kairos-chain 3.78.0 → 3.79.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bdf5a0932b91258ccacf0520ca20eb252b7080c7ef3682f87edb8fdb07144c6
-  data.tar.gz: '09f911f59d0aba91f246f5ec6721cc4ee11f8534bd96ed73fc31edd3df1a78ff'
+  metadata.gz: 22b92a50151e63d6f243858700e0a0982dd569ce6df05133362dcda4077d6fd6
+  data.tar.gz: d6d5559901257355633ba3a9d26a43af62293757b67f98c011bd795be4dee8f7
 SHA512:
-  metadata.gz: 884fe864157b0c5ea27cc9249de0378f4c8e53d0b724ef6c92e9adc85dd1a092e8c7291c1e0e778a20d3edf4058da92801968733f38017a73df60eb7b552ade3
-  data.tar.gz: c9061d247bee27b8525dae1d14f4acd1036e27d2c024b74228c43bc23211329285d418689aa6314c70f2e5f6060b9df4ad68e118870b680f6c411ab5d2de5cc7
+  metadata.gz: 8f1bdd48fc2dd110b151e1bc2a8aff18278ea2bc0d97d801dcf3bdd086462e8d6d97b27fdd0a81b75dac820f84aa0786a076eeef84b8ae44d5012e1e435141c0
+  data.tar.gz: 0c401f4330cff3dc4af3bf6a4277fcf68412e93fec79acc6eb50a12f7e19c84c6eec298ba5527938e8fc8e2dc983a192383f7babec0c1741dde0e47aca993985

data/CHANGELOG.md

@@ -4,6 +4,66 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.79.0] - 2026-08-26
+
+### Fixed
+
+- **Field defect D4 — the delegated worker's watchdog killed healthy slow
+  cycles at minute 25, and killed them silently.** 3.77.0's first night of
+  field use ran the agent SkillSet on real goals; twice, a worker died with
+  nothing written, and the second death gave the mechanism away: spawn 20:31,
+  last heartbeat 20:56 — spawn plus exactly `WORKER_SELF_TIMEOUT_SECONDS`
+  (1500). The watchdog's design assumption was that only a HUNG gated call
+  reaches the bound; a healthy cycle with several LLM subprocess calls
+  routinely runs past 25 minutes. The bound is now two-fold: a stall bound
+  (default 45 min) measured against real session-dir activity — heartbeats
+  and lock files excluded, because the heartbeat thread outlives a hung main
+  thread and would blind the detector — and an absolute hard cap (default
+  3 h). Both are env-overridable (`KAIROS_WORKER_STALL_SECONDS`,
+  `KAIROS_WORKER_TIMEOUT_SECONDS`), and both write a `worker_exit.json`
+  record before `exit!(124)`. Every other exit the worker can see coming —
+  superseded, trapped signal, setsid failure, bootstrap failure, uncaught
+  error, normal completion — now leaves the same one-line record, and a
+  `crashed` report from `agent_wait` / `agent_status` carries the record (or
+  says explicitly that the process vanished without one, which is what a
+  SIGKILL still looks like). The record is deliberately NOT a result file:
+  the collector's crash path stays the crash path, so a committed advance is
+  still recovered from the gate log and never masked.
+
+- **Field defect D5 — a reviewer reply that defeats parsing lost both the
+  cycle and the evidence.** The high-complexity plan review extracts JSON
+  from the reviewer's reply; a long reply can contain several JSON blocks
+  (echoed plan fragments in code fences, code in findings), and taking the
+  first parseable one produced a hash with no `overall_verdict` — REVISE by
+  fallback, twice, then `review_max_retries` with zero cycles run, while the
+  5,819-character reply itself was discarded (snapshots keep metadata only).
+  The parser now scans all candidate blocks — whole reply, every fenced
+  block, every balanced object around an `"overall_verdict"` occurrence —
+  and prefers the one carrying a String verdict; and when parsing still
+  falls back, the raw reply is persisted beside the session records
+  (`review_raw_<ts>.txt`, 64 KiB cap) with the path named in the review's
+  findings.
+
+### Added
+
+- **Norm (g)** in the agent's standing norms, from field defect D2: what
+  `operator_report` receives must already be the finished text. The executor
+  feeds no step's output into another step's arguments, so a body written as
+  an assembly instruction is delivered verbatim as the report — cycle 1 of
+  the first field run did exactly that, and cycle 2 corrected it on its own.
+  The norm makes the correction standing.
+
+- `test_agent_worker_exit_and_review_parse.rb` — 19 tests, 42 assertions:
+  exit-record round-trip and token matching, stall-clock exclusion of
+  heartbeats and locks, env-overridable bounds, decoy-JSON regression for
+  the review parser, raw-reply persistence, norm (g) presence.
+
+Field context: defects D1 (worker bootstrap vs host-profile add-on guards,
+fixed and proven in 3.77.0's field night) through D5 are ledgered in L2
+`agent_3_77_0_field_defects` with the two field runs that surfaced them.
+D3 (read-only status calls queue behind a blocking wait on the stdio
+transport) remains open and recorded.
+
 ## [3.78.0] - 2026-08-26
 
