@chllming/wave-orchestration 0.9.0 → 0.9.1

package/scripts/wave-orchestrator/closure-engine.mjs

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { appendCoordinationRecord } from "./coordination-store.mjs";
 import {
   parseStructuredSignalsFromLog,
   refreshWaveDashboardAgentStates,
@@ -14,8 +15,13 @@ import {
   readWaveIntegrationBarrier as readWaveIntegrationBarrierDefault,
   readWaveSecurityGate as readWaveSecurityGateDefault,
 } from "./gate-engine.mjs";
+import { applyLaunchResultToRun } from "./launcher-runtime.mjs";
 import { REPO_ROOT, toIsoTimestamp } from "./shared.mjs";
-import { isSecurityReviewAgent, resolveWaveRoleBindings } from "./role-helpers.mjs";
+import {
+  isSecurityReviewAgentForLane,
+  resolveAgentClosureRoleKeys,
+  resolveWaveRoleBindings,
+} from "./role-helpers.mjs";
 import { summarizeResolvedSkills } from "./skills.mjs";
 
 function failureResultFromGate(gate, fallbackLogPath) {
@@ -57,6 +63,64 @@ function recordClosureGateFailure({
   });
 }
 
+function isForwardableClosureGap(gate) {
+  return gate?.statusCode === "wave-proof-gap";
+}
+
+function forwardedClosureGapRecord({
+  stage,
+  wave,
+  lanePaths,
+  gate,
+  attempt,
+  targetAgentIds = [],
+}) {
+  return {
+    id: `wave-${wave.wave}-closure-gap-${stage.key}-${gate.agentId}-attempt-${attempt || 1}`,
+    kind: "blocker",
+    lane: lanePaths.lane,
+    wave: wave.wave,
+    agentId: gate.agentId,
+    status: "open",
+    priority: "high",
+    blocking: true,
+    blockerSeverity: "closure-critical",
+    summary: `${stage.label} reported a proof gap and was forwarded to later closure stages.`,
+    detail: gate.detail,
+    artifactRefs: gate.logPath ? [gate.logPath] : [],
+    targets: targetAgentIds.map((agentId) => `agent:${agentId}`),
+    attempt: attempt || 1,
+  };
+}
+
+function stageRequiresRun(stage, wave, lanePaths) {
+  switch (stage.key) {
+    case "integration":
+    case "documentation":
+    case "cont-qa":
+      return true;
+    case "cont-eval":
+      return Array.isArray(wave?.agents) && wave.agents.some((agent) => agent?.agentId === stage.agentId);
+    case "security-review":
+      return (
+        Array.isArray(wave?.agents) &&
+        wave.agents.some((agent) => isSecurityReviewAgentForLane(agent, lanePaths))
+      );
+    default:
+      return false;
+  }
+}
+
+function missingClosureRunGate(stage) {
+  return {
+    ok: false,
+    agentId: stage.agentId,
+    statusCode: "missing-closure-run",
+    detail: `${stage.label} is required for this wave but no matching closure run was provided.`,
+    logPath: null,
+  };
+}
+
 export async function runClosureSweepPhase({
   lanePaths,
   wave,
@@ -113,10 +177,24 @@ export async function runClosureSweepPhase({
       ? readWaveContQaGateFn
       : readWaveContQaGateDefault;
   const stagedRuns = planClosureStages({ lanePaths, wave, closureRuns });
+  const forwardedFailures = [];
   const { contQaAgentId, contEvalAgentId, integrationAgentId, documentationAgentId } =
     resolveWaveRoleBindings(wave, lanePaths);
-  for (const stage of stagedRuns) {
+  for (const [stageIndex, stage] of stagedRuns.entries()) {
     if (stage.runs.length === 0) {
+      if (stageRequiresRun(stage, wave, lanePaths)) {
+        const gate = missingClosureRunGate(stage);
+        recordClosureGateFailure({
+          wave,
+          lanePaths,
+          gate,
+          label: stage.label,
+          recordCombinedEvent,
+          appendCoordination,
+          actionRequested: stage.actionRequested,
+        });
+        return failureResultFromGate(gate, null);
+      }
       continue;
     }
     for (const runInfo of stage.runs) {
