kairos-chain 3.78.0 → 3.80.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bdf5a0932b91258ccacf0520ca20eb252b7080c7ef3682f87edb8fdb07144c6
-  data.tar.gz: '09f911f59d0aba91f246f5ec6721cc4ee11f8534bd96ed73fc31edd3df1a78ff'
+  metadata.gz: e2c2d4657c313e3452dbdfaa619a7949d9682961fe4e9ccc15e772ff580f300a
+  data.tar.gz: f276e35c55991a4ea269309e7ff6f2a94208a4e86967dc9754685a258525645c
 SHA512:
-  metadata.gz: 884fe864157b0c5ea27cc9249de0378f4c8e53d0b724ef6c92e9adc85dd1a092e8c7291c1e0e778a20d3edf4058da92801968733f38017a73df60eb7b552ade3
-  data.tar.gz: c9061d247bee27b8525dae1d14f4acd1036e27d2c024b74228c43bc23211329285d418689aa6314c70f2e5f6060b9df4ad68e118870b680f6c411ab5d2de5cc7
+  metadata.gz: d10d880b482015c17e13014e432bf383cb8003f947ce1caabc4f3f24e775228facb81f042466917f530aa4c4018443cb33567c7fd8ba41c2e3a56149a4db2417
+  data.tar.gz: 2f4b29826187f483df3a95d601623f587e28eb5575670a235706c4bc7bc8bbc73d285f3ab60f9012fd0ae391a36f294c6a28866fb9a777d60bd1b361c7e9e987

