wicked-crew 0.7.7 → 0.7.9

package/dist/api/steering-landing.js

@@ -0,0 +1,367 @@
+/**
+ * THE STEERING-AUTHOR LANDING (crew#388) — the post-approval write that closes TH-12.
+ *
+ * ## The defect
+ *
+ * The `steering-author` workflow's doctrine says "approved rules land via the rules CRUD with
+ * `provenance.source: "chat"` — the run itself writes nothing", and the propose phase tells the
+ * worker "do not write them yourself". Correct on both counts — evaluator≠creator — but NO
+ * component performed the write: the generic `POST /runs/:id/gate` only confirmed the gate, core
+ * has no steering-author hook, and the studio's `onRunResolved` only reloads rules. Every
+ * chat-authored rule ever approved was silently lost, orphaned as prose in the run's transcript
+ * (campaign 2026-09-01, scenario C5, run f3db4335).
+ *
+ * ## The design
+ *
+ * The landing is CREW-side, on APPROVE of the propose gate — the run keeps writing nothing to the
+ * store. The proposal is read machine-readably first: the propose phase now ALSO writes the
+ * proposed-rules JSON to a declared per-run artifact (`<steering inbox>/proposed-rules.json`,
+ * inside the run's own `extraWriteRoots`) — an ARTIFACT of the proposal, not a store write, so
+ * evaluator≠creator holds. Parsing the propose unit's stored transcript is the FALLBACK (runs
+ * launched before this fix, or a worker that ignored the file contract), and the cached gate
+ * prompt is the last resort (the transcript is written only on approval, so a store hiccup there
+ * still has the prompt core composed FROM that output).
+ *
+ * Invariants:
+ *  - AUDITABLE — every landed rule records `governance.rule.upserted` with the chat provenance
+ *    and the run id, exactly as the doctrine documents; a landing that could not happen records
+ *    `governance.steering.landing_failed` with the reason.
+ *  - IDEMPOTENT — a durable marker (`landed.json` beside the proposal) is written after a full
+ *    landing; a replayed approve (daemon restart mid-request, double-driven gate) finds it and
+ *    re-lands nothing. The rule write itself is an UPSERT keyed by rule id, so even a lost
+ *    marker degrades to a same-content overwrite, never a duplicate rule.
+ *  - FAIL-LOUD — when no source yields a parseable proposal the approve still succeeds for the
+ *    RUN (the gate decision is the operator's and already happened), but the response and the
+ *    audit trail carry an explicit `landing.outcome: "failed"` with the reason. A silent no-op
+ *    is the bug this module exists to end.
+ *  - AMEND-APPROVE — an approve carrying an amend note lands the proposal UNCHANGED: the amend
+ *    steers the RUN (core injects it into the run's continuation), not the rule text. An
+ *    operator who wants different rules rejects and re-authors; editing rule text inside a gate
+ *    note would land words nobody reviewed as JSON nobody saw.
+ */
+import { promises as fsp } from 'node:fs';
+import { join } from 'node:path';
+import { resolveRunWorkflow } from '../qe/acceptance.js';
+import { coreUnitId } from './evidence.js';
+import { STEERING_PROPOSAL_FILENAME, STEERING_TYPES, steeringInboxDir } from './governance-steering.js';
+export { STEERING_PROPOSAL_FILENAME } from './governance-steering.js';
+/** The workflow whose propose gate this landing serves. */
+export const STEERING_AUTHOR_WORKFLOW = 'steering-author';
+/** Durable idempotency marker written beside the proposal after a full landing. */
+export const STEERING_LANDED_MARKER_FILENAME = 'landed.json';
+/** Where the propose phase is told to write its machine-readable proposal. */
+export function steeringProposalPath(runId) {
+    return join(steeringInboxDir(runId), STEERING_PROPOSAL_FILENAME);
+}
+/** Where a completed landing records what it landed (replay dedupe). */
+export function steeringLandedMarkerPath(runId) {
+    return join(steeringInboxDir(runId), STEERING_LANDED_MARKER_FILENAME);
+}
+/**
+ * The steering fields a rule write may carry (the merged model's additions) — mirrored by
+ * `POST /governance/rules`, which refuses them on a pre-steering engine because the engine
+ * would silently DROP them and persist a rule that enforces differently than written. The
+ * landing applies the same guard: authored-then-downgraded is a loud landing failure, never
+ * a quiet field amputation.
