release-skill 0.2.5 → 0.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/references/.render-manifest.json

@@ -10,8 +10,8 @@
       "bytes": 8840
     },
     "02-project-config.md": {
-      "digest": "1e3c10fb4598aa6406b9d7cb4fdab2f663c3dad017dce88098b9e79868796806",
-      "bytes": 16514
+      "digest": "0cff13ebb270f3515290e0ce60b91303143777d1a4948db28cf2c69612ceff8e",
+      "bytes": 19029
     },
     "03-readme-quality.md": {
       "digest": "d74e41052592443ebbd450d0ace5f9b9b19c7a94db50f952b17c1c5a4c5dc230",
@@ -22,8 +22,8 @@
       "bytes": 4682
     },
     "05-evidence-and-errors.md": {
-      "digest": "00039b9bd3724f40ec084b366103f1b84a2b599c5e884f23904d337f4c193661",
-      "bytes": 8484
+      "digest": "ebcb4940ff2a25ce6945c3b11cfcafe751f4a1f515276b7e021717ea5844eebf",
+      "bytes": 9688
     },
     "06-adapter-contract.md": {
       "digest": "39f0271bc06eae38dade518ece8f7e16a18f53099a433e3ae07e9d20ff7a142e",

package/references/02-project-config.md

@@ -23,8 +23,9 @@ apiVersion: release-skill/v1
 kind: ReleaseProject
 
 project:
-  name: <string>            # 项目标识，必填
-  defaultBranch: <string>   # 默认分支，必填
+  name: <string>                 # 项目标识，必填
+  defaultBranch: <string>        # workspace 远端默认分支，必填；不限定为 main
+  sourceRepository: <owner/repo> # workspace 源仓库；生产发布必填
 
 releaseUnits:               # 发布单元数组，至少 1 个
   - id: <string>            # 唯一标识
@@ -125,6 +126,31 @@ human-owned 权威源，然后重新 prepare、审阅并 approve；后续环节
 
 旧的 `policy.requiredPublicFiles` 已不支持。加载器必须返回 `CONFIG_INVALID`，并引导迁移到各自的 `releaseUnits[].requiredPublicFiles`。
 
+### 3.1.1 Workspace 源码权威内容闭包
+
+`project.sourceRepository` 标识承载当前 workspace 人工源文件的 GitHub
+`owner/repo`，它与各发布单元的 `publicRepo` 不是同一概念；多个发布单元可以投影到不同
+公开仓库，但它们仍可共享一个 workspace 源仓库。`project.defaultBranch` 表示该源仓库的
+真实远端默认分支，可以是 `main`、`master`、`develop`、`trunk` 或其他明确名称。
+setup 只在 workspace Git remotes 唯一一致时提出候选；缺失或冲突时要求人工裁决，不保存
+`auto`。
+
+生产 prepare 在 hooks 完成后，从所有 `publicFiles.from`（目录递归展开）和每个 unit 的
+`version.source` 计算源码输入闭包，冻结 workspace 相对路径、内容 SHA-256 和 Git mode。
+只有闭包内 staged、unstaged 或 untracked 的文件会阻断 prepare；无关 dirty 文件不阻断。
+离线 prepare 明确记录 `unobserved-offline`，远端内容的强制比较留在 publish。
+
+production publish 在任何 adapter `execute` 前，从
+`sourceRepository/defaultBranch` 读取冻结路径集合，先确认配置分支仍是远端实际默认分支，
+再比较内容和 mode。判定只依赖内容闭包，不依赖 commit ancestry，因此普通 merge、
+squash、rebase 和默认分支上的无关后续提交可以通过；冲突解决或 revert 丢失 README、
+版本源或其他公开输入会按具体路径失败关闭。系统不会自动 merge、rebase、切分支、push
+或创建 PR。
+
+通过后，publish 写入与 plan digest 绑定的源码权威收据；PARTIAL 经 reconcile 恢复时继承
+并重新校验该收据。verify 只消费这份冻结收据，不在发布完成后用可变默认分支重新判定历史
+发布。
+
 ### 3.2 公开分支策略
 
