp and the placement inputs), onboard a `work/intake-<type>-<slug>`
+ * branch cut from the freshly-fetched `<arbiter>/main`, stage exactly the one
+ * document path and integrate it through {@link performIntegration} (`propose`
+ * PR, or `merge` with the CAS loop), then post the completion comment. The
+ * `intake-` producer prefix keeps the branch distinct from a later `do
+ * task:<slug>` build branch for the same slug.
+ */
+export async function emitIntakeDocument(doc, content, ctx) {
+    const { issueNumber, cwd, arbiter, issueProvider, seen, env, note } = ctx;
+    const { kind, slug, title } = doc;
+    const relPath = `${intakePlacementDir(kind, ctx.originTrust, ctx.placement)}/${slug}.md`;
+    await switchToWorkBranch(cwd, arbiter, kind, slug, env);
+    const core = await performIntegration({
+        cwd,
+        arbiter,
+        slug,
+        // `source`/`recovering` are task-shaped and IGNORED when `lifecycle` is set.
+        source: 'in-progress',
+        recovering: false,
+        // An intake-emitted document has no `verify` floor of its own (it is a new
+        // backlog item / spec, not a build); skip the acceptance gate, exactly as
+        // the tasking transition does.
+        skipVerify: true,
+        // The EXPLICITLY-chosen per-type mode proceeds as-is (`merge` IS the
+        // auto-land mode, never downgraded).
+        mode: ctx.integration[kind],
+        // The cross-job merge-serialiser CAS-retry cap (config `mergeRetries`).
+        mergeRetries: ctx.mergeRetries,
+        ...(ctx.mergeJitterMs === undefined
+            ? {}
+            : { mergeJitterMs: ctx.mergeJitterMs }),
+        noPR: ctx.noPR,
+        providerInstance: ctx.providerInstance,
+        type: 'feat',
+        // A short PR body so an intake PR is never blank (`gh --fill`): it names the
+        // source issue WITHOUT a closing keyword (the issue must outlive the merge).
+        body: composeIntakeProposeBody({ kind, issueNumber }),
+        lifecycle: {
+            // The document IS the title source. Pass the DRAFTED title EXPLICITLY:
+            // `stage()` writes the file AFTER the core reads the title, so a
+            // `titlePath` read would race the write. `titlePath` stays set (the
+            // lifecycle contract requires it) but is IGNORED while `title` is present.
+            titlePath: join(cwd, relPath),
+            title,
+            commitTag: 'intake',
+            // The document RESTS at its placed path (staged or pool), so point the
+            // reviewer at THAT file, never the task-build `work/tasks/done/` default.
+            proposeHeader: proposePointer(kind === 'task' ? 'Task' : 'Spec', relPath),
+            stage: () => stageIntakeContent({ cwd, relPath, content, env }),
+        },
+        env,
+        note,
+    });
+    return integrationToIntakeResult(core, {
+        issueNumber,
+        slug,
+        relPath,
+        kind,
+        cwd,
+        issueProvider,
+        seen,
+        env,
+        note,
+    });
+}
+/**
+ * The propose PR prose of an intake emit (task
+ * `propose-pr-bodies-point-at-the-real-item`); the shared core puts the
+ * document pointer above it. It names the source issue as a plain `#<n>`
+ * reference and deliberately uses NO closing keyword (`closes`, `fixes`,
+ * `resolves`, ...): merging an intake PR only files the task or spec, and the
+ * issue stays open until that work is done (the close job owns closing it).
+ */
+export function composeIntakeProposeBody(params) {
+    const { kind, issueNumber } = params;
+    return (`Intake drafted this ${kind} from issue #${issueNumber}. Merging this PR ` +
+        `files the ${kind}; it leaves the issue open.`);
+}
 /**
  * DISPATCH the `ask` / `bounce` outcomes — the SHARED comment band, which now
  * BRANCHES on the outcome:
@@ -593,275 +893,6 @@ async function dispatchComment(params) {
         message,
     };
 }
-/**
- * DISPATCH the `task` outcome: derive a content-derived slug, write
- * `work/backlog/<slug>.md` (`covers: []`, NO `spec:`) carrying `issue: N` (the
- * lone-task closure link, NOT `Fixes #N`), and integrate via {@link
- * performIntegration}. The runner owns the git: it onboards a
- * `work/<slug>` branch off fresh `<arbiter>/main`, then the lifecycle `stage`
- * writes + stages the task and the band commits + rebases + integrates it. The
- * agent did NO git/seam ops.