+ */
+export const STEERING_RULE_FIELDS = [
+    'steering_type',
+    'applies_to',
+    'excludes',
+    'weight',
+    'effect',
+    'trigger',
+    'obligations',
+    'criteria',
+];
+/** True when this run IS a steering-author run (by workflow id, or — for runs whose stored
+ *  `workflow_id` is core's `wf-<uuid>` instance id — by exact phase sequence). Defensive on a
+ *  view without a `workflow_id` (partial-stub adapters in tests; a free-text run has no def):
+ *  "not steering-author" is the honest answer there, and the legacy gate path must not 500. */
+export function isSteeringAuthorRun(run, workflows) {
+    if (typeof run.session.workflow_id !== 'string')
+        return false;
+    return resolveRunWorkflow(run, workflows)?.id === STEERING_AUTHOR_WORKFLOW;
+}
+/**
+ * Recover the default steering type from the author route's own problem-statement preamble
+ * (`Author steering rules for the '<type>' steering type …`) so a proposed rule that omitted
+ * `steering_type` still lands on the sub-page the operator authored it for. `undefined` when
+ * the problem does not carry the preamble (a hand-launched run) — the engine's serde default
+ * (`architecture`) then applies, same as any other write.
+ */
+export function steeringTypeFromProblem(problem) {
+    const m = /^Author steering rules for the '([a-z-]+)' steering type/.exec(problem);
+    const type = m?.[1];
+    return type !== undefined && STEERING_TYPES.has(type) ? type : undefined;
+}
+function isRawRule(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        !Array.isArray(v) &&
+        typeof v['id'] === 'string' &&
+        v['id'].trim().length > 0 &&
+        typeof v['statement'] === 'string' &&
+        v['statement'].trim().length > 0);
+}
+/** Accept a bare array or a `{ rules: [...] }` wrapper; every entry must look like a rule. */
+function rulesFromJson(parsed) {
+    const arr = Array.isArray(parsed)
+        ? parsed
+        : typeof parsed === 'object' && parsed !== null && Array.isArray(parsed['rules'])
+            ? parsed['rules']
+            : null;
+    if (arr === null || arr.length === 0)
+        return null;
+    return arr.every(isRawRule) ? arr : null;
+}
+/**
+ * Extract the proposed rules from free text — the whole text as JSON first (the deliverable
+ * file's shape), then each fenced code block, then every balanced top-level `[...]` in the
+ * text (the transcript / gate-prompt shape, where the JSON array is embedded in prose).
+ * `null` when nothing parses to a non-empty array of `{id, statement}` objects.
+ */
+export function extractProposedRules(text) {
+    const trimmed = text.trim();
+    if (trimmed.length === 0)
+        return null;
+    // 1. The whole text is the JSON (the deliverable-file contract).
+    try {
+        const whole = rulesFromJson(JSON.parse(trimmed));
+        if (whole !== null)
+            return whole;
+    }
+    catch {
+        /* fall through to embedded extraction */
+    }
+    // 2. Fenced code blocks — workers habitually wrap JSON in ```json fences.
+    for (const m of trimmed.matchAll(/```(?:json)?\s*\n([\s\S]*?)```/g)) {
+        const block = m[1];
+        if (block === undefined)
+            continue;
+        try {
+            const rules = rulesFromJson(JSON.parse(block.trim()));
+            if (rules !== null)
+                return rules;
+        }
+        catch {
+            /* try the next block */
+        }
+    }
+    // 3. Balanced top-level arrays embedded in prose. String-aware bracket walk, so a `]` inside
+    //    a statement never closes the array early.
+    for (let i = trimmed.indexOf('['); i !== -1; i = trimmed.indexOf('[', i + 1)) {
+        let depth = 0;
+        let inString = false;
+        let escaped = false;
+        for (let j = i; j < trimmed.length; j++) {
+            const ch = trimmed[j];
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (inString) {
+                if (ch === '\\')
+                    escaped = true;
+                else if (ch === '"')
+                    inString = false;
+                continue;
+            }
+            if (ch === '"')
+                inString = true;
+            else if (ch === '[')
+                depth++;
+            else if (ch === ']') {
+                depth--;
+                if (depth === 0) {
+                    try {
+                        const rules = rulesFromJson(JSON.parse(trimmed.slice(i, j + 1)));
+                        if (rules !== null)
+                            return rules;
+                    }
+                    catch {
+                        /* not JSON — keep scanning from the next '[' */
+                    }
+                    break;
+                }
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Stamp the chat provenance and the recovered default steering type onto one proposed rule.
