p-dev-harness 0.3.1 → 0.4.0

package/workspace-snapshot/files/ARCHITECTURE.md

@@ -4,7 +4,7 @@ Modular design for an agentic product development harness. The architecture is *
 
 ## p-dev packaged operator shell
 
-**Status:** **Implemented** in v0.3.1 — public npm package `p-dev-harness@0.3.1`.
+**Status:** **Implemented** in v0.4.0 — public npm package `p-dev-harness@0.4.0`.
 
 **Purpose:** Launch the guided Configure GUI without cloning the source repository. Operators use a durable workspace (`~/.p-dev`, `P_DEV_HOME`, or `--workspace`) separate from the npm install directory.
 
@@ -43,20 +43,35 @@ Details: [`docs/provider-portability.md`](docs/provider-portability.md) and [`do
 
 **Inputs:** Structured setup state, committed example templates, operator-provided target repo mapping.
 
-**Outputs:** Dry-run previews, confirmation-gated local file writes via GUI (`preview-local-files` / `apply-local-files` API routes), confirmation-gated remote harness secret writes and target workflow branch/PR installs via GUI (`preview-harness-secrets` / `apply-harness-secrets` / `preview-target-workflow` / `apply-target-workflow` API routes), confirmation-gated Linear workspace setup and Vercel bridge configuration via the seven-step Configure GUI (Steps 2–3, 6–7), CLI scaffold apply, copy-paste setup instructions.
+**Outputs:** Dry-run previews, confirmation-gated local file writes via GUI (`preview-local-files` / `apply-local-files` API routes), confirmation-gated remote harness secret writes and target workflow branch/PR installs via GUI (`preview-harness-secrets` / `apply-harness-secrets` / `preview-target-workflow` / `apply-target-workflow` API routes), confirmation-gated Linear workspace setup and Vercel bridge configuration via the seven-step Configure GUI (Steps 2–3, 6–7), operator-initiated managed runner upgrades via Settings → Deployments (`runner-upgrade-status` / `preview-runner-upgrade` / `apply-runner-upgrade` with three-way snapshot safety and a GitHub Actions config canary), CLI scaffold apply, copy-paste setup instructions.
 
 **Seven-step Configure GUI (implemented):**
 
 1. Connect services (optional packaged harness workspace provisioning)
 2. Set up Linear workspace (confirmation-gated)
 3. Set up Vercel webhook bridge (confirmation-gated)
-4. Choose target repo(s)
+4. Choose target repo(s) — create a technology-neutral product repository or connect an existing GitHub repo; preview and confirm local setup files separately from repository creation
 5. Check local readiness
 6. Connect cloud secrets — harness repo GitHub Actions secret writes (confirmation-gated)
 7. Install target repo workflow — branch/PR create/reuse, checks, guarded auto-finalization for system-owned setup PRs (confirmation-gated)
 
 Ordinary product implementation PRs remain governed by Linear status gates; the GUI does not trigger harness phases or write Linear issue comments outside confirmation-gated setup actions.
 
