wicked-crew 0.7.28 → 0.7.30

package/dist/core/deliver-triage.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Deliver-failure triage — wicked-core#431 follow-through (crew consumes wicked-core#433).
+ *
+ * The deliver phase is a TOOL unit: a bash script the engine spawns (`run_tool_cmd`); no CLI seat
+ * runs it. When it exits non-zero the engine still emits `stepFailed {failureKind: "workerError"}` —
+ * the Tool path has no finer kind — and hands the excerpt to its agent triage judge, which answers
+ * `escalate` (a human decides). Crew's own folds over `stepFailed` must not read that `workerError`
+ * literally: `api/seat-health.ts` used to mark the unit's ASSIGNED seat inactive on ANY
+ * `workerError`, so a `deliver: LIFT-CONFLICT` refusal blamed a CLI for a git state.
+ *
+ * Since wicked-core#433 the refusal can also be ENGINE-authored — the deliver LIFT + RE-VERIFY runs
+ * BEFORE the script (`wicked-core/src/deliver_lift.rs` `lift_and_reverify`); its texts, in order:
+ *   - `deliver: the worktree's HEAD is attached to `<ref>` / is detached, not the run branch
+ *     `wicked/<run>` — nothing was lifted, reset or pushed; …` (the run-branch precondition);
+ *   - `deliver: the lift onto <base> (<tip>) could not be applied cleanly — …` (a partial worktree);
+ *   - `deliver: LIFT-CONFLICT — lifting the run's work onto <base> (<tip>) would conflict in: …`
+ *     (the worktree was left exactly as verified; carries crew's own marker ON PURPOSE so the
+ *     strand derivation — `completed` + `delivery: 'stranded'`, `POST /runs/:id/deliver` — fires);
+ *   - `deliver: the worktree could not be snapshotted before delivery (…); nothing was pushed …`;
+ *   - `deliver: <why>, and the repository's own checks FAILED on it: …` — the RE-VERIFY the engine
+ *     runs whenever the worktree's tree is not the tree the run verified (`<why>` = "the lift
+ *     changed the tree" | "the worktree's tree X is not the tree the run verified (Y)" | "the run
+ *     recorded no verified tree"); the worktree holds an UNVERIFIED tree — NOT a strand, a post-hoc
+ *     lift would push it;
+ *   - `deliver: the repository's checks passed but CHANGED the worktree while running …` /
+ *     `deliver: the repository's checks passed but the worktree could not be re-snapshotted …`
+ *     (a check script that edits tracked files; inspect).
+ * Every one of them — and every refusal crew's own script prints (`core/deliver.ts`: nothing to
+ * deliver, the default branch, a moved verified base, a failed `gh`) — is an OPERATOR decision,
+ * never a seat fault. This module recognises them from the excerpt the engine puts on
+ * `stepFailed.detail` / the unit's `denial_reason` — head 150 + tail 250 chars of the WHOLE Tool
+ * output (`bounded_excerpt` in `actor.rs`). The engine's refusals ARE the whole output (the command
+ * never ran) and every phrase matched here sits inside the first 150 chars of that text, so they
+ * survive in the head. The script's refusals come AFTER real fetch / install / codegen chatter, so
+ * only the tail is theirs: every script marker (`LIFT-CONFLICT`, `BASE MOVED`, `PREFLIGHT CHANGED`)
+ * TRAILS its last line and lands in the tail-250 (review F-527-001).
+ *
+ * ORDERING: this is a TEXT classifier and assumes nothing about the event stream. In particular a
+ * deliver unit refused for a wrong HEAD ref (`deliver: the worktree's HEAD is attached to …`) emits
+ * its `stepFailed` WITHOUT a preceding `deliverLiftEvaluated` — the run-branch precondition runs
+ * before any lift — so no consumer (this one, the strand derivation, seat health, the studio's
+ * delivery card) may treat the lift event as a prerequisite of a deliver failure.