- */
-async function dispatchTask(params) {
-    const { verdict, issueNumber, cwd, arbiter, integration, mergeRetries, originTrust, noPR, tasksLandIn, untrustedTasksLandIn, explicitTasksLandIn, providerInstance, issueProvider, reviewTask, seen, env, agentEnv, note, } = params;
-    // A content-derived slug — NEVER a counter (spec `issue-intake` US #8). Prefer the drafted
-    // `taskSlug`, else derive from the drafted title; sanitise either through
-    // `paramCase` so the filename + frontmatter slug are well-formed.
-    const slug = resolveSlug(verdict);
-    if (slug === '') {
-        const message = `Intake produced a 'task' verdict for issue #${issueNumber} with no usable ` +
-            `slug/title to derive a content-derived slug from (never a counter).`;
-        note(message);
-        return { exitCode: 1, outcome: 'usage-error', issueNumber, message };
-    }
-    // RUNNER-DETERMINISTIC PLACEMENT (task `intake-task-placement-symmetry`; the
-    // untrusted-forces-staging rung RETIRED by ADR
-    // `untrusted-origin-carries-via-stamp-not-forced-staging`). Resolve which
-    // folder the runner writes the intake-authored task into BEFORE handing it to
-    // the shared integrate band — the SAME precedence chain, the SAME shared
-    // resolver, and (via `TASK_PLACEMENT_SLOTS` + `landingToSide` reused from
-    // `tasking.ts`) the SAME task slots the tasker uses; only the intake dispatch
-    // differs from the spec twin (`dispatchSpec`) in its lifecycle SLOTS. THIS
-    // caller selects the trusted-vs-untrusted configured default by reading the
-    // `originTrust` stamp: an untrusted task selects `untrustedTasksLandIn`
-    // (default staging; `ready` when configured), a trusted/unset task selects
-    // `tasksLandIn`. The agent (the intake decider) never influences placement.
-    // Net vs the old hardcoded `tasks-ready`: an untrusted-author task now MERGES
-    // a document to `main` in `backlog` (by default) carrying the stamp instead of
-    // opening a document PR; safety for a `ready`-landed untrusted task flows
-    // through its carried stamp at BUILD time (forces a code PR), not the folder.
-    const configuredTasksLanding = originTrust === 'untrusted' ? untrustedTasksLandIn : tasksLandIn;
-    const placementDecision = resolvePlacement({
-        explicit: landingToSide(explicitTasksLandIn),
-        configuredDefault: landingToSide(configuredTasksLanding),
-    });
-    const placementDir = placementFolder(TASK_PLACEMENT_SLOTS, placementDecision.choice);
-    const relPath = `${placementDir}/${slug}.md`;
-    // BOUNDED INTERNAL REVIEW (observation
-    // `intake-lone-task-skips-adversarial-review-the-prd-path-gets`, rulings A/B/C):
-    // the `do spec:` path gets `runTaskReviewLoop`; the lone-TASK path got NOTHING.
-    // AFTER the `task` verdict and BEFORE the write/integrate, run a bounded (3-round,
-    // HARD-CAPPED) adversarial self-review on the SINGLE drafted task. It mutates the
-    // candidate body IN MEMORY (no `work/backlog/` write pre-convergence). A launch/
-    // parse failure THROWS — `decideAndDispatch`'s try/catch maps it onto `agent-failed`
-    // (never a silent emit of the un-reviewed task).