 ### Fixed

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.78.0"
+  VERSION = "3.79.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/bin/agent_step_worker.rb

@@ -62,6 +62,17 @@ rescue ScriptError, StandardError => e
   write_raw_result(session_dir, boot_identity,
                    { 'status' => 'error',
                      'error' => "worker bootstrap failed: #{e.class}: #{e.message}" })
+  # StepDelegation itself failed to load, so write the exit record by hand
+  # (field defect D4: every exit this worker can see coming leaves one).
+  begin
+    File.write(File.join(session_dir, 'worker_exit.json'),
+               JSON.generate({ 'timestamp' => Time.now.utc.iso8601, 'pid' => Process.pid,
+                               'exit_class' => 'bootstrap_failure',
+                               'step_token' => boot_identity['step_token'],
+                               'error' => "#{e.class}: #{e.message}" }))
+  rescue StandardError
+    # best effort
+  end
   exit 1
 end
 
@@ -81,6 +92,7 @@ rescue StandardError => e
   delegation.write_result({ 'status' => 'error',
                             'error' => "worker setsid failed: #{e.message}" },
                           identity: boot_identity)
+  delegation.write_worker_exit(boot_identity, 'setsid_failure', 'error' => e.message)
   exit 125
 end
 
@@ -96,16 +108,36 @@ heartbeat_thread = Thread.new do
   end
 end
 
-# Self-timeout watchdog: a hung gated call would otherwise hold the advance
-# lock forever. Exiting the process releases its flock; the driver then sees
-# 'crashed' and re-issues safely. We deliberately write NO result here so the
-# collector takes the crash path — if the gated advance had already committed,
-# crashed_response recovers its outcome from the gate log; an error result
-# would instead mask that committed advance.
-timeout_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_self_timeout_seconds
+# Watchdog (field defect D4, 2026-08-26): two bounds instead of one wall
+# clock. A hung gated call must not hold the advance flock forever — but the
+# old fixed 1500 s assumed only a hung call could reach it, and killed
+# healthy LLM-bound cycles at minute 25 with nothing written. Now the worker
+# dies when the session dir has gone SILENT for the stall bound (heartbeats
+# and locks excluded — the heartbeat thread outlives a hung main thread), or
+# when the hard cap elapses, whichever comes first. Either firing writes a
+# worker_exit record BEFORE exit!(124). That record is not a result, so the
+# collector still takes the crash path and a committed advance is still
+# recovered from the gate log, never masked.
+worker_started = Time.now
+stall_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_stall_seconds
+cap_s   = KairosMcp::SkillSets::Agent::StepDelegation.worker_hard_cap_seconds
 watchdog = Thread.new do
-  sleep timeout_s
-  exit!(124)
+  loop do
+    sleep 30
+    elapsed = (Time.now - worker_started).round
+    silent  = (Time.now - delegation.last_activity_time).round
+    if elapsed > cap_s
+      delegation.write_worker_exit(boot_identity, 'self_timeout_hard_cap',
+                                   'elapsed_seconds' => elapsed,
+                                   'silent_seconds' => silent)
+      exit!(124)
+    elsif silent > stall_s
+      delegation.write_worker_exit(boot_identity, 'self_timeout_stalled',
+                                   'elapsed_seconds' => elapsed,
+                                   'silent_seconds' => silent)
+      exit!(124)
+    end
+  end
 end
 
