wicked-crew 0.7.40 → 0.7.45

package/dist/core/deliver.js

@@ -85,7 +85,8 @@
  */
 import { execFile } from 'node:child_process';
 import { childEnvWithBootEstateDb } from './governance-store.js';
-import { composeEmbeddedDeliverText, factsFromWorkflow, framedDeliverText, runUrlFor, urlPathSegment, } from './deliver-text.js';
+import { DELIVER_STRANDED_SENTINEL } from './deliver-exclusions.js';
+import { composeEmbeddedDeliverText, factsFromWorkflow, framedDeliverText, runUrlFor, configuredPublicOrigin, commitSubject, urlPathSegment, } from './deliver-text.js';
 /**
  * The content-address of wicked-core's built-in evidence floor (`builtin_floors::EVIDENCE_FLOOR_PIN`,
  * criterion "the run left a change in its worktree (done is re-derived from the diff, never
@@ -105,8 +106,10 @@ export const EVIDENCE_FLOOR_PIN = 'e2e7af1db9e48454';
 export const DELIVER_PHASE_ID = 'deliver';
 /**
  * The sentinel the deliver script prints when the RUN'S WORK has been committed but its LIFT did
- * not complete (crew#418/#432): a rebase conflict or any failed push. The work is safe on its
- * `wicked/<id>` branch; an operator can fix the remote condition and retry delivery.
+ * not complete (crew#418): a rebase onto the remote default branch hit a conflict outside the
+ * changelog. The work is safe on its `wicked/<id>` branch; an operator resolves the collision and
+ * retries delivery. A push the REMOTE refused is not a lift collision and carries
+ * {@link DELIVER_PUSH_REJECTED_MARKER} instead (N4).
  *
  * crew keys the "stranded, recoverable" reinterpretation on this EXACT substring appearing in
  * the deliver unit's `denial_reason` (which carries the head+TAIL excerpt of the script's
@@ -116,6 +119,53 @@ export const DELIVER_PHASE_ID = 'deliver';
  * terminal run failures exactly as before (the crew#400 refusal-vs-infra posture).
  */
 export const DELIVER_LIFT_CONFLICT_MARKER = 'deliver: LIFT-CONFLICT';
+/**
+ * The sentinel the deliver script prints LAST when the REMOTE REFUSED the push after the run's work
+ * was committed and its lift came out clean (N4, ship re-proof): a pre-receive hook, a protected
+ * ref, an auth 403, a transport failure, or a non-fast-forward on the run branch. It used to carry
+ * {@link DELIVER_LIFT_CONFLICT_MARKER}, which mislabelled a refusal as a lift collision — the lift
+ * read `unchanged` — and, because the engine EXEMPTS that marker from its deterministic
+ * deliver-refusal arm, sent the failure to the LLM triage judge, which re-ran the push once with no
+ * gate. Without the lift marker the failure takes the engine's deterministic arm: the run parks at
+ * an `escalation` gate on the deliver unit, and nothing is pushed again until a human approves.
+ * The untracked recovery sentinel ({@link DELIVER_STRANDED_SENTINEL}) still keeps the worktree.
+ */
+export const DELIVER_PUSH_REJECTED_MARKER = 'deliver: PUSH-REJECTED';
+/**
+ * The machine line the deliver script prints LAST on a successful PUSH-ONLY delivery (N1, the half
+ * of F2 that did not hold): the branch is on the remote, and no pull request was opened because gh
+ * could not resolve the origin to a GitHub repository. `deliver: PUSHED-NO-PR <branch> <remote>` —
+ * the branch has no spaces (git forbids them in a ref), and the remote is the rest of the line.
+ * The daemon reads it from the APPROVED deliver unit's output ({@link pushedOnlyFrom}) into the
+ * durable `run.delivered` record, so the run reads `delivery: 'pushed'` instead of `'stranded'`.
+ */
+export const DELIVER_PUSHED_NO_PR_MARKER = 'deliver: PUSHED-NO-PR';
+/** A remote URL with its userinfo removed — `https://tok@host/r` → `https://host/r`. A scp-like
+ *  `git@host:path` keeps its user (it names an SSH login, not a secret). */
+export function remoteWithoutUserinfo(url) {
+    return url.trim().replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)[^@/]*@/, '$1');
+}
+/**
+ * The push-only delivery a deliver transcript records, or `null`. The LAST
+ * {@link DELIVER_PUSHED_NO_PR_MARKER} line wins. Whether it outranks a PR URL in the same transcript
+ * is decided by position in `deliveryRecordFrom` (`api/delivery-index.ts`): the script's verdict is
+ * the last of the two, and anything earlier may be the remote's echo.
+ */
+export function pushedOnlyFrom(text) {
+    let found = null;
+    for (const line of text.split('\n')) {
+        const m = /^deliver: PUSHED-NO-PR (\S+) (.+)$/.exec(line.trimEnd());
+        if (m !== null)
+            found = { branch: m[1], remote: remoteWithoutUserinfo(m[2]) };
+    }
+    return found;
+}
+/** A GitHub login as GitHub itself allows it — alphanumerics and single hyphens, ≤ 39 chars. The
+ *  ONE validator for the deliver identity: the setting's 400 and the script's splice share it, so
+ *  a value that passed the route can always be baked into a single-quoted shell literal. */
+export function isGitHubLogin(login) {
+    return /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(login);
+}
 /** A branch name the script may splice into a single-quoted literal and hand to git: the ref
  *  charset git accepts for `wicked/<run>`-style heads, no `..`, no leading `-`, no quotes. */
 const SAFE_REF = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
@@ -131,7 +181,7 @@ const SAFE_PR_URL = /^https:\/\/[A-Za-z0-9.-]+\/[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+
  *  (≤ 90 ASCII bytes) on purpose — the PTY carrier's whole prompt is 1000 B and core's budget test
  *  keeps ≥ 300 B of intent headroom. */
 export const BUG_FIX_SWEEP_INSTRUCTIONS = 'Update every consumer of behaviour this fix retires or changes: tests, docs, comments.';
-const defaultGhExec = (args, opts) => new Promise((resolve) => {
+export const defaultGhExec = (args, opts) => new Promise((resolve) => {
     // The daemon's governance-store variables never ride into a child (crew#495): the boot value is
     // restored and the exported store URL is stripped, the same helper every other spawn site uses.
     execFile('gh', args, { cwd: opts.cwd, timeout: opts.timeoutMs, encoding: 'utf8', env: childEnvWithBootEstateDb(process.env) }, (err, stdout, stderr) => {
@@ -139,6 +189,39 @@ const defaultGhExec = (args, opts) => new Promise((resolve) => {
         resolve({ stdout: String(stdout ?? ''), stderr: String(stderr ?? ''), code });
     });
 });
+/**
+ * `git remote get-url --push origin` in `rootPath` — the deliver gate's origin preflight (F2).