+ */
+/** The engine's lift-conflict remedy (`LiftOutcome::Conflict`) — crew's marker plus the engine's words. */
+export declare const ENGINE_LIFT_CONFLICT_PHRASE = "deliver: LIFT-CONFLICT \u2014 lifting the run's work onto";
+/** The engine refused before any lift: the worktree is not on its run branch (`require_run_branch`). */
+export declare const ENGINE_RUN_BRANCH_PHRASE = "nothing was lifted, reset or pushed; the deliver script only pushes the run branch";
+/** The engine's apply failure (`LiftOutcome::Failed`) — the line starts `deliver: the lift onto`. */
+export declare const ENGINE_LIFT_APPLY_FAILED_PHRASE = "could not be applied cleanly";
+/** The engine could not identify the tree it was about to ship (pre-check snapshot failed). */
+export declare const ENGINE_SNAPSHOT_FAILED_PHRASE = "deliver: the worktree could not be snapshotted before delivery";
+/** The engine's re-verify: the repository's checks FAILED on the tree that would ship. */
+export declare const ENGINE_REVERIFY_FAILED_PHRASE = "repository's own checks FAILED on";
+/** The engine's post-check proof failing: the checks changed the tree, or it could not be re-snapshotted. */
+export declare const ENGINE_CHECKS_MUTATED_PHRASE = "deliver: the repository's checks passed but";
+/**
+ * What kind of deliver refusal a failed deliver unit's excerpt carries.
+ * - `lift_conflict` — the engine's lift or the script's rebase/push hit a collision (recoverable);
+ * - `run_branch_refused` — the worktree is not on its run branch; nothing was touched (engine);
+ * - `lift_apply_failed` — the lift could not be applied cleanly, partial worktree (engine);
+ * - `snapshot_failed` — the worktree could not be snapshotted before delivery (engine);
+ * - `reverify_failed` — the repository's checks FAILED on the tree that would ship (engine);
+ * - `checks_mutated` — the checks passed but changed the tree / could not be re-proven (engine);
+ * - `base_moved` — the script found origin/<default> past `WICKED_DELIVER_VERIFIED_BASE` (script);
+ * - `preflight_changed` — the crew#426 lockfile/codegen re-sync changed the verified tree (script);
+ * - `script_refusal` — any other loud `deliver: …` refusal the script prints (script).
+ */
+export type DeliverFailureKind = 'lift_conflict' | 'run_branch_refused' | 'lift_apply_failed' | 'snapshot_failed' | 'reverify_failed' | 'checks_mutated' | 'base_moved' | 'preflight_changed' | 'script_refusal';
+export interface DeliverFailureTriage {
+    kind: DeliverFailureKind;
+    /** Who wrote the refusal: the engine's deliver lift, or crew's own deliver script. */
+    author: 'engine' | 'script';
+    /** Always `'escalate'`: a deliver refusal is an operator decision, never a seat (worker) fault. */
+    disposition: 'escalate';
+    /**
+     * Whether the run's work is intact and post-hoc deliverable (`POST /runs/:id/deliver` after the
+     * operator clears the collision) — `true` only for a lift conflict, the shape crew's strand
+     * derivation already keys on (`isDeliverConflictStranded`). A failed re-verify, an apply failure
+     * or a moved base must NOT be offered a post-hoc push: that would deliver a tree nobody verified.
+     */
+    recoverable: boolean;
+}
+/**
+ * Classify a failed deliver unit's excerpt (`stepFailed.detail`, or the unit's `denial_reason`).
+ * `null` when the text carries no deliver refusal at all — a spawn/infra failure (`bash: gh:
+ * command not found`), or a unit that is not the deliver phase — so callers fall back to their
+ * default reading of `failureKind`.
+ */
+export declare function triageDeliverFailure(detail: string | null | undefined): DeliverFailureTriage | null;
+//# sourceMappingURL=deliver-triage.d.ts.map

package/dist/core/deliver-triage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-triage.d.ts","sourceRoot":"","sources":["../../src/core/deliver-triage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAQH,2GAA2G;AAC3G,eAAO,MAAM,2BAA2B,8DAAkE,CAAC;AAC3G,wGAAwG;AACxG,eAAO,MAAM,wBAAwB,uFACiD,CAAC;AACvF,qGAAqG;AACrG,eAAO,MAAM,+BAA+B,iCAAiC,CAAC;AAC9E,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,mEAAmE,CAAC;AAC9G,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B,sCAAsC,CAAC;AACjF,6GAA6G;AAC7G,eAAO,MAAM,4BAA4B,gDAAgD,CAAC;AAE1F;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,YAAY,GACZ,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,sFAAsF;IACtF,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,mGAAmG;IACnG,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAeD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,GAAG,IAAI,CAyBnG"}

package/dist/core/deliver-triage.js

@@ -0,0 +1,106 @@
+/**
+ * Deliver-failure triage — wicked-core#431 follow-through (crew consumes wicked-core#433).
