@ai-sdlc/orchestrator 0.4.0 → 0.6.0

package/dist/fix-ci.js

@@ -8,11 +8,12 @@ import { loadConfig } from './config.js';
 import { createLogger } from './logger.js';
 import { createStructuredConsoleLogger } from './structured-logger.js';
 import { ClaudeCodeRunner } from './runners/claude-code.js';
-import { execFileAsync, getGitHubConfig, extractIssueNumber, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, recordMetric, validateAndAuditOutput, authorizeFilesChanged, } from './shared.js';
+import { execFileAsync, getGitHubConfig, extractIssueId, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, recordMetric, validateAndAuditOutput, authorizeFilesChanged, issueIdToNumber, } from './shared.js';
 import { renderTemplate } from './notifications.js';
 import { parseDuration } from './policy-evaluators.js';
 import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, } from './security.js';
 import { DEFAULT_MAX_FIX_ATTEMPTS, DEFAULT_MAX_LOG_LINES, DEFAULT_GH_CLI_TIMEOUT_MS, DEFAULT_CONFIG_DIR_NAME, defaultSandboxConstraints, NOTIFICATION_TITLES, } from './defaults.js';
+import { createCycleDetectorFromConfig, checkAndHandleCycle } from './cycle-utils.js';
 export const MAX_FIX_ATTEMPTS = DEFAULT_MAX_FIX_ATTEMPTS;
 export const MAX_LOG_LINES = DEFAULT_MAX_LOG_LINES;
 export const RETRY_MARKER = '<!-- ai-sdlc-fix-ci-attempt -->';
@@ -107,6 +108,8 @@ export async function executeFixCI(prNumber, runId, options = {}) {
     }
     // Tracker is available if injected directly or if we're not in test mode
     const trackerAvailable = !!options.tracker || options._prComments === undefined;
+    // Create cycle detector (marker generated after all guard conditions pass)
+    const cycleDetector = createCycleDetectorFromConfig(config.pipeline?.spec ?? {});
     // 2. Count retry attempts (via injected comments or IssueTracker)
     log.stage('check-retries');
     let comments;
@@ -126,6 +129,27 @@ export async function executeFixCI(prNumber, runId, options = {}) {
             await getTracker().addComment(String(prNumber), body);
         }
     };
+    // Check for pipeline-level cycles AFTER retry counting
+    // (so legitimate retries under the limit aren't blocked)
+    if (trackerAvailable) {
+        const cycleCheck = await checkAndHandleCycle({
+            issueOrPrId: String(prNumber),
+            stage: 'fix-ci',
+            tracker: getTracker(),
+            detector: cycleDetector,
+        });
+        if (cycleCheck.cycleDetected) {
+            log.info('Pipeline cycle detected. Halting fix-ci execution.');
+            auditLog.record({
+                actor: 'system',
+                action: 'evaluate',
+                resource: `pr#${prNumber}`,
+                decision: 'denied',
+                details: { reason: 'pipeline-cycle-detected' },
+            });
+            return;
+        }
+    }
     if (attempts >= maxFixAttempts) {
         log.info(`Fix-CI retry limit reached (${maxFixAttempts}). Commenting and stopping.`);
         auditLog.record({
@@ -148,6 +172,9 @@ export async function executeFixCI(prNumber, runId, options = {}) {
         await addComment(`## ${limitComment.title}\n\n${limitComment.body}`);
         return;
     }
+    // Generate cycle marker AFTER all guard conditions (retry limit + cycle detection)
+    // so it's only recorded when we actually proceed with execution
+    const cycleMarker = cycleDetector.recordInvocation('fix-ci');
     // 3. Fetch CI logs
     log.stage('fetch-logs');
     const ciLogs = await fetchCILogs(runId, options._ciLogs, options.ciAdapter);
@@ -157,24 +184,25 @@ export async function executeFixCI(prNumber, runId, options = {}) {
         cwd: workDir,
     });
     const currentBranch = branchStdout.trim();
-    const issueNumber = extractIssueNumber(currentBranch);
-    if (issueNumber === null) {
-        throw new Error(`Branch "${currentBranch}" does not match ai-sdlc/issue-N pattern`);
+    const issueId = extractIssueId(currentBranch);
+    if (issueId === null) {
+        throw new Error(`Branch "${currentBranch}" does not match ai-sdlc/issue-<id> pattern`);
     }
+    const issueNumber = issueIdToNumber(issueId);
     // 5. Resolve autonomy level and constraints
     const currentLevel = resolveAutonomyLevel(autonomyPolicy);
     const resolved = resolveConstraints(agentRole.spec.constraints, currentLevel);
     // 6. Fetch issue data (via tracker when available)
-    let issueTitle = `Issue #${issueNumber}`;
+    let issueTitle = `Issue ${issueId}`;
     let issueBody = '';
     if (trackerAvailable) {
-        const issueData = await getTracker().getIssue(String(issueNumber));
