p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/CHANGELOG.md

@@ -0,0 +1,166 @@
+# Changelog
+
+All notable changes to this harness repo are documented here.
+
+V0.3.0 is a **GitHub source release** plus a **public npm CLI package** (`p-dev-harness@0.3.0`). The root repository remains `private: true`; the published package is `packages/p-dev`.
+
+## Unreleased
+
+## [0.3.1] — Unreleased (release preparation only)
+
+Planned patch release: immutable package-owned workspace snapshots for `p-dev-harness` provisioning plus narrowly scoped release-impact agent-contract improvements.
+
+**Release type (planned):** GitHub source release plus public npm package `p-dev-harness@0.3.1`.
+
+### Added
+
+- Deterministic embedded `workspace-snapshot/` generation from immutable Git commits during `package:p-dev:prepare`
+- Package-owned GitHub provisioning (`auto_init`, snapshot commit, marker commit v3) without runtime dependency on `weston-uribe/p-dev-harness-template`
+- Conditional release-impact analysis in canonical planner skill and runtime planning prompt
+- Release contract draft [`docs/releases/v0.3.1.md`](docs/releases/v0.3.1.md)
+
+### Changed
+
+- Release process docs: snapshot/manifest/tarball validation replaces future template synchronization for 0.3.1+
+- Architecture docs: embedded snapshot is provisioning source for 0.3.1+; public template frozen for 0.3.0 legacy compatibility
+- Implementation skill/prompt preserve planner release boundaries and report outstanding release preparation
+
+### Compatibility
+
+- Existing valid `p-dev-harness@0.3.0` managed workspaces reconnect without content rewrite
+- `weston-uribe/p-dev-harness-template` remains frozen legacy artifact for 0.3.0; not used by 0.3.1+ provisioning
+
+## [0.3.0] — 2026-07-13
+
+V0.3.0 is the guided-onboarding and distribution release: seven-step Configure GUI, six canonical skills, and public `p-dev-harness` npm package.
+
+**Release type:** GitHub source release (annotated tag + curated release notes) plus public npm package `p-dev-harness@0.3.0`.
+
+### Highlights
+
+- Guided seven-step Configure GUI repaired and automated end to end
+- Public `p-dev-harness` package — launch without cloning the source repository
+- Six canonical harness skills under `.agents/skills/`
+- Public template provisioning for private `OWNER/p-dev-harness` workspaces
+- Automated Vercel bridge setup with redeploy polling and signed webhook verification
+- Guarded Step 7 workflow install PR finalization for system-owned setup PRs
+
+### Added
+
+- Canonical end-user guide [`docs/p-dev.md`](docs/p-dev.md)
+- Public npm package `p-dev-harness@0.3.0` with durable operator workspace (`~/.p-dev`, `P_DEV_HOME`, `--workspace`)
+- Packaged harness workspace provisioning/reconnection from `weston-uribe/p-dev-harness-template`
+- Seven-step guided Configure GUI with confirmation-gated local and remote writes
+- Remote setup: Linear workspace/status configuration, Vercel bridge, cloud secrets, target workflow install
+- Automatic Vercel production redeploy polling and signed webhook verification
+- Step 7 workflow install PR validation, guarded merge, and production verification
+- Six canonical skills: `issue-intake`, `code-health-audit`, `architecture-evolution-audit`, `security-audit`, `planner`, `implementation`
+- Skill architecture documentation at [`docs/skills/skill-architecture.md`](docs/skills/skill-architecture.md)