+ *
+ * The deliver phase is a TOOL unit: a bash script the engine spawns (`run_tool_cmd`); no CLI seat
+ * runs it. When it exits non-zero the engine still emits `stepFailed {failureKind: "workerError"}` —
+ * the Tool path has no finer kind — and hands the excerpt to its agent triage judge, which answers
+ * `escalate` (a human decides). Crew's own folds over `stepFailed` must not read that `workerError`
+ * literally: `api/seat-health.ts` used to mark the unit's ASSIGNED seat inactive on ANY
+ * `workerError`, so a `deliver: LIFT-CONFLICT` refusal blamed a CLI for a git state.
+ *
+ * Since wicked-core#433 the refusal can also be ENGINE-authored — the deliver LIFT + RE-VERIFY runs
+ * BEFORE the script (`wicked-core/src/deliver_lift.rs` `lift_and_reverify`); its texts, in order:
+ *   - `deliver: the worktree's HEAD is attached to `<ref>` / is detached, not the run branch
+ *     `wicked/<run>` — nothing was lifted, reset or pushed; …` (the run-branch precondition);
+ *   - `deliver: the lift onto <base> (<tip>) could not be applied cleanly — …` (a partial worktree);
+ *   - `deliver: LIFT-CONFLICT — lifting the run's work onto <base> (<tip>) would conflict in: …`
+ *     (the worktree was left exactly as verified; carries crew's own marker ON PURPOSE so the
+ *     strand derivation — `completed` + `delivery: 'stranded'`, `POST /runs/:id/deliver` — fires);
+ *   - `deliver: the worktree could not be snapshotted before delivery (…); nothing was pushed …`;
+ *   - `deliver: <why>, and the repository's own checks FAILED on it: …` — the RE-VERIFY the engine
+ *     runs whenever the worktree's tree is not the tree the run verified (`<why>` = "the lift
+ *     changed the tree" | "the worktree's tree X is not the tree the run verified (Y)" | "the run
+ *     recorded no verified tree"); the worktree holds an UNVERIFIED tree — NOT a strand, a post-hoc
+ *     lift would push it;
+ *   - `deliver: the repository's checks passed but CHANGED the worktree while running …` /
+ *     `deliver: the repository's checks passed but the worktree could not be re-snapshotted …`
+ *     (a check script that edits tracked files; inspect).
+ * Every one of them — and every refusal crew's own script prints (`core/deliver.ts`: nothing to
+ * deliver, the default branch, a moved verified base, a failed `gh`) — is an OPERATOR decision,
+ * never a seat fault. This module recognises them from the excerpt the engine puts on
+ * `stepFailed.detail` / the unit's `denial_reason` — head 150 + tail 250 chars of the WHOLE Tool
+ * output (`bounded_excerpt` in `actor.rs`). The engine's refusals ARE the whole output (the command
+ * never ran) and every phrase matched here sits inside the first 150 chars of that text, so they
+ * survive in the head. The script's refusals come AFTER real fetch / install / codegen chatter, so
+ * only the tail is theirs: every script marker (`LIFT-CONFLICT`, `BASE MOVED`, `PREFLIGHT CHANGED`)
+ * TRAILS its last line and lands in the tail-250 (review F-527-001).
+ *
+ * ORDERING: this is a TEXT classifier and assumes nothing about the event stream. In particular a
+ * deliver unit refused for a wrong HEAD ref (`deliver: the worktree's HEAD is attached to …`) emits
+ * its `stepFailed` WITHOUT a preceding `deliverLiftEvaluated` — the run-branch precondition runs
+ * before any lift — so no consumer (this one, the strand derivation, seat health, the studio's
+ * delivery card) may treat the lift event as a prerequisite of a deliver failure.
