forge-workflow 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/commands/setup.js

@@ -188,7 +188,6 @@ const WORKFLOW_RUNTIME_ASSETS = Object.freeze([
   'scripts/forge-team/index.sh',
   'scripts/forge-team/lib/agent-prompt.sh',
   'scripts/forge-team/lib/claim.sh',
-  'scripts/forge-team/lib/dashboard.sh',
   'scripts/forge-team/lib/epic.sh',
   'scripts/forge-team/lib/hooks.sh',
   'scripts/forge-team/lib/identity.sh',
@@ -378,13 +377,13 @@ async function finalizeWorkflowConfig(options = {}) {
 
 /**
  * Default init runner for finalizeWorkflowConfig. When `skipSideEffects` is set
- * (setup paths that already installed git hooks and migrated Beads), pass no-op
- * deps so init only writes `.forge/config.yaml` instead of re-doing that work —
- * avoids duplicate side effects and warning noise (CodeRabbit on PR #368).
+ * (setup paths that already installed git hooks), pass no-op deps so init only
+ * writes `.forge/config.yaml` instead of re-doing that work — avoids duplicate
+ * side effects and warning noise (CodeRabbit on PR #368).
  */
 function defaultRunInit(root, skipSideEffects) {
   const deps = skipSideEffects
-    ? { installHooks: () => {}, autoMigrateBeads: () => {} }
+    ? { installHooks: () => {} }
     : {};
   return initCommand.handler(['--yes'], {}, root, deps);
 }
@@ -2734,6 +2733,102 @@ function installForgeHookScripts() {
 // kept shipping the broken behaviour. They are imported at the top of this file and
 // re-exported below for the existing test surface.
 
