opencode-swarm 7.156.0 → 7.157.0

package/dist/cli/{skill-generator-9k1ztt7c.js → skill-generator-kh1z90tm.js}

@@ -33,30 +33,30 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-sfdg1xg5.js";
-import"./index-9n555qz4.js";
-import"./index-aqg7c1z9.js";
+} from "./index-n6ayyadp.js";
+import"./index-tvtvhjh0.js";
+import"./index-gpf3cjre.js";
 import"./index-rtry5xyf.js";
 import"./index-q7sjgr1y.js";
-import"./index-dfmr6pj5.js";
-import"./index-98j6z038.js";
-import"./index-164c64z8.js";
+import"./index-j3egsxa1.js";
+import"./index-3vqdt1sx.js";
+import"./index-q94gt4n9.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
 import"./index-dtn0pne5.js";
 import"./index-z6xqpmqg.js";
 import"./index-r3mvsbtq.js";
-import"./index-b91qwpms.js";
-import"./index-5w87j6j4.js";
-import"./index-myt57pht.js";
+import"./index-2e60kmzg.js";
+import"./index-4w20thrc.js";
+import"./index-9r7gp6cp.js";
 import"./index-zjygnfay.js";
 import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
 import"./index-ae75rja9.js";
-import"./index-85p1850w.js";
-import"./index-ew6fykvv.js";
+import"./index-b5xm177r.js";
+import"./index-xe6zbfps.js";
 import"./index-bk5tah7q.js";
-import"./index-6bqqzfbe.js";
+import"./index-6sbx96v6.js";
 import"./index-xagq35tf.js";
 import"./index-ed5ykebp.js";
 import"./index-h1g8w4v0.js";

package/dist/cli/{workspace-snapshot-8269e1p9.js → workspace-snapshot-yq0tc49d.js}

@@ -10,10 +10,12 @@ import {
   parsePorcelainPaths,
   parsePorcelainV2Snapshot,
   readGitTextAtRevision,
+  redactRemoteUrlIdentity,
   resolveCommitCountSince,
   resolveCommitCountSinceAsync,
   resolveCurrentGitHead,
   resolveCurrentGitHeadAsync,
+  resolveCurrentLocalHeadRefAsync,
   resolveCurrentUpstreamPushTarget,
   resolveCurrentUpstreamPushTargetAsync,
   resolveCurrentUpstreamRemoteRef,
@@ -36,9 +38,11 @@ import {
   resolvePrWorkflowRevisionDigestDetailedAsync,
   resolveRemoteRefsContainingHead,
   resolveRemoteRefsContainingHeadAsync,
+  resolveRemoteUrlIdentity,
+  resolveRemoteUrlIdentityAsync,
   switchPrFeedbackTrackingCandidateAsync,
   workspaceSnapshotMatches
-} from "./index-vnn7qq8c.js";
+} from "./index-3f7hqtgg.js";
 import"./index-r3mvsbtq.js";
 import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
@@ -47,6 +51,8 @@ import"./index-a76rekgs.js";
 export {
   workspaceSnapshotMatches,
   switchPrFeedbackTrackingCandidateAsync,
+  resolveRemoteUrlIdentityAsync,
+  resolveRemoteUrlIdentity,
   resolveRemoteRefsContainingHeadAsync,
   resolveRemoteRefsContainingHead,
   resolvePrWorkflowRevisionDigestDetailedAsync,
@@ -69,10 +75,12 @@ export {
   resolveCurrentUpstreamRemoteRef,
   resolveCurrentUpstreamPushTargetAsync,
   resolveCurrentUpstreamPushTarget,
+  resolveCurrentLocalHeadRefAsync,
   resolveCurrentGitHeadAsync,
   resolveCurrentGitHead,
   resolveCommitCountSinceAsync,
   resolveCommitCountSince,
+  redactRemoteUrlIdentity,
   readGitTextAtRevision,
   parsePorcelainV2Snapshot,
   parsePorcelainPaths,

package/dist/cli/{worktree-collision-ownership-ej10dhwe.js → worktree-collision-ownership-2qxjtxt6.js}

@@ -6,11 +6,11 @@ import {
   WORKTREE_PROVISIONING_OWNER_LEASE_MS,
   removeWorktreeProvisioningOwner,
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-0q8kywcf.js";
+} from "./index-dwkrdpz2.js";
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-fpg4tzf7.js";
+} from "./index-12e2hztp.js";
 import"./index-ddszzne4.js";
 import"./index-dtn0pne5.js";
 import"./index-z6xqpmqg.js";
@@ -23,7 +23,7 @@ import {
   resolveGitExecutable
 } from "./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
-import"./index-6bqqzfbe.js";
+import"./index-6sbx96v6.js";
 import"./index-xagq35tf.js";
 import"./index-ed5ykebp.js";
 import"./index-h1g8w4v0.js";

package/dist/cli/{worktree-isolation-r7qqy6ca.js → worktree-isolation-40v34p0s.js}