+### Target repository provisioning vs foundation CI
+
+**Repository provisioning (Configure Step 4 Create)** installs only technology-neutral bootstrap files and the generic PDev target workflow (Step 7). It does **not** create stack-specific CI, required branch checks, or application deployment configuration.
+
+**Foundation initialization** happens later via an approved foundation PR that updates `.p-dev/product.json` on `dev` and may add stack-specific CI. Linear project metadata syncs from `uninitialized` to `initialized` after that merge.
+
+### Application preview vs PDev automation bridge
+
+| Concern | Authority |
+|---------|-----------|
+| Application preview/deployment capture | Harness `repos[].previewProvider` (`vercel` or `none`) |
+| PDev automation bridge (Linear webhook → harness dispatch) | Step 3 Vercel bridge setup |
+
+New PDev-created repositories default to `previewProvider: "none"`. The marker on `dev` holds product initialization state only — not deployment configuration.
+
 ## Pipeline overview
 
 ```mermaid
@@ -313,16 +328,18 @@ The first automation inspects status and labels, then:
 | Ready to Merge | Merge runner (M6) |
 | Other | Exit with no changes |
 
-### Agent roles (planned)
+### Agent roles (implemented / planned)
 
 | Role | Trigger | Primary durable output |
 |------|---------|------------------------|
 | Router Agent | Status change | Route or exit |
 | Planning Agent | Ready for Planning | Plan comment in Linear |
-| Implementation Agent | Ready for Build | Branch, PR, Linear comment |
-| Revision Agent | Needs Revision | Commits, revision comment |
+| Builder (implementation) | Ready for Build | Branch, PR, Linear comment; canonical `builder_agent_id` |
+| Builder (revision / repair) | Needs Revision; Merging agent repair | Follow-up prompts on the same Builder thread |
 | Merge/Deployment Reporter | Ready to Merge | Final links comment |
 
+**Builder continuity:** Implementation creates generation `1` of the canonical Builder. Revision and agent-based integration repair resolve lineage from hidden Linear metadata (handoff, implementation-start, and prior Builder markers), resume when possible, and replace only on definitive agent loss (`agent_not_found`, `agent_deleted`, `agent_inaccessible`, or exhausted legacy lineage). Planner remains a separate agent. There is no VM or session guarantee across phases.
+
 Full role contracts: [`docs/architecture/linear-automation-state-machine.md`](docs/architecture/linear-automation-state-machine.md).
 
 ---

package/workspace-snapshot/files/CHANGELOG.md

@@ -6,22 +6,67 @@ V0.3.0 is a **GitHub source release** plus a **public npm CLI package** (`p-dev-
 
 ## Unreleased
 
-## [0.3.1] — Unreleased (release preparation only)
+_(none reserved for post-0.4.0 work yet)_
 
-Planned patch release: immutable package-owned workspace snapshots for `p-dev-harness` provisioning plus narrowly scoped release-impact agent-contract improvements.
+## [0.4.0] — 2026-07-18
 
-**Release type (planned):** GitHub source release plus public npm package `p-dev-harness@0.3.1`.
+Minor release: authoritative Linear associations + cloud config fingerprint gate, faster Step 1 provisioning, operator `release:sync-managed-runner`, and managed-runner upgrade plumbing with the in-app Update card **disabled by default**.
+
+**Release type:** GitHub source release plus public npm package `p-dev-harness@0.4.0` (publish/tag gated on operator approval after release-prep PR).
+
+**Release contract:** [`docs/releases/v0.4.0.md`](docs/releases/v0.4.0.md)
+
+### Added
+
+- Authoritative Linear→repo associations for issue routing; Configure Step 2 reuses Settings associations
