wicked-crew 0.8.10 → 0.9.1

package/dist/api/routes.js

@@ -8,7 +8,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, GovernanceReplayUnsupportedError, PlanLaunchUnsupportedError, SteeringUnsupportedError, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
+import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, GovernanceReplayUnsupportedError, PlanLaunchUnsupportedError, SteeringUnsupportedError, addonSupportsReducedAssurance, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
 import { codeGraphDb, codeGraphErrorStatus, requirementsGraph } from '../core/repoPaths.js';
 import { resolveCursorUnit } from '../core/cursor.js';
 import { detectRefusal } from './gate-cache.js';
@@ -33,12 +33,15 @@ import { listInteractiveDocs } from '../interactive/docs-index.js';
 import { TestSetIndex } from '../qe/test-sets.js';
 import { estateExe, parseEstateTotals, resolveProjectGraphBinding } from '../projects/graph.js';
 import { registerProjectRoutes } from '../projects/routes.js';
+import { registerProjectAggregateRoutes } from './project-aggregates.js';
+import { registerProductRoutes } from './product.js';
 import { registerPresetRoutes } from '../presets/routes.js';
 import { registerTeamRoutes } from '../team/routes.js';
 import { registerCampaignRoutes } from '../campaigns/routes.js';
 import { registerGovernanceWikiRoutes } from './governance-wiki.js';
 import { DEFAULT_STEERING_TYPE, STEERING_TYPE_VALUES, STEERING_TYPES, registerGovernanceSteeringRoutes, } from './governance-steering.js';
 import { isSteeringAuthorRun, landSteeringProposal } from './steering-landing.js';
+import { inventoryComplete, parseInventoryClaims } from '../core/inventory-claim.js';
 import { ApproveEditSchema, approveEdited, captureLaunchRoots, editInFlight, FileProposalSchema, registerCaptureRoutes } from './capture.js';
 import { registerTestingRoutes } from './testing.js';
 import { DEMO_PRESET, demoLaunchRoots, registerDemoRoutes, registerWalkthroughRoutes, walkthroughAcceptance } from './recording.js';
@@ -50,12 +53,16 @@ import { phaseSkillFindings, withPhaseSkillGaps } from '../skills/phase-skill-ga
 import { STATE_HOME_BLOCKER_CODE, STATE_HOME_REMEDY, isEngineStateHomeRefusal, stateHomeBlockerBody, } from '../projects/state-home-preflight.js';
 import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE, baseSkillRemedy } from '../skills/base-skill.js';
 import { REQUIRED_GARDEN_VERSION } from '../skills/plugin-source.js';
-import { noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
+import { engineRosterJson, noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
+import { launchAssuranceNotice } from '../core/assurance.js';
+import { QE_ACCEPTANCE, aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcceptanceRefusal, receiptOf, requiresQeAcceptance, unreadableQeAcceptance, } from './delivery-assurance.js';
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { isHumanOperator } from './watch-routes.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
 import { composeDeliverText, configuredPublicOrigin, extractFollowUps, factsFromRun, reportsFromOutputs, FOLLOW_UPS_MAX, framedDeliverText, runUrlFor, } from '../core/deliver-text.js';
-import { deliverRepoFor, deliverTargetView, isGitHubLogin, readDeliverOriginUrl, resolvePullRequest as resolvePullRequestViaGh, } from '../core/deliver.js';
+import { deliverRepoFor, deliverTargetView, isGitHubLogin, readDeliverOriginUrl, resolvePullRequest as resolvePullRequestViaGh, unverifiedTreesFrom, } from '../core/deliver.js';
+import { credentialsMissingIn, deliverCredentialsProbe, missingCredentials } from '../core/deliver-credentials.js';
+import { codebaseArchiveUrl } from './codebase-archive.js';
 import { registerInteractiveProxy } from '../interactive/proxy-routes.js';
 import { registerInteractiveDocDelete } from '../interactive/doc-delete-routes.js';
 import { registerInteractiveDocChecks } from '../interactive/doc-checks-routes.js';
@@ -77,7 +84,7 @@ import { DeliveryFreeze, frozenRefusal, isDeliverUnit, registerDeliveryFreezeRou
 import { GroupIndex } from './group-index.js';
 import { RunTimingIndex, recordRunLaunched } from './run-timing-index.js';
 import { GuidanceIndex } from './guidance-index.js';
-import { DELIVER_REQUESTED_ACTION, DeliveryIndex, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, deliveryRecordFrom, pushedState, canDeliverResolver, FREE_TEXT_NOTICE, freeTextOutcome, } from './delivery-index.js';