+        const issueData = await getTracker().getIssue(issueId);
         issueTitle = issueData.title;
         issueBody = issueData.description ?? '';
     }
     // Store issue context in working memory
     if (options.memory) {
-        options.memory.working.set('currentIssue', { prNumber, issueNumber, currentBranch });
+        options.memory.working.set('currentIssue', { prNumber, issueId, currentBranch });
     }
     // Query episodic memory for previous fix-CI attempts
     if (options.memory) {
@@ -195,7 +223,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
         try {
             if (options.security) {
                 const timeoutMs = codeStage?.timeout ? parseDuration(codeStage.timeout) : undefined;
-                sandboxId = await options.security.sandbox.isolate(`issue-${issueNumber}`, defaultSandboxConstraints(workDir, timeoutMs));
+                sandboxId = await options.security.sandbox.isolate(`issue-${issueId}`, defaultSandboxConstraints(workDir, timeoutMs));
             }
             // Issue JIT credentials before agent execution
             const jitCred = options.security
@@ -207,7 +235,8 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                     [ATTRIBUTE_KEYS.RESOURCE_NAME]: `pr#${prNumber}`,
                 }, async () => {
                     const r = await runner.run({
-                        issueNumber,
+                        issueId,
+                        issueNumber: issueNumber ?? undefined,
                         issueTitle,
                         issueBody,
                         workDir,
@@ -257,7 +286,8 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                         const agentFailComment = agentFailTpl
                             ? renderTemplate(agentFailTpl, { stageName: 'fix-ci', details: errorDetail })
                             : { title: NOTIFICATION_TITLES.fixCIAgentFailed, body: errorDetail };
-                        await addComment(`## ${agentFailComment.title}\n\n${agentFailComment.body}\n\n${RETRY_MARKER}`);
+                        // Use pre-created marker (one per execution, prevents double-counting)
+                        await addComment(`## ${agentFailComment.title}\n\n${agentFailComment.body}\n\n${RETRY_MARKER}\n${cycleMarker}`);
                         throw new Error(`Fix-CI agent failed on PR #${prNumber}: ${r.error}`);
                     }
                     log.stageEnd('agent');
@@ -306,7 +336,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                 auditLog,
                 log,
                 onViolation: async (violationList) => {
-                    await addComment(`## ${NOTIFICATION_TITLES.fixCIGuardrailViolations}\n\n${violationList}\n\n${RETRY_MARKER}`);
+                    await addComment(`## ${NOTIFICATION_TITLES.fixCIGuardrailViolations}\n\n${violationList}\n\n${RETRY_MARKER}\n${cycleMarker}`);
                 },
             });
         });
@@ -333,6 +363,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                 title: NOTIFICATION_TITLES.fixCIApplied,
                 body: `Attempt ${attempts + 1} of ${maxFixAttempts} — pushed fixes to \`${currentBranch}\`.`,
             };
+        // Use pre-created marker (one per execution, prevents double-counting)
         await addComment([
             `## ${successComment.title}`,
             '',
@@ -342,6 +373,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
             result.filesChanged.map((f) => `- \`${f}\``).join('\n'),
             '',
             RETRY_MARKER,
+            cycleMarker,
         ].join('\n'));
         // 12. Record episodic memory (success)
         if (options.memory) {
@@ -349,7 +381,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                 key: 'fix-ci-execution',
                 value: {
                     prNumber,
-                    issueNumber,
+                    issueId,
                     filesChanged: result.filesChanged.length,
                     outcome: 'success',
                 },
@@ -365,7 +397,7 @@ export async function executeFixCI(prNumber, runId, options = {}) {
                 key: 'fix-ci-execution',
                 value: {
                     prNumber,
-                    issueNumber,
+                    issueId,
                     outcome: 'failure',
                     error: err instanceof Error ? err.message : String(err),
                 },

package/dist/fix-review.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Fix-Review orchestrator — detects review findings on agent-created PRs,
+ * fetches review comments, and re-invokes the agent with review context.