data/CHANGELOG.md

@@ -4,6 +4,125 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.80.0] - 2026-08-27
+
+### Changed
+
+- **`readable_gate`: the measurement bound is the hook's own remaining time,
+  not a mode's declaration.** `measure_timeout_seconds` is retired, and its
+  whole observable surface goes with it — the clamp, the type-error clause,
+  and the silent death where `0` or a negative passed the Integer check,
+  reached `Regexp.timeout=` and killed the gate with exit 0, empty stdout and
+  no log file. A mode file must not be able to silence the gate by arithmetic
+  (operator ruling, 2026-08-27). A config still declaring the key flows
+  through `checked()` as an unknown key and is read by nobody.
+
+  Time protection is now `bounded_match`, the one seam every mode-supplied
+  match passes through: remaining computed from an absolute deadline fixed at
+  `main`'s first statement, a floor at one millisecond (`Regexp.timeout=`
+  silently stores nil for positive values under 1e-9), the grant set to the
+  remaining time, and the grant revoked as the match ends — no match runs
+  under an authorisation granted to another. Announce, specimen, shorthand and
+  both gloss operands route through it; `each_match` starts every match inside
+  the seam, so no ordering exists in which a match begins before the clock is
+  read. The recheck's poll is charged as time actually spent, which retires
+  the old static arithmetic that billed a first read for the four seconds only
+  a recheck uses. `HOOK_TIMEOUT_MARGIN` drops from 1.0 to 0.5 (start-up
+  measured at a 0.033s median), recovering half the band the old margin
+  discarded.
+
+  **Three declared output differences** against the pre-bound gate: a config
+  declaring the key loses its problem clause and the gate runs when no other
+  problem remains; the measurement-exceeded banner quotes elapsed time against
+  the live budget instead of a mode-declared value; and the budget itself
+  grows from a flat 5s to the deadline's remainder (≈9.4s on a first read,
+  ≈5.4s on a recheck), so a measurement finishing between 5s and the budget
+  now yields a verdict where it used to yield NOT RUN. Probed at 10, 12 and 14
+  configurations by three independent contexts: no undeclared difference.
+
+  Design frozen at v0.7 after six review rounds; implementation conformance
+  round 1 REVISE, round 2 APPROVE 3/3 with zero DOES NOT HOLD. Suite 152 runs
+  / 948 assertions green; the mutation harness gains 19 rows paired one-to-one
+  with the design's table (anchors verified 72/72), plus a label filter and
+  early exit so a narrowed sweep is possible and says so in its summary.
+
+### Fixed
+
+- **`readable_gate`: the carry-over note's truncation fallback refuses to
+  follow a symlink.** When a stale note cannot be deleted the gate empties it
+  in place, and that write followed whatever the note's name pointed at: with
+  a symlink planted at the note key and the notes directory made unwritable so
+  the unlink is refused, the emptying truncated a file outside the notes
+  directory. The open now carries `File::NOFOLLOW`, so a final-component
+  symlink fails with `ELOOP` and lands in the existing refusal arm — the
+  leaning is to refuse, never to write through a name to somewhere the path
+  did not say. The leftover link stays unspent and every later recheck refuses
+  it. A hard link and an intermediate-component symlink still reach through;
+  both need the same outside hand and are declared rather than closed.
+
+- `kairos_hook_projector` SkillSet version 0.5.0 → 0.6.0, so instances
+  actually receive the two changes above on `skillset upgrade`.
+
+## [3.79.0] - 2026-08-26
+
+### Fixed
+
+- **Field defect D4 — the delegated worker's watchdog killed healthy slow
+  cycles at minute 25, and killed them silently.** 3.77.0's first night of
+  field use ran the agent SkillSet on real goals; twice, a worker died with
+  nothing written, and the second death gave the mechanism away: spawn 20:31,
+  last heartbeat 20:56 — spawn plus exactly `WORKER_SELF_TIMEOUT_SECONDS`
+  (1500). The watchdog's design assumption was that only a HUNG gated call
+  reaches the bound; a healthy cycle with several LLM subprocess calls
+  routinely runs past 25 minutes. The bound is now two-fold: a stall bound
+  (default 45 min) measured against real session-dir activity — heartbeats
+  and lock files excluded, because the heartbeat thread outlives a hung main
+  thread and would blind the detector — and an absolute hard cap (default
+  3 h). Both are env-overridable (`KAIROS_WORKER_STALL_SECONDS`,
+  `KAIROS_WORKER_TIMEOUT_SECONDS`), and both write a `worker_exit.json`
+  record before `exit!(124)`. Every other exit the worker can see coming —
+  superseded, trapped signal, setsid failure, bootstrap failure, uncaught
+  error, normal completion — now leaves the same one-line record, and a
+  `crashed` report from `agent_wait` / `agent_status` carries the record (or
+  says explicitly that the process vanished without one, which is what a
+  SIGKILL still looks like). The record is deliberately NOT a result file:
+  the collector's crash path stays the crash path, so a committed advance is
+  still recovered from the gate log and never masked.
+
+- **Field defect D5 — a reviewer reply that defeats parsing lost both the
+  cycle and the evidence.** The high-complexity plan review extracts JSON
+  from the reviewer's reply; a long reply can contain several JSON blocks
+  (echoed plan fragments in code fences, code in findings), and taking the
+  first parseable one produced a hash with no `overall_verdict` — REVISE by
+  fallback, twice, then `review_max_retries` with zero cycles run, while the
+  5,819-character reply itself was discarded (snapshots keep metadata only).
+  The parser now scans all candidate blocks — whole reply, every fenced
+  block, every balanced object around an `"overall_verdict"` occurrence —
+  and prefers the one carrying a String verdict; and when parsing still
+  falls back, the raw reply is persisted beside the session records
+  (`review_raw_<ts>.txt`, 64 KiB cap) with the path named in the review's
+  findings.
+
+### Added
+
+- **Norm (g)** in the agent's standing norms, from field defect D2: what
+  `operator_report` receives must already be the finished text. The executor
+  feeds no step's output into another step's arguments, so a body written as
+  an assembly instruction is delivered verbatim as the report — cycle 1 of
+  the first field run did exactly that, and cycle 2 corrected it on its own.
+  The norm makes the correction standing.
+
+- `test_agent_worker_exit_and_review_parse.rb` — 19 tests, 42 assertions:
+  exit-record round-trip and token matching, stall-clock exclusion of
+  heartbeats and locks, env-overridable bounds, decoy-JSON regression for
+  the review parser, raw-reply persistence, norm (g) presence.
+
+Field context: defects D1 (worker bootstrap vs host-profile add-on guards,
+fixed and proven in 3.77.0's field night) through D5 are ledgered in L2
+`agent_3_77_0_field_defects` with the two field runs that surfaced them.
+D3 (read-only status calls queue behind a blocking wait on the stdio
+transport) remains open and recorded.
+
 ## [3.78.0] - 2026-08-26
 
