p-dev-harness 0.3.0 → 0.3.1

package/dist/setup/harness-repo-provisioning.js

@@ -8,27 +8,44 @@ import { buildHarnessManagedRepoMarker, HARNESS_MANAGED_REPO_MARKER_FILE, marker
 import { buildPendingValidationContext, clearHarnessProvisioningPendingState, readHarnessProvisioningPendingState, validatePendingProvisioningState, withHarnessProvisioningMutex, writeHarnessProvisioningPendingStateAtomic, } from "./harness-provisioning-pending-state.js";
 import { parseRepoSlug } from "./github-remote-setup-live.js";
 import { assessPackagedProvisioningTokenCapabilities, } from "./github-workflow-permissions.js";
-import { HARNESS_DEFAULT_DESTINATION_DESCRIPTION, HARNESS_DEFAULT_DESTINATION_REPO_NAME, HARNESS_LEGACY_PUBLIC_SOURCE_REPO, HARNESS_TEMPLATE_IDENTITY_FILE, HARNESS_TEMPLATE_OWNER, HARNESS_TEMPLATE_REPO, parseHarnessTemplateIdentityJson, } from "./harness-template-identity.js";
+import { HARNESS_DEFAULT_DESTINATION_DESCRIPTION, HARNESS_DEFAULT_DESTINATION_REPO_NAME, HARNESS_LEGACY_PUBLIC_SOURCE_REPO, HARNESS_TEMPLATE_IDENTITY_FILE, parseHarnessTemplateIdentityJson, } from "./harness-template-identity.js";
+import { SnapshotProvisioningError, } from "./harness-snapshot-provisioning-helpers.js";
+import { provisionHarnessWorkspaceFromSnapshot, verifyProvisionedHarnessWorkspace, } from "./harness-snapshot-provisioning.js";
+import { loadEmbeddedWorkspaceSnapshot } from "./harness-workspace-snapshot-loader.js";
 import { persistGithubDispatchRepository } from "./local-apply-actions.js";
 import { resolveLocalFilePaths } from "./setup-state.js";
-const POST_CREATE_POLL_MAX_DELAY_MS = 8_000;
-function resolvePostCreatePollConfig() {
-    return {
-        timeoutMs: Number(process.env.HARNESS_PROVISIONING_POLL_TIMEOUT_MS ?? 60_000),
-        initialDelayMs: Number(process.env.HARNESS_PROVISIONING_POLL_INITIAL_DELAY_MS ?? 1_000),
-        maxDelayMs: Number(process.env.HARNESS_PROVISIONING_POLL_MAX_DELAY_MS ??
-            POST_CREATE_POLL_MAX_DELAY_MS),
-    };
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 function buildFingerprint(input) {
     return JSON.stringify(input);
 }
 function destinationSlug(login) {
     return `${login}/${HARNESS_DEFAULT_DESTINATION_REPO_NAME}`;
 }
+function emptySnapshotPreviewFields() {
+    return {
+        packageName: "p-dev-harness",
+        packageVersion: "",
+        sourceRepository: "",
+        sourceCommit: "",
+        snapshotContentId: null,
+        snapshotFingerprint: null,
+        templateContentId: null,
+    };
+}
+function snapshotPreviewFields(snapshot, templateContentIdOverride) {
+    if (!snapshot) {
+        return emptySnapshotPreviewFields();
+    }
+    const snapshotContentId = snapshot.manifest.snapshotContentId;
+    return {
+        packageName: snapshot.manifest.packageName,
+        packageVersion: snapshot.manifest.packageVersion,
+        sourceRepository: snapshot.manifest.sourceRepository,
+        sourceCommit: snapshot.manifest.sourceCommit,
+        snapshotContentId,
+        snapshotFingerprint: snapshot.fingerprint,
+        templateContentId: templateContentIdOverride ?? snapshotContentId,
+    };
+}
 function readSavedRepositoryId(existingEnv) {
     const raw = existingEnv?.values.GITHUB_DISPATCH_REPOSITORY_ID?.trim();
     if (!raw) {
@@ -40,14 +57,31 @@ function readSavedRepositoryId(existingEnv) {
     }
     return parsed;
 }
+function buildSnapshotPendingValidationContext(snapshot, input) {
+    return buildPendingValidationContext({
+        operationId: input.operationId,
+        authenticatedUserId: input.authenticatedUserId,
+        authenticatedLogin: input.authenticatedLogin,
+        targetOwner: input.targetOwner,
+        targetRepo: input.targetRepo,
+        packageName: snapshot.manifest.packageName,
+        packageVersion: snapshot.manifest.packageVersion,
+        sourceRepository: snapshot.manifest.sourceRepository,
+        sourceCommit: snapshot.manifest.sourceCommit,
+        manifestSchemaVersion: snapshot.manifest.schemaVersion,
+        snapshotContentId: snapshot.manifest.snapshotContentId,
+        snapshotSha256: snapshot.manifest.snapshotSha256,
+        snapshotGitTreeSha1: snapshot.manifest.gitRootTreeSha1,
+        previewFingerprint: input.previewFingerprint,
+    });
+}
 function buildProvisioningPreviewFingerprint(input) {
     const context = buildHarnessProvisioningPreviewContext({
         operationId: input.operationId,
         user: input.user,
         destination: input.destination,
-        templateDefaultBranch: input.templatePreview.defaultBranch,
-        templateHeadSha: input.templatePreview.headSha,
-        templateIdentity: input.templatePreview.identity.identity,
+        manifest: input.snapshotPreview.manifest,
+        snapshotFingerprint: input.snapshotPreview.fingerprint,
         classification: input.classification,
         envBaseline: input.envBaseline,
         pDevVersion: input.pDevVersion,
@@ -57,6 +91,12 @@ function buildProvisioningPreviewFingerprint(input) {
     return serializeHarnessProvisioningPreviewContext(context);
 }
 async function resolveProvisioningOperation(input) {
+    const validationContext = buildSnapshotPendingValidationContext(input.snapshotPreview, {
+        authenticatedUserId: input.user.id,
+        authenticatedLogin: input.user.login,
+        targetOwner: input.user.login,
+        targetRepo: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
+    });
     if (input.requestedOperationId) {
         const pending = await readHarnessProvisioningPendingState(input.cwd);
         if (pending && pending.operationId !== input.requestedOperationId) {
@@ -84,18 +124,7 @@ async function resolveProvisioningOperation(input) {
             pending: null,
         };
     }
-    const validation = validatePendingProvisioningState(pending, buildPendingValidationContext({
-        authenticatedUserId: input.user.id,
-        authenticatedLogin: input.user.login,
-        targetOwner: input.user.login,
-        targetRepo: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
-        templateIdentity: input.templatePreview.identity.identity.templateIdentity,
-        templateVersion: input.templatePreview.identity.identity.templateVersion,