-    let review;
-    try {
-        review = await runLoneTaskReview({
-            slug,
-            issueNumber,
-            draftTitle: verdict.taskTitle ?? slug,
-            draftBody: verdict.taskBody,
-            gate: reviewTask,
-            cwd,
-            // The review AGENT launches AMBIENT (never the identity-scoped env).
-            env: agentEnv,
-            note,
-        });
-    }
-    catch (err) {
-        // A review-agent launch/parse FAILURE DEGRADES honestly onto the EXISTING
-        // `agent-failed` outcome (exit 1) — NEVER a silent emit of the un-reviewed
-        // task. The SAME try/catch discipline the decision step uses.
-        const detail = err instanceof Error ? err.message : String(err);
-        const message = `Intake lone-task review failed for issue #${issueNumber}: ${detail}`;
-        note(message);
-        return { exitCode: 1, outcome: 'agent-failed', issueNumber, message };
-    }
-    if (review.outcome === 'non-converge') {
-        // NON-CONVERGE (ruling C): FLIP the verdict TASK→ASK, reusing the EXISTING
-        // `asked` outcome + `kind=ask` marker. The ASK comment carries BOTH the proposed
-        // task DRAFT and the open question(s) in its BODY (NOT a new marker kind) — the
-        // human reacts to a concrete draft, strictly richer than a blank-question ask.
-        // NEVER write `work/backlog/<slug>.md`; NEVER silently emit the under-refined
-        // task. The next intake run resumes via the already-built triage gate.
-        note(`Intake's lone-task review did not converge for issue #${issueNumber} ` +
-            `(${review.passes} round(s)); flipping TASK→ASK with the draft + open ` +
-            `question(s) in the comment body.`);
-        return dispatchComment({
-            outcome: 'asked',
-            cwd,
-            issueNumber,
-            issueProvider,
-            body: composeLoneTaskAskComment({
-                issueNumber,
-                slug,
-                draftTitle: review.title,
-                draftBody: review.body,
-                questions: review.questions,
-            }),
-            markerKind: 'ask',
-            seen,
-            env,
-            note,
-        });
-    }
-    // CONVERGED: the (possibly edited) task is emitted via the EXISTING write/integrate
-    // path below + the existing `task created` completion comment. The refined body
-    // replaces the agent's first draft.
-    const reviewedBody = review.body;
-    // ONBOARD the task write onto a `work/intake-task-<slug>` branch cut from the
-    // freshly-fetched `<arbiter>/main` (the SAME runner-owns-git discipline the
-    // tasking path uses): the lifecycle `stage` writes the file ON THIS BRANCH and
-    // the shared integrate core (`--propose` PR / `--merge` main) lands it. The
-    // intake- producer prefix keeps it distinct from a later `do task:<slug>`
-    // build branch for the same slug. The agent ran no git.
-    await switchToWorkBranch(cwd, arbiter, 'task', slug, env);
-    const taskContent = renderBacklogTask({
-        slug,
-        title: review.title,
-        body: reviewedBody,
-        issueNumber,
-        originTrust,
-    });
-    const core = await performIntegration({
-        cwd,
-        arbiter,
-        slug,
-        // `source`/`recovering` are task-shaped and IGNORED when `lifecycle` is set.
-        source: 'in-progress',
-        recovering: false,
-        // An intake-emitted task has no `verify` floor of its own (it is a new
-        // backlog item, not a build); skip the acceptance gate, exactly as the
-        // tasking transition does.
-        skipVerify: true,
-        // Default `propose` (the per-outcome KNOBS are a later task). The
-        // EXPLICITLY-chosen mode proceeds as-is: a future `--merge-task` lands on main
-        // (`merge` IS the auto-land mode, never downgraded).
-        mode: integration,
-        // The cross-job merge-serialiser CAS-retry cap (config `mergeRetries`) — the
-        // git-alone floor of the cross-job land queue, resolved through the gate-
-        // family precedence chain in the CLI and threaded here so intake's lone-task
-        // emit lands under the same per-repo cap the build path uses. Unset ⇒ the
-        // engine default (byte-for-byte unchanged).