+- Release contract [`docs/releases/v0.3.0.md`](docs/releases/v0.3.0.md)
+- Package publication process in [`docs/releases/release-process.md`](docs/releases/release-process.md)
+
+### Changed
+
+- README leads product managers to `npx --yes p-dev-harness@0.3.0`; source clone remains contributor path
+- `docs/getting-started.md` — p-dev primary, source clone for maintainers
+- `docs/npm-packaging-spike.md` — historical spike document linking to `docs/p-dev.md`
+- `packages/p-dev/README.md` — public npm package README
+- Root `package.json` version `0.2.0` → `0.3.0` (source marker; `private: true` unchanged)
+- `RELEASE_PHASE` `v0.2-prep` → `v0.3-prep`
+- ROADMAP reflects post-v0.3 priorities; shipped v0.3 items moved to history
+
+### Fixed
+
+- Guided setup step order and navigation (seven stages before completion)
+- npm package published as `p-dev-harness` after registry rejected `p-dev` as too similar to `pdev`
+- Packaged workspace seeding without overwriting existing operator files
+- Durable repo ID / managed-marker recovery for provisioned harness workspaces
+- Server-authored evidence for cloud secret setup
+- Target workflow PR reuse, exact-content validation, and production verification
+
+### Security and safety
+
+- Confirmation-gated remote mutations with fingerprint validation
+- Error redaction and permission handling in setup flows
+- Published package excludes credentials, local state, and generated private workspace artifacts
+- MIT license included in npm package artifact
+
+### Documentation
+
+- Truth audit across README, AGENTS, ARCHITECTURE, ROADMAP, operator and GUI docs
+- Token permission documentation derived from implementation (classic `repo` + `workflow`; fine-grained Contents + Workflows write)
+- Explicit distinction: system-owned setup PR automation does not alter ordinary product PR policy
+
+### Validation
+
+- Codespaces source-based GUI validation
+- Controlled separate-account packaged onboarding through Setup complete
+- Package pack/inspect tests, tarball smoke, Configure route HTTP 200
+- Expanded setup, GUI, and provisioning test coverage
+
+### Known limitations
+
+- **Cursor-only** agent provider
+- **Linear / GitHub / GitHub Actions / Vercel** stack only
+- **macOS validated** for packaged browser auto-launch; use `--no-open` elsewhere
+- **No full real issue lifecycle** from an isolated npm-installed workspace
+- **No automatic upgrade/sync** of already-created private harness workspaces
+- **Public template compatibility** dependency on `weston-uribe/p-dev-harness-template`
+- **Not production-grade SaaS** or provider-agnostic
+- Manual eval rubrics remain where automation is not implemented
+- Deferred: `performance-cost-audit`, skill registry/package manager, manifests, provider adapters, runner-skill prompt integration
+
+[0.3.0]: https://github.com/weston-uribe/agentic-product-development-harness/releases/tag/v0.3.0
+[0.2.0]: https://github.com/weston-uribe/agentic-product-development-harness/releases/tag/v0.2.0
+
+## [0.2.0] — 2026-07-08
+
+V0.2.0 moves the harness from early validated spikes to a documented source release: lifecycle runners, Linear-triggered GitHub Actions automation, production sync, provider posture, security hardening, and operator docs now tell one consistent story.
+
+**Release type:** GitHub source release (annotated tag + GitHub release).