+ *
+ * `--push` because the sentence is about the PUSH: `git push origin` uses `remote.origin.pushurl`
+ * when one is configured, so a repo whose FETCH url is GitHub while its PUSH url is not (or the
+ * reverse) would otherwise get a card describing a destination the branch never reaches (codex
+ * review of this PR, HIGH). With no `pushurl` configured git answers the fetch url, so the common
+ * case is unchanged.
+ *
+ *  - the trimmed URL when git answered one;
+ *  - `''` when git said there is NO such remote — the one answer that licenses the card to claim
+ *    "this repository has no origin";
+ *  - `null` for everything else (git missing, a timeout, a root that is not a checkout). "Could
+ *    not read it" is not a licence to claim anything about it either way, so the card keeps its
+ *    generic sentence.
+ *
+ * A run worktree shares its repository's remotes and does not exist yet at compose time, so this
+ * reads the REGISTERED repo root. Bounded to 5 s, once per delivering launch.
+ */
+export async function readDeliverOriginUrl(rootPath) {
+    const res = await new Promise((resolve) => {
+        execFile('git', ['remote', 'get-url', '--push', 'origin'], { cwd: rootPath, timeout: 5_000, encoding: 'utf8', env: childEnvWithBootEstateDb(process.env) }, (err, stdout, stderr) => {
+            const code = err === null ? 0 : typeof err.code === 'number' ? err.code : null;
+            resolve({ stdout: String(stdout ?? ''), stderr: String(stderr ?? ''), code });
+        });
+    });
+    if (res.code === 0) {
+        const url = res.stdout.trim();
+        // git can exit 0 with nothing for a remote configured with an empty URL — unknown, not absent.
+        return url === '' ? null : url;
+    }
+    return /no such remote/i.test(res.stderr) ? '' : null;
+}
 /**
  * Resolve `revisesPr` (a PR number) to the head branch the run will base on and push to — the
  * daemon's job, since the engine has no GitHub client (DES-L9 §2). Bounded to 5 s; every failure
@@ -300,6 +383,13 @@ export function deliverPrScript(intent, opts = {}) {
     const api = apiOriginLiteral(opts.apiOrigin);
     const fallbackLines = heredocLines(framedDeliverText(fallback));
     const heredoc = heredocDelimiter(fallbackLines);
+    // crew#550: the PR title may run to GitHub's 256 characters, the commit subject stays at git's 72.
+    // The subject is composed here from the same title; the script puts it above the full text when
+    // the two differ, so the commit body opens with the whole title.
+    const subjectLines = heredocLines(commitSubject(fallback.title));
+    const fallbackTitleLines = heredocLines(fallback.title);
+    // Never the text heredoc's own delimiter, so each heredoc has exactly one closing line.
+    const subjectHeredoc = heredocDelimiter([...fallbackLines, ...subjectLines, ...fallbackTitleLines, heredoc]);
     // The run id for the daemon URL: the LAUNCH id when the composer knows it, pre-encoded as one
     // strict path segment (only `[A-Za-z0-9._~%-]` survive, so the single-quoted literal is safe);
     // otherwise derived from the branch at run time and percent-encoded byte-wise by the script.
@@ -315,6 +405,20 @@ export function deliverPrScript(intent, opts = {}) {
         if (!SAFE_PR_URL.test(revises.url))
             throw new Error(`revisesPr #${revises.number}: not a pull request URL: ${JSON.stringify(revises.url)}`);
     }
+    // (crew#549) The configured deliver identity, baked as a single-quoted literal. Fail CLOSED at
+    // compose time on anything that is not a GitHub login: a run that silently delivered under an
+    // unchecked identity is the defect, and a value that reached a shell literal unvalidated would
+    // be worse than either.
+    const identity = (opts.deliverIdentity ?? '').trim();
+    if (identity !== '' && !isGitHubLogin(identity)) {
+        throw new Error(`deliver identity: not a GitHub login: ${JSON.stringify(identity)}`);
+    }
+    // R1: the repository the consent card names IS the one `gh pr create` opens on. Without `--repo`
+    // gh resolves the base itself (a `gh repo set-default`, an `upstream` remote), so "opens a pull
+    // request there" could name one repository while the PR opened on another (codex review, HIGH).
+    // `githubRepoOf` admits only `[A-Za-z0-9._-]+/[A-Za-z0-9._-]+`, safe in a single-quoted literal;
+    // a non-github.com origin bakes '' and gh keeps resolving it (the push-only path keys on that).
+    const ghRepo = githubRepoOf(opts.originUrl) ?? '';
     const prNum = revises === null ? '' : String(revises.number);
     const target = revises === null ? '' : revises.headRef;
     const prUrl = revises === null ? '' : revises.url;
@@ -332,17 +436,95 @@ export function deliverPrScript(intent, opts = {}) {
         // token's login) holds, disclosed on the gate card, never switched at push time. Unset ⇒
         // today's behaviour, now said aloud. No account name is baked into crew code (env-driven).
         'L=$(gh api user -q .login 2>/dev/null || true)',
+        // (crew#549) The CONFIGURED identity is the system setting `deliverIdentityLogin` — baked
+        // here at compose time, validated against the GitHub login charset before it is spliced —
+        // and the `GH_ACCOUNT` env var when the setting is empty (still supported; the setting wins
+        // so a daemon started without the export is not silently unpinned). `GH_ACCOUNT` is then the
+        // ONE name the refusals use, whichever source set it.