 begin
@@ -115,6 +147,12 @@ begin
   # KAIROS_DATA_DIR was set in the worker env by spawn_worker so ToolRegistry
   # / Session resolve the server's effective .kairos even under --data-dir.
   require 'kairos_mcp/tool_registry'
+  # Host-profile add-on SkillSets (codex_projection, opencode_projection) guard
+  # their lib entry point with `raise unless defined?(PluginProjector::HostProfile)`.
+  # The server satisfies that guard as a side effect of protocol.rb; this worker
+  # bootstraps only tool_registry, so it must load the core explicitly or
+  # Skillset#load! trips the guard and the whole registry bootstrap dies.
+  require 'kairos_mcp/plugin_projector'
 
   pending = delegation.pending
   raise "no pending delegation in #{session_dir}" unless pending
@@ -126,6 +164,8 @@ begin
   # worker owns this delegation, and the gate would replay/serialize our stale
   # call anyway. Exiting leaves the current handle to its rightful worker.
   if my_token.nil? || pending['step_token'] != my_token
+    delegation.write_worker_exit(boot_identity, 'superseded',
+                                 'current_token' => pending['step_token'])
     exit 0
   end
 
@@ -136,7 +176,10 @@ begin
   args = (pending['arguments'] || {}).merge('session_id' => session_id)
   args.delete('execution') # never recurse into another delegation
 
-  exit 130 if shutdown[:requested]
+  if shutdown[:requested]
+    delegation.write_worker_exit(boot_identity, 'trapped_signal')
+    exit 130
+  end
 
   registry = KairosMcp::ToolRegistry.new
   raw = registry.call_tool('agent_step', args)
@@ -158,6 +201,7 @@ begin
   # races a concurrently-opened fresh delegation by clearing state it may no
   # longer own or by mislabeling its result as a newer delegation's.
   delegation.write_result(response, identity: identity)
+  delegation.write_worker_exit(identity, 'normal')
   exit 0
 rescue SystemExit, SignalException
   # A deliberate exit (including our own `exit 0`) or a signal is not a
@@ -176,6 +220,11 @@ rescue Exception => e # rubocop:disable Lint/RescueException
   rescue StandardError
     # best effort
   end
+  begin
+    delegation.write_worker_exit(boot_identity, 'uncaught', 'error' => "#{e.class}: #{e.message}")
+  rescue StandardError
+    # best effort
+  end
   exit 1
 ensure
   watchdog&.kill

data/templates/skillsets/agent/lib/agent/step_delegation.rb

@@ -44,14 +44,23 @@ module KairosMcp
         HEARTBEAT_FILE = 'delegation.heartbeat'
         RESULT_FILE    = 'delegation_result.json'
         LOG_FILE       = 'delegation_worker.log'
+        WORKER_EXIT_FILE = 'worker_exit.json'
 
         HEARTBEAT_INTERVAL_SECONDS        = 2
         HEARTBEAT_STALE_THRESHOLD_SECONDS = 15
         STARTUP_GRACE_SECONDS             = 30
-        # Wall-clock ceiling for a delegated step; past it the worker exits so
-        # a hung gated call cannot hold the advance lock forever (a dead
-        # process releases its flock). Generous: real steps are LLM-bound.
-        WORKER_SELF_TIMEOUT_SECONDS       = 1500
+        # Two-bound watchdog for the delegated worker (field defect D4,
+        # 2026-08-26). The original single 1500 s wall clock assumed only a
+        # hung call could reach it; a healthy cycle with several LLM
+        # subprocess calls routinely runs past 25 minutes, so the clock killed
+        # sound workers — silently, because its exit wrote nothing. The stall
+        # bound frees a hung call's flock once the session dir has gone quiet
+        # (heartbeats and locks excluded: the heartbeat thread outlives a hung
+        # main thread, so it must not count as activity); the hard cap remains
+        # the absolute ceiling. Both are env-overridable per run and both
+        # record their firing in WORKER_EXIT_FILE before exiting.
+        WORKER_STALL_SECONDS_DEFAULT      = 2700
+        WORKER_HARD_CAP_SECONDS_DEFAULT   = 10800
 
