Harden issue PR publication reliability

.github/workflows/authority-installer-retention.yml

@@ -0,0 +1,31 @@
+name: Authority installer retention
+
+on:
+  pull_request:
+    paths:
+      - 'authority-host/windows/install-release.ps1'
+      - 'tests/windows/authority-release-retention.ps1'
+      - '.github/workflows/authority-installer-retention.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  retention:
+    name: Prune obsolete Authority versions
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          global-json-file: global.json
+
+      - name: Run Authority installer retention regression
+        shell: pwsh
+        run: ./tests/windows/authority-release-retention.ps1

authority-host/windows/install-release.ps1

@@ -123,6 +123,19 @@ try {
     [IO.File]::WriteAllText($recordTemp, $recordJson, $utf8NoBom)
     Move-Item -Force $recordTemp $recordPath
 
+    # Version directories are release-owned and self-contained. Once the new
+    # version is active, remove obsolete release versions so updates do not
+    # accumulate full runtimes. Root state and unknown app content are preserved.
+    $targetName = 'v' + $ExpectedVersion
+    $obsoleteVersionDirs = @(
+        Get-ChildItem -LiteralPath $appRoot -Directory -Force | Where-Object {
+            $_.Name -match '^v\d+\.\d+\.\d+$' -and $_.Name -ne $targetName
+        }
+    )
+    foreach ($obsoleteVersionDir in $obsoleteVersionDirs) {
+        Remove-Item -LiteralPath $obsoleteVersionDir.FullName -Recurse -Force
+    }
+
     # Remove only the obsolete root-level launcher from the legacy layout. State
     # (`authority.db`, trust-store.json) and unknown user files are deliberately preserved.
     $legacyExe = Join-Path $InstallDir 'GitHubDeliveryAuthority.exe'

references/create-pr-for-issue.md

@@ -18,7 +18,9 @@ Policy modules:
 
 ## Goal
 
-Open only the requested PRs, normally one, on the issue's canonical repository. Fix the verified issue, preserve unrelated work, pass the required gates, link/assign/notify as permitted, and stop before merge.
+Open only requested PRs on the issue's canonical repository. Fix the verified issue, preserve unrelated work, pass required gates, link/assign/notify as permitted, and stop before merge.
+
+Explicit **open the PR and stop** requests use this route through E, then `OPEN_PR -> DONE` after live identity verification and both locked publication receipts; skip F/G.
 
 ## Runtime contract
 
@@ -27,6 +29,7 @@ Open only the requested PRs, normally one, on the issue's canonical repository.
 - `create_pr` intent is controller-owned/operation-bound. Never repair via manual `--workflow-intent`, checkpoint edits, or `explicitInstruction`; changed payloads need fresh intent.
 - `github-mutate.mjs` owns authority; `off` skips only Hello/Authority, protected modes retain it.
 - Local work is not publication; broker remote writes.
+- Issue publication uses `scripts/create-pr-publication-plan.mjs`; no hand-built mutation schemas or direct `git push` / `gh pr create`.
 - **Do not merge.**
 
 ## A. Need-to-fix preflight
@@ -44,7 +47,7 @@ Read the issue body, **every comment** with pagination, labels, linked PRs, and
 
 ### Screenshot gate
 
-Review author-provided screenshots/images before implementation. If required screenshots cannot be reviewed, stop instead of opening a speculative PR.
+Review author-provided screenshots/images before implementation. If required screenshots cannot be reviewed, stop.
 
 ### Preflight outcome
 
@@ -58,7 +61,7 @@ If `research-issue.md` just produced the same verdict on the same development ti
 
 ## B. Confirm scope
 
-Default to one cohesive PR. Split only when independently shippable concerns need separate validation/review boundaries or acceptance criteria conflict. Batches over three issues use fan-out.
+Default to one cohesive PR. Split only for independently shippable concerns with separate validation/review boundaries or conflicting acceptance criteria. Batches over three issues use fan-out.
 
 ## C. Implement locally
 
@@ -67,7 +70,7 @@ Default to one cohesive PR. Split only when independently shippable concerns nee
 3. Follow required consumers as dependencies appear; for broad migrations or deterministic sweeps apply `references/change-execution.md`.
 4. Run focused validation appropriate to the changed code: tests, typecheck, build, repro, and repository-local checks as available.
 5. Require a non-empty base-to-head candidate diff. If no change is needed, return to the matching preflight outcome; do not open an empty PR.
-6. Hygiene: resolve passes independently. Run `references/no-comments.md` unless its pass is opted out, then `references/simplify-pr.md` unless its pass is opted out. The no-comments and simplify opt-outs are independent. A failed no-comments pass blocks publication.
+6. Hygiene: use the canonical helpers for both passes. Caller text cannot opt out of a pass or supply trusted skip provenance. Until a controller/host-owned user-intent receipt can prove a skip, run `references/no-comments.md` and `references/simplify-pr.md`; skipped results fail closed.
 