+- Paired `HARNESS_CONFIG_JSON_B64` + `HARNESS_CONFIG_FINGERPRINT` cloud config check (`cloud_config_stale` fail-closed), including `run-merge`
+- Configuration canary diagnostics (expected/computed fingerprint, decode + association success) and `canary_operation_id` run location after workflow_dispatch 204
+- Operator CLI `release:sync-managed-runner` for known managed harness runner sync + required canary
+- Update PDev runner upgrade flow (Settings Deployments card) behind `P_DEV_RUNNER_UPGRADE_UI_ENABLED` (off by default for 0.4)
+- Step 1 bulk authenticated git push / packaged Git object pack provisioning path
+
+### Fixed
+
+- Guided Configure hold-on-success UX (Steps 1–6) and Step 7 server-authoritative finalization / branch recovery
+- Runner status comments and conditional Blocked finalization during upgrade sync windows
+- Runner-upgrade status deadlocks and false Deployments progress; release sync monorepo snapshot load for source checkouts
+
+### Changed
+
+- Create-new Vercel bridge auto-deploy before probe; Configure header/select layout polish
+- In-app runner update experience deferred — flag-gated only for 0.4
+
+### Compatibility
+
+- Existing valid 0.3.0 / 0.3.1 managed workspaces reconnect; operator sync CLI available for the known release test harness
+- `weston-uribe/p-dev-harness-template` remains frozen legacy artifact for 0.3.0
+
+### Also included since 0.3.1 (already on `main` before this cut)
+
+- Configure GUI data-sharing onboarding gate and Settings **Data sharing** route; observability nonce for local preference writes
+- Builder thread continuity (canonical Cursor Builder lineage across revision/repair) with hidden Linear lineage metadata
+- Canonical product-development workflow descriptor, fail-closed Linear workflow preflight, Workflow page + `roleModels`
+- Guided Configure header/progress/motion polish and autonomous Vercel bridge verification
+
+## [0.3.1] — 2026-07-14
+
+Patch release: immutable package-owned workspace snapshots for `p-dev-harness` provisioning plus narrowly scoped release-impact agent-contract improvements.
+
+**Release type:** GitHub source release plus public npm package `p-dev-harness@0.3.1`.
+
+**RELEASE_SHA:** `995387c74334ba85206d9d87d7d78d4ecbfa8361` (merge commit for PR #60)
 
 ### Added
 
 - Deterministic embedded `workspace-snapshot/` generation from immutable Git commits during `package:p-dev:prepare`
 - Package-owned GitHub provisioning (`auto_init`, snapshot commit, marker commit v3) without runtime dependency on `weston-uribe/p-dev-harness-template`
 - Conditional release-impact analysis in canonical planner skill and runtime planning prompt
-- Release contract draft [`docs/releases/v0.3.1.md`](docs/releases/v0.3.1.md)
+- Release contract [`docs/releases/v0.3.1.md`](docs/releases/v0.3.1.md) (published)
 
 ### Changed
 
-- Release process docs: snapshot/manifest/tarball validation replaces future template synchronization for 0.3.1+
+- Default snapshot blob-upload concurrency **2** with strict `HARNESS_SNAPSHOT_UPLOAD_CONCURRENCY` validation and shared GitHub rate-limit gate
+- Release process docs: snapshot/manifest/tarball validation replaces template synchronization for 0.3.1+
 - Architecture docs: embedded snapshot is provisioning source for 0.3.1+; public template frozen for 0.3.0 legacy compatibility
 - Implementation skill/prompt preserve planner release boundaries and report outstanding release preparation
 

package/workspace-snapshot/files/README.md

@@ -1,13 +1,13 @@
 # Agentic Product Development Harness
 
-**Current release: v0.3.1** — immutable embedded workspace provisioning
+**Current release: v0.4.0** — immutable embedded workspace provisioning
 
 ## Use the product
 
 **Easiest start for product managers:**
 