+import { DELIVER_REQUESTED_ACTION, DeliveryIndex, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, deliveryRecordFrom, deliverUnitOf, pushedState, canDeliverResolver, FREE_TEXT_NOTICE, freeTextOutcome, } from './delivery-index.js';
 import { DeliveryDerivationCache } from './delivery-cache.js';
 import { gitReprovisionWorktree, runDeliverScript, } from './post-hoc-deliver.js';
 import { LOCAL_ACTOR, trustAtLeast } from './auth.js';
@@ -399,6 +406,11 @@ export const LaunchSchema = z.object({
      *  the issue. They are answered as `linkedIssues[].excluded`. Send only when
      *  `GET /health.capabilities.linkedIssuesExclude === true`. */
     excludeLinkedIssues: ExcludeLinkedIssuesSchema,
+    /** wicked-core#850 (api-types 0.102.0) — the EXPLICIT reduced-assurance opt-in: the creator's seat
+     *  may evaluate and a judge-less gate may pass, disclosed on every receipt. `false` is an explicit
+     *  "full assurance", the same as omitting it: the launcher never chooses for the caller, and a
+     *  full-assurance launch on a one-CLI roster is answered with `assuranceNotice` (`core/assurance.ts`). */
+    reducedAssurance: z.boolean().optional(),
 }).strict().refine((b) => b.plan === undefined || b.workflow === undefined, {
     message: 'plan and workflow are mutually exclusive — a launch carries a plan or names a preset, not both',
     path: ['plan'],
@@ -428,7 +440,10 @@ export const LaunchSchema = z.object({
  *  evaluator's discarded, pinned edit as the creator's amendment. The ENGINE refuses each at any
  *  other gate (a 409 naming the gate it answers). */
 export const ESCALATION_ACTIONS = ['extend', 'targeted', 'accept_partial', 'accept_suggestion'];
-const isEscalationAction = (a) => a !== undefined && ESCALATION_ACTIONS.includes(a);
+/** (core#820) A consent gate's answer token: `consent:<choice id>` approves that row of the dry-run
+ *  plan (the engine refuses an id its plan does not offer); `reject` stays the decline. */
+export const CONSENT_CHOICE_ACTION = /^consent:[A-Za-z0-9_-]{1,32}$/u; // core `parse_plan` caps a choice id at 32
+const isEscalationAction = (a) => a !== undefined && (ESCALATION_ACTIONS.includes(a) || CONSENT_CHOICE_ACTION.test(a));
 /** `POST /runs/:id/gate` (api-types 0.38.0 `GateDecision`; DES-L1 PR-2). Additive arms: `action`
  *  names the arm (`approve` | `request_changes` | `reject`; absent = today's two-arm mapping of
  *  `approve`), `amendScope` says where an approve's `amend` lands (`cursor` = the gated unit, today's
@@ -445,7 +460,12 @@ const isEscalationAction = (a) => a !== undefined && ESCALATION_ACTIONS.includes
 export const GateSchema = z.object({
     approve: z.boolean(),
     amend: z.string().optional(),
-    action: z.enum(['approve', 'request_changes', 'reject', 'edit_plan', 'amend_intent', ...ESCALATION_ACTIONS]).optional(),
+    action: z
+        .union([
+        z.enum(['approve', 'request_changes', 'reject', 'edit_plan', 'amend_intent', ...ESCALATION_ACTIONS]),
+        z.string().regex(CONSENT_CHOICE_ACTION, 'a consent choice is `consent:<choice id>`'),
+    ])
+        .optional(),
     amendScope: z.enum(['cursor', 'creator']).optional(),
     /** DES-TEAMING-002 T3 — approve a `plan_approval` gate WITH AN EDIT (`GateDecision.plan`). */
     plan: PlanSchema.optional(),
@@ -453,11 +473,11 @@ export const GateSchema = z.object({
      *  open gate is a 409 `gate_changed`: the decision was made on a gate that is no longer open. */
     ord: z.number().int().nonnegative().optional(),
 }).strict().refine((b) => b.action === undefined
-    || (b.action === 'approve' || b.action === 'edit_plan' || b.action === 'amend_intent' || isEscalationAction(b.action)) === b.approve, { message: '`action` disagrees with `approve`: request_changes and reject require approve: false; approve, edit_plan, amend_intent, extend, targeted, accept_partial and accept_suggestion require approve: true', path: ['action'] }).refine(
+    || (b.action === 'approve' || b.action === 'edit_plan' || b.action === 'amend_intent' || isEscalationAction(b.action)) === b.approve, { message: '`action` disagrees with `approve`: request_changes and reject require approve: false; approve, edit_plan, amend_intent, extend, targeted, accept_partial, accept_suggestion and consent:<id> require approve: true', path: ['action'] }).refine(
 // (wicked-core#555) An intent amendment IS its text: an empty one amends nothing, and the arm's
 // scope is every unit at or after the cursor — which is what makes it reach the evaluator — so
 // `amendScope` cannot narrow it. Both are 400s here rather than a 409 from the engine.