+ */
+import { DELIVER_BASE_MOVED_MARKER, DELIVER_LIFT_CONFLICT_MARKER, DELIVER_PREFLIGHT_CHANGED_MARKER, } from './deliver.js';
+/** The engine's lift-conflict remedy (`LiftOutcome::Conflict`) — crew's marker plus the engine's words. */
+export const ENGINE_LIFT_CONFLICT_PHRASE = `${DELIVER_LIFT_CONFLICT_MARKER} — lifting the run's work onto`;
+/** The engine refused before any lift: the worktree is not on its run branch (`require_run_branch`). */
+export const ENGINE_RUN_BRANCH_PHRASE = 'nothing was lifted, reset or pushed; the deliver script only pushes the run branch';
+/** The engine's apply failure (`LiftOutcome::Failed`) — the line starts `deliver: the lift onto`. */
+export const ENGINE_LIFT_APPLY_FAILED_PHRASE = 'could not be applied cleanly';
+/** The engine could not identify the tree it was about to ship (pre-check snapshot failed). */
+export const ENGINE_SNAPSHOT_FAILED_PHRASE = 'deliver: the worktree could not be snapshotted before delivery';
+/** The engine's re-verify: the repository's checks FAILED on the tree that would ship. */
+export const ENGINE_REVERIFY_FAILED_PHRASE = "repository's own checks FAILED on";
+/** The engine's post-check proof failing: the checks changed the tree, or it could not be re-snapshotted. */
+export const ENGINE_CHECKS_MUTATED_PHRASE = "deliver: the repository's checks passed but";
+const APPLY_FAILED = /deliver: the lift onto [^\n]*? could not be applied cleanly/;
+/** A `deliver: …` line of the script's — at the start, after a newline, or after the engine's
+ *  `Worker FAILED on unit N (triage: …): ` framing. The classifier's informational
+ *  `deliver: EXCLUDED (<reason>): <path>` lines are not refusals and do not count. */
+const SCRIPT_REFUSAL = /(?:^|\n|\): )deliver: (?!EXCLUDED \()/;
+const ENGINE = (kind) => ({
+    kind,
+    author: 'engine',
+    disposition: 'escalate',
+    recoverable: false,
+});
+/**
+ * Classify a failed deliver unit's excerpt (`stepFailed.detail`, or the unit's `denial_reason`).
+ * `null` when the text carries no deliver refusal at all — a spawn/infra failure (`bash: gh:
+ * command not found`), or a unit that is not the deliver phase — so callers fall back to their
+ * default reading of `failureKind`.
+ */
+export function triageDeliverFailure(detail) {
+    if (typeof detail !== 'string' || detail.length === 0)
+        return null;
+    if (detail.includes(DELIVER_LIFT_CONFLICT_MARKER)) {
+        return {
+            kind: 'lift_conflict',
+            author: detail.includes(ENGINE_LIFT_CONFLICT_PHRASE) ? 'engine' : 'script',
+            disposition: 'escalate',
+            recoverable: true,
+        };
+    }
+    if (detail.includes(ENGINE_RUN_BRANCH_PHRASE))
+        return ENGINE('run_branch_refused');
+    if (APPLY_FAILED.test(detail))
+        return ENGINE('lift_apply_failed');
+    if (detail.includes(ENGINE_SNAPSHOT_FAILED_PHRASE))
+        return ENGINE('snapshot_failed');
+    if (detail.includes(ENGINE_REVERIFY_FAILED_PHRASE))
+        return ENGINE('reverify_failed');
+    if (detail.includes(ENGINE_CHECKS_MUTATED_PHRASE))
+        return ENGINE('checks_mutated');
+    if (detail.includes(DELIVER_BASE_MOVED_MARKER)) {
+        return { kind: 'base_moved', author: 'script', disposition: 'escalate', recoverable: false };
+    }
+    if (detail.includes(DELIVER_PREFLIGHT_CHANGED_MARKER)) {
+        return { kind: 'preflight_changed', author: 'script', disposition: 'escalate', recoverable: false };
+    }
+    if (SCRIPT_REFUSAL.test(detail)) {
+        return { kind: 'script_refusal', author: 'script', disposition: 'escalate', recoverable: false };
+    }
+    return null;
+}
+//# sourceMappingURL=deliver-triage.js.map

package/dist/core/deliver-triage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-triage.js","sourceRoot":"","sources":["../../src/core/deliver-triage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,cAAc,CAAC;AAEtB,2GAA2G;AAC3G,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,4BAA4B,gCAAgC,CAAC;AAC3G,wGAAwG;AACxG,MAAM,CAAC,MAAM,wBAAwB,GACnC,oFAAoF,CAAC;AACvF,qGAAqG;AACrG,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAA8B,CAAC;AAC9E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,6BAA6B,GAAG,gEAAgE,CAAC;AAC9G,0FAA0F;AAC1F,MAAM,CAAC,MAAM,6BAA6B,GAAG,mCAAmC,CAAC;AACjF,6GAA6G;AAC7G,MAAM,CAAC,MAAM,4BAA4B,GAAG,6CAA6C,CAAC;AAwC1F,MAAM,YAAY,GAAG,6DAA6D,CAAC;AACnF;;sFAEsF;AACtF,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAwB,EAAE,CAAC,CAAC;IAClE,IAAI;IACJ,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,UAAU;IACvB,WAAW,EAAE,KAAK;CACnB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiC;IACpE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1E,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACnF,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/deliver.d.ts