 ## D. Pre-open bug + security gate
 
@@ -79,19 +82,20 @@ node <github-delivery>/scripts/pre-open-gate.mjs OWNER/REPO <base> <head> --chec
 
 - `ready`: continue.
 - `blocked` with `workflow:implementation_missing`: return to C and implement.
-- other `blocked`: run required branch-diff bug/security passes, load `bug-review.md` / `security-review.md` only for triggered lenses/surfaces, fix Confirmed High/Critical findings, record `done` or honest `n/a (why)` evidence, then re-evaluate.
+- other `blocked`: run each required bug/security pass. Load `bug-review.md` / `security-review.md` only for triggered lenses/surfaces, fix Confirmed High/Critical findings, and record one head-bound row per required lens/surface with status, bounded method, and required file coverage. Candidate-wide `bug: clean` / `security: clean` declarations are non-authoritative.
 - `unknown`: stop and restore complete branch evidence before publication.
 
 Carry completed gate/review evidence into the PR validation notes.
 
 ## E. Publish the canonical PR
 
 1. Resolve repository identity from the **issue**, not whichever remote is convenient, and resolve the correct base branch.
-2. Publish the exact commit using broker action `push_code`. Bind the observed remote generation; use force-with-lease only when the selected Git workflow permits rewriting that branch.
-3. Build the PR description from `references/pr-description.md`, the final candidate diff, issue acceptance criteria, thread clarifications, and completed validation. Do not narrate planned work as completed work.
-4. After push, re-check exact publication identity: canonical repository + pushed head identity + intended base. One exact open PR → reuse it; multiple → fail closed and report them; none → create. This is narrower than A's semantic covering-PR check, and `create_pr` preflight repeats it immediately before execution.
-5. Create with broker action `create_pr`, a stable idempotency key, and exact base/head/title/body. `create_pr_existing` names the publication result; do not bypass it or retry under another title.
-6. Confirm the created/reused PR has the canonical issue repository and intended base/head. Wrong topology is a hard stop.
+2. Build the PR description from `references/pr-description.md`, final diff, issue contract, and completed validation; never claim planned work as done.
+3. Resolve exact tips/identity, then run `node scripts/create-pr-publication-plan.mjs --input <input> --output <plan>`. It locks broker action `push_code` plus draft broker action `create_pr` to the checkpoint.
+4. Execute the plan unchanged via `node scripts/github-mutate.mjs --request <plan> --execute --checkpoint <workflow-checkpoint>`. No direct `git push` / `gh pr create`; force-with-lease remains planner-owned.
+5. Re-check canonical repo + head + base. Reuse one exact open PR; multiple or none after successful publication fail closed. `create_pr_existing` names reuse.
+6. Require canonical repo/base/head and successful receipts for both locked operations; otherwise stop.
+7. Explicit open-only request: `OPEN_PR -> DONE`; otherwise continue to F/G.
 
 ## F. Link, assign, notify
 
@@ -120,17 +124,21 @@ Work on the current PR head until the authoritative merge-ready bar is satisfied
 
 ## H. Completion report
 
-Before final reporting, apply `references/completion-claims.md` to current authoritative evidence; re-measure material counts and preserve unknown, blocked, not-run, and partial states.
+Before final reporting, apply `references/completion-claims.md`; re-measure material counts and preserve unknown, blocked, not-run, and partial states.
 