 ```bash
-npx --yes p-dev-harness@0.3.1
+npx --yes p-dev-harness@0.4.0
 ```
 
 - Requires **Node.js 22+**
@@ -38,7 +38,7 @@ Cursor-first orchestration harness for turning structured Linear issues into Git
 
 | Layer | Status |
 |-------|--------|
-| Product install | `p-dev-harness@0.3.1` on npm (public) |
+| Product install | `p-dev-harness@0.4.0` on npm (public) |
 | Agent provider | Cursor Cloud Agents only |
 | Product system | Linear |
 | SCM / PR | GitHub |
@@ -54,7 +54,7 @@ It is **not** provider-agnostic and **not** a production SaaS.
 |-------|-----|
 | **p-dev install guide** | [`docs/p-dev.md`](docs/p-dev.md) |
 | Getting started (source) | [`docs/getting-started.md`](docs/getting-started.md) |
-| Release contract (v0.3.1) | [`docs/releases/v0.3.1.md`](docs/releases/v0.3.1.md) |
+| Release contract (v0.4.0) | [`docs/releases/v0.4.0.md`](docs/releases/v0.4.0.md) |
 | Release contract (v0.3.0) | [`docs/releases/v0.3.0.md`](docs/releases/v0.3.0.md) |
 | Release contract (v0.2.0) | [`docs/releases/v0.2.0.md`](docs/releases/v0.2.0.md) |
 | Security baseline | [`docs/security.md`](docs/security.md) |
@@ -105,6 +105,12 @@ See [`ROADMAP.md`](ROADMAP.md) for deferred work: `performance-cost-audit`, skil
 - Full isolated npm-installed issue lifecycle (setup validated; issue run not yet)
 - Generic auto-merge for arbitrary product PRs
 
+## Optional observability (packaged runtime)
+
+Packaged `p-dev-harness` supports **optional, consent-gated** anonymous analytics and sanitized error reports. No telemetry is sent until you enable each category in Configure. Preferences are stored locally at `.harness/observability.local.json`.
+
+See [`docs/observability-and-privacy.md`](docs/observability-and-privacy.md).
+
 ## License
 
 MIT — see [`LICENSE`](LICENSE).

package/workspace-snapshot/files/ROADMAP.md

@@ -10,6 +10,7 @@ For shipped history, see [CHANGELOG.md](CHANGELOG.md).
 - Validate a full issue lifecycle from an isolated npm-installed workspace
 - Improve cross-platform packaged launch policy beyond macOS browser auto-open
 - Continue validating the Linear → GitHub → Cursor workflow on real but private target repos
+- Operator-initiated **Update PDev runner** from Settings → Deployments (implemented on debug branch; not yet a published release milestone)
 
 ## Next
 
@@ -24,7 +25,15 @@ For shipped history, see [CHANGELOG.md](CHANGELOG.md).
 - Add additional agent providers after proving a second adapter end to end
 - Support more preview/deployment providers
 - Improve multi-repo and team workflows
-- Automatic upgrade/synchronization of already-created private harness workspaces
+- Automatic background upgrade/synchronization of already-created private harness workspaces (operator-initiated Update PDev runner is separate and already implemented in-tree)
+
+## Shipped in v0.4.0
+
+- Authoritative Linear→repo associations with paired cloud config fingerprint (`HARNESS_CONFIG_JSON_B64` + `HARNESS_CONFIG_FINGERPRINT`)
+- Faster Step 1 provisioning via bulk authenticated git push / packaged object pack
+- Operator release CLI `release:sync-managed-runner` for managed harness runner sync + configuration canary
+- In-app Update PDev runner path exists but is **disabled by default** for 0.4 (`P_DEV_RUNNER_UPGRADE_UI_ENABLED`)
+- FRE end-to-end release gate completed on the test workspace (FRE-1)
 
 ## Shipped in v0.3.1
 

package/workspace-snapshot/files/apps/gui/app/api/observability/event/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  captureAnalyticsEvent,
+  registerDisplayedConfigureStep,
+} from "@harness/observability/facade.js";
+import {
+  parseClientAnalyticsEventBody,
+  toAnalyticsEvent,
+} from "@harness/observability/analytics-schemas.js";
+import { guardObservabilityRequest } from "@/lib/observability-request-guard";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const guard = await guardObservabilityRequest(request);
+  if (!guard.ok) {
+    return guard.response;
+  }
+
+  try {
+    const event = parseClientAnalyticsEventBody(guard.body);
+    if (
+      event.type === "p_dev_configure_step_viewed" ||
+      event.type === "p_dev_configure_step_completed"
+    ) {
+      registerDisplayedConfigureStep(event.stepId);
+    }
+    captureAnalyticsEvent(toAnalyticsEvent(event));
+    return NextResponse.json({ ok: true });
+  } catch {
+    return NextResponse.json(
+      { error: "Invalid analytics event payload." },
+      { status: 400 },
+    );
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/observability/preferences/route.ts

@@ -0,0 +1,88 @@
+import { NextRequest, NextResponse } from "next/server";
+import { resolveHarnessWorkspaceDir } from "@harness/gui/repo-root";
+import {
+  readObservabilityPreferences,
+  resetObservabilityState,
+  writeObservabilityPreferences,
+} from "@harness/observability/facade.js";
+import type { ConsentPreference } from "@harness/observability/types.js";
+import { guardObservabilityRequest } from "@/lib/observability-request-guard";
+import { handleObservabilityRouteFailure } from "@/lib/observability-route";
+
+export const dynamic = "force-dynamic";
+
+function normalizePreference(value: unknown): ConsentPreference | undefined {
+  if (value === "enabled" || value === "disabled" || value === null) {
+    return value;
+  }
+  return undefined;
+}
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const guard = await guardObservabilityRequest(request);
+  if (!guard.ok) {
+    return guard.response;
+  }
+
+  const workspaceDir = resolveHarnessWorkspaceDir();
+  const state = await readObservabilityPreferences(workspaceDir);