+        `CFG='${identity}'`,
+        'if [ -n "$CFG" ]; then GH_ACCOUNT="$CFG"; fi',
         'if [ -n "${GH_ACCOUNT:-}" ]; then',
         '  [ "$L" = "$GH_ACCOUNT" ] || { echo "deliver: identity mismatch — GH_ACCOUNT is $GH_ACCOUNT but gh\'s active login is ${L:-unreadable}; nothing was staged, committed or pushed. Fix the daemon\'s gh login (switch gh\'s active account, or export GH_TOKEN in the daemon environment) and approve to retry the deliver phase"; exit 1; }',
         '  if [ -n "${GH_TOKEN:-}" ]; then echo "deliver: pushing as $L (GH_ACCOUNT pinned by GH_TOKEN)"; else echo "deliver: pushing as $L (GH_ACCOUNT from the gh keyring — export GH_TOKEN to pin it)"; fi',
         'elif [ -n "$L" ]; then echo "deliver: pushing as $L (GH_ACCOUNT not set — not pinned)"',
         'else echo "deliver: pushing as an unknown login (gh not authenticated; GH_ACCOUNT not set — not pinned)"; fi',
+        // (crew#549 / F-RC1-010) THE CREDENTIAL CROSS-CHECK. `gh api user` says who gh is; it says
+        // NOTHING about the credential `git push` will use. On the RC1 rig those two disagreed —
+        // `git credential fill` handed git one account while `gh api user` reported another — and the
+        // run pushed under an identity the operator had not chosen (or took a 403 that hard-failed
+        // it). So ask git itself, for the remote's own host, BEFORE anything is fetched or staged,
+        // and REFUSE when both logins are concrete and differ — naming both, whether or not an
+        // identity is configured. `GIT_TERMINAL_PROMPT=0` keeps a helperless host from prompting (it
+        // errors instead, which reads as unresolved). Only an https remote has a git credential; an
+        // ssh or local remote authenticates another way, so the check does not apply and says so.
+        // A placeholder username (`x-access-token`, `oauth2`, `token`) identifies a TOKEN, not an
+        // account: unresolved, disclosed, never a refusal (the token's own login is what `gh api
+        // user` already reported).
+        //
+        // THE REMOTE'S OWN USERNAME COMES FIRST (codex review on #727). A remote spelled
+        // `https://other-bot@github.com/o/r.git` tells git which account to authenticate as, and git
+        // uses it whatever the helper would have answered for the bare host. Stripping it and asking
+        // only about the host left exactly the defect this guard exists for alive: gh reports
+        // `release-bot`, the URL says `other-bot`, the helper agrees with gh, and the push goes out as
+        // `other-bot`. So the URL username is read, refused against gh's login when both are concrete,
+        // and passed INTO the credential query so the helper answers for the account git will use.
+        'RU=$(git remote get-url origin 2>/dev/null || true)',
+        'case "$RU" in',
+        '  https://*)',
+        '    RH=${RU#https://}; RH=${RH%%/*}; RU_USER=""',
+        '    case "$RH" in *@*) RU_USER=${RH%@*}; RH=${RH##*@};; esac',
+        // A `user:password@host` remote carries the secret in the URL; take the user, never the rest.
+        '    case "$RU_USER" in *:*) RU_USER=${RU_USER%%:*};; esac',
+        '    case "${RU_USER:-}" in',
+        '      ""|x-access-token|oauth2|token|PRIVATE-TOKEN) ;;',
+        '      *) if [ -n "$L" ] && [ "$RU_USER" != "$L" ]; then echo "deliver: identity mismatch — gh\'s active login is $L but origin\'s URL authenticates as $RU_USER (https://$RU_USER@$RH/…); nothing was staged, committed or pushed. The push would use $RU_USER, not $L. Point origin at https://$RH/… and pin ONE identity (export GH_TOKEN in the daemon environment, or fix the credential helper for $RH), then approve to retry the deliver phase"; exit 1; fi',
+        '         echo "deliver: origin authenticates as $RU_USER (agrees with gh)";; esac',
+        '    GC=$(printf "protocol=https\\nhost=%s\\n%s\\n" "$RH" "${RU_USER:+username=$RU_USER}" | GIT_TERMINAL_PROMPT=0 git credential fill 2>/dev/null | sed -n "s/^username=//p" | head -1 || true)',
+        '    case "${GC:-}" in',
+        '      "") echo "deliver: git\'s credential identity for $RH is unresolved (no credential helper answered) — the push uses whatever the helper hands git at push time";;',
+        '      x-access-token|oauth2|token|PRIVATE-TOKEN) echo "deliver: git\'s credential for $RH is a token ($GC), so it names no account — gh reports ${L:-an unknown login}";;',
+        '      *)',
+        '        if [ -n "$L" ] && [ "$GC" != "$L" ]; then echo "deliver: identity mismatch — gh\'s active login is $L but git\'s credential for $RH is $GC; nothing was staged, committed or pushed. The push would use $GC, not $L. Pin ONE identity (export GH_TOKEN in the daemon environment, or fix the credential helper for $RH) and approve to retry the deliver phase"; exit 1; fi',
+        '        echo "deliver: git\'s credential for $RH is $GC (agrees with gh)";;',
+        '    esac;;',
+        '  "") echo "deliver: this worktree has no origin remote — no git credential applies";;',
+        '  *) echo "deliver: origin is not an https remote — no git credential applies (ssh keys or a local path authenticate the push)";;',
+        'esac',
         // REVISION MODE inputs (DES-L9 / crew#550) — baked at compose time from the resolved PR, each
         // validated against a strict charset before it is spliced into a single-quoted literal. Empty
         // TARGET ⇒ today's new-PR delivery.