-(b) => b.action !== 'amend_intent' || (b.amend !== undefined && b.amend.trim() !== ''), { message: 'amend_intent needs `amend`: what the run\'s acceptance list now says (approve without an action to proceed unamended)', path: ['amend'] }).refine((b) => b.action !== 'amend_intent' || (b.amendScope === undefined && b.plan === undefined), { message: 'amend_intent takes no amendScope or plan — an intent amendment reaches every unit at or after the cursor, which is what makes it reach the evaluator', path: ['amendScope'] }).refine((b) => !isEscalationAction(b.action) || (b.amend === undefined && b.amendScope === undefined && b.plan === undefined), { message: 'extend, targeted, accept_partial and accept_suggestion take no amend, amendScope or plan — the engine re-runs the floor or adopts the pinned edit as it stands', path: ['action'] }).refine((b) => (b.action === 'edit_plan') === (b.plan !== undefined) || (b.action === undefined && b.plan !== undefined), { message: 'an edited plan answers a plan_approval gate: `plan` needs approve: true with `action` omitted or edit_plan, and edit_plan needs `plan`', path: ['plan'] }).refine((b) => b.plan === undefined || (b.approve && b.amend === undefined && b.amendScope === undefined), { message: '`plan` is an approve WITH an edited plan: approve: true, and no amend / amendScope (the plan is the edit)', path: ['plan'] }).refine((b) => b.amendScope === undefined || b.approve, { message: '`amendScope` applies to an approve only (approve: true)', path: ['amendScope'] });
+(b) => b.action !== 'amend_intent' || (b.amend !== undefined && b.amend.trim() !== ''), { message: 'amend_intent needs `amend`: what the run\'s acceptance list now says (approve without an action to proceed unamended)', path: ['amend'] }).refine((b) => b.action !== 'amend_intent' || (b.amendScope === undefined && b.plan === undefined), { message: 'amend_intent takes no amendScope or plan — an intent amendment reaches every unit at or after the cursor, which is what makes it reach the evaluator', path: ['amendScope'] }).refine((b) => !isEscalationAction(b.action) || (b.amend === undefined && b.amendScope === undefined && b.plan === undefined), { message: 'extend, targeted, accept_partial, accept_suggestion and consent:<id> take no amend, amendScope or plan — the engine re-runs the floor, adopts the pinned edit, or runs the chosen install as it stands', path: ['action'] }).refine((b) => (b.action === 'edit_plan') === (b.plan !== undefined) || (b.action === undefined && b.plan !== undefined), { message: 'an edited plan answers a plan_approval gate: `plan` needs approve: true with `action` omitted or edit_plan, and edit_plan needs `plan`', path: ['plan'] }).refine((b) => b.plan === undefined || (b.approve && b.amend === undefined && b.amendScope === undefined), { message: '`plan` is an approve WITH an edited plan: approve: true, and no amend / amendScope (the plan is the edit)', path: ['plan'] }).refine((b) => b.amendScope === undefined || b.approve, { message: '`amendScope` applies to an approve only (approve: true)', path: ['amendScope'] });
 /** `PUT /runs/:id/guidance` (DES-UX-002 §7.2, CREW-UX-7) — the durable pre-gate note body.
  *  The empty string is a legal body: it CLEARS the note. The byte cap is checked in the route
  *  (not zod's char-counting `max`) so the 400 names the actual limit. */
@@ -932,6 +952,10 @@ runtime = {}) {
             view.session.launch_actor = launchActor;
         const state = resolveDelivery(view, conflictStrand);
         view.session.delivery = state.delivery;
+        // wicked-core#850 EX-04: a post-hoc delivery reads unverified, with its trees. ABSENT otherwise.
+        const deliveryAssurance = deliveryIndex.assuranceFor(view.session.id);
+        if (deliveryAssurance !== undefined)
+            view.session.delivery_assurance = deliveryAssurance;
         // crew#762: was delivery asked for? The launch's decision (`deliver: 'pr'`), a post-hoc attempt
         // or a delivery on record says yes; a launch that said `deliver: 'none'` with neither says no.
         // ABSENT when the daemon holds no launch record and no attempt (never fabricated).
@@ -952,6 +976,15 @@ runtime = {}) {
             view.session.deliverBranch = state.deliverBranch;
         if (state.deliverRemote !== undefined)
             view.session.deliverRemote = state.deliverRemote;
+        // crew#720: the final-codebase zip (every outcome), and a deliver phase that refused for want of
+        // the provider credential — read from the deliver unit's own refusal line.
+        const archive = runtime.codebaseArchives?.get(view.session.id);
+        if (archive !== undefined)
+            view.session.codebase_archive = archive;
+        const deliverUnit = deliverUnitOf(view);
+        const credMissing = deliverUnit !== null && deliverUnit.status !== 'done' ? credentialsMissingIn(deliverUnit.denial_reason ?? '') : null;
+        if (credMissing !== null)
+            view.session.deliver_credentials = missingCredentials(credMissing);
         // crew#641/#642 (item 5): chat promotion provenance — ABSENT when not a chat-promoted run.
         const chatSeatCount = runTimingIndex.chatSeatCountFor(view.session.id);
         if (chatSeatCount !== undefined)
@@ -1038,6 +1071,10 @@ runtime = {}) {
             askPath: typeof adapter.engineCapabilities === 'function' ? adapter.engineCapabilities().askPath : false,
             // WT-W1: repo-bound launches mint an evidence root only on an addon that takes the field.
             walkthroughRoots: typeof adapter.evidenceRootsSupported === 'function' ? adapter.evidenceRootsSupported() : false,
+            // wicked-core#850: `LaunchRunBody.reducedAssurance` is accepted (the installed addon carries the
+            // assurance contract); a one-CLI full-assurance launch answers `assuranceNotice`. A route set
+            // that cannot probe the addon reports no capability — never an invented one.
+            reducedAssurance: typeof adapter.engineCapabilities === 'function' && addonSupportsReducedAssurance(),
         };
         // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
         // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
@@ -1719,8 +1756,18 @@ runtime = {}) {
         // F-E2E-030: only the explicit `'auto'` opts out of the engine's deliver gate. `'human'` and
         // an omitted field both leave `autoDeliver` off the input — the gate is the engine's default,
         // so the wire never has to say "gate me" to be gated.
-        if (b.deliverGate === 'auto')
+        if (b.deliverGate === 'auto') {
+            // wicked-core#850 EX-03: a workflow that requires QE acceptance delivers only through the deliver
+            // gate, where crew checks the verdict. Unattended delivery would push before anyone could.
+            const required = b.workflow !== undefined ? adapter.getWorkflow(b.workflow)?.required_instruments : undefined;
+            if (required?.includes(QE_ACCEPTANCE) === true) {
+                return reply.code(400).send({
+                    error: `workflow ${b.workflow} requires QE acceptance (required_instruments: qe_acceptance), so it delivers only ` +
+                        'through the deliver gate, where the verdict is checked — deliverGate: "auto" cannot apply to it',
+                });
+            }
             input.autoDeliver = true;
+        }
         if (b.repoRef !== undefined)
             input.repoRef = b.repoRef;
         if (b.workflow !== undefined)
@@ -1786,6 +1833,10 @@ runtime = {}) {
         }
         if (deliver === 'pr')
             input.deliver = 'pr';
+        // wicked-core#850 EX-01/EX-02: forwarded only when the caller sent it — crew never waives
+        // assurance on anyone's behalf (a one-CLI launch that did not is TOLD so in its answer, below).