@@ -21,61 +21,61 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-ppx8bnzd.js";
-import"./index-4m3j9q9z.js";
-import"./index-wn0xm2e8.js";
-import"./index-68098cfj.js";
-import"./index-q2khkey7.js";
-import"./index-gthnsbzf.js";
+} from "./index-gk6wpq41.js";
+import"./index-t0kxka8n.js";
+import"./index-4kd1nqd2.js";
+import"./index-nd22bsnt.js";
+import"./index-93ymj3j5.js";
+import"./index-ngn6jmad.js";
 import"./index-134d35c1.js";
 import"./index-nj6rmyeh.js";
 import"./index-txdagbh7.js";
-import"./index-6g6qwr8z.js";
-import"./index-sm2t1awr.js";
+import"./index-g0j2hnse.js";
+import"./index-1dzy1j4v.js";
 import"./index-70ha9e09.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
-import"./index-fjcm6wwf.js";
+import"./index-91ybfvy2.js";
 import"./index-zsrtt42s.js";
-import"./index-zdgdf0e9.js";
-import"./index-0q8kywcf.js";
-import"./index-sfdg1xg5.js";
-import"./index-9n555qz4.js";
-import"./index-aqg7c1z9.js";
+import"./index-vbqssmbs.js";
+import"./index-dwkrdpz2.js";
+import"./index-n6ayyadp.js";
+import"./index-tvtvhjh0.js";
+import"./index-gpf3cjre.js";
 import"./index-rtry5xyf.js";
-import"./index-5r3zrw81.js";
-import"./index-za6bb2fd.js";
-import"./index-fpg4tzf7.js";
+import"./index-61nkp124.js";
+import"./index-p0by16z8.js";
+import"./index-12e2hztp.js";
 import"./index-ddszzne4.js";
-import"./index-vnn7qq8c.js";
-import"./index-fd7wj6fy.js";
-import"./index-mdypz60w.js";
-import"./index-xdy28ngt.js";
+import"./index-3f7hqtgg.js";
+import"./index-n7gv8m7v.js";
+import"./index-79k7p589.js";
+import"./index-nwkr6tvv.js";
 import"./index-556ja8an.js";
 import"./index-4fwbbad3.js";
 import"./index-b43rt5ph.js";
 import"./index-q7sjgr1y.js";
-import"./index-dfmr6pj5.js";
-import"./index-98j6z038.js";
+import"./index-j3egsxa1.js";
+import"./index-3vqdt1sx.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-164c64z8.js";
+} from "./index-q94gt4n9.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
 import"./index-dtn0pne5.js";
 import"./index-z6xqpmqg.js";
 import"./index-r3mvsbtq.js";
-import"./index-b91qwpms.js";
-import"./index-5w87j6j4.js";
-import"./index-myt57pht.js";
+import"./index-2e60kmzg.js";
+import"./index-4w20thrc.js";
+import"./index-9r7gp6cp.js";
 import"./index-zjygnfay.js";
 import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
 import"./index-ae75rja9.js";
-import"./index-85p1850w.js";
-import"./index-ew6fykvv.js";
+import"./index-b5xm177r.js";
+import"./index-xe6zbfps.js";
 import"./index-bk5tah7q.js";
-import"./index-6bqqzfbe.js";
+import"./index-6sbx96v6.js";
 import"./index-xagq35tf.js";
 import"./index-ed5ykebp.js";
 import"./index-h1g8w4v0.js";

package/dist/commands/registry.d.ts

@@ -752,7 +752,7 @@ export declare const COMMAND_REGISTRY: {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Clear a stuck PR_REVIEW/PR_FEEDBACK mechanical gate and stop the auto-resume loop [mode] [reason]";
         readonly args: "[PR_REVIEW|PR_FEEDBACK] [reason...]";
-        readonly details: "Human-only escape hatch for an unrecoverable PR_REVIEW or PR_FEEDBACK mechanical gate. When the architect cannot reach complete_pr_workflow — for example a compound `git fetch && git checkout` was rejected as read-only shell syntax, the PR head cannot be fetched, or the working tree is on the wrong branch — running this clears the durable gate state for the current session and stops the auto-resume loop without depending on the trapped model. The agent itself cannot run this command; it must call the abort_pr_workflow tool (or ask you to run this command). Both paths funnel into the same fail-closed abortPrWorkflow hook, which refuses while the workflow is armed for publication or while PR workflow lanes are still in flight. This human-only force path has exactly one