         `PRNUM='${prNum}'`,
         `TARGET='${target}'`,
         `PRURL='${prUrl}'`,
+        `GHREPO='${ghRepo}'`,
+        // R1 (Copilot on crew#736): the card the operator approved named GHREPO; if origin was
+        // re-pointed since (the run can wait at its gate for hours), the push would leave for another
+        // repository than the one consented to. Refuse before anything is fetched, staged or pushed.
+        // The URL is PARSED, not globbed (codex review, HIGH: `*github.com/o/r` also matched
+        // `https://evil.example/github.com/o/r` and `git@evilgithub.com:o/r`): the host — userinfo and
+        // port stripped, lowercased — must be exactly github.com and the path exactly GHREPO (a
+        // trailing `/` or `.git` dropped). The URL itself (it may carry a token) is never printed.
+        // EVERY push URL is checked (`--all`): `git push origin` pushes to each `remote.origin.pushurl`,
+        // so a second one would receive the branch unnamed (Copilot on crew#736). The host must be
+        // github.com or ssh.github.com — the same two `githubRepoOf` names a repository for.
+        'if [ -n "$GHREPO" ]; then',
+        "  GL=$(printf '%s' \"$GHREPO\" | tr 'A-Z' 'a-z'); ODRIFT=''; OANY=''",
+        '  while IFS= read -r OU; do',
+        '    [ -n "$OU" ] || continue; OANY=1',
+        '    case "$OU" in',
+        '      *://*) OH=${OU#*://}; OH=${OH%%/*}; OH=${OH##*@}; OH=${OH%%:*}; OP=${OU#*://*/};;',
+        '      *) OH=${OU%%:*}; OH=${OH##*@}; OP=${OU#*:};;',
+        '    esac',
+        // GitHub owner/repo names are case-insensitive: compare lowercased, keep GHREPO's spelling
+        // for `--repo` (codex review, MEDIUM). An absolute scp path (`git@github.com:/o/r`) is the same
+        // repository: the leading `/` goes.
+        "    OH=$(printf '%s' \"$OH\" | tr 'A-Z' 'a-z'); OP=$(printf '%s' \"$OP\" | tr 'A-Z' 'a-z'); OP=${OP#/}; OP=${OP%/}; OP=${OP%.git}",
+        '    case "$OH" in github.com|ssh.github.com) [ "$OP" = "$GL" ] || ODRIFT=1;; *) ODRIFT=1;; esac',
+        '  done <<GHREPO_URLS',
+        '$(git remote get-url --push --all origin 2>/dev/null || true)',
+        'GHREPO_URLS',
+        '  if [ -n "$ODRIFT" ] || [ -z "$OANY" ]; then echo "deliver: origin no longer points at $GHREPO (or also pushes elsewhere), the repository this delivery was approved for — nothing was staged, committed or pushed. Point origin back at $GHREPO alone, or reject and relaunch against the new remote"; exit 1; fi',
+        'fi',
         // (a) The run branch: wicked/<worktree-basename> (the engine names run worktrees by run id),
         // falling back to the currently checked-out branch when that ref does not exist.
         'R=$(basename "$PWD")',
@@ -404,7 +586,7 @@ export function deliverPrScript(intent, opts = {}) {
         // A failed PUSH happens after the product was committed. Keep its worktree from being reaped
         // by leaving this reserved, untracked recovery sentinel; it is removed HERE (before staging)
         // so a normal delivery never sees it, and a retry removes it before another attempt (crew#432).
-        'S=.wicked-crew-delivery-stranded',
+        `S=${DELIVER_STRANDED_SENTINEL}`,
         'rm -f -- "$S"',
         // (c1) COMMIT THE RUN'S WORK (crew#317). Agents write files; they do not commit — which is
         // the premise of core#291 and the reason `d1bc72c2` pushed a branch identical to origin/main.
@@ -459,6 +641,18 @@ export function deliverPrScript(intent, opts = {}) {
         heredoc,
         'fi',
         'TITLE=$(sed -n 1p "$TD/text")',
+        `cat > "$TD/subject" <<'${subjectHeredoc}'`,
+        ...subjectLines,
+        subjectHeredoc,
+        `cat > "$TD/fbtitle" <<'${subjectHeredoc}'`,
+        ...fallbackTitleLines,
+        subjectHeredoc,
+        // The subject for the title actually used: the composed one when the daemon's title is the
+        // embedded fallback's; else (the daemon titled it differently) a plain word-boundary cut at 72.
+        'if [ "$(cat "$TD/fbtitle")" != "$TITLE" ]; then printf \'%s\\n\' "$TITLE" | awk \'{ if (length($0) <= 72) print; else { s = substr($0, 1, 71); sub(/ [^ ]*$/, "", s); print s "…" } }\' > "$TD/subject"; fi',
+        // The commit message: the text verbatim when its title fits the subject width, else the 72-column
+        // subject, a blank line, then the text (whose first line is the full title) — crew#550.
+        'if [ "$(cat "$TD/subject")" = "$TITLE" ]; then cp "$TD/text" "$TD/commit"; else { cat "$TD/subject"; echo; cat "$TD/text"; } > "$TD/commit"; fi',
         "sed '1,2d' \"$TD/text\" > \"$TD/body\"",
         // (c0) DELIVER PREFLIGHT (crew#426) — a governed run that bumps an internal WORKSPACE package's
         // version (e.g. packages/crew-api-types) leaves its version-derived codegen AND the lockfile
@@ -554,6 +748,9 @@ export function deliverPrScript(intent, opts = {}) {
         'while IFS= read -r -d "" F; do',
         '  [ -n "$F" ] || continue',
         '  BN=${F##*/}; RN=""',
+        // The recovery sentinel is removed above, so this arm is the ONE predicate's first rule, kept
+        // here so `deliverExclusionByName` and this classifier stay the same ladder (N2).
+        '  [ "$F" = "$S" ] && RN="delivery-sentinel"',
         // Classify on a LOWERCASED basename so DEPLOY.KEY / .ENV / SOCKET.PATH cannot bypass the
         // denylist by case (review, #439).
