🏭 Author authenticated user settlement for Stages 7–8

[minkimcello]

Parent: #633

Architecture ancestry: PR #630

Planning base: 0479b3b1e6a3de08fb7d9de515a3efde80e7fe91; implementation base is the exact accepted L9 feedback commit and all recorded ancestors

Stack position: L10; follows L9 and precedes E11

Readiness: blocked until L9's exact accepted feedback SHA and ancestors are recorded; no human authority, target publication, merge, abandonment, retention, or terminal choice is delegated

Purpose and observable outcome

An authenticated repository and Project writer can accept, request changes to, or abandon the exact Stage 7 revision. XMD either returns to the earliest invalidated contract or reconciles one retained merged or abandoned terminal outcome before projecting Stage 8 Closed.

Authoritative behavior

• F2's authenticated form binds the decision to the exact run, issue, PR, Project item, active Stage 6 verdict, and { headSha, baseSha }. Comment text and bare dispatch input have no authority.
• Closed decisions are merge, change with earliest invalidated stage/reason, and abandon with required reason.
• Merge creates a trusted commit with parents [reviewedBase, reviewedHead] through F4, then uses an explicit provider-neutral Git.PublishTarget effect. That effect takes no document-supplied remote/ref/force props: host configuration supplies the admitted target, and the request requires the observed target to equal reviewedBase before one non-force publication.
• Target movement or uncertain publication refuses/reconciles without treating a different base as reviewed; invalidation returns to Stage 5 or 4.
• The target ruleset admits only the dedicated App for this update, while the host separately enforces repository, target, parents, revision, and non-force ceilings.
• Merge creation, target publication, PR observation, PR/issue closure, Project projection, and terminal settlement are separate durable effects.
• Abandonment closes the PR unmerged, closes the issue not_planned, projects Closed, retains terminal kind abandoned, and preserves Project item, branch, comments, journal, roots, and Agent evidence. Reopening does not reopen the run.

Current state

L9 supplies one accepted Stage 6 verdict and ready PR at an exact revision. F2/F3/F4/F6 supply authenticated decisions, projection/closure effects, trusted merge construction, and terminal records. Existing <Git.Push> publishes only the current checkout branch to its origin and allows any proven fast-forward predecessor; it cannot express the exact configured target/ref precondition required here. No Git.PublishTarget or authored settlement component exists.

Affected modules and public contracts

• Add Stage 7 decision/settlement/handoff Markdown components to the immutable factory bundle.
• Add provider-neutral Git.PublishTarget request/result/parser/API/component and Deno GitHub adapter under packages/workflow/src/composition/** and packages/workflow/src/deno/composition/**; keep it separate from ordinary <Git.Push>.
• The target publication natural key is retained repository + configured remote + configured target ref. Inputs additionally include exact expected remote/base, source merge commit, reviewed head, and non-force policy.
• Add target-ruleset observation/verification to the GitHub provider configuration without granting repository administration to the runtime App.
• Update workspace/factory specs, architecture, exports, construct/test inventories, and explicit terminal/race/crash tests.

Ordered implementation plan

1. Reread Stage 7's exact PR revision, active Stage 6 verdict, checks required by the factory, Project item, and authenticated form subject before rendering/accepting a decision.
2. For change, validate earliest invalidated stage/reason, retain it, and reconcile backward handoffs/projection through L7–L9 contracts.
3. For merge, invoke F4 with ordered parents [baseSha, headSha], then build the closed Git.PublishTarget request from retained subjects and host target configuration.
4. Observe the target ref completely; perform one non-force publication only when it equals baseSha, adopt only when it already equals the exact merge commit, and otherwise conflict/unavailable without mutation.
5. After publication, reconcile PR merged observation, issue completed closure, Project Closed, and terminal kind merged in separate retained steps.
6. For abandon, retain the exact decision first, then reconcile PR close-unmerged, issue not_planned, Project Closed, and terminal kind abandoned with actor/reason/revision/results.
7. Render terminal/change output and completed replay without deleting retained evidence or reopening providers.

Failure, cancellation, teardown, and replay

Unauthorized actor, stale revision/verdict/form subject, wrong Project/repository/target, missing required reason, invalid change destination, target-ruleset mismatch, moved/unobservable target, parent mismatch, or incompatible prior terminal state refuses before protected mutation. Cancellation publishes no invented merge/terminal result; already-performed external effects reconcile on resume. An uncertain push is reobserved once under the effect contract and adopted only if the target equals the exact merge commit. Completed replay attaches no provider. A completed run cannot resume after issue reopen.

Frozen evidence matrix

• Unauthorized, stale, comment-derived, wrong-subject, and under-permission decisions mutate nothing.
• change to each supported earliest stage deactivates the exact downstream frontier and requires it again.
• Trusted target merge has parents [reviewedBase, reviewedHead] and Git.PublishTarget publishes only when target equals reviewed base.
• Target race before/during publication leaves no unauthorized ref movement and returns to Stage 5 or 4 as specified.
• No trace uses ordinary squash/rebase merge, force, force-with-lease, target/ref input from the document, or a second blind push.
• Kill after each merge/ref/PR/issue/Project/terminal sub-effect resumes to exactly one compatible terminal outcome.
• merged retains exact merge commit and actor, closes the issue completed, and projects Closed only after publication is authoritative.
• abandoned requires reason, closes PR unmerged and issue not_planned, projects Closed, and retains all evidence.
• Issue reopen cannot resume a completed run; continuation requires a new issue/run.
• Completed replay performs no Git/GitHub/Project operation.

Focused feedback evidence

Add explicit files such as packages/workflow/tests/git-publish-target.test.ts, git-publish-target-crash.test.ts, factory-settlement.test.ts, factory-settlement-races.test.ts, and packages/cli/tests/factory-settlement-output.test.ts. Run them with F2 authorization, F3 closure, F4 merge, F6 terminal, and L9 exact-review regressions plus deno task test --changed. Render normalized terminal output. Commit when the matrix passes and report the exact L10 SHA and commands.

Delivery verification

Run deno task lint, deno task check, and deno task check:jsr because Git.PublishTarget is public. CI owns exhaustive runtimes unless shared Git/provider setup changes.

Exclusions

No deletion/archive of retained evidence, PAT, ambient GITHUB_TOKEN, Administration/Workflows/Actions/Secrets/Environment/Deployment/Member permission, force authority, ordinary GitHub merge endpoint without exact base, or remote state as lifecycle authority.

Risks and recovery

Exact target publication is a structural security boundary. A defect in merge construction returns to F4; a defect in target reconciliation stays in L10 and blocks terminal composition. Operator inability to configure the required target ruleset blocks production deployment but not fixture-based feedback evidence; E11 records the real deployment prerequisite explicitly.

Handoff

Record L9's exact feedback SHA and all accepted ancestors. Implement settlement plus the concrete Git.PublishTarget consumer, freeze the evidence, and return the exact L10 feedback commit for E11.