great-cto 3.58.2 → 3.59.1

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.58.2",
+  "version": "3.59.1",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/lib/publication-tickets.mjs

@@ -0,0 +1,26 @@
+/** Ephemeral, single-use UI capability. Never stored inside a worker project. */
+import { randomUUID } from 'node:crypto';
+export function publicationTickets({ now = Date.now, ttl = 120000, limit = 128 } = {}) {
+  const tickets = new Map();
+  const prune = () => { for (const [id, t] of tickets) if (t.expiresAt <= now()) tickets.delete(id); };
+  return {
+    issue(binding) {
+      prune(); if (tickets.size >= limit) throw Error('publication preview capacity reached');
+      const id = randomUUID(); tickets.set(id, { ...binding, expiresAt: now() + ttl }); return id;
+    },
+    consume(id, { root, origin, branch }) {
+      prune(); const ticket = tickets.get(id);
+      if (!ticket || ticket.root !== root || ticket.origin !== origin || ticket.branch !== branch) throw Error('publication confirmation is missing, expired or bound to another project/origin/branch');
+      tickets.delete(id); return ticket;
+    },
+  };
+}
+export function localPublicationOrigin(req) {
+  const address = req.socket?.remoteAddress;
+  if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) return null;
+  const host = req.headers.host;
+  if (!/^(?:localhost|127\.0\.0\.1|\[::1\]):[0-9]+$/.test(host || '')) return null;
+  const expected = `http://${host}`;
+  if (req.headers.origin === expected || (!req.headers.origin && req.headers['sec-fetch-site'] === 'same-origin')) return expected;
+  return null;
+}

package/board/packages/board/lib/routes.mjs

@@ -1,6 +1,7 @@
 import fs from 'fs';
 import path from 'path';
-import { execFileSync } from 'child_process';
+import { execFileSync, execFile } from 'child_process';
+import { fileURLToPath } from 'node:url';
 import os from 'os';
 import {
   getVapidKeys,
@@ -14,7 +15,7 @@ import { autoRegisterProject, listProjects, resolveProjectCwd, resolveProjectInf
 import { readVerdictsWithHealth } from './verdicts.mjs';
 import { agentUsage, usageSnapshot } from '../../../scripts/lib/agent-usage.mjs';
 import { isProjectState } from '../../../scripts/lib/great-cto-scope.mjs';
-import { usageIndexSnapshot, summarizeUsage, readCodexTitles, readClaudeLimits, claudeRecorder } from '../../../scripts/lib/session-usage.mjs';
+import { usageReports } from './usage-report.mjs';
 import { outcomes as computeOutcomes } from '../../../scripts/lib/outcomes.mjs';
 import { reviewerStatus } from '../../../scripts/lib/required-reviewers.mjs';
 import { readSessionStatus } from '../../../scripts/lib/session-status.mjs';
@@ -44,6 +45,19 @@ import { parseAgentBudgets, upsertAgentBudget, removeAgentBudget } from '../../.
 import { resolveSecondOpinion, SECOND_OPINION_PROVIDERS } from '../../../scripts/lib/second-opinion.mjs';
 import { detectCodex } from '../../../scripts/lib/codex-exec.mjs';
 import { getWork } from './work.mjs';
+let publicationPreviewBusy = false;
+let publicationWriteBusy = false;
+import { publicationTickets, localPublicationOrigin } from './publication-tickets.mjs';
+const publicationTicketStore = publicationTickets();
+
+function publicationWorker(args, cwd, timeout = 20000) {
+  const controller = fileURLToPath(new URL('../../../scripts/work-task.mjs', import.meta.url));
+  return new Promise((resolve, reject) => execFile(process.execPath, [controller, ...args, '--dir', cwd],
+    { timeout, maxBuffer: 4 * 1024 * 1024, encoding: 'utf8' }, (error, stdout) => {
+      if (error) { reject(Error('publication worker failed; inspect host state before retry')); return; }
+      try { resolve(JSON.parse(stdout)); } catch { reject(Error('publication response is unreadable')); }
+    }));
+}
 import { listCodexRuns } from '../../../scripts/lib/codex-host-state.mjs';
 import { upsertCapability, capabilitiesFromProjectMd } from '../../../scripts/lib/stack-capabilities.mjs';
 // Moved to scripts/lib so the cross-review Stop hook can ask the same question
@@ -103,6 +117,60 @@ async function dispatch(req, res, url, cwd) {
     }
   }
 
+  if (pathname === '/api/work/publication') {
+    const respond = (status, body) => { res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(body)); };
+    if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') { respond(404, { error: 'Unknown project' }); return true; }
+    if (req.method !== 'POST') { respond(405, { error: 'Use explicit POST confirmation' }); return true; }
+    const origin = localPublicationOrigin(req);
+    // A missing Origin is acceptable for preview, never for an external write.
+    if (!origin || req.headers.origin !== origin || !originAllowed(req)) { respond(403, { error: 'Publication is available only from the local same-origin board' }); return true; }
+    if (publicationWriteBusy) { respond(429, { error: 'Another publication is running; inspect its outcome before retry' }); return true; }
+    publicationWriteBusy = true;
+    try {
+      let bytes = 0, body = '';
+      req.setTimeout(10000, () => req.destroy());
+      for await (const chunk of req) { bytes += chunk.length; if (bytes > 2048) throw Error('confirmation body too large'); body += chunk; }
+      req.setTimeout(0);
+      const parsed = JSON.parse(body);
+      if (parsed.confirm !== 'publish-draft-pr') throw Error('explicit draft PR confirmation required');
+      const ticket = publicationTicketStore.consume(parsed.ticket, { root: fs.realpathSync(cwd), origin, branch: parsed.branch });
+      const result = await publicationWorker(['publish', '--task', ticket.taskId, '--revision', String(ticket.expectedRevision),
+        '--approval', ticket.approval, '--base', ticket.base, '--allow', ticket.allow.join(','), '--confirm', 'publish-draft-pr'], cwd, 120000);
+      respond(200, { publication: result.task.publication });
+    } catch { respond(409, { error: 'Publication was not confirmed. Refresh task state and reconcile the original operation; no automatic retry was sent.' }); }
+    finally { publicationWriteBusy = false; }
+    return true;
+  }
+
+  // Preview never pushes. Local UI receives a short-lived confirmation ticket.
+  if (pathname === '/api/work/publication-preview') {
+    if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') {
+      res.writeHead(404, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Unknown project' })); return true;
+    }
+    if (req.method !== 'GET') {
+      res.writeHead(405, { 'Content-Type': 'application/json', Allow: 'GET' }); res.end(JSON.stringify({ error: 'Publication requires explicit host CLI confirmation' })); return true;
+    }
+    if (publicationPreviewBusy) {
+      res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': '2' });
+      res.end(JSON.stringify({ error: 'Another publication preview is being read; retry shortly' })); return true;
+    }
+    publicationPreviewBusy = true;
+    try {
+      const taskId = url.searchParams.get('task'), base = url.searchParams.get('base') || 'main', allow = url.searchParams.get('allow');
+      if (!/^[0-9a-f-]{36}$/.test(taskId || '') || !/^[A-Za-z0-9][A-Za-z0-9/_-]{0,120}$/.test(base)) throw Error('invalid preview options');
+      // Git/receipt reads run off the board event loop, with one bounded worker.
+      const preview = await publicationWorker(['preview', '--task', taskId, '--base', base, ...(allow ? ['--allow', allow] : [])], cwd);
+      const origin = localPublicationOrigin(req);
+      if (origin) preview.ticket = publicationTicketStore.issue({ root: fs.realpathSync(cwd), origin, taskId,
+        branch: preview.branch, base: preview.base, allow: preview.allow, ...preview.confirmation });
+      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(preview));
+    } catch {
+      res.writeHead(409, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Publication preview unavailable: require verified delivery, a clean committed feature branch, explicit path scope and canonical GitHub origin. Inspect with the host CLI.' }));
+    } finally { publicationPreviewBusy = false; }
+    return true;
+  }
+
   // New read model refuses project fallback rather than relabeling another project.
   if (pathname === '/api/work') {
     if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') {
@@ -1510,12 +1578,12 @@ async function dispatch(req, res, url, cwd) {
   if (pathname === '/api/usage') {
     const rawDays = parseInt(url.searchParams.get('days') || '30', 10);
     const days = Number.isFinite(rawDays) && rawDays > 0 ? Math.min(rawDays, 365) : 30;
-    const snap = boardSessionUsage().get();
+    const snap = boardSessionUsage().get(days);
     let body;
-    if (snap.state !== 'ready') {
+    if (snap.state !== 'counted') {
       body = { state: snap.state, why: snap.why };
     } else {
-      const sum = summarizeUsage(snap.index, { days, codexTitles: readCodexTitles(), claudeReadings: readClaudeLimits(), claudeRecorderState: claudeRecorder() });
+      const sum = snap;
       const ours = new Set(boardAgentNames());
       for (const host of Object.keys(sum.lists)) {
         sum.lists[host].agents = sum.lists[host].agents.map((a) => ({ ...a, ours: ours.has(a.name) }));
@@ -2250,7 +2318,7 @@ function boardOutcomes(days) {
 
 let _sessionUsageSnap = null;
 function boardSessionUsage() {
-  if (!_sessionUsageSnap) _sessionUsageSnap = usageIndexSnapshot();
+  if (!_sessionUsageSnap) _sessionUsageSnap = usageReports();
   return _sessionUsageSnap;
 }
 