+ * Capped at MAX_FIX_ATTEMPTS to prevent infinite loops.
+ */
+import { type IssueTracker, type AuditLog, type MetricStore, type AgentMemory, type SecretStore } from '@ai-sdlc/reference';
+import { type Logger } from './logger.js';
+import type { AgentRunner } from './runners/types.js';
+import { type SecurityContext } from './security.js';
+export declare const MAX_REVIEW_FIX_ATTEMPTS = 2;
+export declare const RETRY_MARKER = "<!-- ai-sdlc-fix-review-attempt -->";
+export interface FixReviewOptions {
+    /** Override the config directory (defaults to `.ai-sdlc`). */
+    configDir?: string;
+    /** Override the working directory (defaults to repo root). */
+    workDir?: string;
+    /** Inject a custom runner (for testing). */
+    runner?: AgentRunner;
+    /** Inject a custom logger (for testing). */
+    logger?: Logger;
+    /** Inject PR comments for testing (bypasses IssueTracker call). */
+    _prComments?: string[];
+    /** Inject review findings for testing (bypasses GitHub API call). */
+    _reviewFindings?: string;
+    /** Inject a custom audit log (for testing). */
+    auditLog?: AuditLog;
+    /** Inject a custom issue tracker (for testing). */
+    tracker?: IssueTracker;
+    /** In-process metric store for testable telemetry. */
+    metricStore?: MetricStore;
+    /** Agent memory for episodic recall. */
+    memory?: AgentMemory;
+    /** Security context for kill switch and JIT credentials. */
+    security?: SecurityContext;
+    /** Use the reference structured logger instead of the plain console logger. */
+    useStructuredLogger?: boolean;
+    /** Secret store adapter for resolving credentials (defaults to process.env). */
+    secretStore?: SecretStore;
+}
+/**
+ * Count how many fix-review retry attempts have been made on a PR
+ * by scanning comments for the hidden retry marker.
+ */
+export declare function countRetryAttempts(comments: string[]): number;
+/**
+ * Validate that a PR number is a positive integer.
+ */
+export declare function validatePrNumber(prNumber: number): void;
+/**
+ * Sanitize a git branch name to prevent command injection.
+ * Allows only alphanumeric characters, slashes, dashes, underscores, and dots.
+ */
+export declare function sanitizeBranchName(branch: string): string;
+/**
+ * Fetch review findings from PR reviews that requested changes.
+ * Returns a formatted string with all findings from review agents.
+ */
+export declare function fetchReviewFindings(prNumber: number, injectedFindings?: string, _secretStore?: SecretStore): Promise<string>;
+/**
+ * Execute the fix-review pipeline for a PR with review findings.
+ *
+ * Returns gracefully (no throw) when the retry limit is reached.
+ * Throws on agent failure or guardrail violations.