         '  LBN=$(printf "%s" "$BN" | tr "[:upper:]" "[:lower:]")',
@@ -571,7 +768,7 @@ export function deliverPrScript(intent, opts = {}) {
         // `--cleanup=whitespace`, NOT git's default for `-F`: an operator/repo `commit.cleanup=strip`
         // would otherwise treat every `## Intent` / `## Run` / `## Phases` heading as a `#` comment and
         // strip it from the commit body (review W3-K1).
-        'git diff --cached --quiet || git commit -q --cleanup=whitespace -F "$TD/text"',
+        'git diff --cached --quiet || git commit -q --cleanup=whitespace -F "$TD/commit"',
         // (c2) NOTHING TO DELIVER — no staged work AND no commits of its own. Fail LOUDLY before the
         // remote is touched: an empty ref pushed under a run id is worse than a failed phase.
         'if [ -n "$TARGET" ]; then A=$(git rev-list --count "origin/$TARGET..$B"); [ "$A" -ge 1 ] || { echo "deliver: nothing to deliver — the run added no commit on top of PR #$PRNUM"; exit 1; }; else',
@@ -637,17 +834,20 @@ export function deliverPrScript(intent, opts = {}) {
         '[ "$A" -ge 1 ] || { echo "deliver: nothing to deliver — the run produced no committed change (after rebasing onto $D, $B carries no commit of its own); nothing was pushed"; exit 1; }',
         'fi',
         // (d) Push. Any push failure happens AFTER the work was committed and its branch was proven
-        // ahead. It is therefore a recoverable lift failure, whether the remote branch moved, auth
-        // returned 403, the transport is down, or a hook rejected it. Preserve git's own output AND
-        // print the marker last, so crew strands the run and POST /runs/:id/deliver can retry it.
+        // ahead, whether the remote branch moved, auth returned 403, the transport is down, or a hook
+        // rejected it. It is a REFUSAL BY THE REMOTE, not a lift collision (N4): the lift already came
+        // out clean. Preserve git's own output, leave the recovery sentinel, and print
+        // DELIVER_PUSH_REJECTED_MARKER last — never the LIFT-CONFLICT marker — so the engine takes its
+        // deterministic deliver-refusal arm and parks the run at a gate; nothing pushes again until a
+        // human approves the retry.
         // A revision pushes the run branch ONTO the PR's head branch (`$B:refs/heads/$TARGET`) — the
         // PR gains exactly the run's commits; a rejection there is the same recoverable strand.
         '_push() { if [ -n "$TARGET" ]; then git push origin "$B:refs/heads/$TARGET"; else git push -u origin "$B"; fi; }',
         'if PUSHOUT=$(_push 2>&1); then echo "$PUSHOUT"; else',
         '  echo "$PUSHOUT"',
         '  case "$PUSHOUT" in',
-        `    *non-fast-forward*|*"fetch first"*|*"[rejected]"*|*"Updates were rejected"*) : > "$S"; echo "${DELIVER_LIFT_CONFLICT_MARKER} — push of $B was rejected because the remote branch moved (non-fast-forward); rebase and re-run; nothing was pushed"; exit 1;;`,
-        `    *) : > "$S"; PUSHERR="\${PUSHOUT:0:96} ... \${PUSHOUT: -128}"; PUSHERR=\${PUSHERR//$'\\n'/ }; echo "deliver: git push of $B failed after commit: $PUSHERR; retry POST /runs/:id/deliver; nothing was pushed; ${DELIVER_LIFT_CONFLICT_MARKER}"; exit 1;;`,
+        `    *non-fast-forward*|*"fetch first"*|*"[rejected]"*|*"Updates were rejected"*) : > "$S"; echo "deliver: the remote refused the push of $B because its branch moved (non-fast-forward); the work is committed on $B and nothing was pushed — approve to retry the deliver phase; ${DELIVER_PUSH_REJECTED_MARKER}"; exit 1;;`,
+        `    *) : > "$S"; PUSHERR="\${PUSHOUT:0:96} ... \${PUSHOUT: -128}"; PUSHERR=\${PUSHERR//$'\\n'/ }; echo "deliver: the remote refused the push of $B after commit: $PUSHERR; the work is committed on $B and nothing was pushed — fix the remote condition, then approve to retry the deliver phase; ${DELIVER_PUSH_REJECTED_MARKER}"; exit 1;;`,
         '  esac',
         'fi',
         // (e) Open the PR with gh's OUTPUT and EXIT STATUS captured separately (crew#317). The old
@@ -669,7 +869,41 @@ export function deliverPrScript(intent, opts = {}) {
         '  if COUT=$(gh pr comment "$PRNUM" --body-file "$TD/body" 2>&1); then echo "deliver: run record commented on pull request #$PRNUM"; else echo "$COUT"; echo "deliver: could not comment on pull request #$PRNUM — the commits landed; the record is in the commit message"; fi',
         '  URL="$PRURL"',
         'else',
-        '  if ! OUT=$(gh pr create --head "$B" --title "$TITLE" --body-file "$TD/body" 2>&1); then echo "$OUT"; echo "deliver: gh pr create failed for $B — no PR was opened"; exit 1; fi',
+        // (e2) A NON-GITHUB ORIGIN DELIVERS THE BRANCH (F2). `gh pr create` failing used to be
+        // `exit 1` with no fallback and no push-only mode, so on a local, SSH, GitLab, ADO or Gitea
+        // origin the phase PUSHED THE BRANCH — step (d), above, already happened — and then died on
+        // "none of the git remotes configured for this repository point to a known GitHub host".
+        // Approving the retry re-ran the identical refusal; rejecting cancelled the run. The run could
+        // never reach a terminal state while the one irreversible side effect was already done.
+        //
+        // gh is the AUTHORITY on whether a remote is a GitHub remote — it resolves the remotes itself
+        // and that refusal IS its verdict — so the push-only success path opens on that message and on
+        // nothing else. The pattern requires BOTH halves of the diagnostic, in order, rather than one
+        // fragment (codex review of this PR, MEDIUM), while skipping the leading "none of the" and the
+        // point/points verb so a gh wording tweak cannot silently re-open the F2 hole. Every other gh failure (auth, validation, rate limit, a gh that is not
+        // installed) stays exactly as loud as it was, which is what keeps a GitHub Enterprise Server
+        // origin — where gh succeeds — on the pull-request path. No forge integration is invented
+        // here: the pushed branch IS the delivery, and the phase says so and says where to take it.