+        if (b.reducedAssurance === true)
+            input.reducedAssurance = true;
         // DES-L9 / crew#550 — REVISION: `revisesPr` names an OPEN same-repository pull request whose
         // head branch becomes the run's base (`baseRef`, crew-internal → the engine's
         // `LaunchSpec.base_ref`) and the push target of the composed deliver phase — the PR gains
@@ -1907,6 +1958,9 @@ runtime = {}) {
                 // trail says what the run will actually do, and whether the daemon decided it.
                 deliver,
                 ...(deliverDefaulted ? { deliverDefaulted: true } : {}),
+                // wicked-core#850: the caller's explicit assurance choice (the engine persists the contract
+                // on the session; this records WHO waived it).
+                ...(b.reducedAssurance !== undefined ? { reducedAssurance: b.reducedAssurance } : {}),
                 // CREW-UX-3: the trail is the durable record of lineage — the retry index (and a
                 // restarted daemon's hydrate) reads it back from exactly this entry.
                 ...(b.retryOf !== undefined ? { retryOf: b.retryOf } : {}),
@@ -1963,7 +2017,11 @@ runtime = {}) {
             // was built from, the launch answer says so (a recorded proof can disclose which garden ran).
             const skillsAhead = runtime.skills?.installedAheadFinding({ fresh: true }) ?? null; // fresh: an upgrade just before Send counts (codex r1)
             const skillsWarning = skillsAhead === null ? {} : { skillsWarning: { kind: skillsAhead.kind, severity: skillsAhead.severity, message: skillsAhead.message } };
-            return reply.code(201).send({ runId, ...(linkedIssues !== undefined ? { linkedIssues } : {}), ...freeText, ...skillsWarning });
+            // wicked-core#850: a full-assurance run on a one-CLI roster will wait at a gate for a seat that
+            // can evaluate or judge it; the answer names the explicit opt-in to relaunch with.
+            const notice = launchAssuranceNotice({ runId, reducedAssurance: b.reducedAssurance, engineClisJson: engineRosterJson(input.clisJson) });
+            const assuranceNotice = notice === null ? {} : { assuranceNotice: notice };
+            return reply.code(201).send({ runId, ...(linkedIssues !== undefined ? { linkedIssues } : {}), ...freeText, ...skillsWarning, ...assuranceNotice });
         }
         catch (err) {
             const msg = message(err);
@@ -2137,6 +2195,61 @@ runtime = {}) {
         await settleDeliveries([run]);
         return { run: decorateRun(run) };
     });
+    // ── Inventory claims (crew#721) — whether each enumerating step's list is complete ──
+    // A step that lists things a later step acts on ends its reply with a `wicked-inventory` block
+    // (wicked-garden core/refs/inventory-report.md). This reads them off every unit's captured
+    // output, so a reviewer sees "partial: 9 of 10, issue #936 unread" without opening transcripts
+    // (crew#648). `complete` is true only when at least one unit claimed an inventory, every claim is
+    // `full` and every unit's output was readable; `readable: false` when the adapter keeps none.
+    app.get(`${V}/runs/:id/inventory`, {
+        config: {
+            manifest: {
+                responseType: 'RunInventoryResponse',
+                statusCodes: [200, 404],
+            },
+        },
+    }, async (req, reply) => {
+        const { id } = req.params;
+        const views = await adapter.sessionsDetail();
+        const run = views.find((v) => v.session.id === id);
+        if (!run)
+            return reply.code(404).send({ error: 'Run not found' });
+        if (typeof adapter.workOutput !== 'function') {
+            return { runId: id, readable: false, complete: false, units: [], unreadUnits: [] };
+        }
+        const units = [];
+        // A unit whose output could not be READ is not a unit that claimed nothing: it may hold the
+        // partial claim, so it is listed and the run is never `complete` while any remain (codex r1).
+        const unreadUnits = [];
+        for (const u of [...run.units].sort((a, b) => a.ord - b.ord)) {
+            let text;
+            try {
+                text = await adapter.workOutput(coreUnitId(id, u));
+            }
+            catch {
+                unreadUnits.push(u.id);
+                continue;
+            }
+            if (text === null) {
+                // No output from a unit that has not run is expected; from one that finished, the
+                // transcript is missing and may have held the claim (codex r3).
+                if (u.status === 'done' || u.status === 'rejected')
+                    unreadUnits.push(u.id);
+                continue;
+            }
+            const claims = parseInventoryClaims(text);
+            if (claims.length > 0)
+                units.push({ ord: u.ord, unitId: u.id, claims });
+        }
+        const all = units.flatMap((u) => u.claims);
+        return {
+            runId: id,
+            readable: true,
+            complete: inventoryComplete(all) && unreadUnits.length === 0,
+            units,
+            unreadUnits,
+        };
+    });
     // ── Deliver text (crew#524 / F-3R2-014) — the PR title + body a run's delivery carries ──
     // `gh pr create --fill` gave wicked-studio#249 a mid-word title and an EMPTY body. The deliver
     // script now asks this route for the text composed from the PERSISTED RUN RECORD: the intent,
@@ -2217,8 +2330,12 @@ runtime = {}) {
         // re-run on a delivered run, so a double-click (or a retry after a slow response) cannot
         // double-open. The index only ever holds real runs, so this needs no store round-trip.
         const existing = deliveryIndex.urlFor(id);
-        if (existing !== undefined)
-            return { prUrl: existing };
+        if (existing !== undefined) {
+            const recorded = deliveryIndex.assuranceFor(id);
+            // crew#720: the run's final-codebase zip rides the replay too.