+ */
+export declare function executeFixReview(prNumber: number, options?: FixReviewOptions): Promise<void>;
+//# sourceMappingURL=fix-review.d.ts.map

package/dist/fix-review.js

@@ -0,0 +1,441 @@
+/**
+ * Fix-Review orchestrator — detects review findings on agent-created PRs,
+ * fetches review comments, and re-invokes the agent with review context.
+ * Capped at MAX_FIX_ATTEMPTS to prevent infinite loops.
+ */
+import { createGitHubIssueTracker, evaluateDemotion, withSpan, getMeter, SPAN_NAMES, METRIC_NAMES, ATTRIBUTE_KEYS, } from '@ai-sdlc/reference';
+import { loadConfig } from './config.js';
+import { createLogger } from './logger.js';
+import { createStructuredConsoleLogger } from './structured-logger.js';
+import { ClaudeCodeRunner } from './runners/claude-code.js';
+import { execFileAsync, getGitHubConfig, extractIssueId, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, recordMetric, validateAndAuditOutput, authorizeFilesChanged, issueIdToNumber, } from './shared.js';
+import { renderTemplate } from './notifications.js';
+import { parseDuration } from './policy-evaluators.js';
+import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, } from './security.js';
+import { DEFAULT_GH_CLI_TIMEOUT_MS, DEFAULT_CONFIG_DIR_NAME, defaultSandboxConstraints, NOTIFICATION_TITLES, } from './defaults.js';
+import { createCycleDetectorFromConfig, checkAndHandleCycle } from './cycle-utils.js';
+// Default max review-fix attempts (lower than CI-fix since reviews are more deterministic)
+export const MAX_REVIEW_FIX_ATTEMPTS = 2;
+export const RETRY_MARKER = '<!-- ai-sdlc-fix-review-attempt -->';
+/**
+ * Count how many fix-review retry attempts have been made on a PR
+ * by scanning comments for the hidden retry marker.
+ */
+export function countRetryAttempts(comments) {
+    let count = 0;
+    for (const body of comments) {
+        const matches = body.match(new RegExp(RETRY_MARKER.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'));
+        if (matches) {
+            count += matches.length;
+        }
+    }
+    return count;
+}
+/**
+ * Validate that a PR number is a positive integer.
+ */
+export function validatePrNumber(prNumber) {
+    if (!Number.isInteger(prNumber) || prNumber <= 0) {
+        throw new Error(`Invalid PR number: ${prNumber} (must be a positive integer)`);
+    }
+}
+/**
+ * Sanitize a git branch name to prevent command injection.
+ * Allows only alphanumeric characters, slashes, dashes, underscores, and dots.
+ */
+export function sanitizeBranchName(branch) {
+    if (!/^[a-zA-Z0-9/_.-]+$/.test(branch)) {
+        throw new Error(`Invalid branch name: "${branch}" (only alphanumeric, /, -, _, . allowed)`);
+    }
+    return branch;
+}
+/**
+ * Fetch review findings from PR reviews that requested changes.
+ * Returns a formatted string with all findings from review agents.
+ */
+export async function fetchReviewFindings(prNumber, injectedFindings, _secretStore) {
+    if (injectedFindings !== undefined) {
+        return injectedFindings;
+    }
+    // Validate PR number to prevent command injection
+    validatePrNumber(prNumber);
+    // Fetch reviews using gh CLI
+    const { stdout } = await execFileAsync('gh', ['pr', 'review', String(prNumber), '--json', 'state,body,author'], { timeout: DEFAULT_GH_CLI_TIMEOUT_MS });
+    let reviews;
+    try {
+        reviews = JSON.parse(stdout);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse review data from gh CLI: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const changesRequestedReviews = reviews.filter((r) => r.state === 'CHANGES_REQUESTED');
+    if (changesRequestedReviews.length === 0) {
+        return 'No review findings (all reviews approved or pending)';
+    }
+    // Format findings from all reviews
+    const findings = changesRequestedReviews
+        .map((r) => `### Review by ${r.author.login}\n\n${r.body}\n\n---\n`)
+        .join('\n');
+    return findings;
+}
+/**
+ * Execute the fix-review pipeline for a PR with review findings.