+ * `source: "chat"` is FORCED, not defaulted — the landing is the doctrine's one write path for
+ * chat-authored rules, and a worker that wrote some other source into its proposal must not be
+ * able to disguise where the rule came from. Everything else passes through untouched: the
+ * ENGINE's upsert path is the one spelling of what a valid rule is.
+ */
+export function normalizeProposedRule(raw, defaultType) {
+    const prior = typeof raw['provenance'] === 'object' && raw['provenance'] !== null && !Array.isArray(raw['provenance'])
+        ? raw['provenance']
+        : {};
+    const sourceKinds = Array.isArray(prior['source_kinds']) ? prior['source_kinds'] : [];
+    const out = {
+        ...raw,
+        provenance: { ...prior, source: 'chat', source_kinds: sourceKinds },
+    };
+    const declaredType = raw['steering_type'];
+    if ((typeof declaredType !== 'string' || !STEERING_TYPES.has(declaredType)) &&
+        defaultType !== undefined) {
+        out['steering_type'] = defaultType;
+    }
+    return out;
+}
+/** Read a file, mapping ONLY a missing file to null — any other error (EACCES, EIO) throws. */
+async function readIfExists(path) {
+    try {
+        return await fsp.readFile(path, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+/**
+ * Perform the landing for an APPROVED steering-author propose gate. Called AFTER
+ * `confirmGate` resolved — the gate decision is already durable; this function's only job is
+ * the write the doctrine promised. Never throws: every failure is folded into a loud
+ * `outcome: "failed"` result (and the audit trail), because a landing error must not turn an
+ * already-successful gate approval into an HTTP 500.
+ *
+ * `gatePrompt` is the cached gate prompt captured BEFORE the confirm (terminal events prune
+ * the cache) — the last-resort proposal source.
+ */
+export async function landSteeringProposal(deps, run, gatePrompt) {
+    const runId = run.session.id;
+    const { adapter, audit, actor } = deps;
+    const failed = (error, landedIds = [], source) => {
+        audit.record('governance.steering.landing_failed', actor, {
+            runId,
+            detail: { error, ...(landedIds.length > 0 ? { landedRuleIds: landedIds } : {}) },
+        });
+        return {
+            outcome: 'failed',
+            ruleIds: landedIds,
+            ...(source !== undefined ? { source } : {}),
+            error,
+        };
+    };
+    // ── Idempotency: a replayed approve re-lands nothing ─────────────────────────
+    let markerText = null;
+    try {
+        markerText = await readIfExists(steeringLandedMarkerPath(runId));
+    }
+    catch {
+        /* an unreadable marker (not just missing) is treated as absent — the upsert is
+           idempotent by rule id, so the worst case is a same-content overwrite */
+    }
+    if (markerText !== null) {
+        try {
+            const marker = JSON.parse(markerText);
+            if (Array.isArray(marker.ruleIds)) {
+                return {
+                    outcome: 'landed',
+                    ruleIds: marker.ruleIds,
+                    source: marker.source,
+                    alreadyLanded: true,
+                };
+            }
+        }
+        catch {
+            /* a corrupt marker is treated as absent — the upsert is idempotent anyway */
+        }
+    }
+    // ── Read the proposal: deliverable file → stored transcript → cached gate prompt ──
+    let rawRules = null;
+    let source;
+    let fileText = null;
+    try {
+        fileText = await readIfExists(steeringProposalPath(runId));
+    }
+    catch (err) {
+        // A present-but-unreadable deliverable (EACCES, EIO) must NOT silently fall back to the
+        // transcript — that would mask an operational failure. Fail the landing loudly instead.
+        return failed(`the run's proposal deliverable exists but could not be read: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (fileText !== null) {
+        rawRules = extractProposedRules(fileText);
+        if (rawRules !== null)
+            source = 'deliverable';
+    }
+    if (rawRules === null) {
+        // The transcript is stored on approval (deny-dominates writes no output for a rejected
+        // unit), so post-confirm it is readable. Find the propose unit by its phase-suffixed id.
