V48 Gate 3 (implementation-only): #25 harness deposit-mode plumbing (synthesizeMode + steering into the in-box runner)

The harness can now run the in-box pipeline in DEPOSIT mode (the foundation of #25). synthesizeMode ('deposit'|'read') + deposit steering (obfuscations, protectedIpExclusions, demandContext) flow through buildAssetPackSandboxHarness → PipelineHarnessManifest → the in-box runner INPUT, so the in-box assetPackPipeline resolves deposit mode (resolveSynthesizeAssetPacksMode reads input.synthesizeMode) and runs the deposit SDIVF over the box's local checkout. The runner now surfaces the synthesized implementation:options in evidence.json as depositOptions, so the dispatching route can project them.

- types.ts: PipelineHarnessManifest gains synthesizeMode + depositSteering.
- manifest.ts: buildAssetPackPipelineHarnessManifest accepts + stores them.
- asset-pack-harness.ts: options → manifest; the in-box runner template carries synthesizeMode + steering in the input and depositOptions in the evidence.

Tests: deposit-mode plumbing (manifest carries synthesizeMode + steering; defaults to read) + the existing runner-syntax-validity test confirms the template edits compile. pipeline-hosts 6 suites/34 green; tsc clean. The deposit route's sandbox dispatch (reading evidence.depositOptions → projection → persist) is the remaining #25 piece.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: geraldarthurdavis

packages/pipeline-hosts/src/__tests__/asset-pack-harness.test.ts

@@ -39,6 +39,35 @@ describe('asset-pack sandbox harness plan', () => {
     expect(plan.manifest.expectedEvidenceTables).toContain('deliverable_pipeline_events');
   });
 
+  it('carries deposit synthesis mode + steering into the manifest (#25)', () => {
+    const plan = buildAssetPackSandboxHarness({
+      ...baseOptions,
+      mode: 'asset_pack_pipeline',
+      source: {
+        type: 'git',
+        url: 'https://github.com/engineeredsoftware/ENGI.git',
+        revision: baseOptions.sourceRevision.commit,
+        depth: 1,
+      },
+      synthesizeMode: 'deposit',
+      depositSteering: {
+        obfuscations: 'hide internal names',
+        protectedIpExclusions: ['secret/'],
+        demandContext: ['auth'],
+      },
+    });
+    expect(plan.manifest.synthesizeMode).toBe('deposit');
+    expect(plan.manifest.depositSteering).toEqual({
+      obfuscations: 'hide internal names',
+      protectedIpExclusions: ['secret/'],
+      demandContext: ['auth'],
+    });
+  });
+
+  it('defaults synthesizeMode to read when unset', () => {
+    expect(buildAssetPackSandboxHarness(baseOptions).manifest.synthesizeMode).toBe('read');
+  });
+
   it('requires a repository source before planning the real pipeline mode', () => {
     expect(() =>
       buildAssetPackSandboxHarness({

packages/pipeline-hosts/src/asset-pack-harness.ts

@@ -45,6 +45,14 @@ export interface BuildAssetPackSandboxHarnessOptions {
   commandEnvironment?: Record<string, string>;
   installDependencies?: boolean;
   sourceOverlayPatch?: Buffer | string;
+  /** V48 Gate 3 #25: run the in-box synthesis in deposit (vs read) mode. */
+  synthesizeMode?: 'deposit' | 'read';
+  /** Deposit steering for the in-box deposit synthesis (source-safe). */
+  depositSteering?: {
+    obfuscations?: string | null;
+    protectedIpExclusions?: string[];
+    demandContext?: string[];
+  };
 }
 
 export function buildAssetPackSandboxHarness(
@@ -87,6 +95,8 @@ export function buildAssetPackSandboxHarness(
     sourceRevision: options.sourceRevision,
     sourceOverlay,
     commandEnvironment,
+    synthesizeMode: options.synthesizeMode ?? 'read',
+    depositSteering: options.depositSteering,
   });
 
   const commands = buildCommands(
@@ -1783,6 +1793,10 @@ try {
     writtenAssetType: 'asset_pack',
     deliveryMechanismTemplate: 'pull-request',
     harness: manifest,
+    synthesizeMode: manifest.synthesizeMode || 'read',
+    obfuscations: (manifest.depositSteering && manifest.depositSteering.obfuscations) || null,
+    protectedIpExclusions: (manifest.depositSteering && manifest.depositSteering.protectedIpExclusions) || [],
+    demandContext: (manifest.depositSteering && manifest.depositSteering.demandContext) || [],
   };
 
   record({ type: 'pipeline-start', stage: 'read-comprehension', sourceRevision: manifest.sourceRevision });
@@ -2145,6 +2159,7 @@ try {
     manifestRoot,
     manifest,
     output,
+    depositOptions: findExecutionValueDown(execution, 'implementation', 'options') || null,
     fitResult,
     depositorySearch,
     sourceSafePreview: settledSourceSafePreview,

packages/pipeline-hosts/src/manifest.ts

@@ -112,6 +112,8 @@ export function buildAssetPackPipelineHarnessManifest(input: {
   commandEnvironment?: Record<string, string | undefined>;
   readNeed?: unknown;
   requireAcceptedReadNeed?: boolean;
+  synthesizeMode?: 'deposit' | 'read';
+  depositSteering?: PipelineHarnessManifest['depositSteering'];
   createdAt?: string;
 }): PipelineHarnessManifest {
   assertNonEmpty(input.read.id, 'read.id');
@@ -130,6 +132,8 @@ export function buildAssetPackPipelineHarnessManifest(input: {
     deposit: input.deposit,
     sourceRevision: input.sourceRevision,
     sourceOverlay: input.sourceOverlay,
+    synthesizeMode: input.synthesizeMode ?? 'read',
+    depositSteering: input.depositSteering,
     host: {
       hostKind: VERCEL_SANDBOX_HOST_CAPABILITIES.hostKind,
       provider: VERCEL_SANDBOX_HOST_CAPABILITIES.provider,

packages/pipeline-hosts/src/types.ts

@@ -102,6 +102,14 @@ export interface PipelineHarnessManifest {
   deposit: PipelineDepositReference;
   sourceRevision: PipelineSourceRevision;
   sourceOverlay?: PipelineHarnessSourceOverlay;
+  /** V48 Gate 3 #25: the synthesis lens the in-box pipeline runs (deposit | read). */
+  synthesizeMode?: 'deposit' | 'read';
+  /** Deposit steering for the in-box deposit synthesis (source-safe). */
+  depositSteering?: {
+    obfuscations?: string | null;
+    protectedIpExclusions?: string[];
+    demandContext?: string[];
+  };
   host: Pick<
     PipelineHostCapabilities,
     | 'hostKind'