+ *
+ * Returns gracefully (no throw) when the retry limit is reached.
+ * Throws on agent failure or guardrail violations.
+ */
+export async function executeFixReview(prNumber, options = {}) {
+    const workDir = options.workDir ?? (await resolveRepoRoot());
+    const configDir = options.configDir ?? `${workDir}/${DEFAULT_CONFIG_DIR_NAME}`;
+    const log = options.logger ??
+        (options.useStructuredLogger ? createStructuredConsoleLogger() : createLogger());
+    const auditLog = options.auditLog ?? createDefaultAuditLog(workDir);
+    const metricStore = options.metricStore;
+    // 1. Load config
+    log.stage('load-config');
+    const config = loadConfig(configDir);
+    log.stageEnd('load-config');
+    // Kill switch check (before any work)
+    if (options.security) {
+        await checkKillSwitch(options.security);
+    }
+    if (!config.agentRole) {
+        throw new Error('No AgentRole resource found in .ai-sdlc/');
+    }
+    if (!config.autonomyPolicy) {
+        throw new Error('No AutonomyPolicy resource found in .ai-sdlc/');
+    }
+    const agentRole = config.agentRole;
+    const autonomyPolicy = config.autonomyPolicy;
+    // Derive max fix attempts from pipeline config (review stage onFailure.maxRetries)
+    const reviewStage = config.pipeline?.spec.stages.find((s) => s.name === 'review');
+    const maxFixAttempts = reviewStage?.onFailure?.maxRetries ?? MAX_REVIEW_FIX_ATTEMPTS;
+    // Notification templates
+    const notifTemplates = config.pipeline?.spec.notifications?.templates;
+    // Create default tracker when needed (lazy to avoid resolving secrets in test environments).
+    // In production (no _prComments injected), the tracker is always available.
+    let _tracker = options.tracker;
+    function getTracker() {
+        if (!_tracker) {
+            const { org, repo } = getGitHubConfig(options.secretStore);
+            const ghConfig = { org, repo, token: { secretRef: 'github-token' } };
+            _tracker = createGitHubIssueTracker(ghConfig);
+        }
+        return _tracker;
+    }
+    // Tracker is available if injected directly or if we're not in test mode
+    const trackerAvailable = !!options.tracker || options._prComments === undefined;
+    // Create cycle detector (marker generated after all guard conditions pass)
+    const cycleDetector = createCycleDetectorFromConfig(config.pipeline?.spec ?? {});
+    // 2. Count retry attempts (via injected comments or IssueTracker)
+    log.stage('check-retries');
+    let comments;
+    if (options._prComments !== undefined) {
+        comments = options._prComments;
+    }
+    else {
+        const issueComments = await getTracker().getComments(String(prNumber));
+        comments = issueComments.map((c) => c.body);
+    }
+    const attempts = countRetryAttempts(comments);
+    log.info(`Fix-review attempt ${attempts + 1} of ${maxFixAttempts}`);
+    log.stageEnd('check-retries');
+    // Helper to add a comment via tracker (uses default tracker in production)
+    const addComment = async (body) => {
+        if (trackerAvailable) {
+            await getTracker().addComment(String(prNumber), body);
+        }
+    };
+    if (attempts >= maxFixAttempts) {
+        log.info(`Fix-review retry limit reached (${maxFixAttempts}). Commenting and stopping.`);
+        auditLog.record({
+            actor: 'system',
+            action: 'evaluate',
+            resource: `pr#${prNumber}`,
+            decision: 'denied',
+            details: { reason: 'retry-limit-reached', attempts, max: maxFixAttempts },
+        });
+        const limitTpl = notifTemplates?.['fix-review-limit'];
+        const limitComment = limitTpl
+            ? renderTemplate(limitTpl, {
+                attempts: String(attempts),
+                max: String(maxFixAttempts),
+            })
+            : {
+                title: NOTIFICATION_TITLES.fixReviewRetryLimit,
+                body: `This PR has reached the maximum number of automated review-fix attempts (${maxFixAttempts}). Manual intervention is needed.`,
+            };
+        await addComment(`## ${limitComment.title}\n\n${limitComment.body}`);
+        return;
+    }