 - `create-release-branch`：目标分支必须不存在；创建独立 release 分支，冻结提交没有父提交。

package/references/05-evidence-and-errors.md

@@ -26,6 +26,12 @@
 | `RELEASE_DOCS_CONFLICT` | 目标文档存在人工冲突 | 非受管同版本 CHANGELOG 条目、受管标记缺失/重复/损坏、版本标记非唯一 | 人工修复目标并保留人工修改后重新演练 |
 | `RELEASE_DOCS_REFRESH_STALE` | 写入确认绑定的候选已变化 | 演练后说明源或目标发生变化，仍用旧 `refreshDigest` 写入 | 重新演练取得新的 `refreshDigest` 并重新确认 |
 | `RELEASE_DOCS_STALE` | prepare 检测到发布文档未刷新 | 说明源已更新但 README/CHANGELOG 受管内容未同步 | `docs refresh` 演练 → 确认写入 → 审阅提交 → 重新 prepare |
+| `CONFIG_MISSING` | 生产源码权威配置缺失 | 缺少明确的 `project.sourceRepository` 或 `project.defaultBranch` | 补充经人工确认的 workspace 源仓库与默认分支后重新 prepare |
+| `REMOTE_UNAVAILABLE` | 无法可靠读取 workspace 源仓库 | 网络、认证或远端协议错误导致默认分支内容不可观察 | 修复网络或认证后基于同一冻结计划重试；不得猜测成功 |
+| `REF_MISSING` | 配置的远端默认分支不存在 | `refs/heads/<defaultBranch>` 不存在 | 核对真实分支名并重新 prepare |
+| `NOT_DEFAULT` | 配置分支不是远端实际默认分支 | 默认分支在 prepare 后改变，或配置错误 | 人工确认远端默认分支，更新配置并重新 prepare |
+| `CONTENT_MISMATCH` | 远端默认分支缺少冻结源码内容 | README、版本源、公开映射输入的内容或 mode 不一致 | 人工 merge/adopt/reject；接受的内容进入默认分支后重试 publish |
+| `DIRTY_SOURCE_INPUT` | 源码输入闭包存在未提交变化 | `publicFiles.from` 或 `version.source` 有 staged、unstaged、untracked 变化 | 提交或撤销这些具体输入的变化后重新 prepare；无关 dirty 不受影响 |
 
 ---
 

package/schemas/.render-manifest.json

@@ -22,16 +22,16 @@
       "bytes": 2390
     },
     "release-plan.schema.json": {
-      "digest": "d7869cdb335618754eb787fe352c4c1775c799900f3bb926197c51359699a648",
-      "bytes": 24088
+      "digest": "01c96659223918b5ce0e2d0d01d1ce5095baeb056de401babb8928add4d2a221",
+      "bytes": 35256
     },
     "release-project.schema.json": {
-      "digest": "53efe202fc5e2bf63c8d846cf4d50648991163b270536c1450c4be44e45d4b93",
-      "bytes": 25761
+      "digest": "a3d46be1e1e8105103a505c6d58d14f3733c8da91ab8289e097ffd259bf1cd93",
+      "bytes": 30982
     },
     "release-run.schema.json": {
-      "digest": "f453845fd2aab02c7b0812b1f62fd1ab7fa37104b8e752914906551c0e8c2637",
-      "bytes": 8959
+      "digest": "bf3c8fb4ca2fc078272a45a6ee6bf663fd2420a722b2f995dbaabf2635e2179e",
+      "bytes": 14824
     }
   }
 }