+        //
+        // Done is still RE-DERIVED before the claim: the remote ref must be ahead of the base. And
+        // nothing may read a pull request out of this output — there is no URL in it, so `prUrlFrom`
+        // answers null and the run's `delivery` never reads `delivered`.
+        '  if ! OUT=$(gh pr create ${GHREPO:+--repo "$GHREPO"} --head "$B" --title "$TITLE" --body-file "$TD/body" 2>&1); then',
+        '    echo "$OUT"',
+        '    case "$OUT" in',
+        '      *"git remotes configured for this repository"*"known GitHub host"*)',
+        '        P=$(git rev-list --count "$D..origin/$B")',
+        '        [ "$P" -ge 1 ] || { echo "deliver: $B is not ahead of $D on the remote after the push — refusing to report a delivery with no commits"; exit 1; }',
+        // The PUSH url, with any `user[:password]@` userinfo stripped before it reaches the transcript
+        // (codex review of N1: a push URL can carry a deploy token).
+        '        R=$(git remote get-url --push origin | sed -E "s#^([A-Za-z][A-Za-z0-9+.-]*://)[^@/]*@#\\1#")',
+        '        echo "deliver: pushed $B to origin ($R) with $P commit(s) on top of $D, and no pull request was opened because that remote is not a GitHub host gh can resolve. The branch IS the delivery — open the pull/merge request for $B on your forge; merge stays human.";',
+        // N1: the machine line the daemon records the push-only delivery from — LAST, one line.
+        `        echo "${DELIVER_PUSHED_NO_PR_MARKER} $B $R";`,
+        '        exit 0;;',
+        '    esac',
+        '    echo "deliver: gh pr create failed for $B — no PR was opened"; exit 1',
+        '  fi',
         '  echo "$OUT"',
         // (f) DONE IS RE-DERIVED, NOT ASSERTED — twice, from two independent facts, before the phase
         // is allowed to report a delivery:
@@ -735,25 +969,225 @@ export function deliverPrPhase(dependsOn = [], intent, opts = {}) {
         validator_pin: EVIDENCE_FLOOR_PIN,
     };
 }
+/** The host of a git remote URL — `https://`/`ssh://` URLs and the scp-like `git@host:owner/repo`
+ *  spelling — or `null` when the value names no host (a path). */
+export function originRemoteHost(url) {
+    const trimmed = url.trim();
+    if (trimmed === '')
+        return null;
+    // Any `scheme://…` is decided HERE, authority or not: `file:///p` has an empty authority and
+    // names no host, and so does any other schemed URL written without one.
+    const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//.exec(trimmed);
+    if (scheme !== null) {
+        if (scheme[1].toLowerCase() === 'file')
+            return null;
+        const authority = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/(?:[^@/]*@)?([^/:]+)/.exec(trimmed);
+        return authority !== null ? authority[1].toLowerCase() : null;
+    }
+    // A Windows drive is a PATH, excluded by shape rather than by "a host is at least two letters"
+    // — which also rejected the single-letter host `h:path` (codex review of this PR, LOW).
+    if (/^[A-Za-z]:[\\/]/.test(trimmed))
+        return null;
+    // scp-like: `[user@]host:path`. The path may be ABSOLUTE (`git@example.com:/srv/git/repo.git`
+    // is valid scp syntax) — an earlier `(?!\/)` guard rejected exactly that and called a real
+    // remote a local path (codex review, LOW).
+    const scp = /^(?:[^@/\\]+@)?([A-Za-z0-9._-]+):/.exec(trimmed);
+    return scp !== null ? scp[1].toLowerCase() : null;
+}
+/** {@link DeliverOriginKind} for an origin URL read at compose time. */
+export function classifyDeliverOrigin(url) {
+    if (url === null || url === undefined || url.trim() === '')
+        return 'none';
+    const host = originRemoteHost(url);
+    if (host === null)
+        return 'local';
+    return host === 'github.com' || host.endsWith('.github.com') ? 'github' : 'other';
+}
+/**
+ * The gate card's first sentence for a NEW-PR delivery — what will ACTUALLY happen (F2).
+ *
+ * It used to promise "pushes its branch → opens a pull request" unconditionally. On a local, SSH,
+ * GitLab, ADO or Gitea origin that was a false promise twice over: the phase pushed the branch and
+ * then died on `gh pr create`, so the operator consented to a pull request that could not exist and
+ * got an irreversible push plus a run that could not reach a terminal state. The push-only success
+ * path in the script fixes the outcome; this fixes the consent.
+ *
+ * `null`/absent origin ⇒ the generic sentence, unchanged: "could not read it" is not a licence to
+ * claim anything about it either way.
+ */
+/** The hosts a GitHub repository is pushed to: the web host and the ssh-over-443 endpoint. */
+const GITHUB_PUSH_HOSTS = new Set(['github.com', 'ssh.github.com']);
 /**
- * What the deliver gate card says (DES-L9 §4): the push target — onto the revised PR's branch, or a
- * new PR — and the push identity with its pin source: `GH_ACCOUNT` pinned by an exported `GH_TOKEN`
- * (then `gh api user` IS the token's login and the script refuses on a difference), `GH_ACCOUNT`
- * from the gh keyring (the login can flip between this check and the push — export `GH_TOKEN` to
- * pin it), or unset (pushes as whatever login gh holds). Never the token, never a live probe.
+ * `owner/repo` of a github.com origin URL — `https://[user[:token]@]github.com/owner/repo(.git)`,
+ * `ssh://git@github.com/owner/repo`, `git@github.com:owner/repo.git` — or `null` when the value is
+ * not a github.com URL with exactly an owner/name path. Credentials never survive: only the path is
+ * read (R1, ship-prove-3).