exception to that second refusal (issue #2251): when the ONLY lanes still blocking are ones past the 30-minute staleness horizon that the liveness probe reports as still running — a lane nothing will ever settle on a schedule — it clears the gate anyway, names exactly which lanes it overrode, and finalizes their delegation records so the session can start a new PR workflow. Those sessions are NOT stopped and their output is NOT collected. A lane with a fresh updatedAt still blocks even under force, and any delegation record that still keeps the session blocked is named in the warning. When checkout preparation preserved a stash, the result instructs the caller to run prepare_pr_workflow_checkout operation=restore after the clear. An audit event is appended to .swarm/events.jsonl.";
+        readonly details: "Human-only escape hatch for an unrecoverable PR_REVIEW or PR_FEEDBACK mechanical gate. When the architect cannot reach complete_pr_workflow — for example a compound `git fetch && git checkout` was rejected as read-only shell syntax, the PR head cannot be fetched, or the working tree is on the wrong branch — running this clears the durable gate state for the current session and stops the auto-resume loop without depending on the trapped model. The agent itself cannot run this command; it must call the abort_pr_workflow tool (or ask you to run this command). Both paths funnel into the same fail-closed abortPrWorkflow hook, which refuses while the workflow is armed for publication or while PR workflow lanes are still in flight. Issue #2108 adds the two audited exits from an armed publication window: the invalidate_pr_feedback_publication tool (change approved content — every approval of the generation is superseded and the full ladder re-runs) and the abort_pr_workflow tool kind \"cancel-publication\" with cancel_publication: true and a reason (terminal no-publish cancellation; never grants push authority). A plain recovery or force abort never clears an armed window. This human-only force path has exactly one exception to the lane refusal (issue #2251): when the ONLY lanes still blocking are ones past the 30-minute staleness horizon that the liveness probe reports as still running — a lane nothing will ever settle on a schedule — it clears the gate anyway, names exactly which lanes it overrode, and finalizes their delegation records so the session can start a new PR workflow. Those sessions are NOT stopped and their output is NOT collected. A lane with a fresh updatedAt still blocks even under force, and any delegation record that still keeps the session blocked is named in the warning. When checkout preparation preserved a stash, the result instructs the caller to run prepare_pr_workflow_checkout operation=restore after the clear. An audit event is appended to .swarm/events.jsonl.";
         readonly category: "utility";
         readonly toolPolicy: "restricted";
     };

package/dist/hooks/pr-workflow-gate.d.ts

@@ -4,7 +4,7 @@ import { type CandidateSeverity, type FindingsSeverity, type RowFormatFamily } f
 import { type LaneOutputArtifact } from '../background/lane-output-store.js';
 import { type BackgroundDelegationRecord, type BackgroundDelegationResult, type BackgroundDelegationWorkflowLaneFailureClass, type BackgroundDelegationWorkflowLaneRecovery, findByBatchId, sweepStaleDelegations } from '../background/pending-delegations.js';
 import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-contract.js';
-import { type RevisionDigestResult, resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestDetailed, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync } from '../background/workspace-snapshot.js';