+        const proposeUnit = run.units.find((u) => u.id === `${runId}:propose` || u.id.endsWith(':propose'));
+        if (proposeUnit !== undefined) {
+            try {
+                const transcript = await adapter.workOutput(coreUnitId(runId, proposeUnit));
+                if (transcript !== null) {
+                    rawRules = extractProposedRules(transcript);
+                    if (rawRules !== null)
+                        source = 'transcript';
+                }
+            }
+            catch {
+                /* an unreadable transcript falls through to the gate prompt */
+            }
+        }
+    }
+    if (rawRules === null && gatePrompt !== undefined) {
+        rawRules = extractProposedRules(gatePrompt);
+        if (rawRules !== null)
+            source = 'gate-prompt';
+    }
+    if (rawRules === null || source === undefined) {
+        return failed(`the approved steering proposal could not be parsed from the run record: no ` +
+            `${STEERING_PROPOSAL_FILENAME} in the run's steering inbox, and no JSON array of ` +
+            `{id, statement} rule objects in the propose unit's stored transcript or gate prompt. ` +
+            `The gate approval stands, but NO rules were landed — re-author via ` +
+            `POST /governance/steering/author, or land the transcript's rules by hand through ` +
+            `POST /governance/rules.`);
+    }
+    const defaultType = steeringTypeFromProblem(run.session.problem);
+    const rules = rawRules.map((r) => normalizeProposedRule(r, defaultType));
+    // ── The same pre-steering-engine guard as POST /governance/rules ─────────────
+    if (!adapter.steeringSupported()) {
+        const carrying = rules.filter((r) => STEERING_RULE_FIELDS.some((f) => r[f] !== undefined));
+        if (carrying.length > 0) {
+            return failed(`the installed engine predates the steering model and would silently drop the steering ` +
+                `fields on ${carrying.length} proposed rule(s) — landing refused so the rules are not ` +
+                `persisted enforcing differently than authored. Upgrade wicked-core-ts (>= 0.7.5) and ` +
+                `re-author.`);
+        }
+    }
+    // ── Land, auditing each write exactly as the doctrine documents ──────────────
+    const landedIds = [];
+    const failures = [];
+    for (const rule of rules) {
+        try {
+            await adapter.upsertConformanceRule(rule);
+            landedIds.push(rule.id);
+            audit.record('governance.rule.upserted', actor, {
+                runId,
+                detail: { id: rule.id, source: 'chat', via: STEERING_AUTHOR_WORKFLOW },
+            });
+        }
+        catch (err) {
+            failures.push(`${rule.id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (failures.length > 0) {
+        return failed(`landing was partial: ${landedIds.length} of ${rules.length} proposed rule(s) landed; ` +
+            `the store refused ${failures.join('; ')}`, landedIds, source);
+    }
+    // ── Durable marker (best-effort — the upsert is idempotent even without it) ──
+    try {
+        await fsp.mkdir(steeringInboxDir(runId), { recursive: true });
+        const marker = { ruleIds: landedIds, source, at: new Date().toISOString() };
+        await fsp.writeFile(steeringLandedMarkerPath(runId), JSON.stringify(marker, null, 2), 'utf8');
+    }
+    catch {
+        /* a missing marker degrades to a re-upsert of identical content, never a duplicate */
+    }
+    return { outcome: 'landed', ruleIds: landedIds, source };
+}
+//# sourceMappingURL=steering-landing.js.map

package/dist/api/steering-landing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steering-landing.js","sourceRoot":"","sources":["../../src/api/steering-landing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAGtE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAE1D,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG,aAAa,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;AACnE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,eAAe;IACf,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,aAAa;IACb,UAAU;CACF,CAAC;AAwBX;;;+FAG+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,GAAgB,EAAE,SAAwB;IAC5E,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,wBAAwB,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,CAAC,GAAG,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAKD,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjB,OAAQ,CAAa,CAAC,IAAI,CAAC,KAAK,QAAQ;QACtC,CAAa,CAAC,IAAI,CAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAClD,OAAQ,CAAa,CAAC,WAAW,CAAC,KAAK,QAAQ;QAC7C,CAAa,CAAC,WAAW,CAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAE,MAAkB,CAAC,OAAO,CAAC,CAAC;YAC