+
+### Added
+
+- SDK lifecycle runners: planning, implementation, handoff, revision, merge, and production sync
+- Event-driven auto-runner: Linear webhook → Vercel bridge → `repository_dispatch` → GitHub Actions → `harness run --phase auto`
+- Trigger statuses: Ready for Planning, Ready for Build, PR Open, Needs Revision, Ready to Merge
+- Explicit `agentProvider.id: "cursor"` config shape and internal provider seam (`src/agents/`)
+- Issue intake: ChatGPT copy-paste prompt, Cursor issue-intake skill, parser-aligned template, `harness validate-issue` CLI
+- Production sync automation (`harness:sync-production`) with optional `production_promoted` dispatch
+- Target-repo integration-branch posture: PRs target `dev`; manual `dev` → `main` promotion; sync updates Linear
+- GitHub Actions hardening: pinned actions, env-var shell safety, output redaction
+- CI / CodeQL / Dependabot
+- Public-repo security baseline and operator guides
+- Release contract (`docs/releases/v0.2.0.md`), release process, operator getting-started guide
+
+### Changed
+
+- Harness positioned as Cursor-first for Linear + GitHub + GitHub Actions (not provider-agnostic)
+- Solo repo automation policy: PR required + required checks + no direct push to `main`; **0 required GitHub approvals** while solo-maintainer
+- `package.json` version marker `0.1.0` → `0.2.0` (source release only; `private: true` unchanged)
+
+### Security
+
+- Branch protection ruleset active on `main` (PR required, required status checks, no force push)
+- GitHub Actions allowed-actions allowlist (pinned first-party actions)
+- Secrets confined to GitHub Actions secrets, Vercel env vars, or local untracked `.env` files
+- Harness output redaction before logs, summaries, and artifacts
+- `.github/CODEOWNERS` documents ownership of workflow files (not enforced as required review in solo mode)
+
+### Documentation
+
+- Truth audit across README, ROADMAP, ARCHITECTURE, AGENTS, security, and operator guides
+- Provider portability posture (`docs/provider-portability.md`)
+- Linear watcher setup, target-repo branch setup, production sync automation guides
+
+### Known limitations
+
+- Cursor Cloud Agents are the **only** implemented agent provider
+- Linear is the only implemented product/control system; GitHub is the only SCM/PR system
+- Vercel is the only implemented preview provider when preview capture is enabled
+- Not provider-agnostic; no Claude Code, Codex, local VS Code agents, GitLab, or Bitbucket support
+- Evals remain manual rubrics — automated eval contract is deferred
+- Not production-grade portable; not a plug-and-play product
+- OpenSSF Scorecard deferred
+- No generic auto-merge for arbitrary green public PRs
+- Linear/status gates required — automation does not ship without human-controlled status transitions

package/workspace-snapshot/files/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Weston Uribe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/workspace-snapshot/files/README.md

@@ -0,0 +1,110 @@
+# Agentic Product Development Harness
+
+**Current release: v0.3.1** — immutable embedded workspace provisioning
+
+## Use the product
+
+**Easiest start for product managers:**
+
+```bash
+npx --yes p-dev-harness@0.3.1
+```
+
+- Requires **Node.js 22+**
+- Starts a local guided **Configure GUI**
+- Provisions or reconnects a private operator harness workspace from the **embedded package snapshot** (0.3.1+)
+- **macOS validated** for packaged launch; use `--no-open` on other platforms
+- First-time provisioning can take several minutes; progress is shown in Configure
+- Early-stage — not production SaaS
+
+Full guide: [`docs/p-dev.md`](docs/p-dev.md)
+
+## Develop the harness
+
+Contributors and maintainers clone the source repository:
+
+```bash
+git clone https://github.com/weston-uribe/agentic-product-development-harness.git
+cd agentic-product-development-harness
+npm ci && npm run build
+npm run harness:configure
+```
+
+See [`docs/getting-started.md`](docs/getting-started.md).
+
+## TL;DR
+
+Cursor-first orchestration harness for turning structured Linear issues into GitHub PRs through a controlled AI-assisted workflow.
+
+| Layer | Status |
+|-------|--------|
+| Product install | `p-dev-harness@0.3.1` on npm (public) |
+| Agent provider | Cursor Cloud Agents only |
+| Product system | Linear |
+| SCM / PR | GitHub |
+| Cloud runner | GitHub Actions |
+| Preview / bridge | Vercel (when configured) |
+| Canonical skills | Six implemented under `.agents/skills/` |
+
+It is **not** provider-agnostic and **not** a production SaaS.