+import { type RevisionDigestResult, resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentLocalHeadRefAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestDetailed, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync, resolveRemoteUrlIdentity, resolveRemoteUrlIdentityAsync } from '../background/workspace-snapshot.js';
 import { type PrReviewResilienceConfig } from '../config/schema.js';
 import { classifyPrWorkflowGitState, type PrWorkflowGitState } from '../git/pr-workflow-state.js';
 import { classifyPrReviewCircuitSignal, type PrReviewCircuitLegacyRecord, type PrReviewCircuitRecordV2 } from './pr-review-resilience-circuit.js';
@@ -259,6 +259,94 @@ interface PrFeedbackReadyToPublishRecord {
     remoteRef: string;
     validatedAt: string;
 }
+/**
+ * Issue #2108: durable publication-generation state machine. The legacy
+ * {@link PrFeedbackReadyToPublishRecord} above becomes a derived mirror that
+ * is present exactly while the active generation is `{armed, push_in_flight}`
+ * (or a legacy record awaits migration), so a rolled-back binary keeps
+ * enforcing the armed window instead of turning permissive.
+ */
+export type PrFeedbackPublicationGenerationState = 'reviewing' | 'armed' | 'invalidated' | 'push_in_flight' | 'published' | 'cancelled_without_publication';
+export interface PrFeedbackPublicationEvidenceJoin {
+    stageAValidatedAt: string;
+    batches: Array<{
+        phase: PrFeedbackGatePhase;
+        batchId: string;
+        laneId: string;
+    }>;
+}
+export interface PrFeedbackPublicationGeneration {
+    schemaVersion: 1;
+    generation: number;
+    state: PrFeedbackPublicationGenerationState;
+    /** Canonical workspace identity at arming (`canonicalWorkspaceIdentity`). */
+    workspaceIdentity: string;
+    sessionID: string;
+    /** HTTPS PR URL bound at arming (PR identity disclosure), when present. */
+    prTargetUrl?: string;
+    /** Immutable intake head the approved commit descends from. */
+    intakeHeadSha: string;
+    /** Local branch ref resolved at arming. */
+    localHeadRef: string;
+    /** Exact approved local head commit. */
+    localHead: string;
+    remoteName: string;
+    /** Credential-redacted remote URL identity (`git remote get-url`). */
+    remoteUrlIdentity?: string;
+    remoteBranchRef: string;
+    remoteRef: string;
+    revisionDigest: string;
+    /** The exact receipt set that authorized this generation. */
+    evidence: PrFeedbackPublicationEvidenceJoin;
+    invalidationReason?: string;
+    supersededByGeneration?: number;
+    createdAt: string;
+    armedAt?: string;
+    invalidatedAt?: string;
+    publishedAt?: string;
+    cancelledAt?: string;
+}
+export type PrFeedbackPushAttemptOutcome = 'completed' | 'rejected' | 'uncertain' | 'cancelled';
+export interface PrFeedbackPushAttempt {
+    attemptId: string;
+    generation: number;
+    sessionID: string;
+    callID?: string;
+    /** SHA-256 over the canonical intent JSON. */
+    intentDigest: string;
+    intent: {
+        remote: string;
+        sourceSha: string;
+        destRef: string;
+    };
+    prePush: {
+        localHead: string;
+        worktreeClean: boolean;
+        remoteName: string;
+        remoteBranchRef: string;
+        observedRemoteHead: string | null;
+    };
+    startedAt: string;
+    result?: {
+        outcome: PrFeedbackPushAttemptOutcome;
+        exitStatus: number | 'not-observed';
+        /** Bounded (<=500 chars) and secret-redacted. */
+        diagnostic: string;
+        postPush: {
+            localHead: string | null;
+            observedRemoteHead: string | null;
+        };
+        completedAt: string;
+    };
+}
+export interface PrFeedbackPublicationState {
+    schemaVersion: 1;
+    active?: PrFeedbackPublicationGeneration;
+    /** Bounded superseded-generation summaries (last 4). */
+    history: PrFeedbackPublicationGeneration[];