@@ -138,6 +216,7 @@ export async function runClosureSweepPhase({
         promptPath: runInfo.promptPath,
         logPath: runInfo.logPath,
         statusPath: runInfo.statusPath,
+        runtimePath: runInfo.runtimePath,
         messageBoardPath: runInfo.messageBoardPath,
         messageBoardSnapshot: runInfo.messageBoardSnapshot || "",
         sharedSummaryPath: runInfo.sharedSummaryPath,
@@ -157,19 +236,18 @@ export async function runClosureSweepPhase({
           attempt: dashboardState?.attempt || 1,
         },
       });
-      runInfo.lastLaunchAttempt = dashboardState?.attempt || null;
-      runInfo.lastPromptHash = launchResult?.promptHash || null;
-      runInfo.lastContext7 = launchResult?.context7 || null;
-      runInfo.lastExecutorId = launchResult?.executorId || runInfo.agent.executorResolved?.id || null;
-      runInfo.lastSkillProjection =
-        launchResult?.skills || summarizeResolvedSkills(runInfo.agent.skillsResolved);
+      applyLaunchResultToRun(runInfo, launchResult, {
+        attempt: dashboardState?.attempt || null,
+        fallbackExecutorId: runInfo.agent.executorResolved?.id || null,
+        fallbackSkills: summarizeResolvedSkills(runInfo.agent.skillsResolved),
+      });
       setWaveDashboardAgent(dashboardState, runInfo.agent.agentId, {
         state: "running",
         detail: `Closure sweep launched${launchResult?.context7?.mode ? ` (${launchResult.context7.mode})` : ""}`,
       });
       recordCombinedEvent({
         agentId: runInfo.agent.agentId,
-        message: `Closure sweep launched in tmux session ${runInfo.sessionName}`,
+        message: `Closure sweep launched via ${launchResult?.sessionBackend || "process"} backend`,
       });
       flushDashboards();
       const result = await waitForWaveCompletionFn(
@@ -228,6 +306,43 @@ export async function runClosureSweepPhase({
       contQaAgentId,
     });
     if (!gate.ok) {
+      if (isForwardableClosureGap(gate)) {
+        const targetAgentIds = stagedRuns
+          .slice(stageIndex + 1)
+          .flatMap((candidate) => candidate.runs.map((run) => run.agent.agentId))
+          .filter(Boolean);
+        forwardedFailures.push({
+          agentId: gate.agentId,
+          statusCode: gate.statusCode,
+          logPath: gate.logPath || (stage.runs[0]?.logPath ? path.relative(REPO_ROOT, stage.runs[0].logPath) : null),
+          detail: gate.detail,
+        });
+        appendCoordinationRecord(
+          coordinationLogPath,
+          forwardedClosureGapRecord({
+            stage,
+            wave,
+            lanePaths,
+            gate,
+            attempt: dashboardState?.attempt || 1,
+            targetAgentIds,
+          }),
+        );
+        recordCombinedEvent({
+          level: "warn",
+          agentId: gate.agentId,
+          message: `${stage.label} reported a proof gap; continuing later closure stages with the gap as input.`,
+        });
+        appendCoordination({
+          event: "closure_gap_forwarded",
+          waves: [wave.wave],
+          status: "blocked",
+          details: `agent=${gate.agentId}; reason=${gate.statusCode}; ${gate.detail}`,
+          actionRequested: `Lane ${lanePaths.lane} owners should resolve the forwarded closure proof gap after downstream closure evidence is collected.`,
+        });
+        refreshDerivedState?.(dashboardState?.attempt || 0);
+        continue;
+      }
       recordClosureGateFailure({
         wave,
         lanePaths,
@@ -243,18 +358,21 @@ export async function runClosureSweepPhase({
       );
     }
   }
-  return { failures: [], timedOut: false };
+  return { failures: forwardedFailures, timedOut: false };
 }
 