+  return NextResponse.json({
+    analyticsPreference: state.analyticsPreference,
+    errorReportingPreference: state.errorReportingPreference,
+    disclosureShown: state.disclosureShown,
+    hasInstallationId: Boolean(state.installationId),
+  });
+}
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const guard = await guardObservabilityRequest(request);
+  if (!guard.ok) {
+    return guard.response;
+  }
+
+  const body = guard.body as Record<string, unknown>;
+  const workspaceDir = resolveHarnessWorkspaceDir();
+
+  if (body.reset === true) {
+    await resetObservabilityState(workspaceDir);
+    const state = await readObservabilityPreferences(workspaceDir);
+    return NextResponse.json({
+      analyticsPreference: state.analyticsPreference,
+      errorReportingPreference: state.errorReportingPreference,
+      disclosureShown: state.disclosureShown,
+      hasInstallationId: Boolean(state.installationId),
+    });
+  }
+
+  const analyticsPreference = normalizePreference(body.analyticsPreference);
+  const errorReportingPreference = normalizePreference(
+    body.errorReportingPreference,
+  );
+  const disclosureShown =
+    typeof body.disclosureShown === "boolean" ? body.disclosureShown : undefined;
+
+  try {
+    const state = await writeObservabilityPreferences(workspaceDir, {
+      analyticsPreference,
+      errorReportingPreference,
+      disclosureShown,
+    });
+
+    const persisted =
+      state?.localState ?? (await readObservabilityPreferences(workspaceDir));
+    return NextResponse.json({
+      analyticsPreference: persisted.analyticsPreference,
+      errorReportingPreference: persisted.errorReportingPreference,
+      disclosureShown: persisted.disclosureShown,
+      hasInstallationId: Boolean(persisted.installationId),
+    });
+  } catch (error) {
+    return await handleObservabilityRouteFailure(error, {
+      lifecyclePhase: "configure_route",
+      productErrorCode: "configure_request_error",
+      errorCategory: "unexpected",
+      publicMessage: "Could not save observability preferences.",
+      status: 500,
+    });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/operations/bootstrap/route.ts

@@ -0,0 +1,8 @@
+import { NextResponse } from "next/server";
+
+export async function GET(request: Request) {
+  const url = new URL(request.url);
+  const target = new URL("/api/workflow/bootstrap", url.origin);
+  target.search = url.search;
+  return NextResponse.redirect(target, 307);
+}

package/workspace-snapshot/files/apps/gui/app/api/operations/draft/route.ts

@@ -0,0 +1,15 @@
+import { NextResponse } from "next/server";
+
+export async function PUT() {
+  return NextResponse.json(
+    { saved: false, error: "Operations draft API is retired. Use /api/workflow/models." },
+    { status: 410 },
+  );
+}
+
+export async function DELETE() {
+  return NextResponse.json(
+    { error: "Operations draft API is retired." },
+    { status: 410 },
+  );
+}

package/workspace-snapshot/files/apps/gui/app/api/settings/apply-config-patch/route.ts

@@ -0,0 +1,52 @@
+import { NextResponse } from "next/server";
+import { resolveHarnessWorkspaceDir } from "@harness/gui/repo-root";
+import {
+  applySettingsConfigPatchRemote,
+  SettingsConfigPatchError,
+  type SettingsConfigPatch,
+} from "@harness/setup/settings-config-patch";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      patch: SettingsConfigPatch;
+      expectedConfigFingerprint: string;
+      confirmed?: boolean;
+      verifyBranches?: boolean;
+      requireDistinctBranches?: boolean;
+    };
+
+    if (!body.confirmed) {
+      return NextResponse.json(
+        { error: "Settings config writes require explicit confirmation." },
+        { status: 400 },
+      );
+    }
+
+    const result = await applySettingsConfigPatchRemote({
+      cwd: resolveHarnessWorkspaceDir(),
+      patch: body.patch,
+      expectedConfigFingerprint: body.expectedConfigFingerprint,
+      verifyBranches: body.verifyBranches,
+      requireDistinctBranches: body.requireDistinctBranches,
+    });
+
+    return NextResponse.json(result);
+  } catch (error) {
+    if (error instanceof SettingsConfigPatchError) {
+      return NextResponse.json(
+        { error: error.message, code: error.code },
+        { status: 422 },
+      );
+    }
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error ? error.message : "Settings config apply failed.",
+      },
+      { status: 400 },
+    );
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/settings/preview-config-patch/route.ts

@@ -0,0 +1,40 @@
+import { NextResponse } from "next/server";
+import { resolveHarnessWorkspaceDir } from "@harness/gui/repo-root";
+import {
+  previewSettingsConfigPatch,
+  SettingsConfigPatchError,
+  type SettingsConfigPatch,
+} from "@harness/setup/settings-config-patch";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      patch: SettingsConfigPatch;
+      verifyBranches?: boolean;
+      requireDistinctBranches?: boolean;
+    };
+    const preview = await previewSettingsConfigPatch({
+      cwd: resolveHarnessWorkspaceDir(),
+      patch: body.patch,
+      verifyBranches: body.verifyBranches,
+      requireDistinctBranches: body.requireDistinctBranches,
+    });
+    return NextResponse.json(preview);
+  } catch (error) {
+    if (error instanceof SettingsConfigPatchError) {
+      return NextResponse.json(
+        { error: error.message, code: error.code },
+        { status: 422 },
+      );
+    }
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error ? error.message : "Settings config preview failed.",
+      },