-        mergeRetries,
-        noPR,
-        providerInstance,
-        type: 'feat',
-        lifecycle: {
-            // The emitted task IS the title source. Pass the DRAFTED title EXPLICITLY
-            // (not a read-from-path): `stage()` WRITES `work/backlog/<slug>.md` AFTER the
-            // core reads the title, so a `titlePath` read would race the write and degrade
-            // the commit subject / PR title to the generic fallback. `titlePath` stays set
-            // (the lifecycle contract requires it) but is IGNORED while `title` is present.
-            titlePath: join(cwd, relPath),
-            title: review.title,
-            commitTag: 'intake',
-            stage: () => stageIntakeContent({ cwd, relPath, content: taskContent, env }),
-        },
-        env,
-        note,
-    });
-    return integrationToIntakeResult(core, {
-        issueNumber,
-        slug,
-        relPath,
-        cwd,
-        issueProvider,
-        seen,
-        env,
-        note,
-    });
-}
-/**
- * DISPATCH the `spec` outcome (the SOLE parent-spec outcome after the HARD CUTOVER;
- * the legacy ''prd'' outcome token is GONE): derive a content-derived slug, write the spec file
- * (`work/specs/ready/<slug>.md`) carrying `issue: N` (the loop-closure linkage the
- * close JOB reaches via `task.spec: → spec issue:`; on a fanned spec the number
- * lives ONLY on the spec — a fanned task uses `spec:`, NOT its own `issue:`, which
- * is the lone-task outcome's link) + the gate axes the prompt JUDGED, integrate it
- * via {@link performIntegration}, then STOP. Tasking the emitted spec is the
- * SEPARATE `do spec:` step (NOT done here). A coupled-but-SMALL pair lands here too
- * (the spec vs BOUNCE line is SHARED VISION, not size — the over-bounce guard). The
- * runner owns the git exactly as the task branch does; the agent did NO git/seam ops.
- */
-async function dispatchSpec(params) {
-    const { verdict, issueNumber, cwd, arbiter, integration, mergeRetries, originTrust, noPR, specsLandIn, untrustedSpecsLandIn, explicitSpecsLandIn, providerInstance, issueProvider, seen, env, note, } = params;
-    // A content-derived slug — NEVER a counter (spec `issue-intake` US #8). Prefer the drafted
-    // `specSlug`, else derive from the drafted title.
-    const slug = resolveSpecSlug(verdict);
-    if (slug === '') {
-        const message = `Intake produced a 'spec' verdict for issue #${issueNumber} with no usable ` +
-            `slug/title to derive a content-derived slug from (never a counter).`;
-        note(message);
-        return { exitCode: 1, outcome: 'usage-error', issueNumber, message };
-    }
-    // RUNNER-DETERMINISTIC PLACEMENT (task
-    // `pre-prd-staging-pool-split-and-untrusted-prd-placement`; the
-    // untrusted-forces-staging rung RETIRED by ADR
-    // `untrusted-origin-carries-via-stamp-not-forced-staging`). Resolve which
-    // folder the runner writes the intake-authored spec into BEFORE handing it to
-    // the shared integrate band: the SAME precedence chain the tasker uses
-    // (`explicit > configured default > built-in (staging)`), the SAME shared
-    // resolver — only the lifecycle SLOTS differ. THIS caller selects the
-    // trusted-vs-untrusted configured default by reading the `originTrust` stamp:
-    // an untrusted spec selects `untrustedSpecsLandIn` (default staging; `ready`
-    // when configured), a trusted/unset spec selects `specsLandIn`. The agent
-    // (the intake decider) never influences placement; it returns the verdict and
-    // the runner computes the destination from unforgeable inputs. Safety for an
-    // untrusted spec landing in `ready` flows through its tasks' carried stamp,
-    // not the folder.