5F,CAAC,CAAG,MAAkB,CAAC,OAAO,CAAe;YAC7C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,GAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,+CAA+C;IAC/C,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,EAAE,KAAK,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;qBAC3B,IAAI,EAAE,KAAK,GAAG;oBAAE,QAAQ,GAAG,KAAK,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,IAAI,CAAC;iBAC3B,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACxB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;wBACjE,IAAI,KAAK,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAC;oBACnC,CAAC;oBAAC,MAAM,CAAC;wBACP,gDAAgD;oBAClD,CAAC;oBACD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,WAAoB;IACtE,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtG,CAAC,CAAE,GAAG,CAAC,YAAY,CAA6B;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,GAAG,GAAY;QACnB,GAAG,GAAG;QACN,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE;KACpE,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IACE,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvE,WAAW,KAAK,SAAS,EACzB,CAAC;QACD,GAAG,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAiC,CAAC;AAC3C,CAAC;AAqBD,+FAA+F;AAC/F,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAyB,EACzB,GAAgB,EAChB,UAAmB;IAEnB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEvC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,YAAsB,EAAE,EAAE,MAA+B,EAAyB,EAAE;QACjH,KAAK,CAAC,MAAM,CAAC,oCAAoC,EAAE,KAAK,EAAE;YACxD,KAAK;YACL,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjF,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS;YAClB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,KAAK;SACN,CAAC;IACJ,CAAC,CAAC;IAEF,gFAAgF;IAChF,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP;kFAC0E;IAC5E,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAiB,CAAC;YACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,IAAI,QAAQ,GAAqB,IAAI,CAAC;IACtC,IAAI,MAA0C,CAAC;IAE/C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wFAAwF;QACxF,wFAAwF;QACxF,OAAO,MAAM,CACX,gEAAgE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,GAAG,aAAa,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,uFAAuF;QACvF,yFAAyF;QACzF,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACpG,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;gBAC5E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACxB,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;oBAC5C,IAAI,QAAQ,KAAK,IAAI;wBAAE,MAAM,GAAG,YAAY,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,GAAG,aAAa,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,MAAM,CACX,6EAA6E;YAC3E,GAAG,0BAA0B,qDAAqD;YAClF,uFAAuF;YACvF,qEAAqE;YACrE,mFAAmF;YACnF,yBAAyB,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAEzE,gFAAgF;IAChF,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAwB,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAC7E,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CACX,wFAAwF;gBACtF,aAAa,QAAQ,CAAC,MAAM,2DAA2D;gBACvF,uFAAuF;gBACvF,YAAY,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC1C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE;gBAC9C,KAAK;gBACL,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,wBAAwB,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CACX,wBAAwB,SAAS,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,4BAA4B;YACrF,qBAAqB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC5C,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1F,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;IACxF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC"}

package/dist/api/testing.d.ts

@@ -115,14 +115,17 @@ export declare const TestingReconSchema: z.ZodObject<{
     problem: z.ZodString;
     projectId: z.ZodOptional<z.ZodString>;
     repoRefs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    ungated: z.ZodOptional<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
     problem: string;
     projectId?: string | undefined;
     repoRefs?: string[] | undefined;
+    ungated?: boolean | undefined;
 }, {
     problem: string;
     projectId?: string | undefined;
     repoRefs?: string[] | undefined;
+    ungated?: boolean | undefined;
 }>;
 export interface TestingRoutesDeps {
     audit: AuditLog;