+    /** Bounded attempt records for the active generation (last 8). */
+    attempts: PrFeedbackPushAttempt[];
+}
 export type PrWorkflowCompletionStatus = 'completed' | 'ready-to-publish' | 'verified-no-change';
 export type PrReviewValidationPhase = 'council' | 'reviewer' | 'critic';
 export type PrReviewArtifactBoundary = 'post_explorer' | 'post_reviewer' | 'post_critic';
@@ -427,6 +515,13 @@ export interface PrWorkflowGateState {
     prFeedbackStageA?: PrFeedbackStageARecord;
     prFeedbackGateBatches?: PrFeedbackGateBatchRecord[];
     prFeedbackReadyToPublish?: PrFeedbackReadyToPublishRecord;
+    /**
+     * Issue #2108: audited publication generations + push attempts. The
+     * authoritative publication state machine; `prFeedbackReadyToPublish`
+     * above is its derived rollback mirror. Optional so pre-#2108 state (and
+     * older binaries, via the root `.passthrough()`) loads unchanged.
+     */
+    prFeedbackPublication?: PrFeedbackPublicationState;
     /**
      * Issue #2131 criterion C2: count of controlled base-sync/rebind transitions.
      * Each rebind moves the immutable intake head to a new verified remote PR
@@ -707,8 +802,18 @@ export declare function settlePresumedStalePrWorkflowLanes(directory: string, se
  */
 export declare function abortPrWorkflow(directory: string, sessionID: string, options?: {
     expectedMode?: PrWorkflowMode;
-    kind: 'recovery' | 'force';
+    kind: 'recovery' | 'force' | 'cancel-publication';
     reason: string;
+    /**
+     * Issue #2108: the explicit cancellation-without-publication arm. While
+     * an armed/push_in_flight/invalidated publication generation exists,
+     * this arm (and ONLY this arm — mutually exclusive with `force`) may
+     * clear the workflow: it records the generation as
+     * `cancelled_without_publication` with the observed remote head and a
+     * REQUIRED reason, and never manufactures push authority. Plain
+     * `recovery`/`force` aborts remain refused while armed.
+     */
+    cancelPublication?: boolean;
 }): Promise<{
     mode: PrWorkflowMode;
     prHeadSha?: string;
@@ -860,6 +965,174 @@ export declare function recordPrFeedbackGateBatch(directory: string, sessionID:
 export declare function assertPrFeedbackGatePhaseSettled(directory: string, sessionID: string, phase: PrFeedbackGatePhase): Promise<PrWorkflowGateState>;
 /** Require every ordered feedback gate on one unchanged revision. */
 export declare function assertPrFeedbackReadyToPublish(directory: string, sessionID: string): Promise<PrWorkflowGateState>;
+/** Build the evidence join for a freshly armed generation. */
+declare function buildPublicationEvidenceJoin(state: PrWorkflowGateState, currentDigest: string): PrFeedbackPublicationEvidenceJoin | null;
+/**
+ * Snapshot of the publication container with bounded history trimming.
+ * History keeps the last {@link MAX_PUBLICATION_HISTORY_GENERATIONS}
+ * superseded generations; attempts belong to the active generation only.
+ */
+declare function nextPublicationContainer(previous: PrFeedbackPublicationState | undefined, active: PrFeedbackPublicationGeneration | undefined, historyAppends?: PrFeedbackPublicationGeneration[], attempts?: PrFeedbackPushAttempt[]): PrFeedbackPublicationState;
+/**
+ * The audited invalidation transition (issue #2108 §4/§5). Supersedes every
+ * content-dependent approval of the active generation — Stage A result,
+ * verification batches, ordered-gate batches, scope declarations — by
+ * removing them from ACTIVE state (the underlying lane artifacts remain in
+ * their own stores; the superseded join is pinned in the generation record),
+ * marks the generation `invalidated`, clears the rollback mirror, and appends
+ * the audit event. Never deletes the generation itself or its history.