package/board/packages/board/lib/task-inspector.mjs

@@ -0,0 +1,21 @@
+/** Read-only activity projection. Session identity, never title/role, owns linkage. */
+export function taskInspector(sessions, activity = { state: 'none', events: [] }) {
+  const linked = new Set(sessions.filter(s => typeof s === 'string' && s));
+  const events = (activity.events || []).filter(e => linked.has(e.session)).slice(-20)
+    .map(e => ({ ts: typeof e.ts === 'string' ? e.ts : null,
+      kind: typeof e.kind === 'string' ? e.kind : null,
+      agent: typeof e.agent === 'string' ? e.agent.slice(0, 80) : null,
+      host: ['claude', 'codex'].includes(e.host) ? e.host : null,
+      tool: typeof e.tool === 'string' ? e.tool.slice(0, 80) : null,
+      outcome: typeof e.outcome === 'string' ? e.outcome.slice(0, 80) : null,
+      verdict: typeof e.verdict === 'string' ? e.verdict.slice(0, 80) : null,
+      ok: typeof e.ok === 'boolean' ? e.ok : null,
+      durationMs: Number.isFinite(e.duration_ms) && e.duration_ms >= 0 ? e.duration_ms : null }));
+  return { state: !linked.size ? 'unlinked' : activity.state === 'unreadable' ? 'unreadable'
+    : events.length ? 'recorded' : 'none', events,
+    partial: (activity.bad || 0) > 0 || activity.gap === true,
+    lastEventAt: events.at(-1)?.ts || null,
+    reason: !linked.size ? 'No explicit execution session link'
+      : activity.state === 'unreadable' ? 'Project activity could not be read'
+      : !events.length ? 'No linked events in the bounded project journal window' : null };
+}

package/board/packages/board/lib/usage-report-worker.mjs

@@ -0,0 +1,9 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import { scanUsage, summarizeUsage, readCodexTitles, readClaudeLimits, claudeRecorder } from '../../../scripts/lib/session-usage.mjs';
+try {
+  const snapshot = await scanUsage();
+  const report = summarizeUsage(snapshot.index, { days: workerData.days, codexTitles: readCodexTitles(), claudeReadings: readClaudeLimits(), claudeRecorderState: claudeRecorder() });
+  parentPort.postMessage({ ...report, seen: snapshot.seen, files: snapshot.files });
+} catch {
+  parentPort.postMessage({ state: 'unavailable', why: 'Session statistics could not be read; retry or inspect local logs.' });
+}

package/board/packages/board/lib/usage-report.mjs

@@ -0,0 +1,45 @@
+import { Worker } from 'node:worker_threads';
+
+function computeReport(days) {
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(new URL('./usage-report-worker.mjs', import.meta.url), { workerData: { days } });
+    worker.unref();
+    let settled = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true; clearTimeout(timer); worker.terminate();
+      if (error) reject(error); else resolve(result);
+    };
+    const timer = setTimeout(() => finish(Error('statistics deadline exceeded')), 120000);
+    timer.unref();
+    worker.once('message', result => finish(null, result));
+    worker.once('error', error => finish(error));
+    worker.once('exit', () => finish(Error('statistics worker exited without a result')));
+  });
+}
+
+/** Bounded stale-while-refresh cache. One scan at a time, off the HTTP thread. */
+export function usageReports({ compute = computeReport, now = Date.now, ttlMs = 60000, limit = 8 } = {}) {
+  const slots = new Map(); let running = null;
+  return {
+    get(days) {
+      let slot = slots.get(days);
+      if (!slot) {
+        if (slots.size >= limit) slots.delete(slots.keys().next().value);
+        slot = { value: null, at: 0 }; slots.set(days, slot);
+      }
+      if ((!slot.value || now() - slot.at >= ttlMs) && !running) {
+        running = Promise.resolve().then(() => compute(days)).then(value => {
+          if (value?.state === 'counted') { slot.value = value; slot.error = null; }
+          else if (!slot.value) slot.value = { state: 'unavailable', why: value?.why || 'Statistics could not be read.' };
+          else slot.error = value?.why || 'Statistics refresh failed.';
+        }, () => {
+          if (!slot.value) slot.value = { state: 'unavailable', why: 'Statistics worker failed; retry after a minute.' };
+          else slot.error = 'Statistics refresh failed.';
+        }).finally(() => { slot.at = now(); running = null; });
+      }
+      if (!slot.value) return { state: 'computing', why: 'Reading session statistics in a background worker; navigation remains available.' };
+      return { ...slot.value, refreshing: !!running, stale: !!slot.error || now() - slot.at >= ttlMs, refreshError: slot.error || null };
+    },
+  };
+}

package/board/packages/board/lib/work.mjs

@@ -8,6 +8,8 @@ import { listWorkTasks, publicWorkTask } from '../../../scripts/lib/work-tasks.m
 import { decisionCapabilities } from '../../../scripts/lib/work-decisions.mjs';
 import { measureWork, compareWork } from '../../../scripts/lib/work-metrics.mjs';
 import { readSessionStatus } from '../../../scripts/lib/session-status.mjs';
+import { agentActivity } from './agent-activity.mjs';
+import { taskInspector } from './task-inspector.mjs';
 
 const text = v => typeof v === 'string' ? v : null;
 const date = v => typeof v === 'string' && Number.isFinite(Date.parse(v)) ? v : null;
@@ -15,7 +17,7 @@ const RUN_PHASE = { ready: 'accepted', 'awaiting-gate': 'needs_decision',
   'awaiting-release': 'needs_decision', blocked: 'blocked', 'manual-action': 'blocked' };
 
 export function projectWork({ projectId, issues = [], codex = { state: 'absent', runs: [] },
-  tasks = [], sessions = [], sources = [], observedAt = new Date().toISOString() }) {
+  tasks = [], sessions = [], sources = [], activity = { state: 'none', events: [] }, observedAt = new Date().toISOString() }) {
   const entries = [];
   for (const r of codex.runs || []) {
     // Completion of a controller run is not proof of the user's acceptance criteria.
@@ -38,6 +40,8 @@ export function projectWork({ projectId, issues = [], codex = { state: 'absent',
           : terminal ? 'This run is terminal' : 'This state does not permit ordinary resume' }],
       command: canCopyResume ? `great-cto resume ${r.id} --host codex` : null,
       evidence: (r.rolesCompleted || []).map(role => ({ kind: 'recorded_role', label: role })),
+      stage: text(r.active) || text(r.pending?.role) || (r.wave?.status === 'running' && Array.isArray(r.wave.roles) ? r.wave.roles.filter(role => typeof role === 'string').join(', ') : null),
+      inspector: taskInspector([r.id], activity),
       release: r.release ? { status: text(r.release.status), url: text(r.release.url), verifiedAt: date(r.release.verifiedAt) } : null,
     });
   }
@@ -52,6 +56,7 @@ export function projectWork({ projectId, issues = [], codex = { state: 'absent',
       decisions: pending ? [{ id: t.id, engine: 'beads', label: 'Review decision' }] : [],
       capabilities: [{ action: pending ? 'review_decision' : 'view_issue', enabled: true, reason: null }],
       command: null, evidence: [], release: null,
+      inspector: taskInspector([], activity),
     });
   }
   for (const t of tasks) {
@@ -75,6 +80,10 @@ export function projectWork({ projectId, issues = [], codex = { state: 'absent',
       intent: t.intent || 'delivery', stage: t.stage || null, taskOutcome: t.outcome || null,
       decisions: decisionCapabilities(t).map(d => ({ ...d, id: d.decisionId, label: d.label || 'Host decision' })), evidence: (t.evidence || []).map(e => ({ kind: 'verdict', label: `${e.role}: ${e.verdict || 'not recorded'}` })),
       release: run?.release || null, revision: t.revision, metrics: t.metrics,
+      inspector: taskInspector([...t.links.runs, ...t.links.sessions], activity),
+      publication: t.publication || null,
+      publicationAllow: Array.isArray(t.authority?.writeScope) ? t.authority.writeScope.join(',') : '',
+      publicationPreview: t.managed !== false && t.intent !== 'research' && t.phase === 'verified' && !owner && !t.decisions?.length,
       capabilities: [...(approval ? [{ action: 'copy_approve', enabled: true, reason: null }] : []), { action: 'copy_resume', enabled, reason: enabled ? null : owner ? 'Host operation is active; duplicate resume is refused'
         : t.managed === false ? 'Continue this observed session inside its native host'
         : t.phase === 'needs_decision' ? 'Resolve the native host decision first' : 'Execution link or resumable host state is unavailable' }],
@@ -98,8 +107,13 @@ export function projectWork({ projectId, issues = [], codex = { state: 'absent',
 
 export function getWork(cwd) {
   const observedAt = new Date().toISOString();
+  let activity;
+  try { activity = agentActivity(cwd, { limit: 200 }); }
+  catch { activity = { state: 'unreadable', events: [] }; }
   const sources = []; let issues = [], codex = { state: 'absent', runs: [] }, sessions = [], tasks = [];
   const source = (id, health, reason = null) => sources.push({ id, health, reason, observedAt });
+  source('activity', activity.state === 'unreadable' || activity.bad ? 'degraded' : 'current',
+    activity.state === 'unreadable' ? 'Cannot read project activity' : activity.bad ? 'Some activity records are malformed' : null);
   try {
     const listing = listWorkTasks(cwd); tasks = listing.tasks.map(publicWorkTask);
     source('tasks', listing.state === 'degraded' ? 'degraded' : 'current', listing.unreadable ? `${listing.unreadable} task state file(s) could not be read` : null);
@@ -132,5 +146,5 @@ export function getWork(cwd) {
   let canonical = cwd;
   try { canonical = realpathSync(cwd); } catch { /* source health already reports inaccessible data */ }
   const projectId = 'project:' + createHash('sha256').update(canonical).digest('hex');
-  return { ...projectWork({ projectId, issues, codex, tasks, sessions, sources, observedAt }), projectName: basename(cwd) };
+  return { ...projectWork({ projectId, issues, codex, tasks, sessions, sources, activity, observedAt }), projectName: basename(cwd) };
 }