@@ -11,6 +11,15 @@
  *      to the current branch when that ref does not exist;
  *  (b) the script REFUSES to push `main`/`master` (or an empty/detached branch name) — the
  *      deliver phase only ever pushes run branches;
+ *  (b2) with the engine's `WICKED_DELIVER_VERIFIED_BASE` pin set (wicked-core#431 / #433: the
+ *      remote-tip commit the engine lifted the work onto and re-verified against), it REFUSES —
+ *      before staging anything — when origin's default branch no longer resolves to that commit
+ *      after its own fetch ({@link DELIVER_BASE_MOVED_MARKER}): a base that moved past the verified
+ *      one is re-verified by the engine's retry, never rebased past by this script;
+ *  (b3) the crew#426 preflight (lockfile re-sync + codegen) runs AFTER the engine's verification;
+ *      when it changes the worktree, an engine-driven delivery REFUSES and names the files
+ *      ({@link DELIVER_PREFLIGHT_CHANGED_MARKER}) — a post-hoc lift ({@link DELIVER_POSTHOC_ENV})
+ *      keeps the regeneration and says so;
  *  (c) it STAGES AND COMMITS the run's work, then rebases onto origin's default branch before
  *      pushing. A conflict whose conflicted paths are ALL `CHANGELOG.md` is union-merged (both
  *      sides' additive lines kept) and the rebase continues — the crew#418 collision magnet, made
@@ -19,8 +28,15 @@
  *      pushed conflicted tree;
  *  (d) `git push -u origin <branch>` — every rejected push carries the recovery marker. The run
  *      work is already committed locally, so an operator can repair auth/transport and retry;
- *  (e) `gh pr create --head <branch> --fill`, with gh's output and exit status captured
- *      SEPARATELY so a gh failure fails the phase carrying gh's own message;
+ *  (e) `gh pr create --head <branch> --title … --body-file …`, with gh's output and exit status
+ *      captured SEPARATELY so a gh failure fails the phase carrying gh's own message. The title
+ *      and body are COMPOSED FROM THE RUN (crew#524 / F-3R2-014, `core/deliver-text.ts`): the
+ *      script asks the daemon that launched it (`GET /runs/:id/deliver-text`) for the text derived
+ *      from the persisted run record — intent, `Fixes #N`, run link, phases + seats + gate
+ *      outcomes, repo checks with exit codes, the evaluator verdict — and falls back to the same
+ *      composer's launch-time text (embedded in the script) when the daemon cannot answer. The
+ *      commit the phase makes for uncommitted work carries that same text (`git commit -F`), so
+ *      ITS subject is the PR title; a run that committed incrementally keeps its own commits;
  *  (f) the PR URL is the last line of the phase output.
  *
  * One deliberate change from the field version: NO gh account is baked into crew code (the
@@ -59,6 +75,7 @@
  *     {@link deliverPrPhase}.
  */
 import type { PhaseDef, WorkflowDef } from './types.js';
+import { type DeliverTextFacts } from './deliver-text.js';
 /**
  * The content-address of wicked-core's built-in evidence floor (`builtin_floors::EVIDENCE_FLOOR_PIN`,
  * criterion "the run left a change in its worktree (done is re-derived from the diff, never
@@ -89,6 +106,75 @@ export declare const DELIVER_PHASE_ID = "deliver";
  * terminal run failures exactly as before (the crew#400 refusal-vs-infra posture).
  */
 export declare const DELIVER_LIFT_CONFLICT_MARKER = "deliver: LIFT-CONFLICT";
+/** What the script carries for its PR/commit text (crew#524). All optional: the bare script still
+ *  composes a title and a body from the intent alone. */
+export interface DeliverScriptOptions {
+    /** The run this script delivers; names the run in the fallback text. */
+    runId?: string;
+    /** Everything known when the script was composed — the embedded fallback is built from it.