package/dist/api/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/api/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,KAAK,EAAwC,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAM3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AA+CvE,eAAO,MAAM,wBAAwB;;;;;;;;;EAK1B,CAAC;AAEZ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKxB,CAAC;AAMZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EASpB,CAAC;AAEZ,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE,KAAK,KAAK,CAAC;IAC5D,kGAAkG;IAClG,MAAM,EAAE,MAAM,OAAO,EAAE,CAAC;IACxB;+FAC2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAE,CAAC;CAC/D;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,iBAAiB,GACtB,IAAI,CAqNN"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/api/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,KAAK,EAAwC,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAO3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AA+CvE,eAAO,MAAM,wBAAwB;;;;;;;;;EAK1B,CAAC;AAEZ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKxB,CAAC;AAQZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAUpB,CAAC;AAEZ,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE,KAAK,KAAK,CAAC;IAC5D,kGAAkG;IAClG,MAAM,EAAE,MAAM,OAAO,EAAE,CAAC;IACxB;+FAC2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAE,CAAC;CAC/D;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,iBAAiB,GACtB,IAAI,CAuVN"}

package/dist/api/testing.js

@@ -25,6 +25,7 @@ import { GovernanceEvalsUnsupportedError, ProjectsUnsupportedError, } from '../c
 import { API_PREFIX } from './api-prefix.js';
 import { STEERING_TYPE_VALUES } from './governance-steering.js';
 import { resolveScopeRepos } from './multiscope.js';
+import { buildReconCampaign, RECON_INTAKE_GATE_TOKEN } from '../campaigns/plan.js';
 import { resolveProjectGraphBinding } from '../projects/graph.js';
 import { MEMBERSHIP_ATTACHED, membershipAttachedKey } from '../projects/events.js';
 const V = API_PREFIX;
@@ -78,8 +79,10 @@ export const ImportEvalCorpusSchema = z
     .strict();
 // The recon trigger's body (the pinned multiscope wire — see api/multiscope.ts): the operator's
 // brief verbatim (`problem` — studio composes its own recon framing, this route never rewrites
-// caller text) plus the two optional scope fields. Strict: a misspelled scope field must 400 by
-// name, never launch an unscoped recon the caller believed was scoped (FINDING-031).
+// caller text) plus the two optional scope fields, plus `ungated` (crew#391): every launched
+// sibling pauses at its intake gate BY DEFAULT — the posture the launch banner promises — and
+// an unattended fan is an EXPLICIT request, never a silent default. Strict: a misspelled field
+// must 400 by name, never launch a recon the caller believed was different (FINDING-031).
 export const TestingReconSchema = z
     .object({
     problem: z.string().min(1),
@@ -88,6 +91,7 @@ export const TestingReconSchema = z
         .array(z.string().min(1))
         .min(1, 'repoRefs must name at least one registered repo — omit the field to scope by project alone')
         .optional(),
+    ungated: z.boolean().optional(),
 })
     .strict();
 export function registerTestingRoutes(app, adapter, deps) {
@@ -174,8 +178,11 @@ export function registerTestingRoutes(app, adapter, deps) {
     // standard /ws frames. What THIS route adds is the pinned multiscope wire: `repoRefs` and/or
     // `projectId` resolve (fail-closed, api/multiscope.ts) to registered repos, and because one
     // engine run carries ONE repo (`LaunchOptions.repoRef` — wicked-core#179), a multi-repo recon
-    // FANS one run per repo under one shared campaign label. Neither field ⇒ one unscoped run —
-    // exactly the launch the studio ReconPanel sends today, kept backward compatible.
+    // FANS one run per repo. A real fan (≥ 2 repos) registers an ENGINE campaign and files the
+    // siblings under it (crew#390 — `GET /campaigns` serves it with real stats); every sibling
+    // pauses at its intake gate unless the caller EXPLICITLY sent `ungated: true` (crew#391 — the
+    // launch banner's promise is the default, never silently 'none'). Neither scope field ⇒ one
+    // unscoped run — the launch the studio ReconPanel sends today, kept backward compatible.
     app.post(`${V}/testing/recon`, {
         config: {
             manifest: {
@@ -209,9 +216,130 @@ export function registerTestingRoutes(app, adapter, deps) {
         if (!scope.ok) {
             return reply.code(scope.status).send({ error: scope.error });
         }
-        // The shared campaign label every fanned run files under (audit detail + response) — the
-        // grouping handle the scoreboard and the run list can fold siblings by.
+        // The shared campaign label every fanned run files under (audit detail + response) — and,
+        // for a real fan (≥ 2 repos), the id of the ENGINE campaign it registers (crew#390).
         const campaign = `recon-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+        // The gate posture (crew#391): the intake gate per sibling — the exact promise the launch
+        // banner makes ("stops at its intake gate; nothing runs until you approve") — unless the
+        // caller EXPLICITLY sent `ungated: true`. Never a silent default the banner contradicts.