package/board/packages/board/public/assets/work-view.js

@@ -19,13 +19,21 @@
         const cap = e.capabilities.find(c => c.enabled);
         const action = cap ? `<button type="button" class="gate-btn" data-work-key="${esc(e.key)}" data-work-action="${esc(cap.action)}">${cap.action === 'copy_approve' ? 'Copy approval command' : cap.action === 'copy_resume' ? 'Copy resume command' : cap.action === 'review_decision' ? 'Review decision' : 'Open issue'}</button>` : '';
         return `<article class="work-card" data-entry-key="${esc(e.key)}"><h2>${esc(e.title)}</h2><p>${esc(phaseLabel(e))}</p>`
+          + `<p>Stage: ${esc(e.stage || 'not recorded')}</p>`
           + `<p class="work-meta">${esc(e.host || 'Host not linked')} · ${e.updatedAt ? esc(e.updatedAt) : 'Update time not recorded'}</p>`
           + (e.acceptance.length ? `<p>Acceptance: ${esc(e.acceptance.join('; '))}</p>` : '')
           + `<p>${esc(e.reason || 'Execution observation is recorded; acceptance is not inferred.')}</p>`
           + e.decisions.map(d => `<p>${esc(d.label)}${d.engine === 'codex' ? ' · resolve in the host controller' : ''}</p>`).join('')
+          + `<p>Next action: ${esc(cap ? cap.action === 'copy_approve' || cap.action === 'review_decision' ? 'Review the pending decision' : cap.action === 'copy_resume' ? 'Resume in the host controller' : 'Inspect the linked issue' : e.capabilities[0]?.reason || 'No supported action recorded')}</p>`
           + action + (e.command ? `<pre>${esc(e.command)}</pre>` : '')
           + (!cap && e.capabilities[0]?.reason ? `<p>${esc(e.capabilities[0].reason)}</p>` : '')
-          + `<details><summary>Technical details</summary><p>${esc(e.key)} · ${esc(e.nativeState || 'unknown')}</p>`
+          + renderInspector(e.inspector)
+          + (e.publicationPreview ? `<label>Publication paths (comma-separated) <input data-publication-allow="${esc(e.key)}" value="${esc(e.publicationAllow || '')}" placeholder="src,tests"></label><button type="button" class="gate-btn" data-work-key="${esc(e.key)}" data-work-action="preview_publication">Preview draft PR publication</button><div data-publication-preview="${esc(e.key)}"></div>` : '')
+          + (e.publication ? `<p>PR publication: ${esc(e.publication.state)} · ${esc(e.publication.head || '')}</p>`
+            + (typeof e.publication.url === 'string' && /^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/.test(e.publication.url) ? `<a href="${esc(e.publication.url)}" target="_blank" rel="noopener noreferrer">Open draft PR result</a>` : '')
+            + (e.publication.lastError ? `<p>${esc(e.publication.lastError)}</p>` : '') : '')
+          + (e.publication?.resumeCommand ? `<p>Reconcile the original publication in the selected project; do not create another PR blindly.</p><pre>${esc(e.publication.resumeCommand)}</pre>` : '')
+          + `<details data-work-detail="technical"><summary>Technical details</summary><p>${esc(e.key)} · ${esc(e.nativeState || 'unknown')}</p>`
           + `<p>Task linkage: ${esc(e.taskId || 'not recorded')}</p>${e.revision ? `<p>Task revision: ${esc(e.revision)}</p>` : ''}`
           + (e.taskOutcome ? `<p>Outcome evidence: ${esc(e.taskOutcome.source || 'operator-attestation')} · ${esc(e.taskOutcome.state)}</p>` : '')
           + `<p>Recorded roles: ${esc(e.evidence.map(v => v.label).join(', ') || 'none recorded; verification is not inferred')}</p>`
@@ -35,6 +43,61 @@
       + (!history && snapshot.sessions.length ? `<details><summary>Claude sessions (${snapshot.sessions.length}) · task linkage not recorded</summary>`
         + snapshot.sessions.map(s => `<p>${esc(s.session)} · ${esc(s.state)} · ${esc(s.reason || '')}</p>`).join('') + '</details>' : '');
   }
+  function renderInspector(inspector) {
+    if (!inspector) return '';
+    return `<details data-work-detail="inspector"><summary>Live activity inspector · read-only</summary>`
+      + `<p>Recent recorded events, refreshed with this view. Activity is not proof of liveness or acceptance. Prompts, raw output and terminal input are not exposed.</p>`
+      + (inspector.reason ? `<p>${esc(inspector.reason)}</p>` : '')
+      + (inspector.partial ? '<p class="work-warning">Activity window is incomplete.</p>' : '')
+      + `<p>Last linked event: ${esc(inspector.lastEventAt || 'not recorded')}</p>`
+      + (inspector.events?.length ? '<ol>' + inspector.events.map(e => `<li>${esc(e.ts || 'time unknown')} · ${esc(e.host || 'host unknown')} · ${esc(e.agent || 'agent unknown')} · ${esc(e.kind || 'event')}`
+        + (e.tool ? ` · ${esc(e.tool)}` : '') + (e.outcome ? ` · outcome: ${esc(e.outcome)}` : '')
+        + (e.verdict ? ` · verdict: ${esc(e.verdict)}` : '')
+        + (e.durationMs !== null ? ` · ${esc(e.durationMs)} ms` : '') + '</li>').join('') + '</ol>' : '')
+      + '</details>';
+  }
+  function publicationCommand(preview) {
+    const confirmation = preview.confirmation || { expectedRevision: preview.revision, approval: preview.approval };
+    if (!/^[0-9a-f-]{36}$/.test(preview.taskId || '') || !Number.isInteger(confirmation.expectedRevision) || confirmation.expectedRevision < 1
+      || !/^[0-9a-f]{64}$/.test(confirmation.approval || '') || !Array.isArray(preview.allow) || preview.allow.some(p => typeof p !== 'string' || p.includes(','))) throw Error('Invalid publication preview. Use the host CLI.');
+    return `great-cto task work publish --task ${preview.taskId} --revision ${confirmation.expectedRevision} --approval ${confirmation.approval} --base ${quote(preview.base)} --allow ${quote(preview.allow.join(','))} --confirm publish-draft-pr`;
+  }
+  async function previewPublication(entry) {
+    const project = config.project(), seq = generation;
+    const panel = [...document.querySelectorAll('[data-publication-preview]')].find(n => n.dataset.publicationPreview === entry.key);
+    if (!panel) return;
+    panel.textContent = 'Reading publication preview…';
+    try {
+      const allow = [...document.querySelectorAll('[data-publication-allow]')].find(n => n.dataset.publicationAllow === entry.key)?.value?.trim();
+      if (!allow) throw Error('Enter an explicit publication path scope first.');
+      const preview = await config.read(`/api/work/publication-preview?task=${encodeURIComponent(entry.taskId)}&allow=${encodeURIComponent(allow)}${project ? '&project=' + encodeURIComponent(project) : ''}`);
+      if (project !== config.project() || seq !== generation || !panel.isConnected) return;
+      if (!preview || preview.error || preview.taskId !== entry.taskId || preview.revision !== entry.revision) throw Error(preview?.error || 'Task changed; refresh before publication.');
+      const command = publicationCommand(preview);
+      previews.set(entry.key, { preview, project });
+      panel.innerHTML = `<p>${esc(preview.repository)} · ${esc(preview.branch)} → ${esc(preview.base)} · SHA ${esc(preview.head)}</p>`
+        + `<p>${esc(preview.scope)}</p><pre>${esc(preview.summary)}</pre><details><summary>Review every commit being published</summary><pre>${esc(preview.patch)}</pre></details>`
+        + (preview.ticket && config.publish ? `<label>Type ${esc(preview.branch)} to confirm draft PR publication <input data-publication-confirm="${esc(entry.key)}" autocomplete="off"></label><button type="button" class="gate-btn" data-work-key="${esc(entry.key)}" data-work-action="publish_publication">Publish approved draft PR</button>` : '<p>Browser publication is unavailable on this connection. Confirm using the host CLI.</p>')
+        + `<p>Only push and draft PR are authorized. No commit, merge, release or deploy.</p><pre>${esc(command)}</pre>`;
+    } catch (error) {
+      if (project === config.project() && seq === generation && panel.isConnected) panel.textContent = error.message;
+    }
+  }
+  const previews = new Map();
+  async function publish(entry, button) {
+    const saved = previews.get(entry.key), project = config.project();
+    if (!saved || saved.project !== project || !saved.preview.ticket || !config.publish) return;
+    const branch = [...document.querySelectorAll('[data-publication-confirm]')].find(n => n.dataset.publicationConfirm === entry.key)?.value;
+    if (branch !== saved.preview.branch) { status('Type the exact preview branch to authorize publication.'); return; }
+    button.disabled = true; previews.delete(entry.key); status('Publishing the approved candidate; do not retry until its outcome is known.');
+    try {
+      const result = await config.publish(`/api/work/publication${project ? '?project=' + encodeURIComponent(project) : ''}`, { ticket: saved.preview.ticket, branch, confirm: 'publish-draft-pr' });
+      if (project !== config.project()) return;
+      if (!result || result.error || result.publication?.state !== 'pr-linked' || !/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/.test(result.publication?.url || ''))
+        throw Error(result?.error || 'Publication result is not linked to a draft PR; reconcile task state.');
+      status('Draft PR publication recorded. Merge and release remain separate decisions.'); await refresh();
+    } catch (error) { if (project === config.project()) { status(error.message); await refresh(); } }
+  }
   let config, snapshot, generation = 0, filter = '';
   const status = message => { document.getElementById('work-feedback').textContent = message; };
   async function refresh() {
@@ -53,16 +116,18 @@
   }
   function paint() {
     if (!snapshot) return;
-    const expanded = [...document.querySelectorAll('.work-card details[open]')].map(d => d.closest('[data-entry-key]').dataset.entryKey);
+    previews.clear(); // Repaint removes the reviewed diff and its confirmation controls.
+    const expanded = [...document.querySelectorAll('.work-card details[open]')].map(d => `${d.closest('[data-entry-key]').dataset.entryKey}:${d.dataset.workDetail}`);
     const focused = document.activeElement;
     const focusKey = focused?.dataset?.workKey, focusAction = focused?.dataset?.workAction;
     document.getElementById('work-list').innerHTML = render(snapshot, false, filter);
     document.getElementById('history-list').innerHTML = render(snapshot, true, filter);
-    for (const card of document.querySelectorAll('[data-entry-key]')) if (expanded.includes(card.dataset.entryKey)) card.querySelector('details').open = true;
+    for (const card of document.querySelectorAll('[data-entry-key]')) for (const detail of card.querySelectorAll('details'))
+      if (expanded.includes(`${card.dataset.entryKey}:${detail.dataset.workDetail}`)) detail.open = true;
     if (focusKey) [...document.querySelectorAll('[data-work-key]')].find(b => b.dataset.workKey === focusKey && b.dataset.workAction === focusAction)?.focus();
   }
   function reset() {
-    generation++; snapshot = null; status('');
+    generation++; snapshot = null; previews.clear(); status('');
     for (const id of ['work-list', 'history-list']) document.getElementById(id).textContent = 'Loading project work…';
     refresh();
   }
@@ -86,6 +151,8 @@
     for (const id of ['work-list', 'history-list']) document.getElementById(id).addEventListener('click', event => {
       const button = event.target.closest('[data-work-action]'); if (!button || !snapshot) return;
       const entry = snapshot.entries.find(e => e.key === button.dataset.workKey);
+      if (button.dataset.workAction === 'preview_publication' && entry?.publicationPreview) { previewPublication(entry); return; }
+      if (button.dataset.workAction === 'publish_publication' && entry?.publicationPreview) { publish(entry, button); return; }
       const action = entry?.capabilities.find(c => c.action === button.dataset.workAction && c.enabled);
       if (!action) return;
       if (action.action === 'copy_resume' || action.action === 'copy_approve') copy(entry.command);
@@ -93,5 +160,5 @@
     });
     setInterval(() => { if (!document.hidden && options.visible()) refresh(); }, 10000);
   }
-  window.GctoWork = { bind, refresh, reset, render, commandFor, search(value) { filter = value; paint(); } };
+  window.GctoWork = { bind, refresh, reset, render, commandFor, publicationCommand, search(value) { filter = value; paint(); } };
 })();

package/board/packages/board/public/index.html

@@ -561,19 +561,23 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   color: var(--text3);
 }
 