-        compatibilityVersion: input.templatePreview.identity.identity.compatibilityVersion,
-        templateContentId: input.templatePreview.identity.identity.templateContentId,
-        templateDefaultBranch: input.templatePreview.defaultBranch,
-        templateHeadSha: input.templatePreview.headSha,
-    }));
+    const validation = validatePendingProvisioningState(pending, validationContext);
     if (!validation.ok) {
         return {
             ok: false,
@@ -111,46 +140,6 @@ async function resolveProvisioningOperation(input) {
         pending,
     };
 }
-function pendingMatchesDestinationTemplateIdentity(pending, templateIdentity) {
-    return (pending.templateIdentity === templateIdentity.templateIdentity &&
-        pending.templateVersion === templateIdentity.templateVersion &&
-        pending.compatibilityVersion === templateIdentity.compatibilityVersion &&
-        pending.templateContentId === templateIdentity.templateContentId);
-}
-async function loadTemplatePreview(provider) {
-    const template = await provider.getRepositoryMetadata(HARNESS_TEMPLATE_OWNER, HARNESS_TEMPLATE_REPO);
-    if (!template || !template.isTemplate) {
-        return {
-            ok: false,
-            state: "template-unavailable",
-            message: "The approved p-dev harness template is missing or not marked as a GitHub template.",
-        };
-    }
-    const headSha = await provider.getRepositoryDefaultBranchHead(HARNESS_TEMPLATE_OWNER, HARNESS_TEMPLATE_REPO, template.defaultBranch);
-    const identityRaw = await provider.readRepositoryFileContent(HARNESS_TEMPLATE_OWNER, HARNESS_TEMPLATE_REPO, HARNESS_TEMPLATE_IDENTITY_FILE, headSha);
-    if (!identityRaw) {
-        return {
-            ok: false,
-            state: "template-identity-missing",
-            message: "Template identity file is missing from the approved template.",
-        };
-    }
-    const parsed = parseHarnessTemplateIdentityJson(identityRaw);
-    if (!parsed.ok) {
-        return {
-            ok: false,
-            state: "template-identity-invalid",
-            message: parsed.reason,
-        };
-    }
-    return {
-        ok: true,
-        defaultBranch: template.defaultBranch,
-        headSha,
-        identityRaw,
-        identity: parsed,
-    };
-}
 async function validateExplicitPackagedRepo(provider, repoSlug, savedRepositoryId) {
     if (repoSlug === HARNESS_LEGACY_PUBLIC_SOURCE_REPO) {
         return {
@@ -243,7 +232,7 @@ async function validateExplicitPackagedRepo(provider, repoSlug, savedRepositoryI
         marker,
     };
 }
-async function classifyDestinationRepo(provider, user, cwd, templatePreview) {
+async function classifyDestinationRepo(provider, user, cwd, snapshotPreview) {
     const repoSlug = destinationSlug(user.login);
     const { owner, repo } = parseRepoSlug(repoSlug);
     const metadata = await provider.getRepositoryMetadata(owner, repo);
@@ -274,6 +263,21 @@ async function classifyDestinationRepo(provider, user, cwd, templatePreview) {
             repositoryId: metadata.repositoryId,
         };
     }
+    const pending = await readHarnessProvisioningPendingState(cwd);
+    if (pending && snapshotPreview) {
+        const validation = validatePendingProvisioningState(pending, buildSnapshotPendingValidationContext(snapshotPreview, {
+            authenticatedUserId: user.id,
+            authenticatedLogin: user.login,
+            targetOwner: user.login,
+            targetRepo: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
+        }));
+        if (validation.ok) {
+            return { kind: "snapshot-only-with-pending" };
+        }
+        if (!validation.ok) {
+            return { kind: "unmanaged-collision" };
+        }
+    }
     const templateRaw = await provider.readRepositoryFileContent(owner, repo, HARNESS_TEMPLATE_IDENTITY_FILE, metadata.defaultBranch);
     if (templateRaw) {
         const parsedTemplate = parseHarnessTemplateIdentityJson(templateRaw);
@@ -283,64 +287,37 @@ async function classifyDestinationRepo(provider, user, cwd, templatePreview) {
                 reason: `Generated repository template identity is invalid: ${parsedTemplate.reason}`,
             };
         }
-        const pending = await readHarnessProvisioningPendingState(cwd);
-        if (pending && templatePreview) {
-            const validation = validatePendingProvisioningState(pending, buildPendingValidationContext({
-                authenticatedUserId: user.id,
-                authenticatedLogin: user.login,
-                targetOwner: user.login,
-                targetRepo: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
-                templateIdentity: templatePreview.identity.identity.templateIdentity,
-                templateVersion: templatePreview.identity.identity.templateVersion,
-                compatibilityVersion: templatePreview.identity.identity.compatibilityVersion,
-                templateContentId: templatePreview.identity.identity.templateContentId,
-                templateDefaultBranch: templatePreview.defaultBranch,
-                templateHeadSha: templatePreview.headSha,
-            }));
-            if (validation.ok &&
-                pendingMatchesDestinationTemplateIdentity(pending, parsedTemplate.identity)) {
-                return { kind: "template-only-with-pending" };
-            }
-            if (!validation.ok) {
-                return { kind: "unmanaged-collision" };
-            }
-        }
-        return { kind: "template-only-without-pending" };
+        return { kind: "snapshot-only-without-pending" };
     }
     return { kind: "unmanaged-collision" };
 }
-async function pollGeneratedRepository(provider, repoSlug, expectedContentId) {
-    const { owner, repo } = parseRepoSlug(repoSlug);
-    const { timeoutMs, initialDelayMs, maxDelayMs } = resolvePostCreatePollConfig();
-    const started = Date.now();
-    let delay = initialDelayMs;
-    while (Date.now() - started < timeoutMs) {
-        const metadata = await provider.getRepositoryMetadata(owner, repo);
-        if (metadata?.private && metadata.permissions.admin) {