+     *  Defaults to the intent + run id alone (no workflow, no phases). */
+    facts?: DeliverTextFacts;
+    /** The launching daemon's own origin (`http://127.0.0.1:7701`). When set, the script first asks
+     *  it for the run-derived text; unset (or unreachable) ⇒ the embedded fallback. */
+    apiOrigin?: string | null;
+}
+/**
+ * The env var the engine hands the deliver command with the remote-tip commit it VERIFIED the
+ * run's work against (wicked-core#431 / #433, `deliver_lift.rs` `VERIFIED_BASE_ENV`): set on a
+ * lift outcome of `unchanged` or `lifted`, absent when the lift was skipped (no remote, no default
+ * ref, a branch carrying its own commits) — and never set on a post-hoc `POST /runs/:id/deliver`,
+ * which has no engine verification to pin to (`api/post-hoc-deliver.ts` strips it).
+ */
+export declare const DELIVER_VERIFIED_BASE_ENV = "WICKED_DELIVER_VERIFIED_BASE";
+/**
+ * The sentinel the deliver script prints when `origin/<default>` no longer resolves to
+ * {@link DELIVER_VERIFIED_BASE_ENV} after the script's own fetch: the remote advanced between the
+ * engine's re-verify and the push window, so the rebase below would carry the base PAST what was
+ * verified. The script refuses BEFORE staging anything. Deliberately NOT a
+ * {@link DELIVER_LIFT_CONFLICT_MARKER}: a moved base is not a recoverable strand — a post-hoc lift
+ * would push a tree nobody verified on the new base; the remedy is the engine's own retry (approve
+ * the deliver gate: it lifts onto the new tip and re-runs the repository's checks first).
+ */
+export declare const DELIVER_BASE_MOVED_MARKER = "deliver: BASE MOVED since verification";
+/**
+ * The env var the daemon sets on a POST-HOC lift (`POST /runs/:id/deliver`, `api/post-hoc-deliver.ts`)
+ * and the engine never does. A post-hoc lift has no engine verification to protect, so the
+ * crew#426 preflight may regenerate tracked files and deliver them (disclosed); an engine-driven
+ * deliver Tool unit — the variable absent — refuses instead ({@link DELIVER_PREFLIGHT_CHANGED_MARKER}).
+ */
+export declare const DELIVER_POSTHOC_ENV = "WICKED_DELIVER_POSTHOC";
+/**
+ * The sentinel the deliver script prints when the crew#426 preflight (`npm install` + the
+ * `manifest:endpoints` / `generate:api-tests` codegen) CHANGED the worktree AFTER the engine had
+ * verified it (wicked-core#433 review addendum): the tree that would ship is then not the tree the
+ * repository's checks certified, and the script refuses before staging anything, leaving the
+ * regenerated files in the worktree. Not a {@link DELIVER_LIFT_CONFLICT_MARKER}: the remedy is to
+ * approve the retry — the engine re-verifies the changed tree first, and the retry's preflight
+ * regenerates nothing more.
+ */
+export declare const DELIVER_PREFLIGHT_CHANGED_MARKER = "deliver: PREFLIGHT CHANGED the verified tree";
+/**
+ * The BASE heredoc delimiter the script writes its fallback text through. A QUOTED heredoc expands
+ * nothing — `$`, backticks, quotes and backslashes in the intent are inert — so the only way the
+ * caller-supplied text could break out is a line equal to the delimiter. That line is never
+ * removed or altered (it may be the title itself — Copilot on #525): {@link heredocDelimiter}
+ * picks a delimiter no line of the text equals, so the text rides verbatim and the heredoc still
+ * ends exactly where the script says it ends.
+ */
+export declare const DELIVER_TEXT_HEREDOC = "WICKED_CREW_DELIVER_TEXT_EOF";
+/**
+ * The framed PR/commit text as heredoc body lines. This is a containment boundary, not cosmetics:
+ * the intent is caller-supplied free text off `POST /runs` and it is being spliced into a bash
+ * script. CR and every control character other than tab and newline are removed (a bare CR could
+ * split a line in the CLI's eyes); nothing else is touched.