-.nav { padding: 12px 8px; flex: 1; }
-.nav-item {
-  display: flex; align-items: center; gap: 10px;
-  height: 32px; padding: 0 10px;
+.sidebar { --nav-row-height: 36px; --nav-row-pad: 10px; --nav-icon-size: 16px; --nav-row-gap: 10px; }
+.nav { padding: 8px; flex: 0 0 auto; display: flex; flex-direction: column; gap: 2px; }
+/* One row pattern for destinations, disclosure and Fleet filters. */
+.nav-item, .nav-view-item, .nav-group-toggle {
+  display: flex; align-items: center; gap: var(--nav-row-gap);
+  height: var(--nav-row-height); padding: 0 var(--nav-row-pad);
   border-radius: 0;
   font-size: var(--fs-body);
+  font-weight: 400;
   color: var(--text);
   cursor: pointer;
   position: relative;
   user-select: none;
 }
-.nav-item:hover { background: var(--bg-muted); }
-.nav-item.active { background: var(--bg-strong); font-weight: 500; }
+.nav-item:hover, .nav-view-item:hover, .nav-group-toggle:hover { background: var(--bg-muted); }
+.nav-item.active, .nav-view-item.active { background: var(--bg-strong); font-weight: 500; }
+.nav-item:focus-visible, .nav-view-item:focus-visible, .nav-group-toggle:focus-visible { outline: 2px solid var(--focus-ring); outline-offset: -2px; }
 .nav-item.active::before {
   content: "";
   position: absolute;
@@ -582,15 +586,22 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   background: var(--accent);
   border-radius: 0;
 }
-.nav-item .icon { width: 16px; height: 16px; color: var(--text2); flex-shrink: 0; }
-.nav-item.active .icon { color: var(--accent-text); }
-.nav-item .count { margin-left: auto; font-size: var(--fs-caption); color: var(--text3); font-family: var(--mono); }
+.sidebar .icon { width: var(--nav-icon-size); height: var(--nav-icon-size); color: var(--text2); flex-shrink: 0; }
+.nav-item.active .icon, .nav-view-item.active .icon { color: var(--accent-text); }
+.nav-label { flex: 1; min-width: 0; }
+.nav-item .count, .nav-view-count { margin-left: auto; font-size: var(--fs-caption); color: var(--text3); font-family: var(--mono); font-variant-numeric: tabular-nums; }
+#tools-nav { flex: 0 0 auto; }
+#tools-nav > summary { margin: 0 8px; list-style: none; }
+#tools-nav > summary::-webkit-details-marker { display: none; }
+#tools-nav > summary::marker { content: ''; }
+#tools-nav[open] > summary .icon { transform: rotate(90deg); }
+#tools-nav .nav { padding-top: 2px; }
 .nav-divider { height: 1px; background: var(--border); margin: 12px 8px; }
 .nav-views-label { padding: 0 18px; font-size: var(--fs-caption); color: var(--text3); text-transform: uppercase; letter-spacing: 0.06em; }
 .nav-views { display: flex; flex-direction: column; gap: 2px; padding: 6px 8px 12px; }
-.nav-view-item { height: 28px; display: flex; align-items: center; padding: 0 10px; font-size: var(--fs-small); color: var(--text3); }
 