-            const identityRaw = await provider.readRepositoryFileContent(owner, repo, HARNESS_TEMPLATE_IDENTITY_FILE, metadata.defaultBranch);
-            if (identityRaw) {
-                const parsed = parseHarnessTemplateIdentityJson(identityRaw);
-                if (parsed.ok &&
-                    parsed.identity.templateContentId === expectedContentId) {
-                    return {
-                        ok: true,
-                        defaultBranch: metadata.defaultBranch,
-                        repositoryId: metadata.repositoryId,
-                        identity: parsed,
-                    };
-                }
-            }
-        }
-        await sleep(delay);
-        delay = Math.min(delay * 2, maxDelayMs);
-    }
+function buildSnapshotPendingState(input) {
+    const manifest = input.snapshotPreview.manifest;
     return {
-        ok: false,
-        timedOut: true,
-        message: "Timed out waiting for the generated harness workspace to become ready. Retry Step 1 Continue.",
+        operationId: input.operationId,
+        authenticatedUserId: input.user.id,
+        authenticatedLogin: input.user.login,
+        packageName: manifest.packageName,
+        packageVersion: manifest.packageVersion,
+        sourceRepository: manifest.sourceRepository,
+        sourceCommit: manifest.sourceCommit,
+        manifestSchemaVersion: manifest.schemaVersion,
+        snapshotContentId: manifest.snapshotContentId,
+        snapshotSha256: manifest.snapshotSha256,
+        snapshotGitTreeSha1: manifest.gitRootTreeSha1,
+        targetOwner: input.user.login,
+        targetRepo: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
+        previewFingerprint: input.previewFingerprint,
+        startedAt: input.pending?.startedAt ?? new Date().toISOString(),
+        phase: input.phase ?? input.pending?.phase,
+        repositoryId: input.repositoryId ?? input.pending?.repositoryId,
+        defaultBranch: input.defaultBranch ?? input.pending?.defaultBranch,
+        initializedCommitSha: input.initializedCommitSha ?? input.pending?.initializedCommitSha,
+        snapshotCommitSha: input.snapshotCommitSha ?? input.pending?.snapshotCommitSha,
+        markerCommitSha: input.markerCommitSha ?? input.pending?.markerCommitSha,
     };
 }
-async function finalizeManagedMarker(provider, input) {
+async function finalizeLegacyTemplateManagedMarker(provider, input) {
     const { owner, repo } = parseRepoSlug(input.repoSlug);
     const metadata = await provider.getRepositoryMetadata(owner, repo);
     if (!metadata) {
@@ -403,6 +380,33 @@ async function finalizeManagedMarker(provider, input) {
     }
     return { ok: true };
 }
+async function readLegacyTemplateIdentityAtHead(provider, repoSlug) {
+    const { owner, repo } = parseRepoSlug(repoSlug);
+    const metadata = await provider.getRepositoryMetadata(owner, repo);
+    if (!metadata) {
+        return {
+            ok: false,
+            message: `Harness workspace ${repoSlug} is not accessible.`,
+        };
+    }
+    const identityRaw = await provider.readRepositoryFileContent(owner, repo, HARNESS_TEMPLATE_IDENTITY_FILE, metadata.defaultBranch);
+    if (!identityRaw) {
+        return {
+            ok: false,
+            message: "Legacy generated repository template identity is missing.",
+        };
+    }
+    const parsed = parseHarnessTemplateIdentityJson(identityRaw);
+    if (!parsed.ok) {
+        return { ok: false, message: parsed.reason };
+    }
+    return {
+        ok: true,
+        defaultBranch: metadata.defaultBranch,
+        repositoryId: metadata.repositoryId,
+        identity: parsed,
+    };
+}
 export async function loadHarnessRepoProvisioningSummary(options) {
     const runtimeMode = isPackagedPDevRuntime()
         ? "packaged"
@@ -485,29 +489,28 @@ export async function loadHarnessRepoProvisioningSummary(options) {
     };
 }
 export async function previewHarnessRepoProvisioning(options) {
+    const basePreview = {
+        creationPreviewFingerprint: null,
+        resumedFromPending: false,
+        harnessDispatchRepo: null,
+        authenticatedLogin: null,
+        recoverable: false,
+        willCreateRepository: false,
+        tokenCapabilities: {
+            tokenType: "unknown",
+            hasRepoScope: false,
+            hasWorkflowScope: false,
+            scopeAmbiguous: true,
+        },
+    };
     if (!isPackagedPDevRuntime()) {
         return {
             state: "skipped-not-packaged",
             fingerprint: buildFingerprint({ action: "preview", skipped: true }),
             operationId: options.operationId ?? randomUUID(),
-            creationPreviewFingerprint: null,
-            resumedFromPending: false,
-            harnessDispatchRepo: null,
-            authenticatedLogin: null,
-            templateOwner: HARNESS_TEMPLATE_OWNER,
-            templateRepo: HARNESS_TEMPLATE_REPO,
-            templateDefaultBranch: "main",
-            templateHeadSha: "",
-            templateContentId: null,
             message: "Packaged runtime mode is not active.",
-            recoverable: false,
-            willCreateRepository: false,
-            tokenCapabilities: {
-                tokenType: "unknown",
-                hasRepoScope: false,
-                hasWorkflowScope: false,
-                scopeAmbiguous: true,
-            },
+            ...basePreview,
+            ...emptySnapshotPreviewFields(),
         };
     }
     const paths = resolveLocalFilePaths(options.cwd);
@@ -537,20 +540,14 @@ export async function previewHarnessRepoProvisioning(options) {
             state: "token-scope-ambiguous",
             fingerprint: buildFingerprint({ action: "preview", operationId }),
             operationId,
-            creationPreviewFingerprint: null,
-            resumedFromPending: false,
-            harnessDispatchRepo: explicitRepo ?? null,
-            authenticatedLogin: capabilities.login,
-            templateOwner: HARNESS_TEMPLATE_OWNER,
-            templateRepo: HARNESS_TEMPLATE_REPO,
-            templateDefaultBranch: "main",
-            templateHeadSha: "",
-            templateContentId: null,
             message: capabilityCheck.ok
                 ? "Token scope metadata is ambiguous."