+
+## Quick links
+
+| Topic | Doc |
+|-------|-----|
+| **p-dev install guide** | [`docs/p-dev.md`](docs/p-dev.md) |
+| Getting started (source) | [`docs/getting-started.md`](docs/getting-started.md) |
+| Release contract (v0.3.1) | [`docs/releases/v0.3.1.md`](docs/releases/v0.3.1.md) |
+| Release contract (v0.3.0) | [`docs/releases/v0.3.0.md`](docs/releases/v0.3.0.md) |
+| Release contract (v0.2.0) | [`docs/releases/v0.2.0.md`](docs/releases/v0.2.0.md) |
+| Security baseline | [`docs/security.md`](docs/security.md) |
+| Provider portability | [`docs/provider-portability.md`](docs/provider-portability.md) |
+| Skill architecture | [`docs/skills/skill-architecture.md`](docs/skills/skill-architecture.md) |
+| Linear watcher setup | [`docs/linear-watcher-setup.md`](docs/linear-watcher-setup.md) |
+
+## Why it exists
+
+AI-assisted development makes it easy to generate code quickly. It does not, by itself, make product judgment, scope control, or review readiness visible. This harness structures the work so that:
+
+- Product intent is captured before implementation
+- AI execution happens in a bounded, reviewable context
+- Outputs are evaluated against explicit criteria before humans sign off
+
+## What this is
+
+```text
+Linear issue → planning/build/review phases → GitHub PR → Linear/status gate → merge or revision
+```
+
+SDK runners handle planning through merge and production sync. Linear status changes can trigger cloud runs automatically. `p-dev` provides guided onboarding without cloning this repository.
+
+## Current capability
+
+| Layer | Status |
+|-------|--------|
+| Product onboarding | `p-dev` guided Configure GUI (implemented) |
+| Issue intake | ChatGPT prompt + Cursor skill + validate-issue CLI |
+| Planning / implementation / handoff / revision / merge | SDK runners (implemented) |
+| Production sync | SDK runner + optional dispatch (implemented) |
+| Auto-run from Linear status | Webhook bridge + GitHub Actions (implemented) |
+| Canonical harness skills | `issue-intake`, `code-health-audit`, `architecture-evolution-audit`, `security-audit`, `planner`, `implementation` |
+
+## Configuration and portability posture
+
+V0.3 is **Cursor-first** and **not provider-agnostic**. See [`docs/provider-portability.md`](docs/provider-portability.md).
+
+## What is planned
+
+See [`ROADMAP.md`](ROADMAP.md) for deferred work: `performance-cost-audit`, skill registry/package manager, runner-skill integration, automated eval contract, and future portability.
+
+## What this repo does not claim
+
+- Autonomous shipping without Linear/status gates
+- Production-grade robustness or SaaS maturity
+- Provider agnosticism
+- Full isolated npm-installed issue lifecycle (setup validated; issue run not yet)
+- Generic auto-merge for arbitrary product PRs
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

package/workspace-snapshot/files/ROADMAP.md

@@ -0,0 +1,50 @@
+# Roadmap
+
+This roadmap is intentionally high-level. It describes likely future product directions, not committed delivery dates.
+
+For shipped history, see [CHANGELOG.md](CHANGELOG.md).