+    // Check for pipeline-level cycles AFTER retry counting
+    if (trackerAvailable) {
+        const cycleCheck = await checkAndHandleCycle({
+            issueOrPrId: String(prNumber),
+            stage: 'fix-review',
+            tracker: getTracker(),
+            detector: cycleDetector,
+        });
+        if (cycleCheck.cycleDetected) {
+            log.info('Pipeline cycle detected. Halting fix-review execution.');
+            auditLog.record({
+                actor: 'system',
+                action: 'evaluate',
+                resource: `pr#${prNumber}`,
+                decision: 'denied',
+                details: { reason: 'pipeline-cycle-detected' },
+            });
+            return;
+        }
+    }
+    // Generate cycle marker AFTER all guard conditions pass
+    const cycleMarker = cycleDetector.recordInvocation('fix-review');
+    // 3. Fetch review findings
+    log.stage('fetch-findings');
+    const reviewFindings = await fetchReviewFindings(prNumber, options._reviewFindings, options.secretStore);
+    log.stageEnd('fetch-findings');
+    // Check if review findings are actionable (not a generic "no findings" message)
+    const isActionable = reviewFindings &&
+        !reviewFindings.startsWith('No review findings') &&
+        reviewFindings.trim().length > 0;
+    if (!isActionable) {
+        log.info('No actionable review findings. Skipping fix-review execution.');
+        auditLog.record({
+            actor: 'system',
+            action: 'evaluate',
+            resource: `pr#${prNumber}`,
+            decision: 'allowed',
+            details: { reason: 'no-actionable-findings', reviewFindings },
+        });
+        return;
+    }
+    // 4. Determine branch and issue number
+    const { stdout: branchStdout } = await execFileAsync('git', ['branch', '--show-current'], {
+        cwd: workDir,
+    });
+    const currentBranch = sanitizeBranchName(branchStdout.trim());
+    const issueId = extractIssueId(currentBranch);
+    if (issueId === null) {
+        throw new Error(`Branch "${currentBranch}" does not match ai-sdlc/issue-<id> pattern`);
+    }
+    const issueNumber = issueIdToNumber(issueId);
+    // 5. Resolve autonomy level and constraints
+    const currentLevel = resolveAutonomyLevel(autonomyPolicy);
+    const resolved = resolveConstraints(agentRole.spec.constraints, currentLevel);
+    // 6. Fetch issue data (via tracker when available)
+    let issueTitle = `Issue ${issueId}`;
+    let issueBody = '';
+    if (trackerAvailable) {
+        const issueData = await getTracker().getIssue(issueId);
+        issueTitle = issueData.title;
+        issueBody = issueData.description ?? '';
+    }
+    // Store issue context in working memory
+    if (options.memory) {
+        options.memory.working.set('currentIssue', { prNumber, issueId, currentBranch });
+    }
+    // Query episodic memory for previous fix-review attempts
+    if (options.memory) {
+        const previousAttempts = options.memory.episodic.search('fix-review-execution');
+        if (previousAttempts.length > 0) {
+            log.info(`Found ${previousAttempts.length} previous fix-review episodes in memory`);
+        }
+    }
+    const meter = getMeter();
+    // Wrap agent+validation+push in try/catch for failure episodes
+    try {
+        // 7. Invoke agent with review findings (with sandbox + JIT credential lifecycle)
+        log.stage('agent');
+        const runner = options.runner ?? new ClaudeCodeRunner();
+        // Sandbox isolation around agent execution
+        let sandboxId;
+        let result;
+        try {
+            if (options.security) {
+                const timeoutMs = reviewStage?.timeout ? parseDuration(reviewStage.timeout) : undefined;
+                sandboxId = await options.security.sandbox.isolate(`issue-${issueId}`, defaultSandboxConstraints(workDir, timeoutMs));
+            }
+            // Issue JIT credentials before agent execution
+            const jitCred = options.security
+                ? await issueAgentCredentials(options.security, agentRole.metadata.name)
+                : undefined;
+            try {
+                result = await withSpan(SPAN_NAMES.AGENT_TASK, {