                 : capabilityCheck.message,
+            ...basePreview,
             recoverable: true,
-            willCreateRepository: false,
+            harnessDispatchRepo: explicitRepo ?? null,
+            authenticatedLogin: capabilities.login,
+            ...emptySnapshotPreviewFields(),
             tokenCapabilities: {
                 tokenType: capabilities.tokenType,
                 hasRepoScope: capabilities.hasRepoScope,
@@ -570,18 +567,12 @@ export async function previewHarnessRepoProvisioning(options) {
             state,
             fingerprint: buildFingerprint({ action: "preview", operationId }),
             operationId,
-            creationPreviewFingerprint: null,
-            resumedFromPending: false,
-            harnessDispatchRepo: explicitRepo ?? null,
-            authenticatedLogin: capabilities.login,
-            templateOwner: HARNESS_TEMPLATE_OWNER,
-            templateRepo: HARNESS_TEMPLATE_REPO,
-            templateDefaultBranch: "main",
-            templateHeadSha: "",
-            templateContentId: null,
             message: capabilityCheck.message,
+            ...basePreview,
             recoverable: true,
-            willCreateRepository: false,
+            harnessDispatchRepo: explicitRepo ?? null,
+            authenticatedLogin: capabilities.login,
+            ...emptySnapshotPreviewFields(),
             tokenCapabilities: {
                 tokenType: capabilities.tokenType,
                 hasRepoScope: capabilities.hasRepoScope,
@@ -606,18 +597,12 @@ export async function previewHarnessRepoProvisioning(options) {
                 state: explicit.state,
                 fingerprint,
                 operationId,
-                creationPreviewFingerprint: null,
-                resumedFromPending: false,
-                harnessDispatchRepo: explicitRepo,
-                authenticatedLogin: user.login,
-                templateOwner: HARNESS_TEMPLATE_OWNER,
-                templateRepo: HARNESS_TEMPLATE_REPO,
-                templateDefaultBranch: "main",
-                templateHeadSha: "",
-                templateContentId: null,
                 message: explicit.message,
+                ...basePreview,
                 recoverable: true,
-                willCreateRepository: false,
+                harnessDispatchRepo: explicitRepo,
+                authenticatedLogin: user.login,
+                ...emptySnapshotPreviewFields(),
                 tokenCapabilities: {
                     tokenType: capabilities.tokenType,
                     hasRepoScope: capabilities.hasRepoScope,
@@ -626,22 +611,16 @@ export async function previewHarnessRepoProvisioning(options) {
                 },
             };
         }
+        const legacyTemplateContentId = explicit.marker.marker.createdFromTemplate?.templateContentId ?? null;
         return {
             state: "explicit-repo-present",
             fingerprint,
             operationId,
-            creationPreviewFingerprint: null,
-            resumedFromPending: false,
+            message: `Reconnecting to saved harness workspace ${explicitRepo}.`,
+            ...basePreview,
             harnessDispatchRepo: explicitRepo,
             authenticatedLogin: user.login,
-            templateOwner: HARNESS_TEMPLATE_OWNER,
-            templateRepo: HARNESS_TEMPLATE_REPO,
-            templateDefaultBranch: "main",
-            templateHeadSha: "",
-            templateContentId: explicit.marker.marker.createdFromTemplate.templateContentId,
-            message: `Reconnecting to saved harness workspace ${explicitRepo}.`,
-            recoverable: false,
-            willCreateRepository: false,
+            ...snapshotPreviewFields(null, legacyTemplateContentId),
             tokenCapabilities: {
                 tokenType: capabilities.tokenType,
                 hasRepoScope: capabilities.hasRepoScope,
@@ -650,25 +629,17 @@ export async function previewHarnessRepoProvisioning(options) {
             },
         };
     }
-    const templatePreview = await loadTemplatePreview(options.provider);
-    if (!templatePreview.ok) {
+    const snapshotPreview = await loadEmbeddedWorkspaceSnapshot(options.moduleUrl ?? import.meta.url);
+    if (!snapshotPreview.ok) {
         const operationId = options.operationId ?? randomUUID();
         return {
-            state: templatePreview.state,
+            state: snapshotPreview.state,
             fingerprint: buildFingerprint({ action: "preview", operationId }),
             operationId,
-            creationPreviewFingerprint: null,
-            resumedFromPending: false,
-            harnessDispatchRepo: null,
+            message: snapshotPreview.message,
+            ...basePreview,
             authenticatedLogin: user.login,
-            templateOwner: HARNESS_TEMPLATE_OWNER,
-            templateRepo: HARNESS_TEMPLATE_REPO,
-            templateDefaultBranch: "main",
-            templateHeadSha: "",
-            templateContentId: null,
-            message: templatePreview.message,
-            recoverable: false,
-            willCreateRepository: false,
+            ...emptySnapshotPreviewFields(),
             tokenCapabilities: {
                 tokenType: capabilities.tokenType,
                 hasRepoScope: capabilities.hasRepoScope,
@@ -681,7 +652,7 @@ export async function previewHarnessRepoProvisioning(options) {
         cwd: options.cwd,
         requestedOperationId: options.operationId,
         user,
-        templatePreview,
+        snapshotPreview,
     });
     if (!resolvedOperation.ok) {
         return {
@@ -691,18 +662,11 @@ export async function previewHarnessRepoProvisioning(options) {
                 conflict: resolvedOperation.message,
             }),
             operationId: options.operationId ?? randomUUID(),
-            creationPreviewFingerprint: null,
-            resumedFromPending: false,
-            harnessDispatchRepo: null,
-            authenticatedLogin: user.login,
-            templateOwner: HARNESS_TEMPLATE_OWNER,
-            templateRepo: HARNESS_TEMPLATE_REPO,
-            templateDefaultBranch: templatePreview.defaultBranch,
-            templateHeadSha: templatePreview.headSha,
-            templateContentId: templatePreview.identity.identity.templateContentId,
             message: resolvedOperation.message,
+            ...basePreview,
             recoverable: true,
-            willCreateRepository: false,
+            authenticatedLogin: user.login,
+            ...snapshotPreviewFields(snapshotPreview),
             tokenCapabilities: {
                 tokenType: capabilities.tokenType,