+            const zip = runtime.codebaseArchives?.get(id);
+            return { prUrl: existing, ...(recorded !== undefined ? { assurance: recorded } : {}), ...(zip !== undefined ? { codebase: zip } : {}) };
+        }
         // N1: a run whose branch is already on a non-GitHub origin has nothing left to lift, and no
         // pull request can be opened from here — say so instead of pushing the branch again.
         const pushedAlready = deliveryIndex.pushedFor(id);
@@ -2252,6 +2369,12 @@ runtime = {}) {
         // back to `| null`.
         const repoRef = s.repo_ref;
         const initialWorkdir = s.workdir;
+        // wicked-core#850 EX-03: a run whose contract requires QE acceptance is lifted only on a PASS
+        // attributed to it — checked BEFORE anything is spawned, so a refusal pushes nothing.
+        const qeAcceptance = await qeAcceptanceCheckFor(run);
+        if (qeAcceptance !== null && !qeAcceptance.satisfied) {
+            return reply.code(409).send(qeAcceptanceRefusal(id, qeAcceptance, aggregateReceipt(run, null), 'post_hoc'));
+        }
         // One delivery per run at a time: the script pushes and opens a PR, so two concurrent
         // spawns could race gh into two PRs — the exact double-open idempotency forbids. The guard
         // wraps the reprovision too, so a reaped run's `wicked/<id>` branch is only ever checked out
@@ -2272,6 +2395,7 @@ runtime = {}) {
         // that branch and lift THAT; the branch (the record) is untouched. `cleanupWorktree` tears
         // the throwaway down after the lift.
         let result;
+        let codebase;
         let worktreeGone = false;
         // DES-L9: a stranded REVISION re-pushes onto its PR's branch (re-checked OPEN via the same
         // resolver), never a new PR; a PR that closed meanwhile is a named 409.
@@ -2330,6 +2454,17 @@ runtime = {}) {
                         // remotes), so the PR opens where origin points rather than where gh's default does.
                         originUrl: await readDeliverOriginUrl(workdir),
                     });
+                    // crew#720: the final-codebase zip, taken while this checkout (perhaps a throwaway)
+                    // still exists — whatever the script's verdict.
+                    const archives = runtime.codebaseArchives;
+                    if (archives !== undefined) {
+                        try {
+                            codebase = (await archives.archive(id, { workdir, repoRoot: (await repoRootOf(repoRef)) ?? null }, 'deliver')) ?? undefined;
+                        }
+                        catch {
+                            // Best-effort: the archive store logs its own failures; a lookup that threw leaves none.
+                        }
+                    }
                 }
                 finally {
                     if (cw !== null)
@@ -2368,6 +2503,8 @@ runtime = {}) {
             // guarantees nothing was pushed on the refusing paths.
             return reply.code(409).send({
                 error: `deliver failed (exit ${result.status}): ${deliverErrorTail(result.output)}`,
+                // crew#720: the final-codebase zip is there whatever the verdict.
+                ...(codebase !== undefined ? { codebase } : {}),
             });
         }
         // The SAME parser the in-run record uses: the script's push-only verdict outranks a URL a
@@ -2375,12 +2512,16 @@ runtime = {}) {
         const record = deliveryRecordFrom(result.output);
         const url = record !== null && 'url' in record ? record.url : null;
         const pushedOnly = record !== null && 'pushed' in record ? record.pushed : null;
+        // wicked-core#850 EX-04: no engine lift re-verified what this pushed — the run record says so,
+        // with the trees the script named (the PR body carries the same label). Built before the
+        // outcome branches, so a push-only delivery records it too (codex r1).
+        const assurance = postHocDeliveryAssurance(run, unverifiedTreesFrom(result.output), qeAcceptance);
         if (pushedOnly !== null) {
             // N1: the script pushed the branch and gh could resolve no GitHub repository for the
             // origin. That IS a delivery — record it, so the run reads `delivery: 'pushed'` — but there
             // is no PR URL to answer with, so the reply says what happened instead of a 200 `prUrl`.
-            audit.record('run.delivered', actorOf(req), { runId: id, detail: { pushed: pushedOnly, via: 'post-hoc' } });
-            deliveryIndex.setPushed(id, pushedOnly);
+            audit.record('run.delivered', actorOf(req), { runId: id, detail: { pushed: pushedOnly, via: 'post-hoc', assurance } });
+            deliveryIndex.setPushed(id, pushedOnly, assurance);
             return reply.code(409).send({ error: pushedOnlyRefusal(id, pushedOnly) });
         }
         if (url === null) {
@@ -2392,9 +2533,9 @@ runtime = {}) {
         }
         // The durable record first, then the read-side index — the same write order as the
         // deliver-phase resolution in server.ts, so the index can only LAG a crash, never lead it.