+        const gate = b.ungated === true ? 'none' : RECON_INTAKE_GATE_TOKEN;
+        /** The audit-detail fields every launch spelling shares. */
+        const gateDetail = { gate, ...(b.ungated === true ? { ungated: true } : {}) };
+        /** The post-commit half of the §2.2 filing (the POST /runs idiom): tag future /ws frames
+         *  and emit the membership event with the AUTHENTICATED actor id. */
+        const fileIntoProject = (runId, attachedAt) => {
+            if (b.projectId === undefined || deps.projects === undefined)
+                return;
+            deps.projects.index.set(runId, b.projectId);
+            deps.projects.bus?.emit(MEMBERSHIP_ATTACHED, {
+                project_id: b.projectId,
+                member: { kind: 'crew.run', ref: runId },
+                actor: actorOf(req).id,
+            }, membershipAttachedKey(b.projectId, 'crew.run', runId, attachedAt));
+        };
+        // ── A real fan (≥ 2 repos): register the ENGINE campaign and file the runs under it ────
+        // (crew#390, option (a)): the fan converges with the campaign-launch path — one durable
+        // `CampaignDef` (one agent node per repo, no edges, fan-width concurrency), scheduled and
+        // persisted by the engine, so `GET /campaigns` serves it with real per-node stats instead
+        // of a label only the audit trail could see. The per-run loop below stays for the
+        // single/unscoped recon (today's shape, unchanged) and as the honest fallback on an
+        // engine addon without the campaign bindings — and on win32, where the engine's
+        // `wicked-worktrees/<run_id>` path (':' in the run id) cannot exist on the filesystem.
+        if (scope.repos.length >= 2 && adapter.campaignsSupported() && process.platform !== 'win32') {
+            const built = buildReconCampaign({
+                id: campaign,
+                problem: b.problem,
+                repos: scope.repos,
+                clis: deps.roster(),
+                ungated: b.ungated === true,
+            });
+            // Pre-provision every node's worktree BEFORE the launch (the engine names worktree
+            // branches `wicked/{run_id}` verbatim, and a node run id is not a legal git ref — see
+            // campaigns/worktrees.ts). Fail-closed: a git refusal aborts with nothing scheduled.
+            const rootOf = new Map((await adapter.listRepos()).map((r) => [r.id, r.root_path]));
+            let rollbackWorktrees;
+            try {
+                rollbackWorktrees = await adapter.provisionCampaignWorktrees(scope.repos.map((r, i) => {
+                    const repoRoot = rootOf.get(r.id);
+                    if (repoRoot === undefined) {
+                        // Unreachable (resolveScopeRepos just admitted these ids) — but a missing root
+                        // must abort, never provision a worktree in a guessed location.
+                        throw new Error(`repo '${r.id}' vanished from the registry mid-launch`);
+                    }
+                    return { runId: built.runIds[i], repoRoot };
+                }));
+            }
+            catch (err) {
+                return reply.code(500).send({ error: message(err) });
+            }
+            try {
+                await adapter.launchCampaign(built.def);
+            }
+            catch (err) {
+                // Nothing launched (the engine validates-then-persists the def as one unit): reclaim
+                // the pre-provisioned worktrees, then answer with the campaign-route posture — 409
+                // for a state conflict, else 500 (the def is DAEMON-built from already-validated
+                // inputs, so a reject here is ours, not "fix your request").
+                await rollbackWorktrees().catch(() => { });
+                const msg = message(err);
+                const busy = /already exists|already launched|busy|in flight/i.test(msg);
+                return reply.code(busy ? 409 : 500).send({ error: msg });
+            }
+            audit.record('campaign.launched', actorOf(req), {
+                detail: {
+                    campaignId: campaign,
+                    nodes: built.def.nodes.length,
+                    edges: 0,
+                    policy: built.def.policy,
+                    maxConcurrency: built.def.max_concurrency,
+                    recon: true,
+                    ...gateDetail,
+                    ...(b.projectId !== undefined ? { projectId: b.projectId } : {}),
+                    repoRefs: scope.repos.map((r) => r.id),
+                },
+            });
+            // Campaign nodes are UNFILED at the engine seam (`RunSpec::to_launch_spec` pins
+            // `project_id: None` — filing rides the daemon, per the engine's own doc), so a
+            // projectId recon files each sibling here: the membership row via the projects surface,
+            // then the same post-commit index/event half `POST /runs` performs. The node run ids
+            // are deterministic (`{campaign}:{node}:a0`), so the rows land before any run finishes.