                 hasRepoScope: capabilities.hasRepoScope,
@@ -713,15 +677,15 @@ export async function previewHarnessRepoProvisioning(options) {
     }
     const { operationId, resumedFromPending, creationPreviewFingerprint, } = resolvedOperation;
     const destination = destinationSlug(user.login);
-    const classification = await classifyDestinationRepo(options.provider, user, options.cwd, templatePreview);
-    let state = "template-preview-ready";
+    const classification = await classifyDestinationRepo(options.provider, user, options.cwd, snapshotPreview);
+    let state = "snapshot-preview-ready";
     let message = `p-dev will create or reconnect ${destination} as your private harness workspace.`;
     let willCreateRepository = false;
     switch (classification.kind) {
         case "absent":
             state = "repo-absent";
             willCreateRepository = true;
-            message = `p-dev will create private harness workspace ${destination} from the approved template.`;
+            message = `p-dev will create private harness workspace ${destination} from the packaged workspace snapshot.`;
             break;
         case "valid-managed":
             state = "valid-existing-managed-repo";
@@ -739,20 +703,20 @@ export async function previewHarnessRepoProvisioning(options) {
             state = "same-name-malformed-marker";
             message = classification.reason;
             break;
-        case "template-only-without-pending":
-            state = "same-name-template-only-without-pending";
+        case "snapshot-only-without-pending":
+            state = "same-name-snapshot-only-without-pending";
             message = `${destination} looks like an unmanaged generated repo.`;
             break;
-        case "template-only-with-pending":
-            state = "same-name-template-only-with-pending";
-            message = `Resuming marker finalization for ${destination}.`;
+        case "snapshot-only-with-pending":
+            state = "same-name-snapshot-only-with-pending";
+            message = `Resuming snapshot provisioning for ${destination}.`;
             break;
     }
     const fingerprint = buildProvisioningPreviewFingerprint({
         operationId,
         user,
         destination,
-        templatePreview,
+        snapshotPreview,
         classification: classification.kind,
         envBaseline: existingEnv?.values.GITHUB_DISPATCH_REPOSITORY ?? "",
         pDevVersion,
@@ -767,16 +731,12 @@ export async function previewHarnessRepoProvisioning(options) {
         resumedFromPending,
         harnessDispatchRepo: classification.kind === "valid-managed" ? destination : null,
         authenticatedLogin: user.login,
-        templateOwner: HARNESS_TEMPLATE_OWNER,
-        templateRepo: HARNESS_TEMPLATE_REPO,
-        templateDefaultBranch: templatePreview.defaultBranch,
-        templateHeadSha: templatePreview.headSha,
-        templateContentId: templatePreview.identity.identity.templateContentId,
         message,
         recoverable: state === "repo-absent" ||
             state === "valid-existing-managed-repo" ||
-            state === "same-name-template-only-with-pending",
+            state === "same-name-snapshot-only-with-pending",
         willCreateRepository,
+        ...snapshotPreviewFields(snapshotPreview),
         tokenCapabilities: {
             tokenType: capabilities.tokenType,
             hasRepoScope: capabilities.hasRepoScope,
@@ -793,6 +753,7 @@ async function applyHarnessRepoProvisioningLocked(options) {
         cwd: options.cwd,
         provider: options.provider,
         operationId: options.operationId,
+        moduleUrl: options.moduleUrl,
     });
     if (!options.confirmed) {
         return {
@@ -805,7 +766,7 @@ async function applyHarnessRepoProvisioningLocked(options) {
     }
     if (preview.fingerprint !== options.fingerprint) {
         return {
-            state: "template-preview-stale",
+            state: "snapshot-preview-stale",
             harnessDispatchRepo: preview.harnessDispatchRepo,
             message: "Provisioning preview is stale. Retry Step 1 Continue.",
             recoverable: true,
@@ -816,14 +777,15 @@ async function applyHarnessRepoProvisioningLocked(options) {
         preview.state === "token-unsupported" ||
         preview.state === "token-insufficient" ||
         preview.state === "token-scope-ambiguous" ||
-        preview.state === "template-unavailable" ||
-        preview.state === "template-identity-missing" ||
-        preview.state === "template-identity-invalid" ||
-        preview.state === "template-incompatible" ||
+        preview.state === "snapshot-unavailable" ||
+        preview.state === "snapshot-manifest-missing" ||
+        preview.state === "snapshot-manifest-invalid" ||
+        preview.state === "snapshot-incompatible" ||
+        preview.state === "snapshot-tampered" ||
         preview.state === "same-name-public-collision" ||
         preview.state === "same-name-unmanaged-collision" ||
         preview.state === "same-name-malformed-marker" ||
-        preview.state === "same-name-template-only-without-pending" ||
+        preview.state === "same-name-snapshot-only-without-pending" ||
         preview.state === "explicit-packaged-repo-invalid" ||
         preview.state === "explicit-packaged-repo-legacy-source") {
         return {
@@ -839,7 +801,6 @@ async function applyHarnessRepoProvisioningLocked(options) {
     const paths = resolveLocalFilePaths(options.cwd);
     const existingEnv = await readExistingEnvFile(paths);
     const explicitRepo = existingEnv?.values.GITHUB_DISPATCH_REPOSITORY?.trim();
-    let targetRepo = explicitRepo ?? destinationSlug(user.login);
     if (explicitRepo) {
         const explicit = await validateExplicitPackagedRepo(options.provider, explicitRepo, readSavedRepositoryId(existingEnv));
         if (!explicit.ok) {
@@ -874,24 +835,23 @@ async function applyHarnessRepoProvisioningLocked(options) {
             persisted: true,
         };
     }
-    const templatePreview = await loadTemplatePreview(options.provider);
-    if (!templatePreview.ok) {
+    const snapshotPreview = await loadEmbeddedWorkspaceSnapshot(options.moduleUrl ?? import.meta.url);
+    if (!snapshotPreview.ok) {
         return {
-            state: templatePreview.state,
+            state: snapshotPreview.state,
             harnessDispatchRepo: null,
-            message: templatePreview.message,
+            message: snapshotPreview.message,
             recoverable: false,
             persisted: false,
         };
     }