+
+## Now
+
+- Harden post-v0.3.0 operator experience from real `p-dev` installs
+- Validate a full issue lifecycle from an isolated npm-installed workspace
+- Improve cross-platform packaged launch policy beyond macOS browser auto-open
+- Continue validating the Linear → GitHub → Cursor workflow on real but private target repos
+
+## Next
+
+- Skill registry/package manager and manifests
+- Runner-skill prompt integration (`src/prompts/*.md` remain runner implementation details today)
+- `performance-cost-audit` skill
+- Automated eval/check runners where manual rubrics are currently used
+- Stronger CI/security defaults for target repos
+
+## Later
+
+- Add additional agent providers after proving a second adapter end to end
+- Support more preview/deployment providers
+- Improve multi-repo and team workflows
+- Automatic upgrade/synchronization of already-created private harness workspaces
+
+## Shipped in v0.3.1
+
+- Immutable embedded workspace snapshot provisioning in `p-dev-harness@0.3.1`
+- Package-owned GitHub git object provisioning without runtime template dependency
+- Shared upload rate-limit coordination with default concurrency 2
+
+## Shipped in v0.3.0
+
+- Seven-step guided Configure GUI with confirmation-gated local and remote setup
+- Codespaces-compatible source development path
+- Six canonical harness skills under `.agents/skills/`
+- Public `p-dev-harness@0.3.0` npm package with durable operator workspace
+- Public template provisioning via `weston-uribe/p-dev-harness-template`
+- Automated Vercel bridge configuration and signed webhook verification
+- Guarded Step 7 workflow install PR finalization for system-owned setup PRs
+
+## Not planned for v0.x
+
+- Autonomous shipping without human-controlled status gates
+- Generic auto-merge for arbitrary public PRs
+- Provider-agnostic claims before multiple providers work end to end
+- Production-grade SaaS/control-plane claims

package/workspace-snapshot/files/api/linear-webhook.ts

@@ -0,0 +1,41 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { handleLinearWebhook } from "../src/webhook/handle-linear-webhook.js";
+
+type VercelRequest = IncomingMessage & {
+  method?: string;
+  headers: Record<string, string | string[] | undefined>;
+};
+
+async function readRawBody(req: IncomingMessage): Promise<string> {
+  const chunks: Buffer[] = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+function getHeader(req: VercelRequest, name: string): string | null {
+  const value = req.headers[name.toLowerCase()] ?? req.headers[name];
+  if (Array.isArray(value)) {
+    return value[0] ?? null;
+  }
+  return value ?? null;
+}
+
+export default async function handler(
+  req: VercelRequest,
+  res: ServerResponse,
+): Promise<void> {
+  const method = req.method ?? "GET";
+  const rawBody = method === "POST" ? await readRawBody(req) : "";
+
+  const result = await handleLinearWebhook({
+    method,
+    rawBody,
+    headerGetter: (name) => getHeader(req, name),
+  });
+
+  res.statusCode = result.status;
+  res.setHeader("Content-Type", "application/json");
+  res.end(JSON.stringify(result.body));
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-connect-services/route.ts

@@ -0,0 +1,21 @@
+import { NextResponse } from "next/server";
+import { applyConnectServicesRemote } from "@/lib/setup-server";
+import type { LocalEnvFormInput } from "@harness/setup/local-apply-actions";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      env: LocalEnvFormInput;
+      confirmed: boolean;
+      fingerprint: string;
+    };
+    const result = await applyConnectServicesRemote(body);
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : "Connect services apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-harness-repo-provisioning/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from "next/server";
+import { applyHarnessRepoProvisioningRemote } from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      confirmed?: boolean;
+      fingerprint?: string;
+      operationId?: string;
+    };
+
+    if (!body.fingerprint?.trim() || !body.operationId?.trim()) {
+      return NextResponse.json(
+        { error: "Provisioning fingerprint and operation ID are required." },
+        { status: 400 },
+      );
+    }
+
+    const result = await applyHarnessRepoProvisioningRemote({
+      confirmed: body.confirmed === true,
+      fingerprint: body.fingerprint,
+      operationId: body.operationId,
+    });
+
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error
+        ? error.message
+        : "Harness repo provisioning apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-harness-secrets/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from "next/server";
+import {
+  applyHarnessSecretsRemote,
+  type RemoteSecretFormPayload,
+} from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as RemoteSecretFormPayload & {
+      confirmed?: boolean;
+      fingerprint?: string;
+    };
+
+    if (!body.confirmed) {
+      return NextResponse.json(