 ## Done when
 
+For normal merge-ready delivery:
 - Only requested PRs; canonical issue repository and intended base/head.
 - Full issue thread and screenshot gate complete; preflight has evidence-backed outcome.
-- Non-empty implementation diff existed before the pre-open gate; bug/security publication requirements cleared.
+- Non-empty implementation diff existed before pre-open; each required bug/security row is head- and file-bound, not aggregate clean evidence.
+- Hygiene evidence came from canonical passes; caller text did not bypass them.
 - Exact-head/base publication was reused instead of duplicated.
-- Network writes used `github-mutate.mjs` with required authority.
+- Network writes used the canonical planner plus `github-mutate.mjs` with required authority.
 - PR description matches final head/issue contract; linkage and protected-media rules are satisfied.
 - Self-assignment when possible; one opened-PR issue comment; no duplicates.
 - Reviews, feedback, required CI, freshness, applicable runtime verification, and final ship gate pass on final head.
 - Final report satisfies `references/completion-claims.md`.
 - Merge-ready was published and **the PR was not merged**.
+
+Open-only delivery ends at E only after both locked receipts and live PR identity verification; no F/G.

references/create-pr-from-local-work.md

@@ -48,13 +48,13 @@ If the active higher-priority instruction stack genuinely requires a GitHub writ
 4. **Validate the candidate.** Run focused tests/typecheck/build/repro appropriate to the changed code plus `git diff --check` when available. Confirm the base-to-head diff is non-empty and contains only intended work. Before publication, use the Git-workflow change summary to identify the logical change, intentionally untouched related surfaces, material concerns, and checks actually run.
 5. **Produce hygiene evidence through the orchestrator.** Resolve `references/no-comments.md` and `references/simplify-pr.md` independently; do not mint checkpoint receipts directly and do not rediscover helper JSON shapes from source.
    - When no-comments runs, execute `node scripts/create-pr-hygiene.mjs prepare --root <repo-root> --base <base-ref-or-sha> --head <head-sha> --scope <scope.json> --snapshot <outside-repo-snapshot>`. Give Comment Inspector exactly the generated `scope.json`. It may read nearby context but may classify only that immutable diff-added-line scope. Save only its final structured `github-delivery/comment-review-result` as `<comment-result.json>`.
-   - Run `references/simplify-pr.md` unless opted out and record one `<simplify.json>` pass object: successful review uses `{ "outcome": "clean", "method": "simplify-pass", "validationPassed": true }`; an explicit opt-out uses `{ "outcome": "skipped", "method": "opt-out", "reason": "<the user opt-out>" }`.
+   - Run `references/simplify-pr.md` and record one `<simplify.json>` pass object such as `{ "outcome": "clean", "method": "simplify-pass", "validationPassed": true }` after the pass succeeds.
    - Finalize with `node scripts/create-pr-hygiene.mjs finalize --root <repo-root> --head <head-sha> --scope <scope.json> --snapshot <outside-repo-snapshot> --result <comment-result.json> --simplify <simplify.json> --output <hygiene.json>`. The helper verifies unchanged reviewer bytes, discards the verified snapshot, validates the final result against the exact scope, and refuses to turn DELETE/root-cause findings into a clean receipt. If it reports `comment_review_guard_changed_restore_required`, restore through `comment-review-guard.mjs` before doing anything else. If it reports pending no-comments changes, the parent applies accepted in-scope fixes, revalidates/commits the new head, then restarts hygiene on that new head.
-   - When no-comments is explicitly opted out, do not prepare/spawn it. Run `node scripts/create-pr-hygiene.mjs skip-no-comments --head <head-sha> --reason "<the user opt-out>" --simplify <simplify.json> --output <hygiene.json>`.
-6. **Run compact pre-open and assemble review evidence without per-row boilerplate.** Run `node scripts/pre-open-gate.mjs OWNER/REPO <base> <head> --compact --checkpoint <workflow-checkpoint> --output <preopen-summary.json>`. The top-level `decision` plus exit code is authoritative. If it is already `ready`, continue. When blocked only on review evidence, use `remaining` and `evidenceRequirements` as the exact worklist.
-   - Perform one structured **bug-axis** review that explicitly covers every ID in `remaining.lenses` and every file required by `evidenceRequirements.lenses`; perform one structured **security-axis** review with the same rule for `remaining.surfaces` / `evidenceRequirements.surfaces`. Preserve every deterministic probe as its own canonical structured probe-evidence record.
-   - Write one `<review-result.json>` with `schemaVersion: 1`, `kind: "github-delivery/pre-open-review-result"`, the exact `headSha`, and `bug` / `security` objects containing `status: "clean"`, a bounded `method`, `coveredIds`, and the union of actually `reviewedFiles`; put the canonical required probe records under `probes`.
-   - Run `node scripts/pre-open-review-evidence.mjs --summary <preopen-summary.json> --review <review-result.json> --output <preopen-evidence.json>`. This helper does **not** reduce coverage: it emits every existing schema-v2 lens/surface row only when its semantic ID and required files were covered by the corresponding axis review.