 ### Fixed

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.78.0"
+  VERSION = "3.80.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/bin/agent_step_worker.rb

@@ -62,6 +62,17 @@ rescue ScriptError, StandardError => e
   write_raw_result(session_dir, boot_identity,
                    { 'status' => 'error',
                      'error' => "worker bootstrap failed: #{e.class}: #{e.message}" })
+  # StepDelegation itself failed to load, so write the exit record by hand
+  # (field defect D4: every exit this worker can see coming leaves one).
+  begin
+    File.write(File.join(session_dir, 'worker_exit.json'),
+               JSON.generate({ 'timestamp' => Time.now.utc.iso8601, 'pid' => Process.pid,
+                               'exit_class' => 'bootstrap_failure',
+                               'step_token' => boot_identity['step_token'],
+                               'error' => "#{e.class}: #{e.message}" }))
+  rescue StandardError
+    # best effort
+  end
   exit 1
 end
 
@@ -81,6 +92,7 @@ rescue StandardError => e
   delegation.write_result({ 'status' => 'error',
                             'error' => "worker setsid failed: #{e.message}" },
                           identity: boot_identity)
+  delegation.write_worker_exit(boot_identity, 'setsid_failure', 'error' => e.message)
   exit 125
 end
 
@@ -96,16 +108,36 @@ heartbeat_thread = Thread.new do
   end
 end
 
-# Self-timeout watchdog: a hung gated call would otherwise hold the advance
-# lock forever. Exiting the process releases its flock; the driver then sees
-# 'crashed' and re-issues safely. We deliberately write NO result here so the
-# collector takes the crash path — if the gated advance had already committed,
-# crashed_response recovers its outcome from the gate log; an error result
-# would instead mask that committed advance.
-timeout_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_self_timeout_seconds
+# Watchdog (field defect D4, 2026-08-26): two bounds instead of one wall
+# clock. A hung gated call must not hold the advance flock forever — but the
+# old fixed 1500 s assumed only a hung call could reach it, and killed
+# healthy LLM-bound cycles at minute 25 with nothing written. Now the worker
+# dies when the session dir has gone SILENT for the stall bound (heartbeats
+# and locks excluded — the heartbeat thread outlives a hung main thread), or
+# when the hard cap elapses, whichever comes first. Either firing writes a
+# worker_exit record BEFORE exit!(124). That record is not a result, so the
+# collector still takes the crash path and a committed advance is still
+# recovered from the gate log, never masked.
+worker_started = Time.now
+stall_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_stall_seconds
+cap_s   = KairosMcp::SkillSets::Agent::StepDelegation.worker_hard_cap_seconds
 watchdog = Thread.new do
-  sleep timeout_s
-  exit!(124)
+  loop do
+    sleep 30
+    elapsed = (Time.now - worker_started).round
+    silent  = (Time.now - delegation.last_activity_time).round
+    if elapsed > cap_s
+      delegation.write_worker_exit(boot_identity, 'self_timeout_hard_cap',
+                                   'elapsed_seconds' => elapsed,
+                                   'silent_seconds' => silent)
+      exit!(124)
+    elsif silent > stall_s
+      delegation.write_worker_exit(boot_identity, 'self_timeout_stalled',
+                                   'elapsed_seconds' => elapsed,
+                                   'silent_seconds' => silent)
+      exit!(124)
+    end
+  end
 end
 
 begin
@@ -115,6 +147,12 @@ begin
   # KAIROS_DATA_DIR was set in the worker env by spawn_worker so ToolRegistry
   # / Session resolve the server's effective .kairos even under --data-dir.
   require 'kairos_mcp/tool_registry'
+  # Host-profile add-on SkillSets (codex_projection, opencode_projection) guard
+  # their lib entry point with `raise unless defined?(PluginProjector::HostProfile)`.
+  # The server satisfies that guard as a side effect of protocol.rb; this worker
+  # bootstraps only tool_registry, so it must load the core explicitly or
+  # Skillset#load! trips the guard and the whole registry bootstrap dies.
+  require 'kairos_mcp/plugin_projector'
 
   pending = delegation.pending
   raise "no pending delegation in #{session_dir}" unless pending
@@ -126,6 +164,8 @@ begin
   # worker owns this delegation, and the gate would replay/serialize our stale
   # call anyway. Exiting leaves the current handle to its rightful worker.
   if my_token.nil? || pending['step_token'] != my_token
+    delegation.write_worker_exit(boot_identity, 'superseded',
+                                 'current_token' => pending['step_token'])
     exit 0
   end
 