 export function planClosureStages({ lanePaths, wave, closureRuns }) {
+  const roleBindings = resolveWaveRoleBindings(wave, lanePaths);
   const { contQaAgentId, contEvalAgentId, integrationAgentId, documentationAgentId } =
-    resolveWaveRoleBindings(wave, lanePaths);
+    roleBindings;
+  const runHasRole = (run, roleKey) =>
+    resolveAgentClosureRoleKeys(run.agent, roleBindings, lanePaths).includes(roleKey);
   return [
     {
       key: "cont-eval",
       agentId: contEvalAgentId,
       label: "cont-EVAL gate",
-      runs: closureRuns.filter((run) => run.agent.agentId === contEvalAgentId),
+      runs: closureRuns.filter((run) => runHasRole(run, "cont-eval")),
       actionRequested:
         `Lane ${lanePaths.lane} owners should resolve cont-EVAL tuning gaps before integration closure.`,
     },
@@ -262,7 +380,7 @@ export function planClosureStages({ lanePaths, wave, closureRuns }) {
       key: "security-review",
       agentId: "security",
       label: "Security review",
-      runs: closureRuns.filter((run) => isSecurityReviewAgent(run.agent)),
+      runs: closureRuns.filter((run) => runHasRole(run, "security-review")),
       actionRequested:
         `Lane ${lanePaths.lane} owners should resolve blocked security findings or missing approvals before integration closure.`,
     },
@@ -270,7 +388,7 @@ export function planClosureStages({ lanePaths, wave, closureRuns }) {
       key: "integration",
       agentId: integrationAgentId,
       label: "Integration gate",
-      runs: closureRuns.filter((run) => run.agent.agentId === integrationAgentId),
+      runs: closureRuns.filter((run) => runHasRole(run, "integration")),
       actionRequested:
         `Lane ${lanePaths.lane} owners should resolve integration contradictions or blockers before documentation and cont-QA closure.`,
     },
@@ -278,7 +396,7 @@ export function planClosureStages({ lanePaths, wave, closureRuns }) {
       key: "documentation",
       agentId: documentationAgentId,
       label: "Documentation closure",
-      runs: closureRuns.filter((run) => run.agent.agentId === documentationAgentId),
+      runs: closureRuns.filter((run) => runHasRole(run, "documentation")),
       actionRequested:
         `Lane ${lanePaths.lane} owners should resolve the shared-plan or component-matrix closure state before cont-QA progression.`,
     },
@@ -286,7 +404,7 @@ export function planClosureStages({ lanePaths, wave, closureRuns }) {
       key: "cont-qa",
       agentId: contQaAgentId,
       label: "cont-QA gate",
-      runs: closureRuns.filter((run) => run.agent.agentId === contQaAgentId),
+      runs: closureRuns.filter((run) => runHasRole(run, "cont-qa")),
       actionRequested:
         `Lane ${lanePaths.lane} owners should resolve the cont-QA gate before wave progression.`,
     },
@@ -320,7 +438,10 @@ function evaluateClosureStage({
         benchmarkCatalogPath: lanePaths.laneProfile?.paths?.benchmarkCatalogPath,
       });
     case "security-review":
-      return readWaveSecurityGateFn(wave, closureRuns, { mode: "live" });
+      return readWaveSecurityGateFn(wave, closureRuns, {
+        mode: "live",
+        securityRolePromptPath: lanePaths?.securityRolePromptPath,
+      });
     case "integration":
       return readWaveIntegrationBarrierFn(
         wave,

package/scripts/wave-orchestrator/control-cli.mjs

@@ -42,11 +42,12 @@ import {
 import { readWaveRelaunchPlanSnapshot, readWaveRetryOverride, resolveRetryOverrideAgentIds, writeWaveRetryOverride, clearWaveRetryOverride } from "./retry-control.mjs";
 import { flushWaveControlQueue, readWaveControlQueueState } from "./wave-control-client.mjs";
 import { readAgentExecutionSummary, validateImplementationSummary } from "./agent-state.mjs";
-import { isContEvalReportOnlyAgent, isSecurityReviewAgent } from "./role-helpers.mjs";
+import { isContEvalReportOnlyAgent, isSecurityReviewAgentForLane } from "./role-helpers.mjs";
 import {
   buildSignalStatusLine,
   syncWaveSignalProjections,
 } from "./signals.mjs";
+import { summarizeSupervisorStateForWave } from "./supervisor-cli.mjs";
 