         WORKER_SCRIPT = File.expand_path('../../bin/agent_step_worker.rb', __dir__)
 
@@ -195,6 +204,68 @@ module KairosMcp
           atomic_write(result_path, JSON.pretty_generate(payload))
         end
 
+        # ---- worker exit record (field defect D4) ----
+
+        # One line, written by the worker at every exit it can see coming
+        # (self-timeout, supersession, trapped signal, setsid/bootstrap
+        # failure, uncaught error, normal completion). Deliberately NOT the
+        # result file: the collector's crash path must stay the crash path, so
+        # a committed advance is still recovered from the gate log and never
+        # masked by an error result. Overwrites are fine — readers match on
+        # step_token, so a stale record for an older worker is ignored.
+        def write_worker_exit(identity, exit_class, detail = {})
+          payload = {
+            'timestamp'    => Time.now.utc.iso8601,
+            'pid'          => Process.pid,
+            'exit_class'   => exit_class.to_s,
+            'step_token'   => identity && identity['step_token'],
+            'issue_anchor' => identity && identity['issue_anchor']
+          }.merge(detail)
+          atomic_write(worker_exit_path, JSON.generate(payload))
+          payload
+        rescue StandardError
+          nil
+        end
+
+        def worker_exit
+          JSON.parse(File.read(worker_exit_path))
+        rescue Errno::ENOENT, JSON::ParserError
+          nil
+        end
+
+        # The exit record for THIS token, or a positive "no record" marker —
+        # so a 'crashed' report can say WHY (e.g. self_timeout_stalled after
+        # N s of silence) or say explicitly that the process vanished without
+        # writing anything (SIGKILL and kin, or a pre-3.78 worker).
+        def crash_detail(token)
+          rec = worker_exit
+          if rec && rec['step_token'] == token
+            rec
+          else
+            { 'exit_class' => 'no_record',
+              'note' => 'process gone without an exit record (killed, or a pre-3.78 worker)' }
+          end
+        end
+
+        # Most recent write anywhere in the session dir EXCLUDING liveness and
+        # locking artifacts: heartbeats tick every 2 s even when the main
+        # thread hangs, so counting them would blind the stall bound.
+        def last_activity_time
+          newest = nil
+          Dir.glob(File.join(@dir, '*')).each do |f|
+            base = File.basename(f)
+            next if base.start_with?(HEARTBEAT_FILE)
+            next if base == LOCK_FILE || base.end_with?('.lock')
+            t = begin
+              File.mtime(f)
+            rescue StandardError
+              next
+            end
+            newest = t if newest.nil? || t > newest
+          end
+          newest || Time.now
+        end
+
         # Collect-once, atomically and self-contained: under the lock, consume
         # the result ONLY if it belongs to the CURRENT pending handle (same
         # issue_anchor + action_key + step_token), clearing both the result and
@@ -274,8 +345,12 @@ module KairosMcp
           pid
         end
 
-        def self.worker_self_timeout_seconds
-          WORKER_SELF_TIMEOUT_SECONDS
+        def self.worker_stall_seconds
+          (ENV['KAIROS_WORKER_STALL_SECONDS'] || WORKER_STALL_SECONDS_DEFAULT).to_i
+        end
+
+        def self.worker_hard_cap_seconds
+          (ENV['KAIROS_WORKER_TIMEOUT_SECONDS'] || WORKER_HARD_CAP_SECONDS_DEFAULT).to_i
         end
 
         private
@@ -338,6 +413,7 @@ module KairosMcp
         def pending_path   = File.join(@dir, PENDING_FILE)
         def heartbeat_path(token) = File.join(@dir, "#{HEARTBEAT_FILE}.#{token}")
         def result_path    = File.join(@dir, RESULT_FILE)
+        def worker_exit_path = File.join(@dir, WORKER_EXIT_FILE)
       end
     end
   end