@@ -136,7 +176,10 @@ begin
   args = (pending['arguments'] || {}).merge('session_id' => session_id)
   args.delete('execution') # never recurse into another delegation
 
-  exit 130 if shutdown[:requested]
+  if shutdown[:requested]
+    delegation.write_worker_exit(boot_identity, 'trapped_signal')
+    exit 130
+  end
 
   registry = KairosMcp::ToolRegistry.new
   raw = registry.call_tool('agent_step', args)
@@ -158,6 +201,7 @@ begin
   # races a concurrently-opened fresh delegation by clearing state it may no
   # longer own or by mislabeling its result as a newer delegation's.
   delegation.write_result(response, identity: identity)
+  delegation.write_worker_exit(identity, 'normal')
   exit 0
 rescue SystemExit, SignalException
   # A deliberate exit (including our own `exit 0`) or a signal is not a
@@ -176,6 +220,11 @@ rescue Exception => e # rubocop:disable Lint/RescueException
   rescue StandardError
     # best effort
   end
+  begin
+    delegation.write_worker_exit(boot_identity, 'uncaught', 'error' => "#{e.class}: #{e.message}")
+  rescue StandardError
+    # best effort
+  end
   exit 1
 ensure
   watchdog&.kill

data/templates/skillsets/agent/lib/agent/step_delegation.rb

@@ -44,14 +44,23 @@ module KairosMcp
         HEARTBEAT_FILE = 'delegation.heartbeat'
         RESULT_FILE    = 'delegation_result.json'
         LOG_FILE       = 'delegation_worker.log'
+        WORKER_EXIT_FILE = 'worker_exit.json'
 
         HEARTBEAT_INTERVAL_SECONDS        = 2
         HEARTBEAT_STALE_THRESHOLD_SECONDS = 15
         STARTUP_GRACE_SECONDS             = 30
-        # Wall-clock ceiling for a delegated step; past it the worker exits so
-        # a hung gated call cannot hold the advance lock forever (a dead
-        # process releases its flock). Generous: real steps are LLM-bound.
-        WORKER_SELF_TIMEOUT_SECONDS       = 1500
+        # Two-bound watchdog for the delegated worker (field defect D4,
+        # 2026-08-26). The original single 1500 s wall clock assumed only a
+        # hung call could reach it; a healthy cycle with several LLM
+        # subprocess calls routinely runs past 25 minutes, so the clock killed
+        # sound workers — silently, because its exit wrote nothing. The stall
+        # bound frees a hung call's flock once the session dir has gone quiet
+        # (heartbeats and locks excluded: the heartbeat thread outlives a hung
+        # main thread, so it must not count as activity); the hard cap remains
+        # the absolute ceiling. Both are env-overridable per run and both
+        # record their firing in WORKER_EXIT_FILE before exiting.
+        WORKER_STALL_SECONDS_DEFAULT      = 2700
+        WORKER_HARD_CAP_SECONDS_DEFAULT   = 10800
 
         WORKER_SCRIPT = File.expand_path('../../bin/agent_step_worker.rb', __dir__)
 
@@ -195,6 +204,68 @@ module KairosMcp
           atomic_write(result_path, JSON.pretty_generate(payload))
         end
 