  */
+export function githubRepoOf(url) {
+    if (classifyDeliverOrigin(url) !== 'github')
+        return null;
+    const trimmed = (url ?? '').trim();
+    // Only the two hosts a repository is pushed to (`ssh.github.com` is GitHub's ssh-over-443
+    // endpoint). Another `*.github.com` (gist, api) names no repository `--repo` could open on —
+    // the card keeps its generic sentence and gh resolves the remote itself. The script's drift
+    // check accepts exactly these two hosts too (Copilot on crew#736).
+    if (!GITHUB_PUSH_HOSTS.has(originRemoteHost(trimmed) ?? ''))
+        return null;
+    const schemed = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/(?:[^@/]*@)?[^/]+\/(.*)$/.exec(trimmed);
+    const scp = schemed === null ? /^(?:[^@/\\]+@)?[A-Za-z0-9._-]+:(.*)$/.exec(trimmed) : null;
+    const path = (schemed ?? scp)?.[1] ?? null;
+    if (path === null)
+        return null;
+    const segs = path.replace(/[?#].*$/, '').split('/').filter((x) => x !== '');
+    if (segs.length !== 2)
+        return null;
+    const owner = segs[0];
+    const name = segs[1].replace(/\.git$/i, '');
+    const part = /^[A-Za-z0-9._-]+$/;
+    return part.test(owner) && part.test(name) && name !== '' ? `${owner}/${name}` : null;
+}
+/** The run branch the deliver script pushes — `wicked/<run id>` (the engine names run worktrees by
+ *  run id and the script pushes `wicked/<worktree basename>`) — or `null` when the run is unknown. */
+export function deliverRunBranch(runId) {
+    // The id as the engine receives it — NOT trimmed: `" run "` takes the engine's hash tier, and a
+    // trim here would announce `wicked/run` (Copilot on crew#736).
+    const id = runId ?? '';
+    // The charset alone is not a git ref component: `.run`, `run..next`, `run.lock`, `run.` are
+    // illegal refs the engine must sanitize, so they name no branch here (Copilot on crew#736).
+    // NTFS reserved device stems (`CON`, `con.txt`, `COM1`…) are rewritten and hashed by the
+    // engine's `sanitize_worktree_id` too, so they name no branch either (Copilot on crew#736).
+    const reserved = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i;
+    const refSafe = (x) => /^[A-Za-z0-9._-]+$/.test(x) && !x.startsWith('.') && !x.startsWith('-') && !x.includes('..') && !x.endsWith('.') && !x.endsWith('.lock') && !reserved.test(x);
+    if (refSafe(id))
+        return `wicked/${id}`;
+    // The engine's hashless COLON tier (core#345/#347): an id whose only illegal char is `:` (a
+    // campaign-shaped `<label>:<repo>:a0`) names its worktree and branch with each `:` as `-`
+    // (Copilot on crew#736). Any other shape takes the engine's hash-suffixed tier, which is not
+    // re-derived here — the card then says "the run branch" rather than guess.
+    if (/^[A-Za-z0-9._-]+(?::[A-Za-z0-9._-]+)+$/.test(id) && refSafe(id.replaceAll(':', '-'))) {
+        return `wicked/${id.replaceAll(':', '-')}`;
+    }
+    return null;
+}
+/**
+ * The gate card's first sentence for a NEW-PR delivery — what will ACTUALLY happen (F2). `runId`
+ * names the branch (R2: the card used to print the literal placeholder `wicked/<run>`); without
+ * one — the LAUNCH composer, before the run exists — it says "the run branch". The same sentence
+ * is what `GET /repos/:id/deliver-target` answers, so launch and gate cannot disagree (R3).
+ */
+export function newPrTargetSentence(originUrl, runId) {
+    const kind = classifyDeliverOrigin(originUrl);
+    const runBranch = deliverRunBranch(runId);
+    const branch = runBranch !== null ? `branch ${runBranch}` : 'the run branch';
+    if (kind === 'github') {
+        // R1: name the GitHub repository the pull request opens on, read off the origin URL (never
+        // crew's registry label, never a credential).
+        const repo = githubRepoOf(originUrl);
+        return repo !== null
+            ? `Pushes ${branch} to ${repo} on GitHub and opens a pull request there; merge stays human.`
+            : `Pushes ${branch} to origin and opens a pull request; merge stays human.`;
+    }
+    if (kind === 'local') {
+        // NOT a flat "no pull request is opened": `gh pr create` resolves every configured remote, not
+        // only `origin`, so a checkout whose origin is a path while some other remote is a GitHub
+        // repository can still get one (codex review of this PR, MEDIUM). The push DESTINATION is what
+        // this read establishes; the pull request is stated as the condition it actually is.
+        return (`Pushes ${branch} to origin (${(originUrl ?? '').trim()}) — a local path, so no pull request ` +
+            'can be opened against it: unless another remote in this checkout is a GitHub repository gh ' +
+            'resolves, the pushed branch IS the delivery.');
+    }
+    if (kind === 'other') {
+        const host = originRemoteHost((originUrl ?? '').trim()) ?? 'that host';
+        return (`Pushes ${branch} to origin (${host}) and opens a pull request only if gh resolves ${host} ` +
+            'as a GitHub host it is logged in to; otherwise no pull request is opened and the pushed ' +
+            'branch IS the delivery. Merge stays human.');
+    }
+    if (originUrl === '') {
+        return (`Pushes ${branch} to origin — but this repository has no \`origin\` remote, so the push ` +
+            'will fail and nothing will be delivered. Add the remote first.');
+    }
+    return `Pushes ${branch} to origin and opens a pull request; merge stays human.`;
+}
+/** The launch-time reading of the same origin preflight the deliver gate uses (R3, crew#730). */
+export function deliverTargetView(originUrl) {
+    const unread = originUrl === null || originUrl === undefined;
+    return {
+        origin: unread ? 'unknown' : classifyDeliverOrigin(originUrl),
+        githubRepo: githubRepoOf(originUrl),
+        sentence: newPrTargetSentence(originUrl),
+    };
+}
+/** The registered repo a launch's `repoRef` names — by id, then name, then checkout basename: the
+ *  ONE matcher the launch's origin read and `GET /repos/:id/deliver-target` share. */
+export function deliverRepoFor(repos, repoRef) {
+    // Three passes, so the precedence is real: an exact id never loses to an earlier repo whose
+    // name or checkout basename collides with it (codex review, MEDIUM).