 function printUsage() {
   console.log(`Usage:
@@ -366,7 +367,8 @@ function buildLogicalAgents({
       proofRegistry || { entries: [] },
     );
     const proofValidation =
-      !isSecurityReviewAgent(agent) && !isContEvalReportOnlyAgent(agent, { contEvalAgentId: lanePaths.contEvalAgentId })
+      !isSecurityReviewAgentForLane(agent, lanePaths) &&
+      !isContEvalReportOnlyAgent(agent, { contEvalAgentId: lanePaths.contEvalAgentId })
         ? validateImplementationSummary(agent, summary ? summary : null)
         : { ok: statusRecord?.code === 0, statusCode: statusRecord?.code === 0 ? "pass" : "pending" };
     const targetedTasks = tasks.filter(
@@ -385,7 +387,7 @@ function buildLogicalAgents({
     const satisfiedByStatus =
       statusRecord?.code === 0 &&
       (proofValidation.ok ||
-        isSecurityReviewAgent(agent) ||
+        isSecurityReviewAgentForLane(agent, lanePaths) ||
         isContEvalReportOnlyAgent(agent, { contEvalAgentId: lanePaths.contEvalAgentId }));
     let state = "planned";
     let reason = "";
@@ -404,7 +406,7 @@ function buildLogicalAgents({
         lanePaths.integrationAgentId || "A8",
         lanePaths.documentationAgentId || "A9",
         lanePaths.contQaAgentId || "A0",
-      ].includes(agent.agentId) || isSecurityReviewAgent(agent)
+      ].includes(agent.agentId) || isSecurityReviewAgentForLane(agent, lanePaths)
         ? "closed"
         : "satisfied";
       reason = "Completed wave preserves the latest satisfied agent state.";
@@ -425,7 +427,7 @@ function buildLogicalAgents({
         lanePaths.integrationAgentId || "A8",
         lanePaths.documentationAgentId || "A9",
         lanePaths.contQaAgentId || "A0",
-      ].includes(agent.agentId) || isSecurityReviewAgent(agent)
+      ].includes(agent.agentId) || isSecurityReviewAgentForLane(agent, lanePaths)
         ? "closed"
         : "satisfied";
       reason = "Latest attempt satisfied current control-plane state.";
@@ -657,6 +659,12 @@ export function buildControlStatusPayload({ lanePaths, wave, agentId = "" }) {
   const controlState = readWaveControlPlaneState(lanePaths, wave.wave);
   const proofRegistry = readWaveProofRegistry(lanePaths, wave.wave) || { entries: [] };
   const relaunchPlan = readWaveRelaunchPlanSnapshot(lanePaths, wave.wave);
+  const supervisor = summarizeSupervisorStateForWave(lanePaths, wave.wave, {
+    agentId,
+  });
+  const forwardedClosureGaps = Array.isArray(relaunchPlan?.forwardedClosureGaps)
+    ? relaunchPlan.forwardedClosureGaps
+    : [];
   const rerunRequest = controlState.activeRerunRequest
     ? {
         ...controlState.activeRerunRequest,
@@ -718,6 +726,8 @@ export function buildControlStatusPayload({ lanePaths, wave, agentId = "" }) {
     selectionSource: selection.source,
     rerunRequest,
     relaunchPlan,
+    forwardedClosureGaps,
+    supervisor,
     nextTimer: isCompletedPhase(phase) ? null : nextTaskDeadline(tasks),
     activeAttempt: controlState.activeAttempt,
   };
@@ -758,6 +768,33 @@ function printStatus(payload) {
     console.log(buildSignalStatusLine(payload.signals.wave, payload));
   }
   console.log(`blocking=${blocking}`);
+  if (payload.supervisor) {
+    console.log(
+      `supervisor=${payload.supervisor.terminalDisposition || payload.supervisor.status} run_id=${payload.supervisor.runId} launcher_pid=${payload.supervisor.launcherPid || "none"}`,
+    );
+    if (payload.supervisor.sessionBackend || payload.supervisor.recoveryState || payload.supervisor.resumeAction) {
+      console.log(
+        `supervisor-backend=${payload.supervisor.sessionBackend || "unknown"} recovery=${payload.supervisor.recoveryState || "unknown"} resume=${payload.supervisor.resumeAction || "none"}`,
+      );
+    }
+    if ((payload.supervisor.agentRuntimeSummary || []).length > 0) {
+      console.log("supervisor-runtime:");
+      for (const record of payload.supervisor.agentRuntimeSummary) {
+        console.log(
+          `- ${record.agentId || "unknown"} ${record.terminalDisposition || "unknown"} pid=${record.pid || "none"} backend=${record.sessionBackend || "process"} attach=${record.attachMode || "log-tail"} heartbeat=${record.lastHeartbeatAt || "n/a"}`,
+        );
+      }
+    }
+  }
+  if ((payload.forwardedClosureGaps || []).length > 0) {
+    console.log("forwarded-closure-gaps:");
+    for (const gap of payload.forwardedClosureGaps) {
+      const targets = Array.isArray(gap.targets) && gap.targets.length > 0 ? gap.targets.join(",") : "none";
+      console.log(
+        `- ${gap.stageKey} agent=${gap.agentId || "unknown"} attempt=${gap.attempt ?? "n/a"} targets=${targets}${gap.detail ? ` detail=${gap.detail}` : ""}`,
+      );
+    }
+  }
   if (payload.nextTimer) {
     console.log(`next-timer=${payload.nextTimer.kind} ${payload.nextTimer.taskId} at ${payload.nextTimer.at}`);
   }