+ */
+export declare function heredocLines(framed: string): string[];
+/**
+ * A heredoc delimiter none of `lines` equals: the base, or the base with a numeric suffix
+ * (`…_EOF_1`, `…_EOF_2`, …) when the text happens to carry the base as a whole line. The framing
+ * (line 1 = title) is therefore never disturbed by containment.
+ */
+export declare function heredocDelimiter(lines: readonly string[]): string;
 /**
  * The hardened deliver script, run as `bash -lc <script>` (login shell so the operator's PATH —
  * where `gh` lives — is loaded, same as the field overlay).
@@ -98,10 +184,11 @@ export declare const DELIVER_LIFT_CONFLICT_MARKER = "deliver: LIFT-CONFLICT";
  * `StepStatus::Failed`. It is no longer the ONLY thing standing between a failed `gh` and a green
  * phase, though — the gh result is captured explicitly and success is re-derived from evidence.
  *
- * `intent` (the run's problem statement) rides in the commit subject; it is sanitised by
- * {@link commitSubjectIntent} before it is spliced in.
+ * `intent` (the run's problem statement) is what the PR title and the commit subject are composed
+ * from (`core/deliver-text.ts`); `opts` carries the rest of the launch-time facts and the daemon
+ * origin the script asks for the run-derived text (crew#524).
  */
-export declare function deliverPrScript(intent?: string): string;
+export declare function deliverPrScript(intent?: string, opts?: DeliverScriptOptions): string;
 /**
  * The deliver phase definition — the PhaseDef JSON shape core accepts, fully spelled out so the
  * composed def round-trips through `registerWorkflow` (core's serde) and crew's own `WorkflowDef`
@@ -133,19 +220,26 @@ export declare function deliverPrScript(intent?: string): string;
  * deterministic and costs no LLM call. The PR-URL and branch-ahead assertions stay in the script
  * because no vaulted floor can see the remote.
  */
-export declare function deliverPrPhase(dependsOn?: string[], intent?: string): PhaseDef;
+export declare function deliverPrPhase(dependsOn?: string[], intent?: string, opts?: DeliverScriptOptions): PhaseDef;
 /**
  * Compose a PER-RUN workflow def: `base`'s phases (untouched — the shared def is never mutated)
  * plus the deliver phase appended last, under a run-scoped id. The caller registers the result
  * with the engine for THIS run only; nothing is written to the overlay dir and the composed id
  * never enters the user-workflow registry, so the catalog (`GET /workflows`) stays clean.
  *
- * `intent` is the run's problem statement — it names WHAT was delivered in the commit subject
- * (`wicked-crew run <run-id>: <intent>`); omit it and the subject carries the run id alone.
+ * `intent` is the run's problem statement — the PR title and commit subject are composed from it
+ * (`core/deliver-text.ts`); omit it and they name the run id alone. `launch` carries what else is
+ * known here (the repo, the daemon's own origin) so the phase's embedded fallback text names the
+ * workflow, its phases and the run link, and so the script knows which daemon to ask for the
+ * run-derived text at delivery time (crew#524).
  *
  * Throws when `base` already carries a `deliver` phase — appending a second phase with the same
  * id would be ambiguous at best; the caller launches such a def as-is instead (see
  * `CoreAdapter.launchRun`).
  */
-export declare function composeDeliverWorkflow(base: WorkflowDef, runId: string, intent?: string): WorkflowDef;
+export interface DeliverLaunchContext {
+    repoRef?: string | null;
+    apiOrigin?: string | null;
+}
+export declare function composeDeliverWorkflow(base: WorkflowDef, runId: string, intent?: string, launch?: DeliverLaunchContext): WorkflowDef;
 //# sourceMappingURL=deliver.d.ts.map

package/dist/core/deliver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deliver.d.ts","sourceRoot":"","sources":["../../src/core/deliver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AA0BrE;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAyMvD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAAC,SAAS,GAAE,MAAM,EAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAgBlF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,CAmBb"}
+{"version":3,"file":"deliver.d.ts","sourceRoot":"","sources":["../../src/core/deliver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAErE;yDACyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0EACsE;IACtE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,2CAA2C,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,iDAAiD,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjE;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,CAsUxF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAC5B,SAAS,GAAE,MAAM,EAAO,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,GAAE,oBAAyB,GAC9B,QAAQ,CAgBV;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,GAAE,oBAAyB,GAChC,WAAW,CA+Bb"}