data/templates/skillsets/agent/test/test_agent_worker_exit_and_review_parse.rb

@@ -0,0 +1,241 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Field defects D4 and D5 (2026-08-26, ledger: L2 agent_3_77_0_field_defects).
+#
+#   D4 — the delegated worker's watchdog killed healthy slow cycles at a fixed
+#        1500 s and exited with exit!(124) writing nothing. Covered here:
+#        the two-bound configuration (stall / hard cap, env-overridable), the
+#        worker exit record round-trip, crash_detail's token matching and its
+#        positive "no record" marker, and last_activity_time's exclusion of
+#        heartbeat and lock files (counting heartbeats would blind the stall
+#        bound: the heartbeat thread outlives a hung main thread).
+#   D5 — a reviewer reply carrying several JSON blocks defeated the parser
+#        (first parseable block had no overall_verdict). Covered here: the
+#        candidate scan prefers the block that carries a String verdict, the
+#        fallback reasons stay honest, and an unparseable reply is persisted
+#        raw beside the session records.
+#
+# Reads the SHIPPED template copies, not the instance copies under .kairos.
+# Usage: ruby test_agent_worker_exit_and_review_parse.rb
+
+require 'minitest/autorun'
+require 'json'
+require 'fileutils'
+require 'tmpdir'
+require 'rbconfig'
+
+$test_kairos_dir = Dir.mktmpdir('agent_worker_exit_test')
+
+module Autoexec
+  def self.loaded?
+    true
+  end
+end
+
+module KairosMcp
+  def self.data_dir
+    $test_kairos_dir
+  end
+
+  module Tools
+    class BaseTool
+      def text_content(text)
+        text
+      end
+    end
+  end
+end
+
+require File.expand_path('../autonomos/lib/autonomos', File.dirname(__dir__))
+require_relative '../lib/agent/mandate_adapter'
+
+$LOAD_PATH.unshift File.expand_path('../../../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../../autoexec/lib', __dir__)
+require 'kairos_mcp/invocation_context'
+require 'kairos_mcp/tools/base_tool'
+require 'kairos_mcp/tool_registry'
+require_relative '../lib/agent'
+require_relative '../tools/agent_step'
+require_relative '../lib/agent/step_delegation'
+
+StepDelegation = KairosMcp::SkillSets::Agent::StepDelegation
+AgentStepTool  = KairosMcp::SkillSets::Agent::Tools::AgentStep
+
+FakeSession = Struct.new(:session_dir)
+
+class TestWorkerExitRecord < Minitest::Test
+  def setup
+    @dir = Dir.mktmpdir('wx_')
+    @delegation = StepDelegation.new(@dir)
+    @identity = { 'step_token' => 'tok-1', 'issue_anchor' => '1:checkpoint:1' }
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  def test_write_and_read_round_trip
+    @delegation.write_worker_exit(@identity, 'self_timeout_stalled',
+                                  'elapsed_seconds' => 100, 'silent_seconds' => 90)
+    rec = @delegation.worker_exit
+    assert_equal 'self_timeout_stalled', rec['exit_class']
+    assert_equal 'tok-1', rec['step_token']
+    assert_equal 90, rec['silent_seconds']
+    assert_equal Process.pid, rec['pid']
+    refute_nil rec['timestamp']
+  end
+
+  def test_crash_detail_matches_token
+    @delegation.write_worker_exit(@identity, 'superseded')
+    assert_equal 'superseded', @delegation.crash_detail('tok-1')['exit_class']
+  end
+
+  def test_crash_detail_ignores_other_tokens_record
+    @delegation.write_worker_exit(@identity, 'normal')
+    detail = @delegation.crash_detail('tok-2')
+    assert_equal 'no_record', detail['exit_class']
+  end
+
+  def test_crash_detail_without_any_record_is_positive_no_record
+    detail = @delegation.crash_detail('tok-1')
+    assert_equal 'no_record', detail['exit_class']
+    assert_match(/without an exit record/, detail['note'])
+  end
+
+  def test_worker_exit_survives_nil_identity
+    rec = @delegation.write_worker_exit(nil, 'bootstrap_failure')
+    assert_equal 'bootstrap_failure', rec['exit_class']
+    assert_nil rec['step_token']
+  end
+end
+
+class TestStallActivityClock < Minitest::Test
+  def setup
+    @dir = Dir.mktmpdir('act_')
+    @delegation = StepDelegation.new(@dir)