-    const classification = await classifyDestinationRepo(options.provider, user, options.cwd, templatePreview);
+    const classification = await classifyDestinationRepo(options.provider, user, options.cwd, snapshotPreview);
     const currentContext = buildHarnessProvisioningPreviewContext({
         operationId: options.operationId,
         user,
         destination: destinationSlug(user.login),
-        templateDefaultBranch: templatePreview.defaultBranch,
-        templateHeadSha: templatePreview.headSha,
-        templateIdentity: templatePreview.identity.identity,
+        manifest: snapshotPreview.manifest,
+        snapshotFingerprint: snapshotPreview.fingerprint,
         classification: classification.kind,
         envBaseline: existingEnv?.values.GITHUB_DISPATCH_REPOSITORY ?? "",
         pDevVersion,
@@ -904,13 +864,14 @@ async function applyHarnessRepoProvisioningLocked(options) {
     });
     if (!contextValidation.ok) {
         return {
-            state: "template-preview-stale",
+            state: "snapshot-preview-stale",
             harnessDispatchRepo: null,
             message: contextValidation.message,
             recoverable: true,
             persisted: false,
         };
     }
+    let targetRepo = destinationSlug(user.login);
     let targetRepositoryId = classification.kind === "valid-managed"
         ? classification.repositoryId
         : undefined;
@@ -918,25 +879,19 @@ async function applyHarnessRepoProvisioningLocked(options) {
     if (preview.resumedFromPending) {
         if (!pending || !preview.creationPreviewFingerprint) {
             return {
-                state: "same-name-template-only-without-pending",
+                state: "same-name-snapshot-only-without-pending",
                 harnessDispatchRepo: destinationSlug(user.login),
                 message: "Matching local pending provisioning evidence is required to resume.",
                 recoverable: true,
                 persisted: false,
             };
         }
-        const pendingValidation = validatePendingProvisioningState(pending, buildPendingValidationContext({
+        const pendingValidation = validatePendingProvisioningState(pending, buildSnapshotPendingValidationContext(snapshotPreview, {
             operationId: options.operationId,
             authenticatedUserId: user.id,
             authenticatedLogin: user.login,
             targetOwner: user.login,
             targetRepo: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
-            templateIdentity: templatePreview.identity.identity.templateIdentity,
-            templateVersion: templatePreview.identity.identity.templateVersion,
-            compatibilityVersion: templatePreview.identity.identity.compatibilityVersion,
-            templateContentId: templatePreview.identity.identity.templateContentId,
-            templateDefaultBranch: templatePreview.defaultBranch,
-            templateHeadSha: templatePreview.headSha,
             previewFingerprint: preview.creationPreviewFingerprint,
         }));
         if (!pendingValidation.ok) {
@@ -960,77 +915,199 @@ async function applyHarnessRepoProvisioningLocked(options) {
             persisted: false,
         };
     }
+    const creationFingerprint = preview.creationPreviewFingerprint ?? options.fingerprint;
+    let activePending = pending;
+    let requiresSnapshotVerification = false;
     if (classification.kind === "valid-managed") {
         targetRepo = classification.repoSlug;
     }
-    else if (classification.kind === "absent" &&
-        !preview.resumedFromPending) {
-        const creationFingerprint = preview.creationPreviewFingerprint ?? options.fingerprint;
-        await writeHarnessProvisioningPendingStateAtomic({
-            operationId: options.operationId,
-            authenticatedUserId: user.id,
-            authenticatedLogin: user.login,
-            targetOwner: user.login,
-            targetRepo: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
-            templateOwner: HARNESS_TEMPLATE_OWNER,
-            templateRepo: HARNESS_TEMPLATE_REPO,
-            templateIdentity: templatePreview.identity.identity.templateIdentity,
-            templateVersion: templatePreview.identity.identity.templateVersion,
-            compatibilityVersion: templatePreview.identity.identity.compatibilityVersion,
-            templateContentId: templatePreview.identity.identity.templateContentId,
-            templateDefaultBranch: templatePreview.defaultBranch,
-            templateHeadSha: templatePreview.headSha,
-            previewFingerprint: creationFingerprint,
-            startedAt: new Date().toISOString(),
-        }, options.cwd);
-        try {
-            const created = await options.provider.createRepositoryFromTemplate({
-                templateOwner: HARNESS_TEMPLATE_OWNER,
-                templateRepo: HARNESS_TEMPLATE_REPO,
-                owner: user.login,
-                name: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
-                description: HARNESS_DEFAULT_DESTINATION_DESCRIPTION,
-                private: true,
-                includeAllBranches: false,
+    else if (classification.kind === "absent" ||
+        classification.kind === "snapshot-only-with-pending") {
+        const legacyTemplateIdentity = classification.kind === "snapshot-only-with-pending"
+            ? await readLegacyTemplateIdentityAtHead(options.provider, targetRepo)
+            : null;
+        if (classification.kind === "snapshot-only-with-pending" &&
+            legacyTemplateIdentity?.ok) {
+            const { owner, repo } = parseRepoSlug(targetRepo);
+            const legacyHeadSha = await options.provider.getRepositoryDefaultBranchHead(owner, repo, legacyTemplateIdentity.defaultBranch);
+            const markerResult = await finalizeLegacyTemplateManagedMarker(options.provider, {
+                repoSlug: targetRepo,
+                repositoryId: legacyTemplateIdentity.repositoryId,
+                defaultBranch: legacyTemplateIdentity.defaultBranch,
+                templateIdentity: legacyTemplateIdentity.identity,
+                templateHeadSha: legacyHeadSha,
+                operationId: options.operationId,
+                user,
+                pDevVersion,
             });
-            targetRepo = created.fullName;
-            targetRepositoryId = created.repositoryId;
+            if (!markerResult.ok) {
+                return {
+                    state: "marker-write-pending",
+                    harnessDispatchRepo: targetRepo,
+                    message: markerResult.message,
+                    recoverable: true,