 .sidebar-footer {
+  margin-top: auto;
   padding: 12px 16px;
   border-top: 1px solid var(--border);
   font-family: var(--mono);
@@ -1511,10 +1522,6 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   .bar { height: 6px; background: var(--bg-strong); border-radius: 999px; overflow: hidden; }
   .bar > i { display: block; height: 100%; background: var(--accent); }
   /* Fleet (great_cto-ki1x.8): saved views in the sidebar, domain groups, AgentRow cells */
-  .nav-view-item { cursor: pointer; display: flex; justify-content: space-between; gap: 8px; }
-  .nav-view-item:hover { background: var(--bg-muted); color: var(--text); }
-  .nav-view-item.active { background: var(--bg-strong); color: var(--text); font-weight: 500; }
-  .nav-view-count { font-family: var(--mono); font-size: var(--fs-caption); color: var(--text3); font-variant-numeric: tabular-nums; }
   .fleet-group-head { display: flex; align-items: center; gap: 8px; padding: 8px 12px 4px; font-size: var(--fs-eyebrow); letter-spacing: .08em; text-transform: uppercase; color: var(--text2); font-weight: 500; }
   .fleet-group-collapsed { display: flex; flex-wrap: wrap; gap: 20px; padding: 10px 12px; font-size: var(--fs-eyebrow); letter-spacing: .08em; text-transform: uppercase; color: var(--text3); }
   .ar-cells { display: grid; grid-template-columns: minmax(200px, 1.4fr) 130px 48px 56px 80px auto; gap: 12px; align-items: center; margin-top: 4px; }
@@ -3159,7 +3166,7 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
    operator caused, none for state the machine caused. Hover and focus 90ms
    linear; the drawer 200ms out / 140ms in (exit faster than enter); SSE
    arrival 0ms — rows and figures swap, they do not animate in. ── */
-.nav-item, .nav-view-item, .agent-row, .inbox-row, .gate-btn, .btn-black, .btn-ghost-sm, .pill, .so-option { transition: background-color 90ms linear, border-color 90ms linear, outline-color 90ms linear; }
+.nav-item, .nav-view-item, .nav-group-toggle, .agent-row, .inbox-row, .gate-btn, .btn-black, .btn-ghost-sm, .pill, .so-option { transition: background-color 90ms linear, border-color 90ms linear, outline-color 90ms linear; }
 @media (prefers-reduced-motion: reduce) {
   *, *::before, *::after { transition-duration: 1ms !important; animation-duration: 1ms !important; animation-iteration-count: 1 !important; scroll-behavior: auto !important; }
 }
@@ -3207,8 +3214,9 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
    labels; the destinations stay one tap away. ── */
 @media (min-width: 768px) and (max-width: 1199px) {
   .sidebar { width: 56px; }
-  .nav-item { justify-content: center; padding: 0; gap: 0; }
+  .nav-item, .nav-group-toggle { justify-content: center; padding: 0; gap: 0; }
   .nav-item > span { display: none; }
+  .nav-group-toggle .nav-label { display: none; }
   .nav-item .count.abs { display: inline; position: absolute; top: 2px; right: 6px; }
   .nav-item { position: relative; }
   .nav-divider, .nav-views-label, .nav-views { display: none; }
@@ -3366,8 +3374,7 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .work-warning { color: var(--absent-warn-fg); background: var(--bg-card); border: 1px solid var(--absent-warn-fg); padding: 12px; }
 .work-page pre { font-weight: 400; white-space: pre-wrap; overflow-wrap: anywhere; margin: 12px 0; }
 #work-compose textarea, #work-compose input, #work-compose select { display: block; width: 100%; margin: 8px 0 12px; padding: 8px; background: var(--bg-muted); color: var(--text); border: 1px solid var(--border-strong); border-radius: 4px; }
-#tools-nav summary { padding: 12px 16px; cursor: pointer; }
-@media (min-width: 768px) and (max-width: 1199px) { .nav-item[data-tab="work"] > span, .nav-item[data-tab="history"] > span { display: inline; font-size: var(--fs-caption); } #tools-nav summary { padding: 12px 4px; } }
+@media (max-width: 767px) { .sidebar { --nav-row-height: 44px; } }
 @media (max-width: 767px) { .work-page { padding: 12px; } .work-page button, #work-compose select { min-height: 44px; } }
 </style>
 </head>
@@ -3406,22 +3413,32 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
           <input id="proj-search" type="text" placeholder="Filter projects…" aria-label="Filter projects" oninput="renderProjMenu(this.value)" />
         </div>
         <div id="proj-menu-list"></div>
+        <div id="proj-menu-status" role="status"></div>
       </div>
     </div>
     <nav class="nav" id="nav-tablist" role="tablist" aria-orientation="vertical">
-      <div class="nav-item active" data-tab="work" role="tab" tabindex="0" aria-label="Work" title="Work" onkeydown="navTabKeydown(event, this)" onclick="switchTab('work', this)"><span>Work</span></div>
+      <div class="nav-item active" data-tab="work" role="tab" tabindex="0" aria-selected="true" aria-label="Work" title="Work" onkeydown="navTabKeydown(event, this)" onclick="switchTab('work', this)">
+        <svg class="icon" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="3" y="7" width="18" height="14" rx="2"/><path d="M8 7V5a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2M3 12h18M10 12v3h4v-3"/></svg>
+        <span class="nav-label">Work</span>
+      </div>
       <div class="nav-item" data-tab="decisions" role="tab" tabindex="0" aria-label="Decisions" title="Decisions" onkeydown="navTabKeydown(event, this)" onclick="switchTab('decisions', this)">
         <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M22 12h-6l-2 3h-4l-2-3H2 M5.45 5.11L2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z"/></svg>
-        <span>Decisions</span>
+        <span class="nav-label">Decisions</span>
         <span class="count" id="nav-inbox-count">0</span>
       </div>
-      <div class="nav-item" data-tab="history" role="tab" tabindex="0" aria-label="History" title="History" onkeydown="navTabKeydown(event, this)" onclick="switchTab('history', this)"><span>History</span></div>
+      <div class="nav-item" data-tab="history" role="tab" tabindex="0" aria-label="History" title="History" onkeydown="navTabKeydown(event, this)" onclick="switchTab('history', this)">
+        <svg class="icon" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M3 10a9 9 0 1 1 2 8M3 4v6h6M12 7v5l3 2"/></svg>
+        <span class="nav-label">History</span>
+      </div>
     </nav>
-    <details id="tools-nav"><summary>Tools</summary>
+    <details id="tools-nav"><summary class="nav-group-toggle" aria-label="Tools" title="Tools">
+      <svg class="icon" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M9 6l6 6-6 6"/></svg>
+      <span class="nav-label">Tools</span>
+    </summary>
     <nav class="nav" role="tablist" aria-label="Technical tools" aria-orientation="vertical">
       <div class="nav-item" data-tab="ledger" role="tab" tabindex="0" aria-label="Ledger" title="Ledger" onkeydown="navTabKeydown(event, this)" onclick="switchTab('ledger', this)">
         <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M12 1v22 M17 5H9.5a3.5 3.5 0 0 0 0 7h5a3.5 3.5 0 0 1 0 7H6"/></svg>
-        <span>Ledger</span>
+        <span class="nav-label">Ledger</span>
         <!-- Real spend total is Ledger's own content (.7); this keeps the count
              of agent budget caps the old Budgets tab already computed, rather
              than inventing a $ figure with nothing behind it yet. -->
@@ -3429,7 +3446,7 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
       </div>
       <div class="nav-item" data-tab="fleet" role="tab" tabindex="0" aria-label="Fleet" title="Fleet" onkeydown="navTabKeydown(event, this)" onclick="switchTab('fleet', this)">
         <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><circle cx="6" cy="6" r="2"/><circle cx="18" cy="6" r="2"/><circle cx="6" cy="18" r="2"/><circle cx="18" cy="18" r="2"/><path d="M8 6h8M6 8v8M18 8v8M8 18h8"/></svg>
-        <span>Fleet</span>
+        <span class="nav-label">Fleet</span>
         <!-- The absence glyph, not a count (DESIGN §5): something in Fleet is
              unclassified. Left hidden — the classification read lives in the
              Fleet screen body (.8/.9), out of this shell task's scope. -->
@@ -3437,22 +3454,18 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
       </div>
       <div class="nav-item" data-tab="harness" role="tab" tabindex="0" aria-label="Harness" title="Harness" onkeydown="navTabKeydown(event, this)" onclick="switchTab('harness', this)">
         <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M3 12h4l2-5 3 10 2-5h7"/></svg>
-        <span>Harness</span>
+        <span class="nav-label">Harness</span>
         <span class="count" id="nav-harness-count"></span>
       </div>
       <div class="nav-item" data-tab="usage" role="tab" tabindex="0" aria-label="Usage" title="Usage" onkeydown="navTabKeydown(event, this)" onclick="switchTab('usage', this)">
         <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M4 20V10 M10 20V4 M16 20v-7 M22 20H2"/></svg>
-        <span>Usage</span>
+        <span class="nav-label">Usage</span>
       </div>
     </nav>
     </details>
     <div class="nav-divider"></div>
     <div class="nav-views-label" id="nav-views-label" hidden>Views</div>
-    <!-- Saved views over Fleet (DESIGN §5 point 2). Static for this shell —
-         filtering the fleet list is the Fleet screen body's job (.8), not this
-         task's; deliberately not `.nav-item`/`role="tab"`, since they neither
-         switch a top-level destination nor do anything yet, and a control that
-         looks live and isn't fails `ui-ux-pro-max` empty-nav-state. -->
+    <!-- Fleet filters share the row pattern, but stay buttons, not destinations. -->
     <div class="nav-views" hidden>
       <div class="nav-view-item" id="nav-view-needs" role="button" tabindex="0" onclick="setFleetView('needs')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();setFleetView('needs')}">Needs attention</div>
       <div class="nav-view-item" id="nav-view-expensive" role="button" tabindex="0" onclick="setFleetView('expensive')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();setFleetView('expensive')}">Expensive grants</div>
@@ -4085,6 +4098,10 @@ window.GctoWork.bind({
   project: () => new URLSearchParams(location.search).get('project') || '',
   visible: () => currentTab === 'work' || currentTab === 'history',
   read: url => api(url),
+  publish: async (url, body) => {
+    const response = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+    return response.json();
+  },
   openIssue: (id, decision) => { if (decision) switchTab('decisions'); openSideById(id); },
 });
 let searchQuery = '';
@@ -5992,6 +6009,7 @@ let usageDays = 30;
 let usageHost = 'claude';
 let usageData = null;
 let _usageTimer = null;
+let _usageRequest = 0;
 const USAGE_HOSTS = { claude: 'Claude Code', codex: 'Codex' };
 const USAGE_LOGS = { claude: '~/.claude/projects', codex: '~/.codex/sessions' };
 const USAGE_FN = { chat: 'Conversations', subagent: 'Subagents', automation: 'Automations', headless: 'Headless runs' };
@@ -6014,7 +6032,13 @@ async function loadUsage(days) {
   if (days) usageDays = days;
   document.querySelectorAll('.usage-chip[data-days]').forEach((c) => c.classList.toggle('active', Number(c.dataset.days) === usageDays));
   clearTimeout(_usageTimer);
+  const request = ++_usageRequest, requestedDays = usageDays;
+  const loadingBody = document.getElementById('usage-body');
+  if (loadingBody && (!usageData || usageData.window?.days !== requestedDays)) {
+    loadingBody.className = 'usage-note'; loadingBody.textContent = 'Loading session statistics…';
+  }
   const d = await api(`/api/usage?days=${usageDays}`);
+  if (request !== _usageRequest || requestedDays !== usageDays || currentTab !== 'usage') return;
   const body = document.getElementById('usage-body');
   if (!body) return;
   if (!d || d.error) {
@@ -6035,6 +6059,12 @@ async function loadUsage(days) {
   }
   usageData = d;
   renderUsage(d);
+  if (d.stale || d.refreshing) {
+    const note = document.createElement('p'); note.className = 'usage-note';
+    note.textContent = d.refreshError || 'Showing the last counted statistics while refreshing in the background.';
+    body.prepend(note);
+  }
+  if (d.refreshing) _usageTimer = setTimeout(() => { if (currentTab === 'usage') loadUsage(); }, 2000);
   loadOutcomes();
 }
 
@@ -7480,8 +7510,28 @@ function toggleProjMenu(e) {
   const isOpen = sw.classList.toggle('open');
   if (isOpen) {
     document.getElementById('proj-search').focus();
-    renderProjMenu('');
-  }
+    renderProjMenu();
+    refreshProjMenu();
+  }
+}
+let _projMenuRead = 0, _projMenuAbort;
+async function refreshProjMenu() {
+  const request = ++_projMenuRead;
+  _projMenuAbort?.abort();
+  const controller = new AbortController(); _projMenuAbort = controller;
+  const note = document.getElementById('proj-menu-status');
+  if (note) note.textContent = 'Refreshing projects…';
+  const timer = setTimeout(() => controller.abort(), 5000);
+  try {
+    const projects = await api('/api/projects', { signal: controller.signal });
+    if (request !== _projMenuRead) return;
+    if (!Array.isArray(projects) || projects.some(p => !p || typeof p.slug !== 'string')) throw Error('Invalid project list');
+    allProjects = projects;
+    if (note) note.textContent = '';
+    if (document.getElementById('proj-switch').classList.contains('open')) renderProjMenu();
+  } catch {
+    if (request === _projMenuRead && note) note.textContent = 'Could not refresh projects; showing the last loaded list.';
+  } finally { clearTimeout(timer); }
 }
 function closeProjMenu() {
   document.getElementById('proj-switch')?.classList.remove('open');
@@ -7531,14 +7581,14 @@ function archetypeIcon(arch, size = 14) {
   return `<svg width="${size}" height="${size}" viewBox="0 0 24 24" fill="none" stroke="${meta.color}" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="${meta.d}"/></svg>`;
 }
 
-function renderProjMenu(filter = '') {
+function renderProjMenu(filter = document.getElementById('proj-search')?.value || '') {
   const list = document.getElementById('proj-menu-list');
   if (!list) return;
   if (!allProjects.length) {
     list.innerHTML = '<div class="proj-menu-empty">No projects registered yet</div>';
     return;
   }
-  const f = filter.toLowerCase();
+  const f = filter.trim().toLowerCase();
   const filtered = allProjects.filter(p =>
     !f || (p.slug || '').toLowerCase().includes(f) ||
     (p.archetype || '').toLowerCase().includes(f) ||
@@ -9078,7 +9128,9 @@ function switchTab(id, el) {
   closeMenu(false);   // choosing a destination is the end of using the menu
   // sidebar nav
   document.querySelectorAll('.nav-item[data-tab]').forEach(t => {
-    t.classList.toggle('active', t.dataset.tab === navKey);
+    const selected = t.dataset.tab === navKey;
+    t.classList.toggle('active', selected);
+    t.setAttribute('aria-selected', String(selected));
   });
   // top tabs
   document.querySelectorAll('.tab-btn').forEach(t => t.classList.toggle('active', t.dataset.tab === id));
@@ -9389,8 +9441,11 @@ function renderFleetViews() {
     const el = document.getElementById(`nav-view-${key}`);
     if (!el) continue;
     const n = agents.filter((a) => inFleetView(a, key)).length;
-    el.classList.toggle('active', fleetState.view === key);
-    el.innerHTML = `<span>${esc(label)}</span><span class="nav-view-count">${n}</span>`;
+    const selected = fleetState.view === key;
+    el.classList.toggle('active', selected);
+    el.setAttribute('aria-pressed', String(selected));
+    // A filter glyph keeps the same icon/label columns as the destinations.
+    el.innerHTML = `<svg class="icon" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M4 5h16l-6 7v6l-4 2v-8z"/></svg><span class="nav-label">${esc(label)}</span><span class="nav-view-count">${n}</span>`;
   }
   const abs = document.getElementById('nav-fleet-abs');
   if (abs) abs.hidden = !agents.some((a) => a.posture?.state === 'unclassified' || a.posture?.state === 'unreadable');

package/board/scripts/lib/gate-plan.mjs

@@ -24,8 +24,9 @@ import { fileURLToPath } from 'node:url';
 
 import { classify } from './change-tier.mjs';
 import { selectJudgeModel } from './judge-model.mjs';
-// effectiveGates lives in the built CLI package (TS → dist).
-import { effectiveGates } from '../../packages/cli/dist/archetypes.js';
+// Generated from the canonical CLI policy, but shipped in Git too: marketplace
+// installs do not contain the gitignored CLI build.
+import { effectiveGates } from './gate-policy.mjs';
 