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  def test_heartbeats_and_locks_do_not_count_as_activity
+    old = Time.now - 300
+    content = File.join(@dir, 'progress.jsonl')
+    File.write(content, 'x')
+    File.utime(old, old, content)
+    # Fresh liveness/locking artifacts that must NOT rejuvenate the clock.
+    File.write(File.join(@dir, 'delegation.heartbeat.tok-1'), '')
+    File.write(File.join(@dir, 'delegation.lock'), '')
+    File.write(File.join(@dir, 'advance.lock'), '')
+
+    assert_in_delta old.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+
+  def test_real_writes_do_count
+    File.write(File.join(@dir, 'llm_snapshots.jsonl'), 'x')
+    assert_in_delta Time.now.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+
+  def test_empty_dir_falls_back_to_now
+    assert_in_delta Time.now.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+end
+
+class TestWatchdogBounds < Minitest::Test
+  def test_defaults
+    assert_equal 2700,  StepDelegation.worker_stall_seconds
+    assert_equal 10_800, StepDelegation.worker_hard_cap_seconds
+  end
+
+  def test_env_overrides
+    ENV['KAIROS_WORKER_STALL_SECONDS'] = '60'
+    ENV['KAIROS_WORKER_TIMEOUT_SECONDS'] = '120'
+    assert_equal 60,  StepDelegation.worker_stall_seconds
+    assert_equal 120, StepDelegation.worker_hard_cap_seconds
+  ensure
+    ENV.delete('KAIROS_WORKER_STALL_SECONDS')
+    ENV.delete('KAIROS_WORKER_TIMEOUT_SECONDS')
+  end
+
+  def test_worker_script_parses
+    script = File.expand_path('../bin/agent_step_worker.rb', __dir__)
+    assert system(RbConfig.ruby, '-c', script, out: File::NULL, err: File::NULL),
+           'agent_step_worker.rb must stay syntactically valid'
+  end
+end
+
+class TestReviewParseHardening < Minitest::Test
+  def setup
+    @tool = AgentStepTool.allocate
+  end
+
+  def parse(content)
+    @tool.send(:parse_persona_review, content)
+  end
+
+  def test_clean_json_still_parses
+    r = parse('{"overall_verdict": "approve", "key_findings": []}')
+    assert_equal 'APPROVE', r[:overall_verdict]
+    refute r[:parse_error]
+  end
+
+  def test_verdict_found_past_a_decoy_json_block
+    # D5 regression shape: the first parseable JSON block (echoed plan
+    # fragment in a code fence) has no overall_verdict; the real verdict
+    # object comes later in prose.
+    content = <<~REPLY
+      Looking at the plan first:
+      ```json
+      {"task_id": "t-99", "steps": [{"tool_name": "safe_file_read"}]}
+      ```
+      My assessment as a panel follows.
+      {"overall_verdict": "revise", "key_findings": ["step 3 unclear"]}
+    REPLY
+    r = parse(content)
+    assert_equal 'REVISE', r[:overall_verdict]
+    assert_equal ['step 3 unclear'], r[:key_findings]
+    refute r[:parse_error]
+  end
+
+  def test_hash_without_verdict_still_falls_back_honestly
+    r = parse('{"verdict": "APPROVE"}')
+    assert r[:parse_error]
+    assert_match(/invalid overall_verdict type: NilClass/, r[:key_findings].first)
+    assert_equal 'REVISE', r[:overall_verdict]
+  end
+
+  def test_no_json_at_all_falls_back
+    r = parse('The plan looks fine to me, ship it.')
+    assert r[:parse_error]
+    assert_match(/no JSON found/, r[:key_findings].first)
+  end
+
+  def test_fenced_verdict_object_parses
+    content = "verdict below\n```json\n{\"overall_verdict\": \"REJECT\"}\n```\n"
+    assert_equal 'REJECT', parse(content)[:overall_verdict]
+  end
+
+  def test_persist_raw_review_writes_capped_file
+    Dir.mktmpdir('raw_') do |dir|
+      session = FakeSession.new(dir)
+      path = @tool.send(:persist_raw_review, session, 'a' * 70_000)
+      refute_nil path
+      assert File.exist?(path)
+      assert_equal 65_536, File.size(path)
+      assert File.basename(path).start_with?('review_raw_')
+    end
+  end
+
+  def test_persist_raw_review_nil_content_is_nil
+    assert_nil @tool.send(:persist_raw_review, FakeSession.new('/tmp'), nil)
+  end
+
+  def test_norm_g_present
+    norms = @tool.send(:permission_norms)
+    assert_match(/\(g\)/, norms)
+    assert_match(/finished text/, norms)
+  end
+end