package/scripts/wave-orchestrator/dashboard-renderer.mjs

@@ -1,4 +1,3 @@
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { loadWaveConfig } from "./config.mjs";
@@ -14,6 +13,7 @@ import {
   formatAgeFromTimestamp,
   formatElapsed,
   pad,
+  readJsonOrNull,
   sleep,
   truncate,
 } from "./shared.mjs";
@@ -21,6 +21,10 @@ import {
   createCurrentWaveDashboardTerminalEntry,
   createGlobalDashboardTerminalEntry,
 } from "./terminals.mjs";
+import {
+  attachSession as attachTmuxSession,
+  hasSession as hasTmuxSession,
+} from "./tmux-adapter.mjs";
 
 const DASHBOARD_ATTACH_TARGETS = ["current", "global"];
 
@@ -78,30 +82,7 @@ export function parseDashboardArgs(argv) {
   return { help: false, options };
 }
 
-function tmuxSessionExists(socketName, sessionName) {
-  const result = spawnSync("tmux", ["-L", socketName, "has-session", "-t", sessionName], {
-    cwd: REPO_ROOT,
-    encoding: "utf8",
-    env: { ...process.env, TMUX: "" },
-  });
-  if (result.error) {
-    throw new Error(`tmux session lookup failed: ${result.error.message}`);
-  }
-  if (result.status === 0) {
-    return true;
-  }
-  const combined = `${String(result.stderr || "").toLowerCase()}\n${String(result.stdout || "").toLowerCase()}`;
-  if (
-    combined.includes("can't find session") ||
-    combined.includes("no server running") ||
-    combined.includes("error connecting")
-  ) {
-    return false;
-  }
-  throw new Error((result.stderr || result.stdout || "tmux has-session failed").trim());
-}
-
-function attachDashboardSession(project, lane, target) {
+async function attachDashboardSession(project, lane, target) {
   const config = loadWaveConfig();
   const lanePaths = buildLanePaths(lane, {
     config,
@@ -111,25 +92,112 @@ function attachDashboardSession(project, lane, target) {
     target === "global"
       ? createGlobalDashboardTerminalEntry(lanePaths, "current")
       : createCurrentWaveDashboardTerminalEntry(lanePaths);
-  if (!tmuxSessionExists(lanePaths.tmuxSocketName, entry.sessionName)) {
-    const dashboardsRel = path.relative(REPO_ROOT, path.dirname(lanePaths.globalDashboardPath));
-    throw new Error(
-      `No ${target} dashboard session is live for lane ${lanePaths.lane}. Launch a dashboarded run on that lane, then inspect ${dashboardsRel} if you need the last written dashboard state.`,
-    );
+  if (!await hasTmuxSession(lanePaths.tmuxSocketName, entry.sessionName, { allowMissingBinary: false })) {
+    const fallback = resolveDashboardAttachFallback(lanePaths, target);
+    if (fallback) {
+      return fallback;
+    }
+    throw new Error(buildMissingDashboardAttachError(lanePaths, target));
+  }
+  try {
+    await attachTmuxSession(lanePaths.tmuxSocketName, entry.sessionName);
+    return null;
+  } catch (error) {
+    if (error?.tmuxMissingSession) {
+      const fallback = resolveDashboardAttachFallback(lanePaths, target);
+      if (fallback) {
+        return fallback;
+      }
+      throw new Error(buildMissingDashboardAttachError(lanePaths, target));
+    }
+    throw error;
+  }
+}
+
+function buildMissingDashboardAttachError(lanePaths, target) {
+  const dashboardsRel = path.relative(REPO_ROOT, path.dirname(lanePaths.globalDashboardPath));
+  return `No ${target} dashboard session is live for lane ${lanePaths.lane}. Launch a dashboarded run on that lane, then inspect ${dashboardsRel} if you need the last written dashboard state.`;
+}
+
+function waveDashboardPathForNumber(lanePaths, waveNumber) {