 /** Parse archetype + project_size out of a .great_cto/PROJECT.md body. */
 export function parseProject(text) {

package/board/scripts/lib/gate-policy.mjs

@@ -0,0 +1,97 @@
+// Generated by scripts/build-gate-policy.mjs from packages/cli/src/archetypes.ts.
+// Do not edit; regenerate, then run --check. No CLI build is needed at runtime.
+export const GATES_BY_ARCHETYPE = {
+    "web-service": ["plan", "qa", "ship"],
+    "mobile-app": ["plan", "qa", "ship"],
+    "ai-system": ["plan", "cost", "qa", "security", "ship"],
+    "agent-product": ["plan", "cost", "qa", "security", "ship"],
+    "mlops": ["plan", "cost", "qa", "security", "ship"],
+    "data-platform": ["plan", "qa", "ship"],
+    "streaming": ["plan", "qa", "ship"],
+    "infra": ["plan", "qa", "ship"],
+    "library": ["plan", "qa", "ship"],
+    "cli-tool": ["plan", "qa", "ship"],
+    "commerce": ["plan", "qa", "security", "ship", "compliance"],
+    "marketplace": ["plan", "qa", "security", "ship", "compliance"],
+    "fintech": ["plan", "qa", "security", "ship", "compliance"],
+    "healthcare": ["plan", "qa", "security", "ship", "compliance"],
+    "web3": ["plan", "qa", "oracle-review", "security", "ship"],
+    "iot-embedded": ["plan", "qa", "security", "ship"],
+    "regulated": ["plan", "qa", "security", "ship", "compliance"],
+    "devtools": ["plan", "qa", "ship"],
+    "browser-extension": ["plan", "qa", "ship"],
+    "game": ["plan", "qa", "ship"],
+    "cms": ["plan", "qa", "ship"],
+    "enterprise-saas": ["plan", "qa", "security", "ship", "compliance"],
+    "edtech": ["plan", "qa", "edtech-review", "security", "ship", "compliance"],
+    "gov-public": ["plan", "qa", "gov-review", "security", "ship", "compliance"],
+    "insurance": ["plan", "qa", "insurance-review", "security", "ship", "compliance"],
+    "legal": ["plan", "qa", "upl-review", "security", "ship", "compliance"],
+    "defense-govcon": ["plan", "qa", "cmmc-assessment", "security", "ship", "compliance"],
+    // Product Builder archetypes (A1–A6) — non-regulated baseline; the single CTO gate
+    // emerges at change_tier T1 (effectiveGates → [plan]).
+    "vertical-saas": ["plan", "qa", "ship"],
+    "booking": ["plan", "qa", "ship"],
+    "crm": ["plan", "qa", "ship"],
+    "dashboard": ["plan", "qa", "ship"],
+    "content-platform": ["plan", "qa", "ship"],
+    "marketplace-lite": ["plan", "qa", "ship"],
+    "greenfield": ["plan"],
+};
+/**
+ * Returns the subset of gates the pipeline will actually open for a
+ * given archetype + project_size. Used by the orchestrator before
+ * opening any gate to skip unnecessary human checkpoints on smaller
+ * projects (e.g. nano always skips QA).
+ */
+export function gatesFor(archetype, size) {
+    const all = GATES_BY_ARCHETYPE[archetype] ?? [];
+    if (size === "nano")
+        return all.filter((g) => g === "plan");
+    if (size === "small")
+        return all.filter((g) => g === "plan" || g === "ship");
+    if (size === "medium")
+        return all;
+    // large + enterprise → ensure compliance is included
+    return all.includes("compliance") ? all : [...all, "compliance"];
+}
+/** Gates that form the non-negotiable floor for a *regulated* archetype. */
+const FLOOR_GATES = ["security", "compliance", "ship"];
+/**
+ * The human gates the pipeline opens for a change, given its archetype, the
+ * project size, AND the per-change risk tier. Composes with `gatesFor()`:
+ *
+ *  - T2 (default): the full size baseline, with `ship` guaranteed even if a
+ *    small project_size had stripped it. An irreversible change always gets a
+ *    final go/no-go. Nothing is ever removed → fail-safe for an unknown tier.
+ *  - T1: only `plan` (you review intent) PLUS the regulated floor. The standalone
+ *    qa/security-as-ceremony is dropped because CI + tests cover a reversible change.
+ *  - T0: the regulated floor only — for a plain archetype that is the empty set
+ *    (CI is the gate); for a regulated one, security+compliance+ship still fire.
+ *
+ * An archetype is "regulated" iff its baseline contains `security` or `compliance`.
+ * That is what keeps the downgrade sound: a fintech repo cannot ship an
+ * irreversible change unreviewed even when the change is labelled a fix.
+ *
+ * NOTE: change-specific T2 triggers (a migration, a new write-connector, a prod
+ * deploy) are resolved upstream by the classifier, which escalates such a change
+ * to T2 before this function sees it. Here we only map an already-decided tier.
+ */
+export function effectiveGates(archetype, size, tier = "T2") {
+    const base = gatesFor(archetype, size);
+    // T2 (and any unrecognized tier) → full baseline, never downgraded, ship forced.
+    if (tier !== "T0" && tier !== "T1") {
+        return base.includes("ship") ? base : [...base, "ship"];
+    }
+    // Regulated archetypes carry a floor that survives every downgrade.
+    const isRegulated = base.includes("security") || base.includes("compliance");
+    const floor = isRegulated ? base.filter((g) => FLOOR_GATES.includes(g)) : [];
+    if (tier === "T1") {
+        const keep = new Set(floor);
+        if (base.includes("plan"))
+            keep.add("plan");
+        return base.filter((g) => keep.has(g)); // preserve base order
+    }
+    // T0 — maintenance.
+    return floor;
+}