+ *
+ * `driftReverification` (auto-detected drift) re-proves the drifted component
+ * under the session lock before writing, so a TOCTOU between the unlocked
+ * snapshot and this write cannot invalidate on stale evidence.
+ */
+declare function invalidatePublicationGeneration(directory: string, sessionID: string, reason: string, options?: {
+    drift?: {
+        component: string;
+        detail: string;
+    };
+    driftReverification?: boolean;
+    finalizeInFlightAs?: PrFeedbackPushAttemptOutcome;
+}): Promise<PrWorkflowPublicationTransitionResult>;
+interface PrWorkflowPublicationTransitionResult {
+    generation: PrFeedbackPublicationGeneration;
+    state: PrWorkflowGateState;
+}
+/**
+ * Migrate a legacy armed record (pre-#2108 state) into the generation state
+ * machine, conservatively: every identity component must recompute and match
+ * under the session lock, and the active receipts must be present and bound
+ * to the mirror's digest. Any mismatch or failure persists generation 1 as
+ * `invalidated` with a `legacy-migration-*` reason — never silently armed.
+ * No-op when no legacy record exists (returns the current state unchanged).
+ */
+declare function ensurePublicationGenerationCurrent(directory: string, sessionID: string): Promise<PrWorkflowGateState | null>;
+/**
+ * The reaper (issue #2108 §3): finalize any result-less push attempt before
+ * another armed-window interaction proceeds. Recovers restarts and missed
+ * `tool.execute.after` observations as `uncertain` and re-observes the remote
+ * head, so `push_in_flight` can never wedge a generation.
+ */
+declare function reconcileForeignInFlightAttempt(directory: string, sessionID: string, currentCallId?: string): Promise<PrWorkflowGateState | null>;
+/**
+ * Controller-facing invalidation/rework transition (issue #2108 §4): the
+ * explicit declaration that approved content must change, which opens the
+ * mutation path by superseding every content-dependent approval of the
+ * current armed generation. Requires a non-empty reason. Refuses when no
+ * live window exists and reports already-invalidated as an informative
+ * diagnostic (idempotent no-op is NOT silently accepted — the caller should
+ * see the current state).
+ */
+export declare function invalidatePrFeedbackPublication(directory: string, sessionID: string, reason: string): Promise<PrFeedbackPublicationGeneration>;
+/**
+ * Operator-facing publication summary for `pr_workflow_status` (issue #2108):
+ * generation, state, target, attempts, invalidation reason, and the
+ * state-appropriate recovery instruction. Returns null when the workflow has
+ * no publication state to describe.
+ */
+export declare function describePrWorkflowPublicationSection(state: PrWorkflowGateState): string | null;
+/**
+ * Issue #2108 safety boundary — "fail closed on corrupt, MISSING, ambiguous,
+ * copied, cross-workspace, or conflicting generation state" and "a manual
+ * state-file edit … cannot clear the authorization requirement": when the
+ * gate state file for a session is absent (e.g. deleted by hand while a
+ * generation was live) but the retained events window shows a LIVE
+ * publication generation for that session — an `armed` or
+ * `push_attempt_started` event with no later terminal (`published`,
+ * `cancelled`, `invalidated`) — publication-capable commands fail closed
+ * until an audited terminal lands. The events store is the append-only audit
+ * authority the state-file deletion cannot touch; when the trail is empty or
+ * compacted past the event the guard is silent (it never invents a dangling
+ * generation from absent evidence).