+  if (!Number.isFinite(Number(waveNumber))) {
+    return null;
   }
-  const result = spawnSync("tmux", ["-L", lanePaths.tmuxSocketName, "attach", "-t", entry.sessionName], {
-    cwd: REPO_ROOT,
-    stdio: "inherit",
-    env: { ...process.env, TMUX: "" },
+  const candidate = path.join(lanePaths.dashboardsDir, `wave-${Number(waveNumber)}.json`);
+  return fs.existsSync(candidate) ? candidate : null;
+}
+
+function selectCurrentWaveFromGlobalDashboard(globalState) {
+  const waves = Array.isArray(globalState?.waves) ? globalState.waves : [];
+  const candidates = waves
+    .map((wave) => ({
+      waveNumber: Number.parseInt(String(wave?.wave ?? ""), 10),
+      status: String(wave?.status || "").trim().toLowerCase(),
+      updatedAt: Date.parse(
+        String(wave?.updatedAt || wave?.completedAt || wave?.startedAt || ""),
+      ),
+    }))
+    .filter((entry) => Number.isFinite(entry.waveNumber));
+  if (candidates.length === 0) {
+    return null;
+  }
+  candidates.sort((left, right) => {
+    const leftTerminal = TERMINAL_STATES.has(left.status);
+    const rightTerminal = TERMINAL_STATES.has(right.status);
+    if (leftTerminal !== rightTerminal) {
+      return leftTerminal ? 1 : -1;
+    }
+    const leftUpdatedAt = Number.isFinite(left.updatedAt) ? left.updatedAt : 0;
+    const rightUpdatedAt = Number.isFinite(right.updatedAt) ? right.updatedAt : 0;
+    if (leftUpdatedAt !== rightUpdatedAt) {
+      return rightUpdatedAt - leftUpdatedAt;
+    }
+    return right.waveNumber - left.waveNumber;
   });
-  if (result.error) {
-    throw new Error(`tmux attach failed: ${result.error.message}`);
+  return candidates[0].waveNumber;
+}
+
+export function resolveDashboardAttachFallback(lanePaths, target) {
+  if (target === "global") {
+    return fs.existsSync(lanePaths.globalDashboardPath)
+      ? { dashboardFile: lanePaths.globalDashboardPath }
+      : null;
   }
-  if (result.status !== 0) {
-    throw new Error(
-      `tmux attach exited ${result.status} for lane ${lanePaths.lane} ${target} dashboard session ${entry.sessionName}.`,
-    );
+  const globalState = readJsonOrNull(lanePaths.globalDashboardPath);
+  const preferredWaveNumber = selectCurrentWaveFromGlobalDashboard(globalState);
+  const preferredWavePath = waveDashboardPathForNumber(lanePaths, preferredWaveNumber);
+  if (preferredWavePath) {
+    return { dashboardFile: preferredWavePath };
   }
+  if (!fs.existsSync(lanePaths.dashboardsDir)) {
+    return fs.existsSync(lanePaths.globalDashboardPath)
+      ? { dashboardFile: lanePaths.globalDashboardPath }
+      : null;
+  }
+  const candidates = fs.readdirSync(lanePaths.dashboardsDir, { withFileTypes: true })
+    .filter((entry) => entry.isFile())
+    .map((entry) => ({
+      filePath: path.join(lanePaths.dashboardsDir, entry.name),
+      match: entry.name.match(/^wave-(\d+)\.json$/),
+    }))
+    .filter((entry) => entry.match)
+    .map((entry) => ({
+      dashboardFile: entry.filePath,
+      waveNumber: Number.parseInt(entry.match[1], 10),
+      mtimeMs: fs.statSync(entry.filePath).mtimeMs,
+    }))
+    .sort((left, right) => {
+      if (left.mtimeMs !== right.mtimeMs) {
+        return right.mtimeMs - left.mtimeMs;
+      }
+      return right.waveNumber - left.waveNumber;
+    });
+  if (candidates.length > 0) {
+    return { dashboardFile: candidates[0].dashboardFile };
+  }
+  return fs.existsSync(lanePaths.globalDashboardPath)
+    ? { dashboardFile: lanePaths.globalDashboardPath }
+    : null;
 }
 