data/templates/skillsets/agent/tools/agent_status.rb

@@ -71,6 +71,12 @@ module KairosMcp
                   'status' => dstatus,
                   'step_token' => delegation.pending&.dig('step_token')
                 }.compact
+                if dstatus == 'crashed'
+                  # Field defect D4: surface the worker's own exit record so
+                  # the operator sees WHY, not just 'crashed'.
+                  payload['delegation']['worker_exit'] =
+                    delegation.crash_detail(delegation.pending&.dig('step_token'))
+                end
                 if %w[ready still_pending].include?(dstatus)
                   payload['next_move'] = {
                     'tool' => 'agent_wait',

data/templates/skillsets/agent/tools/agent_step.rb

@@ -1843,10 +1843,29 @@ module KairosMcp
             result = review_loop.run_phase('review', persona_review_system_prompt, messages, [])
 
             parsed = parse_persona_review(result['content'])
+            if parsed[:parse_error]
+              # Field defect D5: without the raw reply on disk a parse failure
+              # is undiagnosable — llm_snapshots keeps only metadata.
+              raw_path = persist_raw_review(session, result['content'])
+              parsed[:key_findings] = Array(parsed[:key_findings]) +
+                                      ["raw reviewer reply saved: #{raw_path}"] if raw_path
+            end
             parsed[:llm_calls] = review_loop.total_calls
             parsed
           end
 
+          # Persist an unparseable reviewer reply beside the session records
+          # (capped at 64 KiB). Returns the path, or nil when nothing usable.
+          def persist_raw_review(session, content)
+            return nil if content.nil? || content.to_s.empty?
+            name = "review_raw_#{Time.now.utc.strftime('%Y%m%dT%H%M%SZ')}.txt"
+            path = File.join(session.session_dir, name)
+            File.write(path, content.to_s[0, 65_536])
+            path
+          rescue StandardError
+            nil
+          end
+
           def run_lightweight_review(session, decision_payload, ar_result)
             prompt = build_lightweight_review_prompt(decision_payload, ar_result)
             review_loop = CognitiveLoop.new(self, session)
@@ -2062,18 +2081,76 @@ module KairosMcp
           def parse_persona_review(content)
             return review_parse_fallback('no content') unless content
 
-            json_str = extract_json_from_content(content)
-            return review_parse_fallback('no JSON found') unless json_str
+            # Field defect D5 (2026-08-26): a long reviewer reply can contain
+            # SEVERAL JSON blocks — echoed plan fragments, code in findings —
+            # and taking the first parseable one yielded a hash with no
+            # overall_verdict at all. Scan every candidate and prefer the one
+            # that actually carries a String overall_verdict; fall back to the
+            # first hash only when none does, so the failure reason stays
+            # honest ("invalid overall_verdict type").
+            candidates = extract_json_candidates(content)
+            return review_parse_fallback('no JSON found') if candidates.empty?
+
+            chosen = nil
+            candidates.each do |json_str|
+              parsed = begin
+                JSON.parse(json_str)
+              rescue JSON::ParserError
+                next
+              end
+              next unless parsed.is_a?(Hash)
+              if parsed['overall_verdict'].is_a?(String)
+                chosen = parsed
+                break
+              end
+              chosen ||= parsed
+            end
+            return review_parse_fallback('no JSON found') if chosen.nil?
 