+   - **Do not use caller-authored skip text as publication evidence.** A `skipped` hygiene result requires trusted user-intent provenance that is not currently supplied by the public hygiene CLI. Until such controller/host-owned provenance exists, an attempted no-comments or simplify skip fails closed and the actual pass must run before publication.
+6. **Run compact pre-open and assemble explicit review evidence.** Run `node scripts/pre-open-gate.mjs OWNER/REPO <base> <head> --compact --checkpoint <workflow-checkpoint> --output <preopen-summary.json>`. The top-level `decision` plus exit code is authoritative. If it is already `ready`, continue. When blocked only on review evidence, use `remaining` and `evidenceRequirements` as the exact worklist.
+   - Review every ID in `remaining.lenses` and `remaining.surfaces` against the exact files required for that ID. Preserve every deterministic probe as its own canonical structured probe-evidence record. One candidate-wide `bug: clean` or `security: clean` assertion is not authoritative and cannot stand in for the required rows.
+   - Write one `<review-result.json>` with `schemaVersion: 2`, `kind: "github-delivery/pre-open-review-result"`, the exact `headSha`, and explicit `lenses` / `surfaces` maps. Every required ID gets its own structured row containing `status: "done"` or honest `n/a <why>`, the exact `headSha`, a bounded `method`, and `reviewedFiles` covering every file required by `evidenceRequirements` for that ID. Put the canonical required probe records under `probes`.
+   - Run `node scripts/pre-open-review-evidence.mjs --summary <preopen-summary.json> --review <review-result.json> --output <preopen-evidence.json>`. The helper validates and assembles the explicit rows; legacy schema-v1 aggregate bug/security declarations fail as `pre_open_review_aggregate_not_authoritative` rather than being expanded into many completions.
    - Rerun `node scripts/pre-open-gate.mjs OWNER/REPO <base> <head> --compact --checkpoint <workflow-checkpoint> --evidence-file <preopen-evidence.json> --hygiene-file <hygiene.json>`. Continue only on top-level `decision=ready` and exit `0`. Full gate output is diagnostic-only when compact output or evidence validation itself fails.
 7. **Check exact-head publication identity and optional branch issue candidate.** Before planning `create_pr`, prove whether an open PR already exists for the exact target repository + head identity + intended base. This is an identity check, not fuzzy title/body similarity. The `create_pr` lifecycle preflight independently repeats this live check immediately before execution. At this same read-only stage, apply the verified branch-derived closing-link rule above when the branch conventionally encodes one issue candidate; perform no issue-side mutation.
    - exactly one PR match → **reuse/report that PR**; do not create another;
@@ -74,15 +74,16 @@ If the active higher-priority instruction stack genuinely requires a GitHub writ
 - Never treat a direct-write instruction conflict as permission to experiment with multiple write paths. Fail closed once and report the conflict.
 - Do not invent issue linkage from arbitrary numbers. A branch-derived `Closes #N` is allowed only after the same-repository open-issue and scope-match verification above; do not add issue-side effects merely because another create-PR workflow supports them.
 - Do not defeat exact-head duplicate prevention by changing the title/body, inventing another local branch name for the same remote head, or weakening repository identity.
-- Do not reduce a large compact evidence worklist by omitting required IDs. Aggregation removes repetitive record construction, not required review coverage.
+- Do not reduce a compact evidence worklist by replacing required IDs with a candidate-wide aggregate declaration. Every required lens/surface remains independently represented and head/file bound.
+- Do not manufacture hygiene opt-out evidence from a caller-controlled reason string.
 
 ## Done when
 
 - exactly one PR exists for the intended local head/base publication;
 - an already-existing exact-head/base PR was reused rather than duplicated when present;
 - the PR contains no unrelated files or commits;
-- current-head hygiene evidence came from the deterministic orchestration boundary;
-- the candidate diff passed the compact pre-open gate with top-level `decision=ready` using complete semantic-ID/file coverage and required probes;
+- current-head hygiene evidence came from the deterministic orchestration boundary and no caller-authored skip bypassed a required pass;
+- the candidate diff passed the compact pre-open gate with top-level `decision=ready` using explicit complete semantic-ID/file coverage and required probes;
 - any verified branch-derived issue candidate produced exactly one closing reference in the PR body, while an unverified/mismatched candidate produced none and no issue-side effects were invented;
 - any remote branch/PR publication was performed from the canonical generated plan through the authorized mutation boundary;
 - the resulting PR repository/base/head/draft state were verified; and