+      { status: 400 },
+    );
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-harness-repo-provisioning/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { applyHarnessRepoProvisioningRemote } from "@/lib/setup-server";
+import { handleObservabilityRouteFailure } from "@/lib/observability-route";
 
 export const dynamic = "force-dynamic";
 
@@ -26,10 +27,10 @@ export async function POST(request: Request) {
 
     return NextResponse.json(result);
   } catch (error) {
-    const message =
-      error instanceof Error
-        ? error.message
-        : "Harness repo provisioning apply failed";
-    return NextResponse.json({ error: message }, { status: 400 });
+    return await handleObservabilityRouteFailure(error, {
+      lifecyclePhase: "provisioning",
+      productErrorCode: "harness_repo_provisioning_route_failed",
+      errorCategory: "server",
+    });
   }
 }

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-linear-workspace/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { applyLinearWorkspaceRemote } from "@/lib/setup-server";
+import type { LinearWorkspacePlanInput } from "@harness/setup/linear-workspace-apply";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      plan: Omit<LinearWorkspacePlanInput, "linearApiKey"> & {
+        linearApiKey?: string;
+      };
+      confirmed: boolean;
+      fingerprint?: string;
+    };
+    const result = await applyLinearWorkspaceRemote(body);
+    return NextResponse.json(result);
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : "Linear workspace apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-runner-upgrade/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { applyRunnerUpgradeForGui } from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json()) as {
+      confirmed?: boolean;
+      previewFingerprint?: string;
+      resume?: boolean;
+    };
+
+    if (body.confirmed !== true) {
+      return NextResponse.json(
+        { error: "Confirmed apply is required." },
+        { status: 400 },
+      );
+    }
+
+    const result = await applyRunnerUpgradeForGui({
+      confirmed: true,
+      previewFingerprint: body.previewFingerprint,
+      resume: body.resume === true,
+    });
+
+    return NextResponse.json(result, { status: 202 });
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : "Runner upgrade apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-target-repo-provisioning/route.ts

@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+import { applyTargetRepoProvisioningRemote } from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  try {
+    const body = (await request.json().catch(() => ({}))) as {
+      owner?: string;
+      name?: string;
+      description?: string;
+      visibility?: "private" | "public";
+      operationId?: string;
+      creationActionId?: string;
+      createdAt?: string;
+      fingerprint?: string;
+      confirmed?: boolean;
+    };
+    const apply = await applyTargetRepoProvisioningRemote({
+      owner: body.owner ?? "",
+      name: body.name ?? "",
+      description: body.description,
+      visibility: body.visibility,
+      operationId: body.operationId ?? "",
+      creationActionId: body.creationActionId ?? "",
+      createdAt: body.createdAt ?? "",
+      fingerprint: body.fingerprint ?? "",
+      confirmed: body.confirmed === true,
+    });
+    return NextResponse.json(apply);
+  } catch (error) {
+    const message =
+      error instanceof Error
+        ? error.message
+        : "Target repository provisioning apply failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/workspace-snapshot/files/apps/gui/app/api/setup/apply-vercel-bridge/route.ts

@@ -16,7 +16,13 @@ export async function POST(request: Request) {
       manualComplete?: boolean;
       verifyOnly?: boolean;
     };
-    const result = await applyVercelBridgeRemote(body);
+    const result = await applyVercelBridgeRemote({
+      plan: body.plan,
+      confirmed: body.confirmed,
+      fingerprint: body.fingerprint,
+      manualComplete: body.manualComplete,
+      verifyOnly: body.verifyOnly,
+    });
     return NextResponse.json(result);
   } catch (error) {
     const message =

package/workspace-snapshot/files/apps/gui/app/api/setup/complete-initial-setup/route.ts

@@ -0,0 +1,49 @@
+import { NextResponse } from "next/server";
+import { resolveHarnessWorkspaceDir } from "@harness/gui/repo-root";
+import { completeInitialSetupFromServer } from "@harness/setup/initial-setup-lifecycle";
+import { loadRemoteSetupSummary, loadSetupSummary } from "@/lib/setup-server";
+
+export const dynamic = "force-dynamic";
+
+export async function POST() {
+  try {
+    const cwd = resolveHarnessWorkspaceDir();
+    const [setupSummary, remoteSummary] = await Promise.all([
+      loadSetupSummary(),
+      loadRemoteSetupSummary(),
+    ]);
+
+    const result = await completeInitialSetupFromServer({
+      cwd,
+      setupSummary,
+      remoteSummary,
+    });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        {
+          completed: false,
+          evidence: result.evidence,
+          error: "Initial setup completion evidence is not satisfied.",
+        },
+        { status: 422 },
+      );
+    }
+
+    return NextResponse.json({
+      completed: true,
+      completedAt: result.state.initialSetup?.completedAt,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        completed: false,
+        error:
+          error instanceof Error
+            ? error.message
+            : "Initial setup completion failed.",
+      },
+      { status: 500 },
+    );
+  }
+}