package/schemas/release-plan.schema.json

@@ -992,6 +992,73 @@
       "type": "string",
       "minLength": 1
     },
+    "sourceAuthority": {
+      "type": "object",
+      "description": "Source authority content closure gate binding: proves frozen source inputs exist in the workspace remote default branch",
+      "required": [
+        "sourceRepository",
+        "defaultBranch",
+        "entries",
+        "inputDigest",
+        "algorithmVersion"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "sourceRepository": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$",
+          "description": "GitHub owner/repo of the workspace source repository"
+        },
+        "defaultBranch": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Workspace remote default branch name"
+        },
+        "entries": {
+          "type": "array",
+          "minItems": 1,
+          "description": "Frozen workspace-relative source inputs compared with the remote default branch",
+          "items": {
+            "type": "object",
+            "required": [
+              "path",
+              "digest",
+              "mode"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "path": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
+              },
+              "digest": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "mode": {
+                "type": "string",
+                "enum": [
+                  "100644",
+                  "100755"
+                ]
+              }
+            }
+          }
+        },
+        "inputDigest": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$",
+          "description": "SHA-256 digest of the deterministic source-input closure"
+        },
+        "algorithmVersion": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Source-input closure algorithm version"
+        }
+      }
+    },
     "waivers": {
       "type": "array",
       "items": {

package/schemas/release-project.schema.json

@@ -35,6 +35,12 @@
         "defaultBranch": {
           "type": "string",
           "minLength": 1
+        },
+        "sourceRepository": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$",
+          "description": "GitHub owner/repo of the workspace source repository for source authority content gate"
         }
       }
     },

package/schemas/release-run.schema.json

@@ -227,6 +227,71 @@
         }
       }
     },
+    "sourceAuthorityReceipts": {
+      "type": "array",
+      "description": "Source authority content closure receipts: one per publish run proving remote content matches frozen inputs",
+      "items": {
+        "type": "object",
+        "required": [
+          "sourceRepository",
+          "defaultBranch",
+          "inputDigest",
+          "algorithmVersion",
+          "entryCount",
+          "planDigest",
+          "verifiedAt",
+          "result"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "sourceRepository": {
+            "type": "string",
+            "minLength": 1
+          },
+          "defaultBranch": {
+            "type": "string",
+            "minLength": 1
+          },
+          "inputDigest": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "algorithmVersion": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "entryCount": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "planDigest": {
+            "type": "string",
+            "minLength": 1
+          },
+          "verifiedAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "result": {
+            "type": "string",
+            "enum": [
+              "CONSISTENT",
+              "MISMATCH"
+            ]
+          },
+          "observedCommit": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{40,64}$"
+          },
+          "mismatchedPaths": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
     "consumerVerificationReceipts": {
       "type": "array",
       "description": "消费端验证收据，每个 marketplace action 一条记录",

package/src/commands/prepare.mjs

@@ -49,7 +49,13 @@ import {
   normalizeGitTimestamp,
   sealFrozenSnapshot,
 } from '../snapshot/frozen.mjs';
-import { ReleaseError, GATE_FAILED, CONFIG_INVALID, FORBIDDEN_CONTENT_DETECTED, RELEASE_DOCS_STALE } from '../core/errors.mjs';
+import { ReleaseError, GATE_FAILED, CONFIG_INVALID, CONFIG_MISSING, FORBIDDEN_CONTENT_DETECTED, RELEASE_DOCS_STALE, DIRTY_SOURCE_INPUT } from '../core/errors.mjs';
+import {
+  SOURCE_INPUT_ALGORITHM_VERSION,
+  computeSourceInputClosure,
+  checkSourceInputDirty,
+  verifySnapshotSourcesMatchClosure,
+} from '../core/source-authority.mjs';
 import { acquireProjectLock } from '../artifacts/project-lock.mjs';
 import { assertPreviousPublicBaselineTarget, observePreviousPublicBaseline } from '../core/previous-public-baseline.mjs';
 import { verifyFrozenNpmTarballIdentity } from '../adapters/npm.mjs';
@@ -1919,6 +1925,87 @@ export async function prepareRelease(options) {
       });
     }
 