+// Honest, resolved-config description of what the installed hooks will actually
+// enforce (issue eda6d866). The hook scripts are installed unconditionally but are
+// INERT when their gate/rail is disabled in .forge/config.yaml, so setup must not
+// claim "enforcement active" when the resolved config says otherwise.
+// Resolve — from the SAME .forge/config.yaml the hooks read at run time — whether the TDD
+// gate is active and how many protected paths are guarded. The reporting/exit layer gates
+// its verdict on this so setup never claims (or fails over) a state the user deliberately
+// disabled (issue eda6d866). On resolver THROW (missing/corrupt config), fail TOWARD
+// enforcement (tddActive:true, resolved:false) so a broken config can never silently
+// downgrade the human-facing verdict.
+function resolveHookEnforcementState(root = projectRoot) {
+  try {
+    const { getResolvedRuntimeGraph } = require('../core/runtime-graph');
+    const graph = getResolvedRuntimeGraph({ projectRoot: root });
+    const tddRail = (graph.rails || []).find(rail => rail.id === 'rail.tdd_intent');
+    const tddActive = !tddRail || tddRail.enabled !== false;
+    const protectedCount = Array.isArray(graph.protectedPaths) ? graph.protectedPaths.length : 0;
+    return { tddActive, protectedCount, resolved: true };
+  } catch {
+    return { tddActive: true, protectedCount: 0, resolved: false };
+  }
+}
+
+function describeHookEnforcement(root = projectRoot) {
+  const state = resolveHookEnforcementState(root);
+  if (!state.resolved) {
+    return null; // never let an honest-status line block setup (resolver threw)
+  }
+  const tdd = state.tddActive ? 'active' : 'disabled in config (hook inert)';
+  const pp = state.protectedCount > 0
+    ? `active (${state.protectedCount} path${state.protectedCount === 1 ? '' : 's'})`
+    : 'disabled in config (hook inert)';
+  return `TDD gate: ${tdd}; protected-path: ${pp}`;
+}
+
+// Pure reporting/exit-layer verdict (issue eda6d866): fold the file-presence hook check
+// (verifyHooksActive) and the resolved config state (resolveHookEnforcementState) into the
+// message/level and whether setup should exit non-zero. Kept pure + exported so the four
+// honesty cases are unit-testable without spawning setup. The caller folds "are we in a git
+// repo" into `loud`, so a non-git dir (nothing to hook into) only ever warns.
+function buildHookVerdict(verdict, state, options = {}) {
+  const loud = options.loud === true;
+  const tddActive = !state || state.tddActive !== false;
+  if (verdict.active) {
+    if (tddActive) {
+      return {
+        message: `  ✓ Git hook enforcement active (${verdict.method}).`,
+        level: 'log',
+        exitFailure: false,
+      };
+    }
+    // Hooks installed but the TDD gate is OFF in config → the scripts are inert by the
+    // user's own choice. Say so honestly instead of over-claiming "enforcement active".
+    return {
+      message: `  ✓ Git hooks installed (${verdict.method}) — TDD gate disabled in .forge/config.yaml, hooks are inert. Re-enable: forge gate enable rail.tdd_intent`,
+      level: 'log',
+      exitFailure: false,
+    };
+  }
+  if (!tddActive) {
+    // Hooks not active AND the user disabled enforcement — this is the CHOSEN state (e.g.
+    // `init --profile minimal`), so never banner or exit non-zero for it, even under loud.
+    return {
+      message: '  ℹ Git hooks not active — enforcement is disabled in .forge/config.yaml anyway.',
+      level: 'info',
+      exitFailure: false,
+    };
+  }
+  // TDD is ON but hooks are inert — the silent-inert bug B3. Loud setup in a git repo fails
+  // LOUDLY + non-zero; otherwise (init/repair path, or non-git dir folded into !loud) warn.
+  if (loud) {
+    const addCmd = PKG_MANAGER === 'bun'
+      ? 'bun add -d'
+      : PKG_MANAGER === 'npm'
+        ? 'npm install --save-dev'
+        : `${PKG_MANAGER} add -D`;
+    const message = [
+      '',
+      '  ============================================================',
+      '  ⚠ TDD ENFORCEMENT IS NOT ACTIVE',
+      `     ${verdict.reason || 'no pre-commit hook is installed'}.`,
+      '     `forge ship` will block until hooks are active. To fix:',
+      `       ${addCmd} lefthook  &&  npx lefthook install`,
+      '     (or re-run `forge setup` in the repo root).',
+      '  ============================================================',
+      '',
+    ].join('\n');
+    return { message, level: 'error', exitFailure: true };
+  }
+  return {
+    message: `  ⚠ TDD enforcement is NOT active: ${verdict.reason || 'no pre-commit hook installed'}.`,
+    level: 'warn',
+    exitFailure: false,
+  };
+}
+
 function installGitHooks(options = {}) { // NOSONAR — Extracted as-is from bin/forge.js; complexity reduction deferred
   // loud=true (the `forge setup` handlers — quickSetup + executeSetup) surfaces an
   // inert-hooks result as a HARD failure — a banner + non-zero exit — so setup never ends
@@ -2742,13 +2837,27 @@ function installGitHooks(options = {}) { // NOSONAR — Extracted as-is from bin
   // init deliberately degrades to a warning rather than failing, and repair runs inside
   // another command's flow.
   const loud = options.loud === true;
-  console.log('Installing git hooks (TDD enforcement)...');
+  // Honest header: when the TDD gate is disabled in config the hooks install but are inert,
+  // so don't announce "(TDD enforcement)" for a state the user turned off (issue eda6d866).
+  console.log(
+    resolveHookEnforcementState(projectRoot).tddActive
+      ? 'Installing git hooks (TDD enforcement)...'
+      : 'Installing git hooks (TDD gate disabled in config — hooks will be inert)...'
+  );
 
   // Install the Forge hook SCRIPTS first, unconditionally: they back BOTH the lefthook
   // pre-commit gate AND the native harness hooks that forge setup renders regardless of
   // whether the lefthook binary is present.
   installForgeHookScripts();
 
+  // Report what the hooks will ACTUALLY enforce given the resolved config — a
+  // disabled gate/rail installs an inert hook, so say so instead of over-claiming.
+  const enforcementStatus = describeHookEnforcement();
+  if (enforcementStatus) {
+    console.log(`  Enforcement (from .forge/config.yaml): ${enforcementStatus}`);
+  }
+
+  // Skip lefthook.yml creation if binary is not available
   const lefthookStatus = checkLefthookStatus(projectRoot);
   let lefthookInstalled = false;
   if (!lefthookStatus.binaryAvailable && lefthookStatus.message) {
@@ -2826,29 +2935,24 @@ function installGitHooks(options = {}) { // NOSONAR — Extracted as-is from bin
   }
 