+        # ---- worker exit record (field defect D4) ----
+
+        # One line, written by the worker at every exit it can see coming
+        # (self-timeout, supersession, trapped signal, setsid/bootstrap
+        # failure, uncaught error, normal completion). Deliberately NOT the
+        # result file: the collector's crash path must stay the crash path, so
+        # a committed advance is still recovered from the gate log and never
+        # masked by an error result. Overwrites are fine — readers match on
+        # step_token, so a stale record for an older worker is ignored.
+        def write_worker_exit(identity, exit_class, detail = {})
+          payload = {
+            'timestamp'    => Time.now.utc.iso8601,
+            'pid'          => Process.pid,
+            'exit_class'   => exit_class.to_s,
+            'step_token'   => identity && identity['step_token'],
+            'issue_anchor' => identity && identity['issue_anchor']
+          }.merge(detail)
+          atomic_write(worker_exit_path, JSON.generate(payload))
+          payload
+        rescue StandardError
+          nil
+        end
+
+        def worker_exit
+          JSON.parse(File.read(worker_exit_path))
+        rescue Errno::ENOENT, JSON::ParserError
+          nil
+        end
+
+        # The exit record for THIS token, or a positive "no record" marker —
+        # so a 'crashed' report can say WHY (e.g. self_timeout_stalled after
+        # N s of silence) or say explicitly that the process vanished without
+        # writing anything (SIGKILL and kin, or a pre-3.78 worker).
+        def crash_detail(token)
+          rec = worker_exit
+          if rec && rec['step_token'] == token
+            rec
+          else
+            { 'exit_class' => 'no_record',
+              'note' => 'process gone without an exit record (killed, or a pre-3.78 worker)' }
+          end
+        end
+
+        # Most recent write anywhere in the session dir EXCLUDING liveness and
+        # locking artifacts: heartbeats tick every 2 s even when the main
+        # thread hangs, so counting them would blind the stall bound.
+        def last_activity_time
+          newest = nil
+          Dir.glob(File.join(@dir, '*')).each do |f|
+            base = File.basename(f)
+            next if base.start_with?(HEARTBEAT_FILE)
+            next if base == LOCK_FILE || base.end_with?('.lock')
+            t = begin
+              File.mtime(f)
+            rescue StandardError
+              next
+            end
+            newest = t if newest.nil? || t > newest
+          end
+          newest || Time.now
+        end
+
         # Collect-once, atomically and self-contained: under the lock, consume
         # the result ONLY if it belongs to the CURRENT pending handle (same
         # issue_anchor + action_key + step_token), clearing both the result and
@@ -274,8 +345,12 @@ module KairosMcp
           pid
         end
 
-        def self.worker_self_timeout_seconds
-          WORKER_SELF_TIMEOUT_SECONDS
+        def self.worker_stall_seconds
+          (ENV['KAIROS_WORKER_STALL_SECONDS'] || WORKER_STALL_SECONDS_DEFAULT).to_i
+        end
+
+        def self.worker_hard_cap_seconds
+          (ENV['KAIROS_WORKER_TIMEOUT_SECONDS'] || WORKER_HARD_CAP_SECONDS_DEFAULT).to_i
         end
 
         private
@@ -338,6 +413,7 @@ module KairosMcp
         def pending_path   = File.join(@dir, PENDING_FILE)
         def heartbeat_path(token) = File.join(@dir, "#{HEARTBEAT_FILE}.#{token}")
         def result_path    = File.join(@dir, RESULT_FILE)
+        def worker_exit_path = File.join(@dir, WORKER_EXIT_FILE)
       end
     end
   end