-    const configuredSpecsLanding = originTrust === 'untrusted' ? untrustedSpecsLandIn : specsLandIn;
-    const placementDecision = resolvePlacement({
-        explicit: specLandingToSide(explicitSpecsLandIn),
-        configuredDefault: specLandingToSide(configuredSpecsLanding),
-    });
-    const placementDir = placementFolder(SPEC_PLACEMENT_SLOTS, placementDecision.choice);
-    const relPath = `${placementDir}/${slug}.md`;
-    // ONBOARD onto a `work/intake-spec-<slug>` branch off fresh `<arbiter>/main` —
-    // the SAME runner-owns-git discipline the task branch uses; the intake-
-    // producer prefix keeps it distinct from a `do spec:<slug>` tasking branch.
-    await switchToWorkBranch(cwd, arbiter, 'spec', slug, env);
-    const specContent = renderSpec({
-        slug,
-        title: verdict.specTitle ?? slug,
-        body: verdict.specBody,
-        issueNumber,
-        humanOnly: verdict.specHumanOnly,
-        needsAnswers: verdict.specNeedsAnswers,
-        originTrust,
-    });
-    const core = await performIntegration({
-        cwd,
-        arbiter,
-        slug,
-        source: 'in-progress',
-        recovering: false,
-        // An intake-emitted spec has no `verify` floor of its own (it is a new spec,
-        // not a build), exactly as the task branch + the tasking transition skip it.
-        skipVerify: true,
-        mode: integration,
-        // The cross-job merge-serialiser CAS-retry cap (config `mergeRetries`) — same
-        // rationale as the lone-task emit above; threaded so intake's spec emit lands
-        // under the same per-repo cap. Unset ⇒ the engine default (byte-for-byte).
-        mergeRetries,
-        noPR,
-        providerInstance,
-        type: 'feat',
-        lifecycle: {
-            // The emitted spec IS the title source. Pass the DRAFTED title EXPLICITLY (same
-            // race as the task path: `stage()` writes the spec file AFTER the title
-            // read). `titlePath` stays set but is IGNORED while `title` is present.
-            titlePath: join(cwd, relPath),
-            title: verdict.specTitle ?? slug,
-            commitTag: 'intake',
-            stage: () => stageIntakeContent({ cwd, relPath, content: specContent, env }),
-        },
-        env,
-        note,
-    });
-    return integrationToIntakeResult(core, {
-        issueNumber,
-        slug,
-        relPath,
-        kind: 'spec',
-        cwd,
-        issueProvider,
-        seen,
-        env,
-        note,
-    });
-}
 /**
  * Map the shared integrate band's {@link IntegrationCoreResult} onto the intake
  * {@link IntakeResult}. On `completed` the artifact was written + integrated; a
@@ -875,9 +906,18 @@ async function integrationToIntakeResult(core, ctx) {
     const kind = ctx.kind ?? 'task';
     const artifact = kind === 'spec' ? 'spec' : 'task';
     if (core.outcome === 'completed') {
+        // HONEST propose report (task `intake-reports-the-pr-it-actually-opened`):
+        // say "opened a PR" ONLY when the provider opened one. A degraded `gh pr
+        // create` (e.g. a repository that refuses PR creation by Actions) pushed the
+        // branch but opened nothing; the shared core already printed the provider's
+        // instruction, and the message names the branch the work is on.
+        const notOpened = proposeRequestNotOpened(core.integration);
         const landed = core.integration?.mode === 'merge'
             ? 'landed it on the arbiter main'
-            : 'opened a PR carrying it (main untouched)';
+            : notOpened !== undefined
+                ? `pushed it on branch ${core.integration?.pushedRef ?? core.branch} ` +
+                    'but opened NO PR (main untouched; see the provider note above)'
+                : 'opened a PR carrying it (main untouched)';
         // Both a lone task and a spec carry `issue: N` as their closure link (the task
         // closes its own issue; a spec is reached via `task.spec: → spec issue:`). On the
         // task/spec path `intake` never closes the issue (CI's close-job does, via the
@@ -943,10 +983,14 @@ async function integrationToIntakeResult(core, ctx) {
  * - reports `task created` / `spec created` framed as CREATED — NEVER "issue
  *   resolved/closed" (intake never closes on the task/spec path).