-            parsed = JSON.parse(json_str)
-            verdict = parsed['overall_verdict']
+            verdict = chosen['overall_verdict']
             unless verdict.is_a?(String)
               return review_parse_fallback("invalid overall_verdict type: #{verdict.class}")
             end
-            parsed['overall_verdict'] = verdict.upcase
-            parsed.transform_keys(&:to_sym)
-          rescue JSON::ParserError => e
-            review_parse_fallback("JSON parse error: #{e.message}")
+            chosen['overall_verdict'] = verdict.upcase
+            chosen.transform_keys(&:to_sym)
+          end
+
+          # All plausible JSON blocks in a reviewer reply, in preference order:
+          # the whole reply, every fenced block, every balanced object around
+          # an "overall_verdict" occurrence, then the crude first-{ to last-}
+          # span. Invalid candidates are skipped by the caller's JSON.parse.
+          def extract_json_candidates(content)
+            begin
+              JSON.parse(content)
+              return [content]
+            rescue JSON::ParserError
+              # fall through to scanning
+            end
+
+            candidates = []
+            content.scan(/```(?:json)?\s*\n?(.*?)\n?```/m) { |m| candidates << m[0] }
+
+            search_from = 0
+            while (key_at = content.index('"overall_verdict"', search_from))
+              open_at = content.rindex('{', key_at)
+              if open_at
+                depth = 0
+                i = open_at
+                while i < content.length
+                  depth += 1 if content[i] == '{'
+                  depth -= 1 if content[i] == '}'
+                  if depth.zero?
+                    candidates << content[open_at..i]
+                    break
+                  end
+                  i += 1
+                end
+              end
+              search_from = key_at + 1
+            end
+
+            candidates << Regexp.last_match(1) if content =~ /(\{.*\})/m
+            candidates.compact.uniq
           end
 
           def review_parse_fallback(reason)
@@ -2401,7 +2478,13 @@ module KairosMcp
             "place it so that everything not depending on it comes first. Marked steps are " \
             "set aside and the rest of the plan still runs; the operator is shown what was " \
             "set aside at the end of the cycle. Do not drop such a step, and do not " \
-            "substitute a reversible half-measure without saying so in the summary."
+            "substitute a reversible half-measure without saying so in the summary.\n" \
+            "  (g) What `operator_report` receives must already be the finished text. " \
+            "The executor does not feed one step's output into another step's " \
+            "arguments, so a body written as an instruction — assemble this, summarize " \
+            "that — is delivered to the operator verbatim as the report. When the " \
+            "deliverable depends on outputs of steps in this plan, deliver it in the " \
+            "next cycle, written from what those steps actually returned."
           end
 
           def reflect_system_prompt

data/templates/skillsets/agent/tools/agent_wait.rb

@@ -174,6 +174,10 @@ module KairosMcp
             text_content(JSON.generate({
               'status' => 'crashed', 'session_id' => session.session_id,
               'step_token' => pending&.dig('step_token'),
+              # Field defect D4: say WHY when the worker left an exit record
+              # (self_timeout_stalled / hard_cap / superseded / uncaught …),
+              # or say explicitly that it vanished without one.
+              'worker_exit' => delegation.crash_detail(pending&.dig('step_token')),
               'next_action' => status_hint(session.session_id,
                                            'the delegated worker died before committing; the gate makes a ' \
                                            're-issue safe (exactly-once) — read agent_status and follow next_move')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.78.0
+  version: 3.79.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama
@@ -431,6 +431,7 @@ files:
 - templates/skillsets/agent/test/test_agent_m4.rb
 - templates/skillsets/agent/test/test_agent_native_body.rb
 - templates/skillsets/agent/test/test_agent_verdict.rb
+- templates/skillsets/agent/test/test_agent_worker_exit_and_review_parse.rb
 - templates/skillsets/agent/test/test_decide_prompt_contract.rb
 - templates/skillsets/agent/test/test_review_hint.rb
 - templates/skillsets/agent/tools/agent_execute.rb