   const verdict = verifyHooksActive(projectRoot);
-  if (verdict.active) {
-    console.log(`  ✓ Git hook enforcement active (${verdict.method}).`);
-  } else if (loud && resolveGitHooksDir(projectRoot)) {
-    // In a git repo but enforcement is inert — the exact silent-inert bug B3 kills.
-    // Fail LOUDLY and non-zero so `forge setup` never ends green with hooks off.
-    // (A non-git dir has nothing to hook into, so it only warns — see the else.)
-    const addCmd = PKG_MANAGER === 'bun'
-      ? 'bun add -d'
-      : PKG_MANAGER === 'npm'
-        ? 'npm install --save-dev'
-        : `${PKG_MANAGER} add -D`;
-    console.error('');
-    console.error('  ============================================================');
-    console.error('  ⚠ TDD ENFORCEMENT IS NOT ACTIVE');
-    console.error(`     ${verdict.reason || 'no pre-commit hook is installed'}.`);
-    console.error('     `forge ship` will block until hooks are active. To fix:');
-    console.error(`       ${addCmd} lefthook  &&  npx lefthook install`);
-    console.error('     (or re-run `forge setup` in the repo root).');
-    console.error('  ============================================================');
-    console.error('');
-    process.exitCode = 1;
+  const state = resolveHookEnforcementState(projectRoot);
+  // A non-git dir has nothing to hook into, so it must only ever WARN (never banner/exit).
+  // Fold that into `loud` before building the verdict so buildHookVerdict stays pure. When
+  // the TDD gate is disabled in config, the verdict is info-level with no failure exit even
+  // under loud setup — enforcement honestly follows the resolved config (issue eda6d866).
+  const inGitRepo = Boolean(resolveGitHooksDir(projectRoot));
+  const built = buildHookVerdict(verdict, state, { loud: loud && inGitRepo });
+  if (built.level === 'error') {
+    console.error(built.message);
+  } else if (built.level === 'warn') {
+    console.warn(built.message);
+  } else if (built.level === 'info') {
+    console.info(built.message);
   } else {
-    console.warn(`  ⚠ TDD enforcement is NOT active: ${verdict.reason || 'no pre-commit hook installed'}.`);
+    console.log(built.message);
+  }
+  if (built.exitFailure) {
+    process.exitCode = 1;
   }
 }
 
@@ -3258,44 +3362,6 @@ function configureDefaultExternalServices(skipExternal) {
   console.log('Configuration saved to .env.local');
 }
 
-// Auto-import an existing Beads store into the Kernel during setup.
-// Idempotent and CLI-free: reuses the `forge migrate --from beads` spine, which
-// reads the committed Beads jsonl sidecars directly (no external issue-tracker
-// binary), so it works even when the legacy SQL backend is offline. Failures
-// degrade to a setup note rather than aborting setup. Returns the migrate
-// outcome for callers/tests.
-async function autoMigrateBeadsToKernel(opts = {}) {
-  const migrateModule = require('./migrate');
-  let outcome;
-  try {
-    outcome = await migrateModule.autoMigrateBeadsIfPresent(projectRoot, opts);
-  } catch (err) {
-    addSetupNote(`Beads → Kernel auto-migration failed: ${err.message}`);
-    return { migrated: false };
-  }
-
-  if (!outcome.migrated) {
-    if (outcome.result && outcome.result.success === false) {
-      addSetupNote(`Beads → Kernel auto-migration skipped: ${outcome.result.error}`);
-    }
-    return outcome;
-  }
-
-  const { imported, gaps } = outcome.result;
-  const inserted = imported.issues.inserted;
-  const skipped = imported.issues.skipped;
-  if (inserted > 0) {
-    let line = `  ✓ Migrated ${inserted} issue(s) from Beads to the Kernel`;
-    if (gaps && gaps.count > 0) {
-      line += ` (${gaps.count} field gap(s): ${gaps.items.map(g => g.field).join(', ')})`;
-    }
-    console.log(line);
-  } else {
-    console.log(`  ✓ Beads store already present in the Kernel (${skipped} issue(s))`);
-  }
-  return outcome;
-}
-
 // Install git hooks for a target project root without a full setup run.
 // Reuses the same lefthook install path setup performs so `forge init` can
 // reach a hook-active state (closing the init → HOOKS_NOT_ACTIVE catch-22).
@@ -3363,9 +3429,6 @@ async function quickSetup(selectedAgents, skipExternal) {
   // Auto-setup project tools (Kernel issue store, Skills)
   await autoSetupToolsInQuickMode();
 
-  // Auto-import an existing Beads store into the Kernel (idempotent, CLI-free)
-  await autoMigrateBeadsToKernel();
-
   // Setup Claude first if selected, then setup remaining agents
   if (selectedAgents.includes('claude')) {
     await setupAgent('claude');
@@ -3905,9 +3968,6 @@ async function executeSetup(config) {
   console.log('');
   installGitHooks({ loud: true });
 