+ */
+export declare function findDanglingLivePublicationGeneration(directory: string, sessionID: string): {
+    generation: number;
+} | null;
+/** Typed rejection taxonomy for a standalone `git push` command. */
+export type ExactPushIntentRejection = 'shell-syntax' | 'token-shape' | 'flag-or-option' | 'credential-bearing-remote' | 'invalid-source-sha' | 'invalid-dest-ref' | 'delete-refspec' | 'wildcard-refspec' | 'remote-mismatch' | 'branch-mismatch' | 'source-mismatch' | 'unbound-target';
+export interface ExactPushIntent {
+    remote: string;
+    sourceSha: string;
+    destRef: string;
+}
+export interface ExactPushIntentParseResult {
+    ok: boolean;
+    intent?: ExactPushIntent;
+    /** SHA-256 over the canonical intent JSON (persisted in attempt records). */
+    digest?: string;
+    reason?: ExactPushIntentRejection;
+}
+/**
+ * Fold an audited invalidation into a PENDING single-write state transition
+ * (the Stage A re-record and inventory-amendment disarm sites, issue #2108
+ * R3.3): when the pending state still carries a live publication window, the
+ * generation is marked `invalidated` with the given reason, the rollback
+ * mirror and the remaining ancestry-bound receipts (verifications, gate
+ * batches, scope declarations) are superseded in the SAME atomic write, and
+ * any result-less attempt is finalized `uncertain`. A fresh `prFeedbackStageA`
+ * the pending write itself is recording survives — it is evidence recorded
+ * after the invalidation moment. No-op when no live window exists (the
+ * normal unarmed flow keeps its existing behavior).
+ *
+ * Returns the pending state plus the audit-event payload; the CALLER appends
+ * the event only AFTER its persistState succeeds (PR #2422 review PRR-023:
+ * an event must never claim an invalidation whose state write failed — the
+ * abort path's retraction discipline, applied here at the source).
+ */
+declare function supersedeLivePublicationInPendingState(pending: PrWorkflowGateState, reason: string): {
+    state: PrWorkflowGateState;
+    invalidationEvent: Record<string, unknown> | null;
+};
+/**
+ * Parse a standalone push command into a typed intent BEFORE any shell
+ * execution. The only publish-capable intent is the exact armed tuple —
+ * `git push <remote> <localHead>:refs/heads/<branch>` — with NO flags, NO
+ * extra refspecs, NO wildcard/delete/mirror/tag forms, and NO
+ * credential-bearing remote token. This is a structural refactor of the
+ * previous single-regex defense with the SAME accepted grammar (nothing that
+ * the regex rejected is accepted here); every rejection is now explicit,
+ * typed, and auditable. Remote and branch compare case-SENSITIVELY (git ref
+ * semantics); the source SHA compares exactly, as before.
+ */
+declare function parseExactBoundPushIntent(command: string, armed: {
+    remoteName: string;
+    remoteBranchRef: string;
+    localHead: string;
+}): ExactPushIntentParseResult;
+/**
+ * Durable attempt-start before the exact bound push is permitted to execute
+ * (issue #2108 §3), all under ONE session-lock acquisition: re-verify the
+ * armed identity, observe the remote head, and either (a) record an
+ * attempt whose result is already `completed` because the remote is observed
+ * at the approved head (no-op push; the observation — not an exit code — is
+ * the truth), or (b) persist the attempt-start and move the generation to
+ * `push_in_flight` BEFORE the push can run.
+ */
+declare function admitPrFeedbackPushAttempt(directory: string, sessionID: string, callID: string | undefined, intent: ExactPushIntent, intentDigest: string): Promise<{
+    kind: 'started' | 'already-published-remotely';
+}>;
+/**
+ * Record the result of an admitted push from the `tool.execute.after` chain
+ * (issue #2108 §3). Fail-open by design: a missed observation is recovered by
+ * the reaper as `uncertain`; publication truth always comes from
+ * complete_pr_workflow's direct remote verification, never from an exit code
+ * alone. Exported for the single `tool.execute.after` guard in `src/index.ts`.
