type: meta

slug: delivery-controller-receipts

base_branch: main

gate0_mode: strict

preset: cursor-codex

land_mode: merge-to-main


type: goal

text: Implement amended delivery-controller and validation-receipt foundation as one buildable DAG while plans without delivery_controller retain byte-identical legacy gate and land behavior.


type: methodology

text: Contract-first TDD; strict gate0 after every task; opt-in policy then durable store; isolated controller/receipt/workspace seams; wrap existing gate/ship/publication paths; integrate daemon ownership last; no retention machinery.


type: intent

text: Make harnessd sole durable delivery authority, validate each exact tree once, publish through credential-isolated compare-and-swap, and terminate no-smoke repositories at truthful PUBLISHED success.


type: direction

verbatim: legacy byte-identical when policy field absent


verbatim: Never counterfeit PREVIEW_READY stays.


type: deferred

text: CI topology and one-job candidate workflow

reason: Phase 1 wraps current gate0 path only.


text: Risk-tiered gate selection, changed-flow selector, bisection, candidate coalescing, and remote executor migration

reason: Requires later gate-graph and executor phases.


text: Full multi-repository gate registry and per-check conversion

reason: Phase 1 uses one broad gate0/v1 node.


text: Artifact build-once and deploy-exact integration

reason: Current repository land adapter emits no artifact digest.


text: Preview UI, notifications, and Works close/reopen workflow

reason: No UI surface in controller foundation.


text: Multideal preview-smoke adapter using deploy-probe verification

reason: Current .claude/scripts/ship.sh exposes land only; phase-1 success terminates at PUBLISHED.


text: Recovery bundles and one-time ref/worktree cleanup

reason: Owned by recovery phase.


text: delivery.db backup and retention policy

reason: Confirmed recovery-phase scope; this plan adds no retention schema, jobs, or configuration.


text: Existing pre-push and CI workflow removal

reason: Compatibility phase retains current workflows.


text: Legacy delivery-policy retirement

reason: Requires proof of zero active legacy runs after deployment.


type: gated

category: policy

needs: Authorize declared harness source/spec/test changes

why: Implementation touches protected src/ and spec/ paths; user explicitly requested a run-plan implementing the amended delivery spec.

status: RESOLVED

resolved_by: user

source: author


type: anchor

what: Amended delivery-controller and receipt design source of truth, including terminal PUBLISHED state.


what: Non-negotiable compatibility contract: absent delivery_controller selects legacy; current gate loop, journals, and land behavior remain byte-identical.


type: task

seat: coder

tier: high

desc: Implement amended spec Contract 1: sole opt-in delivery policy boundary, exact delivery_controller v1 activation, unknown-value preflight rejection, and absent-field legacy selection. Acceptance evidence: src/test/delivery-policy.test.js and src/test/delivery-legacy.test.js via `node --test src/test/delivery-policy.test.js src/test/delivery-legacy.test.js`. Commit only: src/delivery/policy.js, src/test/delivery-policy.test.js, src/test/delivery-legacy.test.js, test/fixtures/delivery-legacy/.

requires_decision: g-protected-delivery


desc: Implement amended spec Contract 3 durable store: delivery/transition/workspace/publication/receipt/check schema, WAL FULL durability, CAS transactions, immutable terminal proofs, atomic blob writes, integrity/version fail-closed behavior, and no backup/retention machinery. Acceptance evidence: src/test/delivery-store.test.js via `node --test src/test/delivery-store.test.js`. Commit only: src/delivery/store.js, src/test/delivery-store.test.js.


desc: Implement amended spec Contract 2 state machine and crash replay, including terminal PUBLISHED for repositories without smoke adapters, configured-only PREVIEW_SMOKE/PREVIEW_READY, REPAIRING only for actual failures, and product-decision proof. Acceptance evidence: src/test/delivery-controller.test.js via `node --test src/test/delivery-controller.test.js`. Commit only: src/delivery/controller.js, src/test/delivery-controller.test.js.