-        audit.record('run.delivered', actorOf(req), { runId: id, detail: { url, via: 'post-hoc' } });
-        deliveryIndex.set(id, url);
-        return { prUrl: url };
+        audit.record('run.delivered', actorOf(req), { runId: id, detail: { url, via: 'post-hoc', assurance, ...(codebase !== undefined ? { codebase } : {}) } });
+        deliveryIndex.set(id, url, assurance);
+        return { prUrl: url, assurance, ...(codebase !== undefined ? { codebase } : {}) };
     });
     // Durable pre-gate guidance (DES-UX-002 §7.2 — spec'd there as CREW-UX-4, implemented as
     // CREW-UX-7 because crew#308 already spent that id; see guidance-index.ts). Upserts the ONE
@@ -2517,6 +2658,7 @@ runtime = {}) {
                 scratchBase: chatScopes.base,
                 log: (m) => req.log.warn(m),
                 ...(runtime.entityCount !== undefined ? { entityCount: runtime.entityCount } : {}),
+                ...(runtime.freshenCheckout !== undefined ? { freshen: runtime.freshenCheckout } : {}),
             });
             if (!resolution.ok) {
                 chatScopes.release(chatId, token);
@@ -3056,6 +3198,8 @@ runtime = {}) {
             adapter,
             settings: projectSettings,
             docRuns,
+            // crew#896: the index carries the grounding the per-project list carries.
+            ...(runtime.docGrounding !== undefined ? { groundingStore: runtime.docGrounding } : {}),
             includeRetired: flag === '1' || flag === 'true',
         });
     });
@@ -3138,6 +3282,25 @@ runtime = {}) {
     // `outputUnavailable` saying WHICH cause applies — denied, not finished, or a store that
     // disagrees with itself. It previously answered `200 {"output": null}` to all four, so the
     // failed unit an operator opens during triage was the one that told them nothing (FINDING-006).
+    // crew#720: the run's final-codebase zip (every delivery, every outcome). 404 for an unknown run
+    // or one with no archive yet; the record (`AgentSession.codebase_archive`) names the same sha256,
+    // which the answer also carries as `X-Content-SHA256`.
+    app.get(`${V}/runs/:id/artifacts/codebase.zip`, { config: { manifest: { responseType: 'binary (application/zip)', statusCodes: [200, 404] } } }, async (req, reply) => {
+        const { id } = req.params;
+        const opened = runtime.codebaseArchives?.open(id) ?? null;
+        if (opened === null || opened.rec.url !== codebaseArchiveUrl(id)) {
+            opened?.stream.destroy();
+            return reply.code(404).send({ error: `run ${id} has no codebase archive` });
+        }
+        const rec = opened.rec;
+        const safe = id.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 80);
+        return reply
+            .header('content-type', 'application/zip')
+            .header('content-disposition', `attachment; filename="${safe}-codebase.zip"`)
+            .header('x-content-sha256', rec.sha256)
+            .header('content-length', String(rec.bytes))
+            .send(opened.stream);
+    });
     app.get(`${V}/runs/:id/units/:unitKey/output`, async (req, reply) => {
         const { id, unitKey } = req.params;
         const views = await adapter.sessionsDetail();
@@ -3262,12 +3425,22 @@ runtime = {}) {
         const run = views.find((v) => v.session.id === id);
         if (!run)
             return reply.code(404).send({ error: 'Run not found' });
+        return acceptanceViewOf(run, { ...(qeRunId !== undefined && qeRunId !== '' ? { qeRunId } : {}) });
+    });
+    /**
+     * One run's acceptance answer — the body `GET /runs/:id/acceptance` serves, and what a delivery
+     * reads (wicked-core#850 EX-03). `forceDeclared`: the run's assurance CONTRACT requires QE
+     * acceptance, so a verdict is owed even when no phase raises `verified_evidence` — missing denies.
+     */
+    async function acceptanceViewOf(run, opts) {
+        const id = run.session.id;
         // What the run must prove, from what it CONTAINS (seam X2): a plan or preset run's steps whose
         // catalog entry re-verifies evidence, a registered workflow's def, nothing for free text — and
         // an unknown run (or one the daemon cannot read) is declared and denied with the reason.
         const verifiedCatalog = typeof adapter.verifiedEvidenceCatalog === 'function' ? await adapter.verifiedEvidenceCatalog() : null;
         const knownCatalog = typeof adapter.catalogIds === 'function' ? await adapter.catalogIds() : null;
-        const requirement = acceptanceRequirementOf(run, adapter.listWorkflows(), verifiedCatalog, knownCatalog);
+        const read = acceptanceRequirementOf(run, adapter.listWorkflows(), verifiedCatalog, knownCatalog);
+        const requirement = opts.forceDeclared === true ? { ...read, declared: true } : read;
         // WT-W2: every walkthrough step the requirement names is resolved from its proof root and seal.
         const walkthroughs = await walkthroughAcceptance(adapter, run, requirement.phases);
         let repo = null;
@@ -3279,7 +3452,7 @@ runtime = {}) {
             runId: id,
             repo,
             requirement,
-            ...(qeRunId !== undefined && qeRunId !== '' ? { qeRunId } : {}),
+            ...(opts.qeRunId !== undefined ? { qeRunId: opts.qeRunId } : {}),
             // AW-14 (arch-R13a + R16): the conformance section reads the same wires the standalone
             // `/governance/claims` and `/runs/:id/events` routes serve, but run-scoped and resolved
             // deny-dominates BESIDE the QE gate — so a wiki-rule violation and an unenforced governed
@@ -3308,7 +3481,19 @@ runtime = {}) {
                 })(),
             },
         });
-    });
+    }
+    /** EX-03: the run's QE acceptance check when its contract requires `qe_acceptance`; `null` when it
+     *  does not. A read that fails is a refusal naming why, never a pass. */
+    async function qeAcceptanceCheckFor(run) {
+        if (!requiresQeAcceptance(run))
+            return null;
+        try {
+            return qeAcceptanceFromView(await acceptanceViewOf(run, { forceDeclared: true }));
+        }
+        catch (err) {
+            return unreadableQeAcceptance(err);
+        }
+    }
     /**
      * The run's OPEN gate, resolved the way `GET /runs/:id/gate` serves it: the cache, then the
      * engine's durable `interaction_requests` row (adopted into the cache), then the event-log replay.