package/board/scripts/lib/work-publication.mjs

@@ -0,0 +1,169 @@
+/** Publish an explicitly approved, already-committed verified task. Never merge. */
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readWorkTask, mutateWorkTask, acquireProjectLease, publicWorkTask } from './work-tasks.mjs';
+import { treeReceipt } from './receipt.mjs';
+import { scan } from './secret-patterns.mjs';
+import { realpathSync } from 'node:fs';
+
+const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+const bindingOf = (value, revision = value.revision) => ({ taskId: value.taskId, revision,
+  repository: value.repository, origin: value.origin, branch: value.branch, base: value.base,
+  head: value.head, baseHead: value.baseHead, tree: value.tree, paths: value.paths,
+  allow: value.allow, patchDigest: value.patchDigest });
+const ref = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9/_-]{0,120}$/.test(value)
+  && !value.endsWith('/') && !value.includes('//');
+const scopePath = value => typeof value === 'string' && value.length <= 300 && value.length > 0
+  && !value.startsWith('/') && !value.startsWith('-') && !value.includes('\\') && !value.includes(':') && !value.includes(',')
+  && !/[\x00-\x1f]/.test(value) && !value.split('/').some(p => !p || p === '.' || p === '..');
+function command(bin, args, root, execute = execFileSync) {
+  try { return String(execute(bin, args, { cwd: root, encoding: 'utf8', timeout: 20000,
+    maxBuffer: 2 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],
+    env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_NO_REPLACE_OBJECTS: '1', GH_PROMPT_DISABLED: '1' } })); }
+  catch { throw Error(`${bin} ${args[0]} failed; inspect local authentication, hooks or network (output withheld)`); }
+}
+function repository(url, root, execute) {
+  const https = /^https:\/\/github\.com\/([A-Za-z0-9_-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(url);
+  if (https) return `${https[1]}/${https[2]}`;
+  const ssh = /^git@([A-Za-z0-9_.-]+):([A-Za-z0-9_-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(url);
+  if (!ssh || ssh[1].startsWith('-')) throw Error('publication requires a credential-free GitHub origin');
+  if (ssh[1] !== 'github.com') {
+    // Inspect OpenSSH's effective config without connecting; never echo identity paths.
+    const config = command('ssh', ['-G', '-o', 'CanonicalizeHostname=no', '-o', 'BatchMode=yes', `git@${ssh[1]}`], root, execute);
+    const values = new Map(config.split('\n').map(line => line.trim().split(/\s+/, 2)));
+    if (values.get('hostname')?.toLowerCase() !== 'github.com' || values.get('user') !== 'git' || values.get('port') !== '22')
+      throw Error('SSH alias does not resolve to git@github.com:22');
+    if (process.env.GIT_SSH || process.env.GIT_SSH_COMMAND || /(?:^|\0)(?:core\.sshcommand|ssh\.variant)\n/i.test(command('git', ['config', '--list', '--null'], root, execute)))
+      throw Error('custom SSH transport cannot be verified for publication');
+  }
+  return `${ssh[2]}/${ssh[3]}`;
+}
+function ready(task, root) {
+  if (task.managed === false || task.intent === 'research' || task.phase !== 'verified' || task.outcome?.state !== 'verified')
+    throw Error('publication requires a managed verified delivery task');
+  if (task.decisions?.length || task.operations.some(o => o.state === 'running')) throw Error('task has pending decisions or an active host operation');
+  const receipt = treeReceipt(root);
+  if (!receipt || receipt.dirty || receipt.truncated || !same(receipt, task.outcome.receipt)) throw Error('verified tree receipt is missing or stale; commit and reverify before publication');
+}
+
+export function previewPublication({ root, taskId, base = 'main', allow = null }, options = {}) {
+  const task = readWorkTask(taskId, { ...options, root }); ready(task, root);
+  const git = args => command('git', args, root, options.execute);
+  if (realpathSync(git(['rev-parse', '--show-toplevel']).trim()) !== realpathSync(root)) throw Error('publication task must own the repository root, not a nested directory');
+  // Even metadata/log changes excluded from verification cannot accidentally ship.
+  if (git(['status', '--porcelain=v1', '--untracked-files=all']).trim()) throw Error('publication requires a fully clean worktree and index');
+  const branch = git(['symbolic-ref', '--quiet', '--short', 'HEAD']).trim();
+  if (!ref(base) || !ref(branch) || branch === base || ['main', 'master', 'develop'].includes(branch)) throw Error('publication requires a non-protected named feature branch and valid base');
+  git(['check-ref-format', `refs/heads/${base}`]); git(['check-ref-format', `refs/heads/${branch}`]);
+  const origins = git(['remote', 'get-url', '--all', 'origin']).trim().split('\n');
+  const pushOrigins = git(['remote', 'get-url', '--push', '--all', 'origin']).trim().split('\n');
+  if (origins.length !== 1 || pushOrigins.length !== 1 || origins[0] !== pushOrigins[0]) throw Error('origin must have exactly one identical fetch and push URL');
+  const repo = repository(origins[0], root, options.execute);
+  const head = git(['rev-parse', '--verify', 'HEAD^{commit}']).trim();
+  const baseHead = git(['rev-parse', '--verify', `refs/remotes/origin/${base}^{commit}`]).trim();
+  git(['merge-base', '--is-ancestor', baseHead, head]);
+  const commits = git(['rev-list', '--reverse', `${baseHead}..${head}`]).trim().split('\n').filter(Boolean);
+  if (!commits.length || commits.length > 100 || git(['rev-list', '--merges', `${baseHead}..${head}`]).trim()) throw Error('publication supports 1..100 linear commits; merge commits require manual review');
+  const paths = [...new Set(commits.flatMap(commit => git(['diff-tree', '-r', '--no-commit-id', '--no-renames', '--name-only', '-z', commit]).split('\0').filter(Boolean)))];
+  if (!paths.length || paths.length > 200) throw Error('publication requires 1..200 changed files');
+  const allowed = allow || task.authority?.writeScope;
+  if (!Array.isArray(allowed) || !allowed.length || allowed.some(p => !scopePath(p))) throw Error('publication requires explicit relative path scope');
+  if (paths.some(p => !scopePath(p) || !allowed.some(a => p === a || p.startsWith(a + '/')))) throw Error('diff contains paths outside the approved publication scope');
+  const patch = commits.map(commit => git(['show', '--no-color', '--format=fuller', '--no-ext-diff', '--no-textconv', '--no-renames', '--binary', commit, '--'])).join('\n');
+  if (Buffer.byteLength(patch) > 2 * 1024 * 1024 || patch.includes('GIT binary patch')) throw Error('publication preview exceeds its text-only size limit; inspect manually');
+  // Scan complete publication content, including removed lines; never return matched secrets.
+  if (scan(patch).length) throw Error('publication diff contains a possible secret; resolve locally before preview');
+  const binding = { taskId, revision: task.revision, repository: repo, origin: origins[0], branch, base,
+    head, baseHead, tree: git(['rev-parse', 'HEAD^{tree}']).trim(), paths, allow: [...allowed], patchDigest: digest(patch) };
+  let confirmation = { expectedRevision: task.revision, approval: digest(binding) };
+  const pending = task.publication;
+  if (pending && pending.state !== 'pr-linked') {
+    if (task.revision !== pending.guardRevision || digest(bindingOf(binding, pending.approvedRevision)) !== pending.approval
+      || digest(bindingOf(pending, pending.approvedRevision)) !== pending.approval) throw Error('unfinished publication changed; reconcile before a new preview');
+    confirmation = { expectedRevision: pending.approvedRevision, approval: pending.approval };
+  }
+  return { ...binding, approval: digest(binding), confirmation, patch,
+    summary: git(['diff', '--no-ext-diff', '--no-textconv', '--stat', baseHead, head, '--']),
+    scope: 'push approved commit and create/find draft PR only; no commit, merge, release or deploy' };
+}
+
+function assertPR(pr, preview) {
+  if (!pr || pr.headRefOid !== preview.head || pr.headRefName !== preview.branch || pr.baseRefName !== preview.base
+    || pr.state !== 'OPEN' || pr.isDraft !== true || typeof pr.url !== 'string'
+    || !pr.url.startsWith(`https://github.com/${preview.repository}/pull/`) || !/\/pull\/[1-9][0-9]*$/.test(pr.url))
+    throw Error('existing PR does not match approved SHA/base/draft state; inspect it manually');
+  return pr;
+}
+
+export function publishPublication({ root, taskId, base = 'main', allow = null, expectedRevision, approval, confirm }, options = {}) {
+  if (confirm !== 'publish-draft-pr' || !Number.isInteger(expectedRevision) || !/^[0-9a-f]{64}$/.test(approval || ''))
+    throw Error('publication requires explicit publish-draft-pr confirmation, revision and preview approval');
+  const lease = acquireProjectLease(root, options);
+  let active = false;
+  try {
+    let task = readWorkTask(taskId, { ...options, root }), existing = task.publication;
+    if (existing && existing.approval === approval && existing.approvedRevision === expectedRevision) {
+      if (base !== existing.base || (allow && !same(allow, existing.allow))) throw Error('publication retry parameters conflict with approved request');
+      if (existing.state === 'pr-linked') return { publication: existing, task: publicWorkTask(task) };
+      if (task.revision !== existing.guardRevision) throw Error('task changed after publication approval; new preview required');
+    } else {
+      const preview = previewPublication({ root, taskId, base, allow }, options);
+      if (preview.revision !== expectedRevision || preview.approval !== approval) throw Error('stale publication preview; refresh and approve exact content');
+      if (existing && existing.state !== 'pr-linked') throw Error('unfinished publication exists; reconcile its approved operation first');
+      task = mutateWorkTask(taskId, t => { t.publication = { ...preview, patch: undefined, summary: undefined,
+        approvedRevision: expectedRevision, guardRevision: t.revision + 1, state: 'prepared', url: null, lastError: null }; }, { ...options, root });
+      existing = task.publication;
+    }
+    active = true;
+    // Revalidate task evidence/content on retry without issuing a new approval.
+    const current = previewPublication({ root, taskId, base: existing.base, allow: existing.allow }, options);
+    if (digest(bindingOf(current, existing.approvedRevision)) !== approval
+      || digest(bindingOf(existing, existing.approvedRevision)) !== approval) throw Error('publication inputs changed; refuse external writes');
+    const git = args => command('git', args, root, options.execute);
+    const gh = args => command('gh', args, root, options.execute);
+    const checkpoint = (state, more = {}) => {
+      task = mutateWorkTask(taskId, t => {
+        if (t.revision !== t.publication.guardRevision) throw Error('task revision changed during publication');
+        Object.assign(t.publication, more, { state, guardRevision: t.revision + 1, lastError: null });
+      }, { ...options, root }); existing = task.publication;
+    };
+    const remoteBase = git(['ls-remote', '--refs', 'origin', `refs/heads/${existing.base}`]).trim().split(/\s+/)[0];
+    if (remoteBase !== existing.baseHead) throw Error('remote base moved; fetch and reverify before publication');
+    const remoteHead = git(['ls-remote', '--refs', 'origin', `refs/heads/${existing.branch}`]).trim().split(/\s+/)[0];
+    if (remoteHead && remoteHead !== existing.head) throw Error('remote feature branch differs; no overwrite or force push permitted');
+    // Empty expected ref is a create-only CAS, not permission to overwrite a ref.
+    // Without it, another writer could create an ancestor between ls-remote and push.
+    // Immutable SHA refspec; normal hooks remain enabled. No --force or nonempty lease.
+    if (remoteHead !== existing.head) git(['push', `--force-with-lease=refs/heads/${existing.branch}:`, 'origin', `${existing.head}:refs/heads/${existing.branch}`]);
+    if (git(['ls-remote', '--refs', 'origin', `refs/heads/${existing.branch}`]).trim().split(/\s+/)[0] !== existing.head)
+      throw Error('remote commit identity is unconfirmed; reconcile before PR creation');
+    checkpoint('pushed');
+    const list = () => {
+      const prs = JSON.parse(gh(['pr', 'list', '--repo', existing.repository, '--head', existing.branch, '--base', existing.base,
+        '--state', 'all', '--limit', '100', '--json', 'url,headRefOid,headRefName,baseRefName,state,isDraft']));
+      if (!Array.isArray(prs) || prs.length > 1) throw Error('PR identity is ambiguous');
+      return prs[0] ? assertPR(prs[0], existing) : null;
+    };
+    let pr = list();
+    if (!pr) {
+      // Persist intent BEFORE sending create. A timeout is an uncertain outcome, not permission to create twice.
+      if (existing.createIssued) throw Error('PR creation outcome is uncertain; no duplicate create will be sent; reconcile remotely');
+      if (git(['ls-remote', '--refs', 'origin', `refs/heads/${existing.base}`]).trim().split(/\s+/)[0] !== existing.baseHead)
+        throw Error('remote base changed before PR creation; reverify before publication');
+      checkpoint('pushed', { createIssued: true });
+      gh(['pr', 'create', '--repo', existing.repository, '--base', existing.base, '--head', existing.branch, '--draft',
+        '--title', `Task ${taskId}`, '--body', `Verified task publication. Task: ${taskId}. Approved commit: ${existing.head}. Merge, release and deploy require separate authorization.`]);
+      pr = list();
+      if (!pr) throw Error('created PR is not visible yet; retry reconciliation only');
+    }
+    checkpoint('pr-linked', { url: pr.url });
+    return { publication: existing, task: publicWorkTask(task) };
+  } catch (error) {
+    if (active) mutateWorkTask(taskId, t => {
+      if (t.revision !== t.publication.guardRevision) return false;
+      t.publication.lastError = error.message; t.publication.guardRevision = t.revision + 1;
+    }, { ...options, root });
+    throw error;
+  } finally { lease.release(); }
+}