desc: Implement amended spec Contracts 4-5 receipt identity and reuse: exact Git tree hash, canonical graph/lockfile keys, minimal phase-1 env fingerprint from OS/arch, node -v, pnpm -v, lib/gates.sh digest, and gate-config digest, durable once-per-tree lookup, failed-proof behavior, and blob invalidation. Acceptance evidence: src/test/delivery-receipts.test.js via `node --test src/test/delivery-receipts.test.js`. Commit only: src/delivery/receipts.js, src/test/delivery-receipts.test.js.


desc: Implement amended spec Contract 6 workspace lease seam: clean base-bound task workspaces, owner-generation CAS, clean candidate assembly, safe expiration reconciliation, and current rescue-branch preservation. Acceptance evidence: src/test/delivery-workspaces.test.js via `node --test src/test/delivery-workspaces.test.js`. Commit only: src/delivery/workspaces.js, src/test/delivery-workspaces.test.js.


desc: Implement amended spec Contract 7 receipt-wrapped gate seam: delivery-v1 lookup before gate0, one broad gate0/v1 execution per identity, saved deterministic failure, durable-success requirement, and untouched legacy runGateLoop retries. Acceptance evidence: src/test/delivery-receipts.test.js and src/test/engine-gates.test.js via `node --test src/test/delivery-receipts.test.js src/test/engine-gates.test.js`. Commit only: src/engine/gates.js, src/test/engine-gates.test.js, src/test/delivery-receipts.test.js.


desc: Implement amended spec Contract 8 standalone publication authority: publication lease, receipt/tree/base preconditions, intent/result replay, fast-forward push, exact post-publish tree verification, and exit-code-plus-stderr classification fixtures for [rejected], fetch first, non-fast-forward, stale info, and generic land-failed. Acceptance evidence: src/test/delivery-publication.test.js via `node --test src/test/delivery-publication.test.js`. Commit only: src/delivery/publication.js, src/test/delivery-publication.test.js, test/fixtures/delivery-publication/.


desc: Implement amended spec Contract 9 runner credential boundary: activate delivery IDs and lease tokens without publication credentials, construct delivery-v1 command environment from controller allowlist, reject credential-helper exposure, and preserve full current environment for legacy runs. Acceptance evidence: src/test/delivery-credentials.test.js, src/test/runner-transcript.test.js, and test/runner-integration.sh via `node --test src/test/delivery-credentials.test.js src/test/runner-transcript.test.js && bash test/runner-integration.sh`. Commit only: src/runner.js, src/test/delivery-credentials.test.js, src/test/runner-transcript.test.js, test/runner-integration.sh.


desc: Integrate amended spec Contracts 6-8 into commit/ship path: enforce durable workspace leases around current helpers, assemble candidate, bind receipt proof, pass controller transaction context to landIntegrationOnce, prohibit unguarded land.intent, and route no-smoke published-tree match to PUBLISHED. Acceptance evidence: src/test/delivery-workspaces.test.js and src/test/engine-ship.test.js via `node --test src/test/delivery-workspaces.test.js src/test/engine-ship.test.js`. Commit only: src/engine/lease.js, src/engine/ship.js, src/test/delivery-workspaces.test.js, src/test/engine-ship.test.js.


desc: Integrate amended spec Contracts 9-10 with harnessd: controller-owned sanitized spawn, delivery tick after promote and before statusCache, transition/lease/receipt/publication reconciliation, bounded worker scopes, and zero standalone timers/services. Acceptance evidence: src/daemon.test.js and src/test/delivery-credentials.test.js via `node --test src/daemon.test.js src/test/delivery-credentials.test.js`. Commit only: src/daemon.js, src/daemon.test.js, src/test/delivery-credentials.test.js.


desc: Prove amended spec Contracts 1-10 end to end: crash replay, once-per-tree receipts, CAS/base-moved fixtures, credential denial, current land-only adapter terminating at PUBLISHED, configured-smoke PREVIEW_READY path, legacy byte identity, warning-free full suite, production build, and actual bin/runplan/bin/harnessd launcher resolution. Acceptance evidence: test/delivery-controller-runtime.test.sh via `bash test/delivery-controller-runtime.test.sh && make test`. Commit only: test/delivery-controller-runtime.test.sh, test/fixtures/delivery-controller/.