@@ -3343,6 +3528,35 @@ runtime = {}) {
             return 'no-log';
         return gateCache.rebuild(id, events) ?? null;
     }
+    /** The unit an open gate holds: the named `ord`, else the open gate's, else the cursor's. */
+    async function gatedUnitOf(run, ord) {
+        let gateOrd = ord;
+        if (gateOrd === undefined) {
+            // A route set whose adapter cannot read the gate (a partial stub without `runEvents`) falls
+            // back to the cursor unit, exactly as a log that records no open gate does.
+            const open = await resolveOpenGate(run.session.id).catch(() => null);
+            gateOrd = open !== null && open !== 'no-log' ? open.ord : undefined;
+        }
+        const units = run.units ?? [];
+        return gateOrd !== undefined
+            ? units.find((u) => u.ord === gateOrd)
+            : [...units].sort((a, b) => a.ord - b.ord)[run.session.unit_ix];
+    }
+    /**
+     * The checks an APPROVE that runs the deliver unit must pass — the ONE place for both gate paths
+     * (`POST /runs/:id/gate`, standing orders, and a gated `POST /runs/:id/resume`): the delivery
+     * freeze (idea 15), and wicked-core#850 EX-03 — a run whose contract requires QE acceptance
+     * delivers only on an attributed PASS. A refusal leaves the gate open.
+     */
+    async function deliverApprovalRefusal(run, deliverUnit) {
+        if (deliveryFreeze.state().frozen)
+            return { refusal: { code: 409, body: frozenRefusal(deliveryFreeze.state()) } };
+        const qeAcceptance = await qeAcceptanceCheckFor(run);
+        if (qeAcceptance !== null && !qeAcceptance.satisfied) {
+            return { refusal: { code: 409, body: qeAcceptanceRefusal(run.session.id, qeAcceptance, receiptOf(deliverUnit), 'gate') } };
+        }
+        return { qeAcceptance };
+    }
     /**
      * THE gate decision path. `POST /runs/:id/gate` answers with it, and so does a standing order
      * (behaviour 10) — the same awaiting check, the same ord check and 409 `gate_changed` /
@@ -3383,22 +3597,17 @@ runtime = {}) {
                     } };
             }
         }
-        // Freeze deliveries (idea 15): an APPROVE that would run the run's deliver unit is held while
-        // the switch is on — the gate stays open, so unfreezing lets the same approve through. The gate
-        // is the named one, else the open one, else the unit the run's cursor points at.
-        if (parsed.data.approve && deliveryFreeze.state().frozen) {
-            let gateOrd = parsed.data.ord;
-            if (gateOrd === undefined) {
-                const open = await resolveOpenGate(id);
-                gateOrd = open !== null && open !== 'no-log' ? open.ord : undefined;
-            }
-            const units = run.units ?? [];
-            const gated = gateOrd !== undefined
-                ? units.find((u) => u.ord === gateOrd)
-                : [...units].sort((a, b) => a.ord - b.ord)[run.session.unit_ix];
-            if (gated !== undefined && isDeliverUnit(gated)) {
-                return { code: 409, body: frozenRefusal(deliveryFreeze.state()) };
-            }
+        // The gated unit — the named gate, else the open one, else the unit the run's cursor points at —
+        // and its receipt as it stands when the person decides (wicked-core#850: every gate answer
+        // carries it). An APPROVE that would run the deliver unit passes the delivery checks first.
+        const gated = await gatedUnitOf(run, parsed.data.ord);
+        const assurance = receiptOf(gated);
+        let deliveryCheck;
+        if (parsed.data.approve && gated !== undefined && isDeliverUnit(gated)) {
+            const refused = await deliverApprovalRefusal(run, gated);
+            if ('refusal' in refused)
+                return refused.refusal;
+            deliveryCheck = { qeAcceptance: refused.qeAcceptance };
         }
         // The steering-author landing (crew#388): decided — and the gate prompt captured — BEFORE
         // the confirm, because a terminal-phase approve prunes the gate cache and moves the run out
@@ -3452,7 +3661,15 @@ runtime = {}) {
             const landing = steeringPropose
                 ? await landSteeringProposal({ adapter, audit, actor }, run, gatePrompt)
                 : undefined;
-            return { code: 200, body: { status, ...(landing !== undefined ? { landing } : {}) } };
+            return {
+                code: 200,
+                body: {
+                    status,
+                    ...(landing !== undefined ? { landing } : {}),
+                    assurance,
+                    ...(deliveryCheck !== undefined ? { delivery: deliveryCheck } : {}),
+                },
+            };
         }
         catch (err) {
             if (err instanceof PlanLaunchUnsupportedError) {
@@ -3466,7 +3683,7 @@ runtime = {}) {
         config: {
             manifest: {
                 requestType: 'GateDecision',
-                responseType: '{ status: SessionStatus; landing?: SteeringLandingResult }',
+                responseType: 'GateDecisionResult',
                 // 409 twice over: a run not awaiting a human gate, and an engine refusal at confirm.