-  // Auto-import an existing Beads store into the Kernel (idempotent, CLI-free)
-  await autoMigrateBeadsToKernel();
-
   // External services (unless skipped)
   await handleExternalServices(skipExternal, agents);
 
@@ -4319,6 +4379,9 @@ module.exports = {
   },
 
   // Expose internals for testing and cross-command use
+  describeHookEnforcement,
+  resolveHookEnforcementState,
+  buildHookVerdict,
   checkPrerequisites,
   setupCoreDocs,
   displaySetupSummary,
@@ -4340,7 +4403,6 @@ module.exports = {
   installViaBunx,
   autoInstallLefthook,
   autoSetupToolsInQuickMode,
-  autoMigrateBeadsToKernel,
   ensureGitHooksInstalled,
   forgeShouldWriteLefthookConfig,
   FORGE_USER_LEFTHOOK_YML,

package/lib/commands/shepherd.js

@@ -36,12 +36,22 @@ const { validatePrStateAdapter } = require('../pr-state-validator');
 const { gatherMonitorSnapshot } = require('../pr-monitor/gather');
 const { pollEvents } = require('../pr-monitor/monitor');
 const { watchLoop } = require('../pr-monitor/watch');
+const { startPrWatcherDetached } = require('../pr-monitor/watch-lifecycle');
+const reconcileExecutor = require('../pr-monitor/reconcile-executor');
 const monitorJournal = require('../pr-monitor/journal');
 const { EVENT_TYPES: T } = require('../pr-monitor/events');
+const { autoShepherdRailEnabled } = require('./ship');
 
 const DEFAULT_RERUN_BUDGET = 3;
 
-const defaultGhRunner = (cmd, a) => execFileSync(cmd, a, { encoding: 'utf8', timeout: 30000 });
+// windowsHide: true on EVERY spawn here is load-bearing, not cosmetic. The
+// shepherd watcher runs detached in the background and re-polls every ~60s; on
+// Windows a child process spawned WITHOUT windowsHide flashes a visible console
+// window each time (Node's default is windowsHide:false). Background work's
+// preferred home is the harness's managed shell (hidden + reaped); a
+// Forge-spawned detached watcher is the no-session fallback and must be
+// COMPLETELY silent — no console window, ever. See kernel issue 931e7924.
+const defaultGhRunner = (cmd, a) => execFileSync(cmd, a, { encoding: 'utf8', timeout: 30000, windowsHide: true });
 
 /**
  * Resolve owner/repo and base branch for the shepherd pass.
@@ -270,11 +280,74 @@ function wireSignals() {
  * @param {object} [deps]
  * @returns {Promise<object>}
  */
+/**
+ * List every OPEN PR number via `gh pr list`. Fail-open: any error yields an
+ * empty list (adopt then arms nothing) rather than throwing.
+ *
+ * @param {Function} [exec] - gh runner (test injection).
+ * @returns {number[]}
+ */
+function defaultListOpenPrs(exec = execFileSync) {
+  try {
+    const out = exec('gh', ['pr', 'list', '--state', 'open', '--json', 'number', '-q', '.[].number'], {
+      encoding: 'utf8', timeout: 20000, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true,
+    });
+    return String(out)
+      .split(/\r?\n/)
+      .map((s) => Number.parseInt(s.trim(), 10))
+      .filter((n) => Number.isInteger(n) && n > 0);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * `forge shepherd watch --adopt` — arm a detached watcher for EVERY currently-open
+ * PR (covers PRs created via gh/UI, or before this rail existed). Idempotent: the
+ * watch loop's PID/journal lock means an already-watched PR is not double-started.
+ * Fail-open per PR and overall — never throws. Honors the default-ON
+ * `rail.auto_shepherd` rail: when a maintainer has disabled it, adoption is a
+ * no-op — no PR listing, no watcher spawn — matching `forge push`/`forge ship`.
+ *
+ * @param {string} projectRoot
+ * @param {object} [deps]
+ * @returns {{ success: true, adopted: number[], total: number, reason?: string }}
+ */
+function handleAdopt(projectRoot, deps = {}) {
+  const railEnabled = deps.railEnabled || autoShepherdRailEnabled;
+  // Gate BEFORE listing PRs / spawning watchers: a disabled rail must not spawn
+  // detached watchers. No-op result mirrors the fail-open (empty) adoption shape.
+  if (!railEnabled(projectRoot)) {
+    return { success: true, adopted: [], total: 0, reason: 'rail.auto_shepherd disabled' };
+  }
+  const listOpenPrs = deps.listOpenPrs || defaultListOpenPrs;
+  const startWatcher = deps.startWatcher || startPrWatcherDetached;
+  let prs;
+  try {
+    prs = listOpenPrs();
+  } catch {
+    prs = [];
+  }
+  if (!Array.isArray(prs)) prs = [];
+  const adopted = [];
+  for (const pr of prs) {
+    try {
+      const res = startWatcher({ prNumber: pr, cwd: projectRoot });
+      if (res?.started) adopted.push(pr);
+    } catch { /* fail-open per PR: one bad arm never blocks the rest */ }
+  }
+  return { success: true, adopted, total: prs.length };
+}
+
 async function handleWatch(args, projectRoot, deps = {}) {
   const rawArgs = args || [];
+  // `--adopt` (no PR arg): arm a detached watcher for every open PR.
+  if (rawArgs.includes('--adopt')) {
+    return handleAdopt(projectRoot, deps);
+  }
   const pr = rawArgs.find((a) => !String(a).startsWith('--') && a !== 'watch');
   if (!pr) {
-    return { success: false, error: 'Usage: forge shepherd watch <pr>' };
+    return { success: false, error: 'Usage: forge shepherd watch <pr> | forge shepherd watch --adopt' };
   }
 