+    // --- Step 3c: Source authority content closure gate ---
+    // After hooks complete, compute the deterministic source-input closure
+    // and verify that closure inputs are clean (no staged/unstaged/untracked
+    // changes). Production configs must declare sourceRepository.
+    const sourceRepository = config.project?.sourceRepository ?? null;
+    const configDefaultBranch = config.project?.defaultBranch ?? null;
+
+    let sourceAuthority = null;
+    let sourceInputClosure = null;
+    if (production) {
+      if (!sourceRepository || typeof sourceRepository !== 'string') {
+        throw new ReleaseError(
+          CONFIG_MISSING,
+          'production prepare requires project.sourceRepository in configuration; source authority content gate needs a workspace source repository',
+          { configPath },
+        );
+      }
+
+      await evidence.append({ phase: 'source-authority', status: 'started' });
+
+      // Compute source-input closure from resolved unit configs
+      const unitConfigsForClosure = configUnits.map((unit, idx) => ({
+        ...unit,
+        version: { ...unit.version },
+      }));
+      sourceInputClosure = await computeSourceInputClosure({
+        units: unitConfigsForClosure,
+        root: realRoot,
+      });
+
+      await evidence.append({
+        phase: 'source-authority',
+        step: 'closure-computed',
+        entryCount: sourceInputClosure.entries.length,
+        inputDigest: sourceInputClosure.digest,
+      });
+
+      // Check only closure inputs for dirty (not whole workspace)
+      const dirtyResult = await checkSourceInputDirty({
+        closure: sourceInputClosure,
+        root: realRoot,
+      });
+      if (dirtyResult.dirty) {
+        await evidence.append({
+          phase: 'source-authority',
+          status: 'blocking',
+          reason: 'DIRTY_SOURCE_INPUT',
+          dirtyPaths: dirtyResult.dirtyPaths,
+        });
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          `source-input closure files have uncommitted changes: ${dirtyResult.dirtyPaths.join(', ')}`,
+          { dirtyPaths: dirtyResult.dirtyPaths },
+        );
+      }
+
+      await evidence.append({
+        phase: 'source-authority',
+        step: 'dirty-check',
+        status: 'clean',
+      });
+
+      // Build sourceAuthority binding for plan digest
+      sourceAuthority = {
+        sourceRepository,
+        defaultBranch: configDefaultBranch,
+        entries: sourceInputClosure.entries,
+        inputDigest: sourceInputClosure.digest,
+        algorithmVersion: SOURCE_INPUT_ALGORITHM_VERSION,
+      };
+
+      await evidence.append({
+        phase: 'source-authority',
+        status: 'completed',
+        sourceRepository,
+        defaultBranch: configDefaultBranch,
+        inputDigest: sourceInputClosure.digest,
+        remoteObservation: offline ? 'unobserved-offline' : 'deferred-to-publish',
+      });
+    }
+
     // --- Step 4: Capture Git baseline (AFTER hooks, so workspaceDigest
     //     reflects any file changes introduced by hooks) ---
     await evidence.append({ phase: 'baseline', status: 'started' });
@@ -2183,6 +2270,75 @@ export async function prepareRelease(options) {
       gateCount: snapshotGateResults.length,
     });
 