                 // 501: an edited plan on an addon without the plan approval gate (DES-TEAMING-002 T3).
                 statusCodes: [200, 400, 404, 409, 501],
@@ -3536,6 +3753,16 @@ runtime = {}) {
             // write too (crew#388). Prompt captured pre-confirm; see the gate route.
             const steeringPropose = gated && isSteeringAuthorRun(run);
             const gatePrompt = steeringPropose ? gateCache.get(id)?.prompt : undefined;
+            // A gated resume IS an approve, so it passes the same delivery checks (freeze, EX-03) — no side
+            // door around the deliver gate — and answers with the gated unit's receipt.
+            const gatedUnit = gated ? await gatedUnitOf(run, undefined) : undefined;
+            let deliveryCheck;
+            if (gatedUnit !== undefined && isDeliverUnit(gatedUnit)) {
+                const refused = await deliverApprovalRefusal(run, gatedUnit);
+                if ('refusal' in refused)
+                    return reply.code(refused.refusal.code).send(refused.refusal.body);
+                deliveryCheck = { qeAcceptance: refused.qeAcceptance };
+            }
             const status = gated ? await adapter.confirmGate(id, true) : await adapter.resumeRun(id);
             // A resume of a gated run IS a gate approval — audit it as one, so the
             // "who approved" trail has no side door (task #88).
@@ -3546,7 +3773,12 @@ runtime = {}) {
             const landing = steeringPropose
                 ? await landSteeringProposal({ adapter, audit, actor: actorOf(req) }, run, gatePrompt)
                 : undefined;
-            return reply.send({ status, ...(landing !== undefined ? { landing } : {}) });
+            return reply.send({
+                status,
+                ...(landing !== undefined ? { landing } : {}),
+                ...(gated ? { assurance: receiptOf(gatedUnit) } : {}),
+                ...(deliveryCheck !== undefined ? { delivery: deliveryCheck } : {}),
+            });
         }
         catch (err) {
             return reply.code(409).send({ error: message(err) });
@@ -3640,6 +3872,16 @@ runtime = {}) {
                 });
             }
         }
+        // A gated reassign APPROVES the gate first, so it passes the same delivery checks (freeze,
+        // wicked-core#850 EX-03) when the gate holds the deliver unit (codex r1 on the EX-03 PR).
+        if (gated) {
+            const gatedUnit = await gatedUnitOf(run, undefined);
+            if (gatedUnit !== undefined && isDeliverUnit(gatedUnit)) {
+                const refused = await deliverApprovalRefusal(run, gatedUnit);
+                if ('refusal' in refused)
+                    return reply.code(refused.refusal.code).send(refused.refusal.body);
+            }
+        }
         const cursor = resolveCursorUnit(run);
         const ord = cursor?.ord ?? run.session.unit_ix;
         try {
@@ -3674,9 +3916,14 @@ runtime = {}) {
     // read it. A restart is routine: deploy, crash, laptop sleep.
     app.get(`${V}/runs/:id/gate`, async (req, reply) => {
         const { id } = req.params;
+        // wicked-core#850: the gate answer carries the gated unit's receipt — what assured the work it asks about.
+        const receiptAt = async (ord) => {
+            const run = (await adapter.sessionsDetail()).find((v) => v.session.id === id);
+            return receiptOf(run?.units?.find((u) => u.ord === ord));
+        };
         const cached = gateCache.get(id);
         if (cached)
-            return { runId: id, ...cached };
+            return { runId: id, ...cached, assurance: await receiptAt(cached.ord) };
         // A miss is not evidence of anything on its own, so ask the run what it is doing before paying
         // to replay it. Only `awaiting_human` can have an open gate, and that answer is definitive:
         // every other status is a 404 that needs no log at all — which is also the overwhelmingly
@@ -3712,7 +3959,7 @@ runtime = {}) {
             // genuinely lost), as does a gate whose `awaitingHuman` predates the log's retention.
             return reply.code(404).send({ error: 'No open gate for this run' });
         }
-        return { runId: id, ...open };
+        return { runId: id, ...open, assurance: receiptOf(run.units?.find((u) => u.ord === open.ord)) };
     });
     // ── Elicitation (DES-002) ────────────────────────────────────────────────────
     //
@@ -4634,7 +4881,9 @@ runtime = {}) {
         if (repo === undefined)
             return reply.code(404).send({ error: `Repo ${id} not found` });
         const originUrl = repo.root_path === '' ? null : await readDeliverOriginUrl(repo.root_path);
-        return reply.send({ repo: repo.id, ...deliverTargetView(originUrl) });
+        // crew#720: the provider credential preflight, so a launch can say "not configured" up front.
+        const credentials = await deliverCredentialsProbe(originUrl, process.env);
+        return reply.send({ repo: repo.id, ...deliverTargetView(originUrl), credentials });
     });
     app.get(`${V}/repos/:id/git-history`, async (req, reply) => {
         const { id } = req.params;
@@ -5513,6 +5762,10 @@ runtime = {}) {
     });
     // ── Projects (DES-PROJECT-001) — the 9-route experience-plane surface ────────
     registerProjectRoutes(app, adapter, { ...projects, settings: projectSettings }, security);
+    // crew#371: a project's requirements / domain / coverage, folded over its repos' own reads.
+    registerProjectAggregateRoutes(app, adapter);
+    // crew#372: draft a product plan from selected requirements, as a governed run via POST /runs.
+    registerProductRoutes(app, adapter);
     // ── Capture (Studio OS behaviour 8) — notes and photos → a project-filed run whose output is
     // proposals in the queue above; the launch is POST /runs itself (api/capture.ts).
     registerCaptureRoutes(app);