+ */
+export declare function recordPrFeedbackPushAttemptResult(directory: string, input: {
+    sessionID: string;
+    callID?: string;
+    tool: string;
+}, command: string, output: unknown): Promise<void>;
+/**
+ * Cancellation without publication (issue #2108 §6): a terminal no-publish
+ * transition. Finalizes any in-flight attempt as `cancelled`, discloses the
+ * observed remote head, marks the generation `cancelled_without_publication`,
+ * appends the audit event, and NEVER manufactures push authority. Used only
+ * by `abortPrWorkflow`'s explicit `cancelPublication` arm. Returns the NEW
+ * state revision when a state write landed (the abort clear must CAS against
+ * it), or null when the generation state was absent/unreadable.
+ */
+declare function cancelPrFeedbackPublication(directory: string, sessionID: string, reason: string): Promise<number | null>;
 export declare function resolvePrReviewWriterRunId(directory: string, sessionID: string, requestedRunId?: string): Promise<string>;
 export declare function markPrReviewTriggerEvaluationComplete(directory: string, sessionID: string, runId: string, artifactPath: string): Promise<PrWorkflowGateState>;
 /** Freeze one exact inline trigger ledger across every micro dispatch. */
@@ -898,7 +1171,7 @@ export declare function validatePrFeedbackScopeBinding(directory: string, bindin
     workflowSessionId?: string;
     workflowRevisionDigest?: string;
 }): Promise<boolean>;
-export declare function enforcePrWorkflowToolBefore(directory: string, sessionID: string, toolName: string, args: Record<string, unknown> | undefined, generatedAgentNames?: readonly string[]): Promise<void>;
+export declare function enforcePrWorkflowToolBefore(directory: string, sessionID: string, toolName: string, args: Record<string, unknown> | undefined, generatedAgentNames?: readonly string[], callID?: string): Promise<void>;
 /** Validate the terminal PR workflow contract before removing its durable gate. */
 export declare function completePrWorkflow(directory: string, sessionID: string, expectedMode: PrWorkflowMode, prHeadSha: string): Promise<PrWorkflowCompletionStatus>;
 export declare const _test_exports: {
@@ -985,6 +1258,21 @@ export declare const _test_exports: {
     resolveCurrentUpstreamPushTarget: typeof resolveCurrentUpstreamPushTarget;
     resolveCurrentUpstreamPushTargetAsync: typeof resolveCurrentUpstreamPushTargetAsync;
     resolveCurrentUpstreamRemoteRef: typeof resolveCurrentUpstreamRemoteRef;
+    resolveCurrentLocalHeadRefAsync: typeof resolveCurrentLocalHeadRefAsync;
+    resolveRemoteUrlIdentity: typeof resolveRemoteUrlIdentity;
+    resolveRemoteUrlIdentityAsync: typeof resolveRemoteUrlIdentityAsync;
+    parseExactBoundPushIntent: typeof parseExactBoundPushIntent;
+    admitPrFeedbackPushAttempt: typeof admitPrFeedbackPushAttempt;
+    recordPrFeedbackPushAttemptResult: typeof recordPrFeedbackPushAttemptResult;
+    reconcileForeignInFlightAttempt: typeof reconcileForeignInFlightAttempt;
+    ensurePublicationGenerationCurrent: typeof ensurePublicationGenerationCurrent;
+    invalidatePublicationGeneration: typeof invalidatePublicationGeneration;
+    invalidatePrFeedbackPublication: typeof invalidatePrFeedbackPublication;
+    cancelPrFeedbackPublication: typeof cancelPrFeedbackPublication;
+    buildPublicationEvidenceJoin: typeof buildPublicationEvidenceJoin;
+    nextPublicationContainer: typeof nextPublicationContainer;
+    supersedeLivePublicationInPendingState: typeof supersedeLivePublicationInPendingState;
+    describePrWorkflowPublicationSection: typeof describePrWorkflowPublicationSection;
     resolveExactRemoteBranchHead: typeof resolveExactRemoteBranchHead;
     resolveExactRemoteBranchHeadAsync: typeof resolveExactRemoteBranchHeadAsync;
     resolveCommitCountSince: typeof resolveCommitCountSince;