+    // Bind the remote source-authority proof to the exact bytes that entered
+    // the frozen snapshots, not merely to an earlier read of the workspace.
+    // Then re-read the complete closure and dirty state once more so version
+    // sources and non-snapshot closure entries cannot drift during prepare.
+    if (production) {
+      const snapshotSourceResult = verifySnapshotSourcesMatchClosure({
+        closure: sourceInputClosure,
+        unitResults,
+      });
+      if (!snapshotSourceResult.passed) {
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          'source inputs changed between closure calculation and frozen snapshot construction',
+          {
+            reason: 'SNAPSHOT_SOURCE_DRIFT',
+            dirtyPaths: snapshotSourceResult.error.paths,
+          },
+        );
+      }
+
+      const finalClosure = await computeSourceInputClosure({
+        units: configUnits,
+        root: realRoot,
+      });
+      if (finalClosure.digest !== sourceInputClosure.digest) {
+        const initialByPath = new Map(
+          sourceInputClosure.entries.map((entry) => [entry.path, entry]),
+        );
+        const finalByPath = new Map(
+          finalClosure.entries.map((entry) => [entry.path, entry]),
+        );
+        const changedPaths = [...new Set([
+          ...sourceInputClosure.entries.map((entry) => entry.path),
+          ...finalClosure.entries.map((entry) => entry.path),
+        ])].filter((path) => (
+          JSON.stringify(initialByPath.get(path) ?? null)
+          !== JSON.stringify(finalByPath.get(path) ?? null)
+        )).sort();
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          'source-input closure changed while preparing frozen snapshots',
+          { reason: 'SOURCE_CLOSURE_DRIFT', dirtyPaths: changedPaths },
+        );
+      }
+
+      const finalDirtyResult = await checkSourceInputDirty({
+        closure: finalClosure,
+        root: realRoot,
+      });
+      if (finalDirtyResult.dirty) {
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          `source-input closure files have uncommitted changes after snapshot construction: ${finalDirtyResult.dirtyPaths.join(', ')}`,
+          {
+            reason: 'DIRTY_AFTER_SNAPSHOT',
+            dirtyPaths: finalDirtyResult.dirtyPaths,
+          },
+        );
+      }
+
+      await evidence.append({
+        phase: 'source-authority',
+        step: 'snapshot-binding',
+        status: 'completed',
+        inputDigest: sourceInputClosure.digest,
+        snapshotSourceCount: snapshotSourceResult.observation.snapshotSourceCount,
+      });
+    }
+
     // --- Step 6: Remote uniqueness (deferred to publish preflight) ---
     // Prepare only observes the previous public baseline (already done above).
     // Remote uniqueness checks (tag, GitHub Release, npm version) are deferred
@@ -2665,6 +2821,7 @@ export async function prepareRelease(options) {
       } : {}),
       units,
       externalActions,
+      ...(sourceAuthority ? { sourceAuthority } : {}),
       createdAt: production ? createdAtTimestamp : (clock ? clock() : new Date().toISOString()),
     };
 

package/src/commands/publish.mjs

@@ -59,10 +59,15 @@ import { appendRunState, createProductionRunDir, writeRunAtomic, resolveDefaultR
 import {
   ReleaseError,
   GATE_FAILED,
+  CONFIG_MISSING,
   BASELINE_CHANGED,
   PARTIAL_RELEASE,
   CONSUMER_VERIFICATION_DEFERRED,
 } from '../core/errors.mjs';
+import {
+  verifyRemoteSourceContent,
+  createSourceAuthorityReceipt,
+} from '../core/source-authority.mjs';
 import { assertTransition, PUBLISHING, PUBLISHED, PARTIAL } from '../core/state-machine.mjs';
 import { matchObservation } from '../adapters/contract.mjs';
 import { observeWithRetry, clampPolicyToTimeout, DEFAULT_OBSERVE_RETRY_POLICY, isPropagatingMissing } from '../core/observe-retry.mjs';
@@ -527,6 +532,13 @@ export async function publishRelease(options) {
     if (productionMode && !isProductionPlan) {
       throw new ReleaseError(GATE_FAILED, 'production publish requires a github-npm-v1 frozen plan');
     }
+    if (isProductionPlan && !plan.sourceAuthority) {
+      throw new ReleaseError(
+        CONFIG_MISSING,
+        'production publish requires a frozen sourceAuthority binding; re-run prepare with project.sourceRepository configured',
+        { gate: 'source-authority' },
+      );
+    }
     const verifiedFrozenSnapshots = new Map();
     if (isProductionPlan) {
       if (!plan.production.assetRoot || plan.production.assetRoot === '.') {
@@ -932,6 +944,65 @@ export async function publishRelease(options) {
       }
     }
 