  * - LINKS the artifact by INTEGRATION MODE: the PR `url` in propose, the landed
- *   `commit` (the additive {@link IntegrateResult.commit}) in merge. A degraded
- *   propose (no `url`) or a failed merge-tip read (no `commit`) simply OMITS the
+ *   `commit` (the additive {@link IntegrateResult.commit}) in merge. An opened PR
+ *   whose `url` was unparseable or a failed merge-tip read (no `commit`) simply OMITS the
  *   link — the comment still confirms what was created (the artifact is safe on the
  *   branch/main regardless). No spec link beyond the slug.
+ * - says so when a propose land opened NO PR at all (the provider degraded, e.g. a
+ *   repository that refuses PR creation by Actions, or a push-only provider): it
+ *   names the pushed branch and quotes the provider's reason verbatim, instead of
+ *   reading as if a PR carried the artifact.
  * - carries the FULL intake MARKER via the SHARED {@link stampIntakeMarker} helper
  *   (`kind=created slug=<slug> seen=<id>,…`) so the triage's `already-terminal`
  *   branch consumes it — the comment cannot re-trigger intake.
@@ -954,13 +998,21 @@ async function integrationToIntakeResult(core, ctx) {
 export function composeIntakeCompletionComment(params) {
     const { kind, slug, integration, seen } = params;
     const artifact = kind === 'spec' ? 'spec' : 'task';
+    // A propose land that opened NO PR (the provider degraded, or push-only) says
+    // so, names the pushed branch and quotes the provider's reason, instead of
+    // implying a PR (task `intake-reports-the-pr-it-actually-opened`).
+    const notOpened = proposeRequestNotOpened(integration);
     const link = integration?.mode === 'merge'
         ? integration.commit !== undefined
             ? `\n\nIt landed on \`main\` in commit ${integration.commit}.`
             : ''
-        : integration?.url !== undefined
-            ? `\n\nIt is carried by the PR: ${integration.url}`
-            : '';
+        : notOpened !== undefined
+            ? `\n\nIt is pushed on branch \`${integration.pushedRef}\`, but **no PR ` +
+                `could be opened**, so nothing proposes it for review yet. The ` +
+                `reason reported:\n\n${fenceVerbatim(notOpened)}`
+            : integration?.url !== undefined
+                ? `\n\nIt is carried by the PR: ${integration.url}`
+                : '';
     const body = `Created ${artifact} \`${slug}\` from this issue.${link}\n\n` +
         `This is an informational update — the issue stays open (it remains in play ` +
         `until the ${artifact} lands; intake does not change the issue's state).`;
@@ -968,6 +1020,17 @@ export function composeIntakeCompletionComment(params) {
     // `already-terminal` branch recognises this terminal `created` comment.
     return stampIntakeMarker(body, { kind: 'created', seen, slug });
 }
+/**
+ * Wrap `text` in a fenced code block that renders it VERBATIM: the fence is one
+ * backtick longer than the longest backtick run inside `text` (minimum three), so
+ * a provider instruction carrying inline code or a quoted PR body can never close
+ * the fence early.
+ */
+function fenceVerbatim(text) {
+    const longest = Math.max(0, ...Array.from(text.matchAll(/`+/g), (m) => m[0].length));
+    const fence = '`'.repeat(Math.max(3, longest + 1));
+    return `${fence}text\n${text}\n${fence}`;
+}
 /**
  * Post the INFORMATIONAL completion comment for a SUCCESSFUL `task` / `spec`
  * outcome (this task). It closes the loop the ASK/BOUNCE comments already close
@@ -1041,6 +1104,31 @@ function resolveSpecSlug(verdict) {
         : (verdict.specTitle ?? '');
     return ensureSafeSlug(paramCase(candidate));
 }
+/**
+ * Refuse an intake verdict whose drafted title cannot be one frontmatter line
+ * (task `intake-frontmatter-title-injection-strips-origin-stamp`). Only the
+ * title the verdict's OUTCOME will render is checked (`taskTitle` for `task`,
+ * `specTitle` for `spec`): it must be one line with no control character and
+ * not blank. An ABSENT title stays legal (the dispatcher falls back to the
+ * slug). THROWS; the caller maps the throw onto `agent-failed`.