data/templates/skillsets/agent/test/test_agent_worker_exit_and_review_parse.rb

@@ -0,0 +1,241 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Field defects D4 and D5 (2026-08-26, ledger: L2 agent_3_77_0_field_defects).
+#
+#   D4 — the delegated worker's watchdog killed healthy slow cycles at a fixed
+#        1500 s and exited with exit!(124) writing nothing. Covered here:
+#        the two-bound configuration (stall / hard cap, env-overridable), the
+#        worker exit record round-trip, crash_detail's token matching and its
+#        positive "no record" marker, and last_activity_time's exclusion of
+#        heartbeat and lock files (counting heartbeats would blind the stall
+#        bound: the heartbeat thread outlives a hung main thread).
+#   D5 — a reviewer reply carrying several JSON blocks defeated the parser
+#        (first parseable block had no overall_verdict). Covered here: the
+#        candidate scan prefers the block that carries a String verdict, the
+#        fallback reasons stay honest, and an unparseable reply is persisted
+#        raw beside the session records.
+#
+# Reads the SHIPPED template copies, not the instance copies under .kairos.
+# Usage: ruby test_agent_worker_exit_and_review_parse.rb
+
+require 'minitest/autorun'
+require 'json'
+require 'fileutils'
+require 'tmpdir'
+require 'rbconfig'
+
+$test_kairos_dir = Dir.mktmpdir('agent_worker_exit_test')
+
+module Autoexec
+  def self.loaded?
+    true
+  end
+end
+
+module KairosMcp
+  def self.data_dir
+    $test_kairos_dir
+  end
+
+  module Tools
+    class BaseTool
+      def text_content(text)
+        text
+      end
+    end
+  end
+end
+
+require File.expand_path('../autonomos/lib/autonomos', File.dirname(__dir__))
+require_relative '../lib/agent/mandate_adapter'
+
+$LOAD_PATH.unshift File.expand_path('../../../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../../autoexec/lib', __dir__)
+require 'kairos_mcp/invocation_context'
+require 'kairos_mcp/tools/base_tool'
+require 'kairos_mcp/tool_registry'
+require_relative '../lib/agent'
+require_relative '../tools/agent_step'
+require_relative '../lib/agent/step_delegation'
+
+StepDelegation = KairosMcp::SkillSets::Agent::StepDelegation
+AgentStepTool  = KairosMcp::SkillSets::Agent::Tools::AgentStep
+
+FakeSession = Struct.new(:session_dir)
+
+class TestWorkerExitRecord < Minitest::Test
+  def setup
+    @dir = Dir.mktmpdir('wx_')
+    @delegation = StepDelegation.new(@dir)
+    @identity = { 'step_token' => 'tok-1', 'issue_anchor' => '1:checkpoint:1' }
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  def test_write_and_read_round_trip
+    @delegation.write_worker_exit(@identity, 'self_timeout_stalled',
+                                  'elapsed_seconds' => 100, 'silent_seconds' => 90)
+    rec = @delegation.worker_exit
+    assert_equal 'self_timeout_stalled', rec['exit_class']
+    assert_equal 'tok-1', rec['step_token']
+    assert_equal 90, rec['silent_seconds']
+    assert_equal Process.pid, rec['pid']
+    refute_nil rec['timestamp']
+  end
+
+  def test_crash_detail_matches_token
+    @delegation.write_worker_exit(@identity, 'superseded')
+    assert_equal 'superseded', @delegation.crash_detail('tok-1')['exit_class']
+  end
+
+  def test_crash_detail_ignores_other_tokens_record
+    @delegation.write_worker_exit(@identity, 'normal')
+    detail = @delegation.crash_detail('tok-2')
+    assert_equal 'no_record', detail['exit_class']
+  end
+
+  def test_crash_detail_without_any_record_is_positive_no_record
+    detail = @delegation.crash_detail('tok-1')
+    assert_equal 'no_record', detail['exit_class']
+    assert_match(/without an exit record/, detail['note'])
+  end
+
+  def test_worker_exit_survives_nil_identity
+    rec = @delegation.write_worker_exit(nil, 'bootstrap_failure')
+    assert_equal 'bootstrap_failure', rec['exit_class']
+    assert_nil rec['step_token']
+  end
+end
+
+class TestStallActivityClock < Minitest::Test
+  def setup
+    @dir = Dir.mktmpdir('act_')
+    @delegation = StepDelegation.new(@dir)
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  def test_heartbeats_and_locks_do_not_count_as_activity
+    old = Time.now - 300
+    content = File.join(@dir, 'progress.jsonl')
+    File.write(content, 'x')
+    File.utime(old, old, content)
+    # Fresh liveness/locking artifacts that must NOT rejuvenate the clock.
+    File.write(File.join(@dir, 'delegation.heartbeat.tok-1'), '')