+    // =======================================================================
+    // Safety Gate 11: Source authority content closure verification
+    // Verifies that the frozen source-input closure content exists in the
+    // workspace's remote default branch. Must pass before ANY adapter execute.
+    // Failure => zero adapter execute calls.
+    // =======================================================================
+    let sourceAuthorityReceipt = null;
+    if (plan.sourceAuthority) {
+      await evidence.append({ phase: 'safety-gate', gate: 'source-authority', status: 'started' });
+
+      const sa = plan.sourceAuthority;
+
+      // Verify the remote source tree against the entries frozen into the
+      // digest-bound plan. Publish must never rebuild authority from the
+      // mutable workspace or current config.
+      const frozenClosure = {
+        algorithmVersion: sa.algorithmVersion,
+        digest: sa.inputDigest,
+        entries: sa.entries,
+      };
+      const remoteResult = await verifyRemoteSourceContent({
+        sourceRepository: sa.sourceRepository,
+        defaultBranch: sa.defaultBranch,
+        closure: frozenClosure,
+        readRemoteFn: options.readRemoteSourceFn,
+      });
+
+      if (!remoteResult.passed) {
+        const errorCode = remoteResult.error?.code ?? GATE_FAILED;
+        await evidence.append({
+          phase: 'safety-gate',
+          gate: 'source-authority',
+          status: 'failed',
+          error: remoteResult.error,
+        });
+        throw new ReleaseError(
+          errorCode,
+          `source authority content gate failed: ${remoteResult.error?.message}`,
+          remoteResult.error,
+        );
+      }
+
+      // Create receipt for successful verification
+      sourceAuthorityReceipt = createSourceAuthorityReceipt({
+        plan,
+        result: 'CONSISTENT',
+        observation: remoteResult.observation,
+        clock: clockFn,
+      });
+
+      await evidence.append({
+        phase: 'safety-gate',
+        gate: 'source-authority',
+        status: 'passed',
+        sourceRepository: sa.sourceRepository,
+        defaultBranch: sa.defaultBranch,
+      });
+    }
+
     // =======================================================================
     // All safety gates passed -- prepare for execution
     // =======================================================================
@@ -1069,6 +1140,7 @@ export async function publishRelease(options) {
           : {}),
       })),
       startedAt,
+      ...(sourceAuthorityReceipt ? { sourceAuthorityReceipts: [sourceAuthorityReceipt] } : {}),
       ...(finishedAt ? { finishedAt } : {}),
     });
     let stateSequence = 0;

package/src/commands/reconcile.mjs

@@ -59,6 +59,7 @@ import {
   CONSUMER_VERIFICATION_DEFERRED,
 } from '../core/errors.mjs';
 import { assertTransition, PARTIAL, PUBLISHED, BLOCKED } from '../core/state-machine.mjs';
+import { verifySourceAuthorityReceipt } from '../core/source-authority.mjs';
 import { matchObservation } from '../adapters/contract.mjs';
 import { observeWithRetry, clampPolicyToTimeout, DEFAULT_OBSERVE_RETRY_POLICY } from '../core/observe-retry.mjs';
 