+                    persisted: false,
+                };
+            }
+            targetRepositoryId = legacyTemplateIdentity.repositoryId;
         }
-        catch (error) {
-            const recovered = await classifyDestinationRepo(options.provider, user, options.cwd, templatePreview);
-            if (recovered.kind === "valid-managed" ||
-                recovered.kind === "template-only-with-pending") {
-                targetRepo = destinationSlug(user.login);
+        else {
+            if (classification.kind === "absent" && !preview.resumedFromPending) {
+                await writeHarnessProvisioningPendingStateAtomic(buildSnapshotPendingState({
+                    operationId: options.operationId,
+                    user,
+                    snapshotPreview,
+                    previewFingerprint: creationFingerprint,
+                }), options.cwd);
+                activePending = await readHarnessProvisioningPendingState(options.cwd);
             }
-            else if (error instanceof GitHubApiError && error.status === 422) {
-                const retryClassification = await classifyDestinationRepo(options.provider, user, options.cwd, templatePreview);
-                if (retryClassification.kind === "absent") {
+            let provisionResult;
+            try {
+                provisionResult = await provisionHarnessWorkspaceFromSnapshot({
+                    provider: options.provider,
+                    user,
+                    repoName: HARNESS_DEFAULT_DESTINATION_REPO_NAME,
+                    description: HARNESS_DEFAULT_DESTINATION_DESCRIPTION,
+                    snapshotRoot: snapshotPreview.snapshotRoot,
+                    manifest: snapshotPreview.manifest,
+                    packageVersion: snapshotPreview.packageVersion,
+                    operationId: options.operationId,
+                    pending: activePending,
+                    onCheckpoint: async (checkpoint) => {
+                        await writeHarnessProvisioningPendingStateAtomic(buildSnapshotPendingState({
+                            operationId: options.operationId,
+                            user,
+                            snapshotPreview,
+                            previewFingerprint: creationFingerprint,
+                            pending: activePending,
+                            phase: checkpoint.phase,
+                            repositoryId: checkpoint.repositoryId,
+                            defaultBranch: checkpoint.defaultBranch,
+                            initializedCommitSha: checkpoint.initializedCommitSha,
+                            snapshotCommitSha: checkpoint.snapshotCommitSha,
+                            markerCommitSha: checkpoint.markerCommitSha,
+                        }), options.cwd);
+                        activePending = await readHarnessProvisioningPendingState(options.cwd);
+                    },
+                });
+            }
+            catch (error) {
+                const message = error instanceof Error
+                    ? error.message
+                    : "Repository provisioning failed unexpectedly.";
+                if (error instanceof SnapshotProvisioningError &&
+                    error.code === "marker-commit-failed") {
+                    const { owner, repo } = parseRepoSlug(destinationSlug(user.login));
+                    const metadata = await options.provider.getRepositoryMetadata(owner, repo);
+                    if (metadata) {
+                        const headSha = await options.provider.getRepositoryDefaultBranchHead(owner, repo, metadata.defaultBranch);
+                        let initializedCommitSha = activePending?.initializedCommitSha;
+                        try {
+                            const headCommit = await options.provider.getGitCommit(owner, repo, headSha);
+                            initializedCommitSha =
+                                headCommit.parents[0]?.sha ?? initializedCommitSha;
+                        }
+                        catch {
+                            // keep best-effort pending evidence
+                        }
+                        await writeHarnessProvisioningPendingStateAtomic(buildSnapshotPendingState({
+                            operationId: options.operationId,
+                            user,
+                            snapshotPreview,
+                            previewFingerprint: creationFingerprint,
+                            pending: activePending,
+                            phase: "marker-pending",
+                            repositoryId: metadata.repositoryId,
+                            initializedCommitSha,
+                            snapshotCommitSha: headSha,
+                        }), options.cwd);
+                    }
+                    return {
+                        state: "marker-write-pending",
+                        harnessDispatchRepo: destinationSlug(user.login),
+                        message,
+                        recoverable: true,
+                        persisted: false,
+                    };
+                }
+                const recovered = await classifyDestinationRepo(options.provider, user, options.cwd, snapshotPreview);
+                if (recovered.kind === "valid-managed" ||
+                    recovered.kind === "snapshot-only-with-pending") {
+                    return {
+                        state: "repo-created-pending-verification",
+                        harnessDispatchRepo: destinationSlug(user.login),
+                        message,
+                        recoverable: true,
+                        persisted: false,
+                    };
+                }
+                else if (error instanceof GitHubApiError && error.status === 422) {
+                    const retryClassification = await classifyDestinationRepo(options.provider, user, options.cwd, snapshotPreview);
+                    if (retryClassification.kind === "absent") {
+                        return {
+                            state: "api-timeout-unknown",
+                            harnessDispatchRepo: destinationSlug(user.login),
+                            message: "Repository creation returned an ambiguous result. Retry Step 1 Continue.",
+                            recoverable: true,
+                            persisted: false,
+                        };
+                    }
+                    return {
+                        state: "repo-created-pending-verification",
+                        harnessDispatchRepo: destinationSlug(user.login),