   const built = await buildMonitorContext(pr, projectRoot, deps);
@@ -315,6 +388,28 @@ async function handleWatch(args, projectRoot, deps = {}) {
   };
 }
 
+/**
+ * `forge shepherd daemon` — the SINGLETON reconcile daemon (W-S4b). It acquires
+ * the machine-wide shepherd lease for this repo (exiting immediately if a live
+ * daemon already owns it), heartbeats, and converges the PR world every ~60s:
+ * self-registering hand-opened PRs, restarting killed watchers, reaping verified
+ * orphans, retiring merged/closed PRs. It self-retires (releases the lease, kills
+ * its verified children, exits) once no PRs remain open. Launched detached by the
+ * per-command `fireAndForget` trigger — not meant to be run by hand.
+ *
+ * @param {string} projectRoot
+ * @param {object} [deps] - injected for tests (acquire/heartbeat/gather/etc.).
+ * @returns {Promise<object>} result envelope.
+ */
+async function handleDaemon(projectRoot, deps = {}) {
+  const res = await reconcileExecutor.runDaemon(projectRoot, { ...deps });
+  if (!res.ok) {
+    // A live foreign daemon owns the lease — this invocation is a clean no-op.
+    return { success: true, started: false, reason: res.reason || 'foreign-lease' };
+  }
+  return { success: true, started: true };
+}
+
 /**
  * Command handler.
  *
@@ -336,6 +431,9 @@ async function handler(args, _flags, projectRoot, deps = {}) {
   if (positional[0] === 'watch') {
     return handleWatch(args, projectRoot, deps);
   }
+  if (positional[0] === 'daemon') {
+    return handleDaemon(projectRoot, deps);
+  }
 
   const pr = positional[0];
 
@@ -343,7 +441,7 @@ async function handler(args, _flags, projectRoot, deps = {}) {
     return { success: false, error: 'Usage: forge shepherd <pr> [--auto-rebase] [--bundle --json] [--pull --json]' };
   }
 
-  const gh = deps.gh || ((cmd, a) => execFileSync(cmd, a, { encoding: 'utf8', timeout: 30000 }));
+  const gh = deps.gh || ((cmd, a) => execFileSync(cmd, a, { encoding: 'utf8', timeout: 30000, windowsHide: true }));
   const git = deps.git || gh;
   const buildContext = deps.buildContext || defaultBuildContext;
   const runPass = deps.runPass || runShepherdPass;
@@ -424,7 +522,7 @@ async function handler(args, _flags, projectRoot, deps = {}) {
 module.exports = {
   name: 'shepherd',
   description: 'Run one bounded monitor pass over a PR (rerun flaky checks, escalate, hand off — never merges)',
-  usage: 'Usage: forge shepherd <pr> [--auto-rebase] [--bundle --json] [--pull --json] | forge shepherd events <pr> --since <seq> [--json] | forge shepherd watch <pr>',
+  usage: 'Usage: forge shepherd <pr> [--auto-rebase] [--bundle --json] [--pull --json] | forge shepherd events <pr> --since <seq> [--json] | forge shepherd watch <pr> | forge shepherd watch --adopt',
   handler,
   handleEvents,
   handleWatch,