+    return (repos.find((r) => r.id === repoRef) ??
+        repos.find((r) => r.name === repoRef) ??
+        repos.find((r) => r.root_path.split(/[\\/]/).filter((x) => x !== '').pop() === repoRef));
+}
 export function deliverGateInstructions(opts) {
     const pr = opts.revisesPr ?? null;
     const target = pr !== null
-        ? `Pushes wicked/<run> onto pull request #${pr.number} (branch ${pr.headRef}); no new PR.`
-        : 'Pushes the run branch wicked/<run> to origin and opens a pull request; merge stays human.';
-    const account = opts.ghAccount ?? null;
+        ? `Pushes ${deliverRunBranch(opts.runId) ?? 'the run branch'} onto pull request #${pr.number} (branch ${pr.headRef}); no new PR.`
+        : newPrTargetSentence(opts.originUrl, opts.runId);
+    // (crew#549) The SETTING wins over the env var, and the card names which one it read, because
+    // "pin it now if it must differ" is not an instruction an operator can follow without knowing
+    // where the pin lives.
+    const configured = (opts.deliverIdentity ?? '').trim();
+    const account = configured !== '' ? configured : (opts.ghAccount ?? null);
+    const source = configured !== '' ? 'the deliver identity setting' : 'GH_ACCOUNT';
     const who = account !== null && account !== ''
         ? opts.ghTokenPinned === true
-            ? `Push identity: GH_ACCOUNT=${account}, pinned by GH_TOKEN — the phase refuses if gh's login differs at push time.`
-            : `Push identity: GH_ACCOUNT=${account} from the gh keyring — the login can change between the check and the push; export GH_TOKEN to pin it. The phase refuses if gh's login differs.`
-        : 'Push identity: GH_ACCOUNT is not set — pushes as whatever login gh holds.';
-    return `${target} ${who}`;
+            ? `Push identity: ${account} (${source}), pinned by GH_TOKEN — the phase refuses if gh's login differs at push time.`
+            : `Push identity: ${account} (${source}) against the gh keyring — the login can change between the check and the push; export GH_TOKEN to pin it. The phase refuses if gh's login differs.`
+        : 'Push identity: none configured — pushes as whatever login gh holds (set the deliver identity in system settings to pin it).';
+    // Whatever is configured, the phase also asks git which credential IT would use for the
+    // remote's host and refuses when the two logins disagree — the flip that pushed under an
+    // unintended account (F-RC1-010).
+    return `${target} ${who} It refuses if gh's login and git's credential for the remote disagree.`;
+}
+/**
+ * The `deliver` PLAN STEP a delivering PRESET launch hands the engine (DES-TEAMING-002 T3,
+ * `LaunchOptions.deliverStepJson`): catalog `deliver`, id `deliver`, the same hardened push-and-PR
+ * Tool command, gate-card instructions and evidence-floor pin as the composed phase below. The
+ * engine appends it to the preset's plan and puts `deliver` in the floor, so the run stays ONE
+ * team plan behind its `plan_approval` gate — crew never composes a def over a preset. The step
+ * omits `depends_on` (compose gives `deliver` the step before it) and carries no
+ * `verified_evidence` (a plan step cannot; DES rev 12 note 4: a recorded difference with no
+ * runtime effect). `phases` only feeds the embedded fallback text.
+ */
+export function deliverPresetStep(
+/** The preset launched, or `null` for a user-composed plan. */
+presetName, phases, runId, intent, launch = {}) {
+    const apiOrigin = launch.apiOrigin ?? null;
+    const revisesPr = launch.revisesPr ?? null;
+    const facts = factsFromWorkflow({
+        runId,
+        intent,
+        workflowId: presetName,
+        repoRef: launch.repoRef ?? null,
+        phases,
+        runUrl: runUrlFor(configuredPublicOrigin(), runId),
+        revisesPr: revisesPr === null ? null : { number: revisesPr.number, url: revisesPr.url },
+    });
+    const phase = deliverPrPhase([], intent, {
+        runId,
+        facts,
+        apiOrigin,
+        revisesPr,
+        ghAccount: launch.ghAccount ?? null,
+        ghTokenPinned: launch.ghTokenPinned === true,
+        originUrl: launch.originUrl ?? null,
+        deliverIdentity: launch.deliverIdentity ?? null,
+    });
+    return {
+        catalog: 'deliver',
+        id: DELIVER_PHASE_ID,
+        instructions: phase.instructions ?? '',
+        executor: phase.executor,
+        validator_pin: EVIDENCE_FLOOR_PIN,
+    };
 }
 export function composeDeliverWorkflow(base, runId, intent, launch = {}) {
     if (base.phases.some((p) => p.id === DELIVER_PHASE_ID)) {
@@ -774,7 +1208,7 @@ export function composeDeliverWorkflow(base, runId, intent, launch = {}) {
         workflowId: base.id,
         repoRef: launch.repoRef ?? null,
         phases: base.phases,
-        runUrl: runUrlFor(apiOrigin, runId),
+        runUrl: runUrlFor(configuredPublicOrigin(), runId),
         revisesPr: revisesPr === null ? null : { number: revisesPr.number, url: revisesPr.url },
     });
     return {
@@ -790,6 +1224,10 @@ export function composeDeliverWorkflow(base, runId, intent, launch = {}) {
                 revisesPr,
                 ghAccount: launch.ghAccount ?? null,
                 ghTokenPinned: launch.ghTokenPinned === true,
+                // F2 — the origin the push will actually go to, so the gate card cannot promise a pull
+                // request on a remote that can never carry one.
+                originUrl: launch.originUrl ?? null,
+                deliverIdentity: launch.deliverIdentity ?? null,
             }),
         ],
     };