package/board/scripts/lib/work-tasks.mjs

@@ -34,6 +34,11 @@ function validate(t) {
   if (t.intent !== undefined && !['delivery', 'research'].includes(t.intent)) throw Error('invalid task intent');
   if (t.decisions !== undefined && (!Array.isArray(t.decisions) || t.decisions.some(d => !d || !/^[0-9a-f]{64}$/.test(d.decisionId) || !['codex', 'claude-code'].includes(d.engine)))) throw Error('invalid task decisions');
   if (t.outcome && (!['research', 'delivery'].includes(t.outcome.kind) || !['verified', 'completed'].includes(t.outcome.state) || !Array.isArray(t.outcome.artifacts) || !Array.isArray(t.outcome.criteria))) throw Error('invalid task outcome');
+  if (t.publication && (!['prepared', 'pushed', 'pr-linked'].includes(t.publication.state)
+    || !/^[0-9a-f]{64}$/.test(t.publication.approval || '') || t.publication.taskId !== t.taskId
+    || !Number.isInteger(t.publication.approvedRevision) || !Number.isInteger(t.publication.guardRevision)
+    || typeof t.publication.repository !== 'string' || typeof t.publication.head !== 'string'
+    || !Array.isArray(t.publication.paths) || !Array.isArray(t.publication.allow))) throw Error('invalid publication state');
   return t;
 }
 export function readWorkTask(id, { store = workTaskStore(), root = null } = {}) {
@@ -257,10 +262,16 @@ export function observeWorkSession(payload, { store = workTaskStore() } = {}) {
     kind: event === 'Notification' ? 'native_permission_or_input' : 'native_session' }); }, { store, root: payload.cwd });
 }
 export function publicWorkTask(t) {
+  const quote = value => "'" + String(value).replace(/'/g, "'\\''") + "'";
+  const publication = t.publication;
   return { schemaVersion: 1, taskId: t.taskId, projectId: t.projectId, managed: t.managed, host: t.host, goal: t.goal,
     acceptance: t.acceptance, authority: t.authority, intent: t.intent || 'delivery', budget: t.budget || null, stage: t.stage || null,
     decisions: (t.decisions || []).map(({ receipt, ...d }) => ({ ...d, ...(['pipeline_gate', 'gate', 'release'].includes(d.kind) ? { bindingState: !receipt ? (d.bindingState || 'unverifiable') : JSON.stringify(treeReceipt(t.root)) === JSON.stringify(receipt) ? 'current' : 'stale' } : {}) })), outcome: t.outcome ? { source: t.outcome.source, kind: t.outcome.kind, state: t.outcome.state, verifiedAt: t.outcome.verifiedAt, completedAt: t.outcome.completedAt || null, artifacts: t.outcome.artifacts, criteria: t.outcome.criteria } : null, rework: t.rework || null, revision: t.revision, phase: t.phase, reason: t.reason,
     createdAt: t.createdAt, updatedAt: t.updatedAt, links: t.links, evidence: t.evidence, metrics: t.metrics,
+    publication: t.publication ? { state: t.publication.state, repository: t.publication.repository, branch: t.publication.branch,
+      base: t.publication.base, head: t.publication.head, url: t.publication.url, lastError: t.publication.lastError,
+      // A content digest is not a bearer credential. Running this command explicitly authorizes only the original operation.
+      resumeCommand: publication.state !== 'pr-linked' ? `great-cto task work publish --task ${t.taskId} --revision ${publication.approvedRevision} --approval ${publication.approval} --base ${quote(publication.base)} --allow ${quote(publication.allow.join(','))} --confirm publish-draft-pr` : null } : null,
     operations: t.operations.map(({ operationId, kind, state, startedAt, finishedAt, exitCode, resume }) => ({ operationId, kind, state, startedAt, finishedAt, exitCode, ...(resume ? { resume } : {}) })) };
 }
 

package/board/scripts/work-task.mjs

@@ -5,22 +5,27 @@ import { listWorkTasks, readWorkTask } from './lib/work-tasks.mjs';
 import { approveWorkDecision, decisionCapabilities } from './lib/work-decisions.mjs';
 import { applyOutcome, readOutcomeEvidence } from './lib/work-outcomes.mjs';
 import { measureWork, compareWork } from './lib/work-metrics.mjs';
+import { previewPublication, publishPublication } from './lib/work-publication.mjs';
 const args = process.argv.slice(2), action = args.shift();
 try {
-  const supported = new Set(['--dir','--task','--decision','--revision','--operation','--evidence','--baseline']);
+  const supported = new Set(['--dir','--task','--decision','--revision','--operation','--evidence','--baseline','--base','--allow','--approval','--confirm']);
   const opts = {};
   for (let i = 0; i < args.length; i += 2) { if (!supported.has(args[i]) || !args[i+1] || args[i+1].startsWith('--') || opts[args[i]] !== undefined) throw Error('invalid or duplicate operator option'); opts[args[i]] = args[i+1]; }
-  const perAction = { metrics: ['--dir','--baseline'], decisions: ['--dir','--task'], approve: ['--dir','--task','--decision','--revision','--operation'], verify: ['--dir','--task','--revision','--operation','--evidence'], complete: ['--dir','--task','--revision','--operation'] };
+  const perAction = { preview: ['--dir','--task','--base','--allow'], publish: ['--dir','--task','--base','--allow','--revision','--approval','--confirm'], metrics: ['--dir','--baseline'], decisions: ['--dir','--task'], approve: ['--dir','--task','--decision','--revision','--operation'], verify: ['--dir','--task','--revision','--operation','--evidence'], complete: ['--dir','--task','--revision','--operation'] };
   if (perAction[action] && Object.keys(opts).some(k => !perAction[action].includes(k))) throw Error('option is not supported for this operation');
   const root = resolve(opts['--dir'] || '.'), taskId = opts['--task'];
   let result;
-  if (action === 'metrics') {
+  if (['preview','publish'].includes(action)) {
+    const request = { root, taskId, base: opts['--base'] || 'main', allow: opts['--allow'] ? opts['--allow'].split(',') : null };
+    result = action === 'preview' ? previewPublication(request) : publishPublication({ ...request,
+      expectedRevision: Number(opts['--revision']), approval: opts['--approval'], confirm: opts['--confirm'] });
+  } else if (action === 'metrics') {
     const listing = listWorkTasks(root); if (listing.state === 'degraded') throw Error('task source is degraded; measurements refused');
     const current = measureWork(listing.tasks), baseline = opts['--baseline'] ? readOutcomeEvidence(root, opts['--baseline']).document : null;
     result = { ...current, comparison: compareWork(current, baseline) };
   } else if (action === 'decisions') result = decisionCapabilities(readWorkTask(taskId, { root }));
   else if (action === 'approve') result = approveWorkDecision({ root, taskId, decisionId: opts['--decision'], expectedRevision: Number(opts['--revision']), operationId: opts['--operation'] });
   else if (['verify','complete'].includes(action)) result = applyOutcome({ root, taskId, kind: action, expectedRevision: Number(opts['--revision']), operationId: opts['--operation'], evidenceFile: opts['--evidence'] });
-  else throw Error('usage: great-cto task work decisions|approve|verify|complete|metrics --dir PATH [--task UUID --revision N --operation UUID --decision ID --evidence EXTERNAL_FILE --baseline EXTERNAL_FILE]');
+  else throw Error('usage: great-cto task work decisions|approve|verify|complete|metrics|preview|publish --dir PATH [--task UUID --revision N --operation UUID --decision ID --evidence EXTERNAL_FILE --baseline EXTERNAL_FILE --base BRANCH --allow PATHS --approval DIGEST --confirm publish-draft-pr]');
   console.log(JSON.stringify(result, null, 2));
 } catch (e) { console.error('work-task: ' + e.message); process.exitCode = 2; }

package/dist/main.js

@@ -767,7 +767,7 @@ ${bold("Usage:")}
   npx great-cto ci [path] [--no-archetype] [--no-budget]
   npx great-cto mcp [--sse --port N]
   npx great-cto adapt [--dry-run]
-  npx great-cto task work decisions|approve|verify|complete|metrics ...
+  npx great-cto task work decisions|approve|verify|complete|metrics|preview|publish ...
   npx great-cto codex-host doctor|list|start|resume|status ...
   npx great-cto serve [--port 3142]
   npx great-cto upgrade [superpowers|beads]  Re-clone companions to latest tag + re-apply overlays

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.58.2",
+  "version": "3.59.1",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",

package/postinstall.mjs

@@ -138,32 +138,38 @@ function main() {
  *   - never block. The board takes the better part of a minute to become
  *     responsive; the installer does not wait for it. Detached, unref'd, output
  *     discarded.
- *   - never in CI, and never when asked not to. Both already guard the notice
- *     above; `GREAT_CTO_NO_BOARD=1` opts out of this specifically.
+ *   - never in CI or a Node test runner, and never when asked not to. A test
+ *     HOME isolates files, NOT ports: a detached board would still claim the
+ *     user's :3141 and serve fixture projects after the test exits.
+ *     `GREAT_CTO_NO_BOARD=1` opts out of this specifically.
  *   - never twice. `ensure` probes the port first and adopts a board that is
  *     already answering, whoever started it.
  */
-function ensureBoard() {
-  if (process.env.GREAT_CTO_NO_BOARD) return;
+export function ensureBoard({ env = process.env, spawnFn = spawn,
+  write = (text) => process.stdout.write(text) } = {}) {
+  if (env.CI || env.GREAT_CTO_QUIET_POSTINSTALL || env.GREAT_CTO_NO_BOARD || env.NODE_TEST_CONTEXT) return false;
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const entry = join(here, 'index.mjs');
-    if (!existsSync(entry)) return;
+    if (!existsSync(entry)) return false;
 
-    const child = spawn(process.execPath, [entry, 'board', 'ensure'], {
+    const child = spawnFn(process.execPath, [entry, 'board', 'ensure'], {
       detached: true,
       stdio: 'ignore',
+      env,
     });
     child.unref();
-    process.stdout.write('  great-cto: starting the board — http://localhost:3141\n');
+    write('  great-cto: starting the board — http://localhost:3141\n');
+    return true;
   } catch (e) {
     // Never fail the install — but never fail SILENTLY either. The first version
     // of this function referenced an import that was not there; the catch ate the
     // ReferenceError and the hook printed nothing, so the board simply did not
     // start and nothing said why. A swallowed error is the defect this project
     // spends most of its checks on.
-    process.stdout.write(`  great-cto: could not start the board — ${e?.message || e}\n`);
-    process.stdout.write('  Start it yourself with: great-cto board\n');
+    write(`  great-cto: could not start the board — ${e?.message || e}\n`);
+    write('  Start it yourself with: great-cto board\n');
+    return false;
   }
 }