+                    [ATTRIBUTE_KEYS.AGENT]: agentRole.metadata.name,
+                    [ATTRIBUTE_KEYS.RESOURCE_NAME]: `pr#${prNumber}`,
+                }, async () => {
+                    const r = await runner.run({
+                        issueId,
+                        issueNumber: issueNumber ?? undefined,
+                        issueTitle,
+                        issueBody,
+                        workDir,
+                        branch: currentBranch,
+                        constraints: {
+                            maxFilesPerChange: resolved.maxFiles,
+                            requireTests: resolved.requireTests,
+                            blockedPaths: resolved.blockedPaths,
+                        },
+                        reviewFindings,
+                    });
+                    if (!r.success) {
+                        log.stageEnd('agent');
+                        auditLog.record({
+                            actor: 'system',
+                            action: 'execute',
+                            resource: `agent/${agentRole.metadata.name}`,
+                            decision: 'denied',
+                            details: { error: r.error },
+                        });
+                        meter.createCounter(METRIC_NAMES.TASK_FAILURE_TOTAL).add(1);
+                        recordMetric(metricStore, METRIC_NAMES.TASK_FAILURE_TOTAL, 1);
+                        // Evaluate demotion on agent failure
+                        const agentMetrics = {
+                            name: agentRole.metadata.name,
+                            currentLevel: currentLevel.level,
+                            totalTasksCompleted: 0,
+                            metrics: {},
+                            approvals: [],
+                        };
+                        const demotion = evaluateDemotion(autonomyPolicy, agentMetrics, 'failed-test');
+                        log.info(`Demotion evaluation: ${demotion.demoted ? `demoted from ${demotion.fromLevel} to ${demotion.toLevel}` : 'no demotion'}`);
+                        auditLog.record({
+                            actor: 'system',
+                            action: 'evaluate',
+                            resource: `agent/${agentRole.metadata.name}`,
+                            policy: 'demotion',
+                            decision: demotion.demoted ? 'denied' : 'allowed',
+                            details: {
+                                trigger: demotion.trigger,
+                                fromLevel: demotion.fromLevel,
+                                toLevel: demotion.toLevel,
+                            },
+                        });
+                        const agentFailTpl = notifTemplates?.['agent-failure'];
+                        const errorDetail = r.error ?? 'Unknown error';
+                        const agentFailComment = agentFailTpl
+                            ? renderTemplate(agentFailTpl, { stageName: 'fix-review', details: errorDetail })
+                            : { title: NOTIFICATION_TITLES.fixReviewAgentFailed, body: errorDetail };
+                        // Use pre-created marker (one per execution, prevents double-counting)
+                        await addComment(`## ${agentFailComment.title}\n\n${agentFailComment.body}\n\n${RETRY_MARKER}\n${cycleMarker}`);
+                        throw new Error(`Fix-review agent failed on PR #${prNumber}: ${r.error}`);
+                    }
+                    log.stageEnd('agent');
+                    auditLog.record({
+                        actor: 'system',
+                        action: 'execute',
+                        resource: `agent/${agentRole.metadata.name}`,
+                        decision: 'allowed',
+                        details: { filesChanged: r.filesChanged.length },
+                    });
+                    meter.createCounter(METRIC_NAMES.TASK_SUCCESS_TOTAL).add(1);
+                    recordMetric(metricStore, METRIC_NAMES.TASK_SUCCESS_TOTAL, 1);
+                    return r;
+                });
+            }
+            finally {
+                // Revoke JIT credentials after agent execution (success or failure)