+    File.write(File.join(@dir, 'delegation.lock'), '')
+    File.write(File.join(@dir, 'advance.lock'), '')
+
+    assert_in_delta old.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+
+  def test_real_writes_do_count
+    File.write(File.join(@dir, 'llm_snapshots.jsonl'), 'x')
+    assert_in_delta Time.now.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+
+  def test_empty_dir_falls_back_to_now
+    assert_in_delta Time.now.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+end
+
+class TestWatchdogBounds < Minitest::Test
+  def test_defaults
+    assert_equal 2700,  StepDelegation.worker_stall_seconds
+    assert_equal 10_800, StepDelegation.worker_hard_cap_seconds
+  end
+
+  def test_env_overrides
+    ENV['KAIROS_WORKER_STALL_SECONDS'] = '60'
+    ENV['KAIROS_WORKER_TIMEOUT_SECONDS'] = '120'
+    assert_equal 60,  StepDelegation.worker_stall_seconds
+    assert_equal 120, StepDelegation.worker_hard_cap_seconds
+  ensure
+    ENV.delete('KAIROS_WORKER_STALL_SECONDS')
+    ENV.delete('KAIROS_WORKER_TIMEOUT_SECONDS')
+  end
+
+  def test_worker_script_parses
+    script = File.expand_path('../bin/agent_step_worker.rb', __dir__)
+    assert system(RbConfig.ruby, '-c', script, out: File::NULL, err: File::NULL),
+           'agent_step_worker.rb must stay syntactically valid'
+  end
+end
+
+class TestReviewParseHardening < Minitest::Test
+  def setup
+    @tool = AgentStepTool.allocate
+  end
+
+  def parse(content)
+    @tool.send(:parse_persona_review, content)
+  end
+
+  def test_clean_json_still_parses
+    r = parse('{"overall_verdict": "approve", "key_findings": []}')
+    assert_equal 'APPROVE', r[:overall_verdict]
+    refute r[:parse_error]
+  end
+
+  def test_verdict_found_past_a_decoy_json_block
+    # D5 regression shape: the first parseable JSON block (echoed plan
+    # fragment in a code fence) has no overall_verdict; the real verdict
+    # object comes later in prose.
+    content = <<~REPLY
+      Looking at the plan first:
+      ```json
+      {"task_id": "t-99", "steps": [{"tool_name": "safe_file_read"}]}
+      ```
+      My assessment as a panel follows.
+      {"overall_verdict": "revise", "key_findings": ["step 3 unclear"]}
+    REPLY
+    r = parse(content)
+    assert_equal 'REVISE', r[:overall_verdict]
+    assert_equal ['step 3 unclear'], r[:key_findings]
+    refute r[:parse_error]
+  end
+
+  def test_hash_without_verdict_still_falls_back_honestly
+    r = parse('{"verdict": "APPROVE"}')
+    assert r[:parse_error]
+    assert_match(/invalid overall_verdict type: NilClass/, r[:key_findings].first)
+    assert_equal 'REVISE', r[:overall_verdict]
+  end
+
+  def test_no_json_at_all_falls_back
+    r = parse('The plan looks fine to me, ship it.')
+    assert r[:parse_error]
+    assert_match(/no JSON found/, r[:key_findings].first)
+  end
+
+  def test_fenced_verdict_object_parses
+    content = "verdict below\n```json\n{\"overall_verdict\": \"REJECT\"}\n```\n"
+    assert_equal 'REJECT', parse(content)[:overall_verdict]
+  end
+
+  def test_persist_raw_review_writes_capped_file
+    Dir.mktmpdir('raw_') do |dir|
+      session = FakeSession.new(dir)
+      path = @tool.send(:persist_raw_review, session, 'a' * 70_000)
+      refute_nil path
+      assert File.exist?(path)
+      assert_equal 65_536, File.size(path)
+      assert File.basename(path).start_with?('review_raw_')
+    end
+  end
+
+  def test_persist_raw_review_nil_content_is_nil
+    assert_nil @tool.send(:persist_raw_review, FakeSession.new('/tmp'), nil)
+  end
+
+  def test_norm_g_present
+    norms = @tool.send(:permission_norms)
+    assert_match(/\(g\)/, norms)
+    assert_match(/finished text/, norms)
+  end
+end

data/templates/skillsets/agent/tools/agent_status.rb

@@ -71,6 +71,12 @@ module KairosMcp
                   'status' => dstatus,
                   'step_token' => delegation.pending&.dig('step_token')
                 }.compact
+                if dstatus == 'crashed'
+                  # Field defect D4: surface the worker's own exit record so
+                  # the operator sees WHY, not just 'crashed'.
+                  payload['delegation']['worker_exit'] =
+                    delegation.crash_detail(delegation.pending&.dig('step_token'))
+                end
                 if %w[ready still_pending].include?(dstatus)
                   payload['next_move'] = {
                     'tool' => 'agent_wait',