@@ -233,6 +234,18 @@ export async function reconcileRelease(options) {
         `reconcile source command must be publish or reconcile, got "${sourceRun.command}"`,
       );
     }
+    let sourceAuthorityReceipt = null;
+    if (plan.sourceAuthority) {
+      const receiptResult = verifySourceAuthorityReceipt({ plan, run: sourceRun });
+      if (!receiptResult.passed) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `reconcile source run has no valid source-authority receipt: ${receiptResult.reason}`,
+          { gate: 'source-authority', sourceRunId: sourceRun.runId },
+        );
+      }
+      sourceAuthorityReceipt = receiptResult.receipt;
+    }
 
     let consumedApprovalPath = sourceRun.approvalPath;
     let consumedApprovalDigest = sourceRun.approvalDigest;
@@ -956,6 +969,9 @@ export async function reconcileRelease(options) {
       sourceRunDigest: sourceAuthorityDigest,
       sourceRunPath,
       status,
+      ...(sourceAuthorityReceipt
+        ? { sourceAuthorityReceipts: [sourceAuthorityReceipt] }
+        : {}),
       checkpoints: planActions.map((action) => {
         const value = actionResults.get(action.id);
         const normalized = value === 'deferred' ? 'deferred'
@@ -1303,6 +1319,9 @@ export async function reconcileRelease(options) {
       sourceRunDigest,
       sourceRunPath,
       status: overallStatus,
+      ...(sourceAuthorityReceipt
+        ? { sourceAuthorityReceipts: [sourceAuthorityReceipt] }
+        : {}),
       checkpoints: planActions.map((a) => {
         const status = actionResults.get(a.id) ?? 'pending';
         const normalized = status === 'deferred' ? 'deferred'

package/src/commands/setup.mjs

@@ -976,6 +976,21 @@ function buildRecommendedProposal(facts, candidates) {
   const legacyOwner = facts.legacyReleaseConfigs
     .map((c) => c.owner)
     .find(Boolean);
+  const sourceRepositoryCandidates = [...new Set(
+    facts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+  )].sort();
+  if (sourceRepositoryCandidates.length !== 1) {
+    return {
+      answers: null,
+      conflicts: [{
+        code: sourceRepositoryCandidates.length === 0
+          ? 'SOURCE_REPOSITORY_MISSING'
+          : 'SOURCE_REPOSITORY_AMBIGUOUS',
+        candidates: sourceRepositoryCandidates,
+      }],
+      assumptions,
+    };
+  }
 
   const units = [];
   for (const unit of candidates.units) {
@@ -1156,6 +1171,7 @@ function buildRecommendedProposal(facts, candidates) {
     project: {
       name: facts.packages[0]?.name ?? 'project',
       defaultBranch: facts.legacyReleaseConfigs[0]?.defaultBranch ?? facts.git.branch ?? 'main',
+      sourceRepository: sourceRepositoryCandidates[0],
     },
     releaseUnits: units,
     ...(selectedGateIds.length > 0 ? {
@@ -1517,6 +1533,9 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
 
   const facts = await discoverFacts(rootReal);
   const candidates = buildCandidates(facts);
+  const sourceRepositoryCandidates = [...new Set(
+    facts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+  )].sort();
   let answers = null;
   if (answersPath) {
     const resolvedAnswers = isAbsolute(answersPath) ? answersPath : resolve(rootReal, answersPath);
@@ -1527,6 +1546,7 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
   const digestAuthority = {
     setupVersion: 1,
     facts,
+    sourceRepositoryCandidates,
     releaseUnitCandidates: candidates.units,
     gateCandidates: candidates.gates,
     selectedGateIds,
@@ -1599,6 +1619,9 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
       const lockedAuthority = {
         setupVersion: 1,
         facts: lockedFacts,
+        sourceRepositoryCandidates: [...new Set(
+          lockedFacts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+        )].sort(),
         releaseUnitCandidates: lockedCandidates.units,
         gateCandidates: lockedCandidates.gates,
         selectedGateIds: lockedAnswers.selectedGateIds,
@@ -1622,6 +1645,9 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
           const finalAuthority = {
             setupVersion: 1,
             facts: finalFacts,
+            sourceRepositoryCandidates: [...new Set(
+              finalFacts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+            )].sort(),
             releaseUnitCandidates: finalCandidates.units,
             gateCandidates: finalCandidates.gates,
             selectedGateIds: finalAnswers.selectedGateIds,