package/lib/commands/ship.js

@@ -13,6 +13,32 @@ const fs = require('node:fs');
 const path = require('node:path');
 
 const { startPrWatcherDetached } = require('../pr-monitor/watch-lifecycle');
+const { getResolvedRuntimeGraph } = require('../core/runtime-graph');
+
+const AUTO_SHEPHERD_RAIL = 'rail.auto_shepherd';
+
+/**
+ * Whether the default-ON `rail.auto_shepherd` rail permits auto-starting the PR
+ * watcher. Reads the SAME resolved runtime graph the `forge gate enable|disable`
+ * surface writes (`workflow.gates.rail.auto_shepherd.enabled`), so the toggle is
+ * config-honest. FAIL-OPEN: only an explicit `enabled === false` disables it — a
+ * missing rail or any resolution error falls back to enabled (the default), and
+ * this NEVER throws (ship must not fail on a config read).
+ *
+ * @param {string} [projectRoot]
+ * @param {Function} [resolveGraph] - injectable graph resolver (tests).
+ * @returns {boolean}
+ */
+function autoShepherdRailEnabled(projectRoot = process.cwd(), resolveGraph = getResolvedRuntimeGraph) {
+	try {
+		const graph = resolveGraph({ projectRoot });
+		const rail = [...(graph.rails || []), ...(graph.gates || [])]
+			.find(entry => entry.id === AUTO_SHEPHERD_RAIL);
+		return !(rail && rail.enabled === false);
+	} catch {
+		return true;
+	}
+}
 
 function getExecOptions() {
 	return { encoding: 'utf8', cwd: process.cwd(), timeout: 120000 };
@@ -490,12 +516,21 @@ async function createPR(options) { // NOSONAR S3776
  * ship: `startWatcher` (startPrWatcherDetached) already never throws, and this
  * guard keeps even a surprise error from surfacing to the ship caller.
  *
- * @param {{ dryRun: boolean, prNumber?: string|number, startWatcher: Function }} params
+ * Gated by the default-ON `rail.auto_shepherd` rail: when a maintainer has
+ * disabled it (`forge gate disable rail.auto_shepherd`), the watcher is skipped
+ * so the auto-start is honestly toggleable. The rail check is fail-open and
+ * wrapped in the same try/catch, so neither a disabled rail nor a config-read
+ * error ever fails ship.
+ *
+ * @param {{ dryRun: boolean, prNumber?: string|number, startWatcher: Function, railEnabled?: Function }} params
  * @returns {{ started: boolean, reason?: string }}
  */
-function maybeStartPrWatcher({ dryRun, prNumber, startWatcher }) {
+function maybeStartPrWatcher({ dryRun, prNumber, startWatcher, railEnabled = autoShepherdRailEnabled }) {
 	if (dryRun || !prNumber) return { started: false, reason: 'skipped' };
 	try {
+		if (!railEnabled(process.cwd())) {
+			return { started: false, reason: 'rail.auto_shepherd disabled' };
+		}
 		return startWatcher({ prNumber, cwd: process.cwd() });
 	} catch (err) {
 		return { started: false, reason: err.message };
@@ -503,7 +538,7 @@ function maybeStartPrWatcher({ dryRun, prNumber, startWatcher }) {
 }
 
 async function executeShip(options) {
-	const { featureSlug, title, dryRun = false, startWatcher = startPrWatcherDetached } = options || {};
+	const { featureSlug, title, dryRun = false, startWatcher = startPrWatcherDetached, railEnabled = autoShepherdRailEnabled } = options || {};
 
 	// Validate feature slug
 	if (!featureSlug || typeof featureSlug !== 'string' || featureSlug.trim() === '') {
@@ -555,7 +590,7 @@ async function executeShip(options) {
 		});
 		const result = await createPR({ title, body: prBody, dryRun });
 		if (!result.success) return result;
-		maybeStartPrWatcher({ dryRun, prNumber: result.prNumber, startWatcher });
+		maybeStartPrWatcher({ dryRun, prNumber: result.prNumber, startWatcher, railEnabled });
 		return {
 			success: true,
 			prUrl: result.prUrl,
@@ -589,6 +624,7 @@ module.exports = {
 		};
 	},
 	maybeStartPrWatcher,
+	autoShepherdRailEnabled,
 	extractKeyDecisions,
 	extractTestScenarios,
 	getTestCoverage,