+                        message,
+                        recoverable: true,
+                        persisted: false,
+                    };
+                }
+                else {
                     return {
                         state: "api-timeout-unknown",
                         harnessDispatchRepo: destinationSlug(user.login),
-                        message: "Repository creation returned an ambiguous result. Retry Step 1 Continue.",
+                        message,
                         recoverable: true,
                         persisted: false,
                     };
                 }
-                targetRepo = destinationSlug(user.login);
             }
-            else {
-                return {
-                    state: "api-timeout-unknown",
-                    harnessDispatchRepo: destinationSlug(user.login),
-                    message: error instanceof Error
-                        ? error.message
-                        : "Repository creation failed unexpectedly.",
-                    recoverable: true,
-                    persisted: false,
-                };
+            if (provisionResult) {
+                if (!provisionResult.ok) {
+                    const markerPending = provisionResult.code === "marker-commit-failed" ||
+                        provisionResult.code === "description-finalization-failed" ||
+                        activePending?.phase === "marker-pending" ||
+                        activePending?.phase === "description-pending" ||
+                        Boolean(activePending?.snapshotCommitSha);
+                    return {
+                        state: markerPending
+                            ? "marker-write-pending"
+                            : provisionResult.recoverable
+                                ? "repo-created-pending-verification"
+                                : "api-timeout-unknown",
+                        harnessDispatchRepo: destinationSlug(user.login),
+                        message: provisionResult.message,
+                        recoverable: provisionResult.recoverable,
+                        persisted: false,
+                    };
+                }
+                targetRepo = provisionResult.fullName;
+                targetRepositoryId = provisionResult.repositoryId;
+                requiresSnapshotVerification = true;
+                await writeHarnessProvisioningPendingStateAtomic(buildSnapshotPendingState({
+                    operationId: options.operationId,
+                    user,
+                    snapshotPreview,
+                    previewFingerprint: creationFingerprint,
+                    pending: activePending,
+                    phase: "persistence-pending",
+                    repositoryId: provisionResult.repositoryId,
+                    defaultBranch: provisionResult.defaultBranch,
+                    initializedCommitSha: provisionResult.initializedCommitSha,
+                    snapshotCommitSha: provisionResult.snapshotCommitSha,
+                    markerCommitSha: provisionResult.markerCommitSha,
+                }), options.cwd);
             }
         }
     }
-    else if (classification.kind === "template-only-with-pending") {
-        targetRepo = destinationSlug(user.login);
-    }
     else {
         return {
             state: preview.state,
@@ -1040,50 +1117,41 @@ async function applyHarnessRepoProvisioningLocked(options) {
             persisted: false,
         };
     }
-    const poll = await pollGeneratedRepository(options.provider, targetRepo, templatePreview.identity.identity.templateContentId);
-    if (!poll.ok) {
-        return {
-            state: poll.timedOut ? "api-timeout-unknown" : "repo-created-pending-verification",
-            harnessDispatchRepo: targetRepo,
-            message: poll.message,
-            recoverable: true,
-            persisted: false,
-        };
-    }
-    const resolvedRepositoryId = targetRepositoryId ?? poll.repositoryId;
-    if (targetRepositoryId !== undefined &&
-        targetRepositoryId !== poll.repositoryId) {
-        return {
-            state: "repo-created-pending-verification",
-            harnessDispatchRepo: targetRepo,
-            message: `Generated harness workspace repository ID mismatch for ${targetRepo}.`,
-            recoverable: true,
-            persisted: false,
-        };
+    if (targetRepositoryId === undefined) {
+        const { owner, repo } = parseRepoSlug(targetRepo);
+        const metadata = await options.provider.getRepositoryMetadata(owner, repo);
+        if (!metadata) {
+            return {
+                state: "repo-created-pending-verification",
+                harnessDispatchRepo: targetRepo,
+                message: `Harness workspace ${targetRepo} is not accessible for verification.`,
+                recoverable: true,
+                persisted: false,
+            };
+        }
+        targetRepositoryId = metadata.repositoryId;
     }
-    const markerResult = await finalizeManagedMarker(options.provider, {
-        repoSlug: targetRepo,
-        repositoryId: resolvedRepositoryId,
-        defaultBranch: poll.defaultBranch,
-        templateIdentity: poll.identity,
-        templateHeadSha: pending?.templateHeadSha ?? templatePreview.headSha,
-        operationId: options.operationId,
-        user,
-        pDevVersion,
-    });
-    if (!markerResult.ok) {
-        return {
-            state: "marker-write-pending",
-            harnessDispatchRepo: targetRepo,
-            message: markerResult.message,
-            recoverable: true,
-            persisted: false,
-        };
+    if (requiresSnapshotVerification) {
+        const verification = await verifyProvisionedHarnessWorkspace({
+            provider: options.provider,
+            repoSlug: targetRepo,
+            repositoryId: targetRepositoryId,
+            manifest: snapshotPreview.manifest,
+        });
+        if (!verification.ok) {
+            return {
+                state: "repo-created-pending-verification",
+                harnessDispatchRepo: targetRepo,
+                message: verification.message,
+                recoverable: true,
+                persisted: false,
+            };
+        }
     }
     const persist = await persistGithubDispatchRepository({
         cwd: options.cwd,
         githubDispatchRepository: targetRepo,
-        githubDispatchRepositoryId: resolvedRepositoryId,
+        githubDispatchRepositoryId: targetRepositoryId,
     });
     if (persist.outcome !== "changed" && persist.outcome !== "skipped") {
         return {