+ */
+export function assertIntakeVerdictTitle(verdict) {
+    const [field, title] = verdict.outcome === 'task'
+        ? ['taskTitle', verdict.taskTitle]
+        : verdict.outcome === 'spec'
+            ? ['specTitle', verdict.specTitle]
+            : [undefined, undefined];
+    if (field === undefined || title === undefined) {
+        return;
+    }
+    const problem = singleLineScalarProblem(title);
+    if (problem !== undefined) {
+        throw new Error(`intake verdict '${field}' ${problem}.`);
+    }
+    if (title.trim() === '') {
+        throw new Error(`intake verdict '${field}' is blank.`);
+    }
+}
 /**
  * Render the backlog task file: the frontmatter (`title`/`slug`/`covers: []`, NO
  * `spec:` — its own source of truth, spec `issue-intake` decision table) carrying the lone-task
@@ -1054,9 +1142,13 @@ function resolveSpecSlug(verdict) {
  */
 export function renderBacklogTask(params) {
     const { slug, title, body, issueNumber, originTrust } = params;
+    // The TITLE is agent-drafted (issue text any user can write): it goes through
+    // the shared quoter, which THROWS on a multi-line / control-character value
+    // (the verdict boundary already refused one; this is the backstop), so it can
+    // never close the fence early and demote the origin-trust stamp below it.
     const lines = [
         '---',
-        `title: ${title}`,
+        `title: ${quoteYamlScalar(title)}`,
         `slug: ${slug}`,
         `issue: ${issueNumber}`,
     ];
@@ -1081,7 +1173,19 @@ export function renderBacklogTask(params) {
             acceptanceCriteria: '- [ ] the issue is resolved',
             prompt: `Resolve issue #${issueNumber}: ${title}`,
         }).trimEnd();
-    return `${frontmatter}\n\n${drafted}\n`;
+    const rendered = `${frontmatter}\n\n${drafted}\n`;
+    // Re-parse what we rendered: every key is runner-owned, so the frontmatter
+    // must read back EXACTLY these keys and values, else fail loudly.
+    assertFrontmatterFields(rendered, {
+        title,
+        slug,
+        issue: String(issueNumber),
+        origin: originTrust === undefined ? undefined : 'issue',
+        originTrust,
+        covers: '[]',
+        blockedBy: '[]',
+    }, { exact: true });
+    return rendered;
 }
 /**
  * Render the emitted spec file: the frontmatter (`title`/`slug` + the loop-closure
@@ -1097,9 +1201,11 @@ export function renderBacklogTask(params) {
  */
 export function renderSpec(params) {
     const { slug, title, body, issueNumber, humanOnly, needsAnswers, originTrust } = params;
+    // The agent-drafted TITLE goes through the shared quoter (see
+    // `renderBacklogTask`).
     const lines = [
         '---',
-        `title: ${title}`,
+        `title: ${quoteYamlScalar(title)}`,
         `slug: ${slug}`,
         `issue: ${issueNumber}`,
     ];
@@ -1133,7 +1239,18 @@ export function renderSpec(params) {
             solution: '(to be detailed; this spec needs tasking via `do spec:`).',
             userStories: `1. As a user, I want issue #${issueNumber} addressed.`,
         }).trimEnd();
-    return `${frontmatter}\n\n${drafted}\n`;
+    const rendered = `${frontmatter}\n\n${drafted}\n`;
+    // Re-parse what we rendered (see `renderBacklogTask`).
+    assertFrontmatterFields(rendered, {
+        title,
+        slug,
+        issue: String(issueNumber),
+        origin: originTrust === undefined ? undefined : 'issue',
+        originTrust,
+        humanOnly: humanOnly === true ? 'true' : undefined,
+        needsAnswers: needsAnswers === true ? 'true' : undefined,
+    }, { exact: true });
+    return rendered;
 }
 /**
  * STAGE the intake artifact content into the index on the `work/<slug>` branch (the