+        { error: "Remote setup writes require explicit confirmation" },
+        { status: 400 },
+      );
+    }
+
+    if (!body.fingerprint) {
+      return NextResponse.json(
+        { error: "Preview fingerprint is required" },
+        { status: 400 },
+      );
+    }
+
+    const { confirmed, fingerprint, ...payload } = body;
+    const result = await applyHarnessSecretsRemote({
+      payload,
+      confirmed: confirmed === true,
+      fingerprint,
+    });
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : "Harness secret apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-linear-setup/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { applyLinearSetupRemote } from "@/lib/setup-server";
+import type { LinearSetupPlanInput } from "@harness/setup/linear-setup-apply";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      plan: Omit<LinearSetupPlanInput, "linearApiKey"> & {
+        linearApiKey?: string;
+      };
+      confirmed: boolean;
+      fingerprint: string;
+    };
+    const result = await applyLinearSetupRemote(body);
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : "Linear setup apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-local-files/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from "next/server";
+import { applyLocalFiles } from "@/lib/setup-server";
+import type { LocalSetupFormPayload } from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+interface ApplyRequestBody extends LocalSetupFormPayload {
+  confirmed: boolean;
+  fingerprint: string;
+}
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as ApplyRequestBody;
+    const { confirmed, fingerprint, env, config } = body;
+
+    if (!confirmed) {
+      return NextResponse.json(
+        { error: "Local file writes require explicit confirmation" },
+        { status: 400 },
+      );
+    }
+
+    if (!fingerprint) {
+      return NextResponse.json(
+        { error: "Preview fingerprint is required" },
+        { status: 400 },
+      );
+    }
+
+    const result = await applyLocalFiles({
+      payload: { env, config },
+      confirmed,
+      fingerprint,
+    });
+
+    return NextResponse.json(result);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-target-workflow/route.ts

@@ -0,0 +1,49 @@
+import { NextResponse } from "next/server";
+import {
+  applyTargetWorkflowRemote,
+  type RemoteTargetWorkflowFormPayload,
+} from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as RemoteTargetWorkflowFormPayload & {
+      confirmed?: boolean;
+      fingerprint?: string;
+    };
+
+    if (!body.repoConfigId || !body.targetRepo || !body.productionBranch) {
+      return NextResponse.json(
+        { error: "repoConfigId, targetRepo, and productionBranch are required" },
+        { status: 400 },
+      );
+    }
+
+    if (!body.confirmed) {
+      return NextResponse.json(
+        { error: "Remote setup writes require explicit confirmation" },
+        { status: 400 },
+      );
+    }
+
+    if (!body.fingerprint) {
+      return NextResponse.json(
+        { error: "Preview fingerprint is required" },
+        { status: 400 },
+      );
+    }
+
+    const { confirmed, fingerprint, ...payload } = body;
+    const result = await applyTargetWorkflowRemote({
+      payload,
+      confirmed: confirmed === true,
+      fingerprint,
+    });
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : "Target workflow apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-vercel-bridge/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+import { applyVercelBridgeRemote } from "@/lib/setup-server";
+import type { VercelBridgePlanInput } from "@harness/setup/vercel-setup-apply";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      plan: Omit<VercelBridgePlanInput, "vercelToken" | "linearApiKey"> & {
+        vercelToken?: string;
+        linearApiKey?: string;
+      };
+      confirmed: boolean;
+      fingerprint: string;
+      manualComplete?: boolean;
+      verifyOnly?: boolean;
+    };
+    const result = await applyVercelBridgeRemote(body);
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : "Vercel bridge apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/finalize-target-workflow/route.ts

@@ -0,0 +1,32 @@
+import { NextResponse } from "next/server";
+import {
+  finalizeTargetWorkflowRemoteAction,
+  type RemoteTargetWorkflowFormPayload,
+} from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as RemoteTargetWorkflowFormPayload & {
+      prUrl?: string;
+      branchName?: string;
+    };
+
+    if (!body.repoConfigId || !body.targetRepo || !body.productionBranch) {
+      return NextResponse.json(
+        { error: "repoConfigId, targetRepo, and productionBranch are required" },
+        { status: 400 },
+      );
+    }
+
+    const result = await finalizeTargetWorkflowRemoteAction(body);
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error
+        ? error.message
+        : "Target workflow finalization failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}