+                if (jitCred && options.security) {
+                    await revokeAgentCredentials(options.security, jitCred.id);
+                }
+            }
+        }
+        finally {
+            // Destroy sandbox after agent execution
+            if (sandboxId && options.security) {
+                await options.security.sandbox.destroy(sandboxId);
+            }
+        }
+        // 8. ABAC authorization check (if write permissions are defined)
+        if (currentLevel.permissions.write.length > 0) {
+            authorizeFilesChanged(result.filesChanged, currentLevel.permissions, agentRole.spec.constraints, auditLog, agentRole.metadata.name);
+        }
+        // 9. Validate agent output against guardrails
+        await withSpan(SPAN_NAMES.PIPELINE_STAGE, {
+            [ATTRIBUTE_KEYS.STAGE]: 'validate-output',
+        }, async () => {
+            await validateAndAuditOutput({
+                filesChanged: result.filesChanged,
+                workDir,
+                constraints: {
+                    maxFilesPerChange: resolved.maxFiles,
+                    requireTests: resolved.requireTests,
+                    blockedPaths: resolved.blockedPaths,
+                },
+                guardrails: { maxLinesPerPR: currentLevel.guardrails.maxLinesPerPR },
+                auditLog,
+                log,
+                onViolation: async (violationList) => {
+                    await addComment(`## ${NOTIFICATION_TITLES.fixReviewGuardrailViolations}\n\n${violationList}\n\n${RETRY_MARKER}\n${cycleMarker}`);
+                },
+            });
+        });
+        // 10. Push to the same branch (review agents re-run automatically via pull_request.synchronize)
+        log.stage('push');
+        await execFileAsync('git', ['push', 'origin', currentBranch], { cwd: workDir });
+        log.stageEnd('push');
+        auditLog.record({
+            actor: 'system',
+            action: 'create',
+            resource: `push/${currentBranch}`,
+            decision: 'allowed',
+            details: { prNumber, attempt: attempts + 1 },
+        });
+        // 11. Comment on PR with success details
+        const successTpl = notifTemplates?.['fix-review-success'];
+        const successComment = successTpl
+            ? renderTemplate(successTpl, {
+                attempt: String(attempts + 1),
+                max: String(maxFixAttempts),
+                branch: currentBranch,
+            })
+            : {
+                title: NOTIFICATION_TITLES.fixReviewApplied,
+                body: `Attempt ${attempts + 1} of ${maxFixAttempts} — pushed review fixes to \`${currentBranch}\`.`,
+            };
+        await addComment([
+            `## ${successComment.title}`,
+            '',
+            successComment.body,
+            '',
+            '### Changes',
+            result.filesChanged.map((f) => `- \`${f}\``).join('\n'),
+            '',
+            RETRY_MARKER,
+            cycleMarker,
+        ].join('\n'));
+        // 12. Record episodic memory (success)
+        if (options.memory) {
+            options.memory.episodic.append({
+                key: 'fix-review-execution',
+                value: {
+                    prNumber,
+                    issueId,
+                    filesChanged: result.filesChanged.length,
+                    outcome: 'success',
+                },
+                metadata: { summary: `Fix-review for PR #${prNumber} (attempt ${attempts + 1})` },
+            });
+            options.memory.working.clear();
+        }
+    }
+    catch (err) {
+        // Record failure episode before rethrowing
+        if (options.memory) {
+            options.memory.episodic.append({
+                key: 'fix-review-execution',
+                value: {
+                    prNumber,
+                    issueId,
+                    outcome: 'failure',
+                    error: err instanceof Error ? err.message : String(err),
+                },
+                metadata: { summary: `Failed fix-review for PR #${prNumber}` },
+            });
+            options.memory.working.clear();
+        }
+        throw err;
+    }
+    log.summary();
+}
+//# sourceMappingURL=fix-review.js.map