+            let projectAttachError;
+            for (const [i, runId] of built.runIds.entries()) {
+                if (b.projectId !== undefined) {
+                    try {
+                        const { member } = await adapter.projectMemberAttach(b.projectId, 'crew.run', runId, { campaign, recon: true }, actorOf(req).id);
+                        fileIntoProject(runId, member.attached_at);
+                    }
+                    catch (err) {
+                        // The campaign is LIVE — failing the request now would report a launch that
+                        // happened as one that did not. Name the filing gap instead (the chats-route
+                        // idiom): the operator can re-attach via POST /projects/:id/members.
+                        projectAttachError ??= message(err);
+                        req.log.warn({ runId, projectId: b.projectId }, `recon run filing failed: ${message(err)}`);
+                    }
+                }
+                // The same trail entry POST /runs writes — each node IS a run launch this route
+                // caused, findable by the same `?action=run.launched` query, grouped by the label.
+                audit.record('run.launched', actorOf(req), {
+                    runId,
+                    detail: {
+                        campaign,
+                        recon: true,
+                        ...gateDetail,
+                        repoRef: scope.repos[i].id,
+                        ...(b.projectId !== undefined ? { projectId: b.projectId } : {}),
+                    },
+                });
+            }
+            return reply.code(201).send({
+                runId: built.runIds[0],
+                runIds: built.runIds,
+                campaign,
+                campaignRegistered: true,
+                ...(projectAttachError !== undefined ? { projectAttachError } : {}),
+            });
+        }
+        // ── The per-run path: single repo / unscoped (today's shape), or no campaign bindings ──
         // No scope fields ⇒ one unscoped run (today's recon), spelled as a single null target.
         const targets = scope.repos.length > 0 ? scope.repos : [null];
         const runIds = [];
@@ -221,6 +349,9 @@ export function registerTestingRoutes(app, adapter, deps) {
                 problem: b.problem,
                 sessionId: runId,
                 clisJson: JSON.stringify(deps.roster()),
+                // crew#391: the intake gate rides EVERY spelling of the recon launch — the fallback
+                // fan and the single run hold the same posture the banner promises.
+                humanConfirm: gate,
             };
             if (target !== null)
                 input.repoRef = target.id;
@@ -247,6 +378,7 @@ export function registerTestingRoutes(app, adapter, deps) {
                             `${runIds.length} run(s) launched: ${msg}`,
                         runIds,
                         campaign,
+                        campaignRegistered: false,
                     });
                 }
                 if (err instanceof ProjectsUnsupportedError) {
@@ -262,26 +394,22 @@ export function registerTestingRoutes(app, adapter, deps) {
                 detail: {
                     campaign,
                     recon: true,
+                    ...gateDetail,
                     ...(target !== null ? { repoRef: target.id } : {}),
                     ...(b.projectId !== undefined ? { projectId: b.projectId } : {}),
                 },
             });
-            if (b.projectId !== undefined && deps.projects !== undefined) {
-                // The post-commit half of the §2.2 filing (the POST /runs idiom): tag future /ws
-                // frames and emit the membership event with the AUTHENTICATED actor id.
-                deps.projects.index.set(runId, b.projectId);
-                deps.projects.bus?.emit(MEMBERSHIP_ATTACHED, {
-                    project_id: b.projectId,
-                    member: { kind: 'crew.run', ref: runId },
-                    actor: actorOf(req).id,
-                }, membershipAttachedKey(b.projectId, 'crew.run', runId, Date.now()));
-            }
+            fileIntoProject(runId, Date.now());
             runIds.push(runId);
         }
         // `runId` (first) is the single-run spelling the ReconPanel's launch already reads;
         // `runIds` is the source of truth (length ≥ 1 always — one entry per fanned repo, in the
-        // caller's resolved order; one entry for an unscoped recon).
-        return reply.code(201).send({ runId: runIds[0], runIds, campaign });
+        // caller's resolved order; one entry for an unscoped recon). `campaignRegistered: false`
+        // says honestly that THIS launch will not appear on GET /campaigns (a single/unscoped
+        // recon, or an engine addon without the campaign bindings).
+        return reply
+            .code(201)
+            .send({ runId: runIds[0], runIds, campaign, campaignRegistered: false });
     });
 }
 //# sourceMappingURL=testing.js.map