 function readMessageBoardTail(messageBoardPath, maxLines = 24) {
@@ -460,7 +528,7 @@ Options:
   --dashboard-file <path>  Path to wave/global dashboard JSON
   --message-board <path>   Optional message board path override
   --attach <current|global>
-                          Attach to the stable tmux-backed dashboard session for the lane
+                          Attach to the stable dashboard session for the lane, or follow the last written dashboard file when no live session exists
   --watch                  Refresh continuously
   --refresh-ms <n>         Refresh interval in ms (default: ${DEFAULT_REFRESH_MS})
 `);
@@ -468,8 +536,12 @@ Options:
   }
 
   if (options.attach) {
-    attachDashboardSession(options.project, options.lane, options.attach);
-    return;
+    const fallback = await attachDashboardSession(options.project, options.lane, options.attach);
+    if (!fallback) {
+      return;
+    }
+    options.dashboardFile = fallback.dashboardFile;
+    options.watch = true;
   }
 
   let terminalStateReachedAt = null;

package/scripts/wave-orchestrator/derived-state-engine.mjs

@@ -26,7 +26,7 @@ import { deriveWaveLedger, readWaveLedger } from "./ledger.mjs";
 import { buildDocsQueue, readDocsQueue } from "./docs-queue.mjs";
 import { parseStructuredSignalsFromLog } from "./dashboard-state.mjs";
 import {
-  isSecurityReviewAgent,
+  isSecurityReviewAgentForLane,
   resolveSecurityReviewReportPath,
   isContEvalImplementationOwningAgent,
   resolveWaveRoleBindings,
@@ -214,7 +214,9 @@ export function buildWaveSecuritySummary({
   summariesByAgentId = {},
 }) {
   const createdAt = toIsoTimestamp();
-  const securityAgents = (wave.agents || []).filter((agent) => isSecurityReviewAgent(agent));
+  const securityAgents = (wave.agents || []).filter((agent) =>
+    isSecurityReviewAgentForLane(agent, lanePaths),
+  );
   if (securityAgents.length === 0) {
     return {
       wave: wave.wave,
@@ -377,7 +379,7 @@ function buildIntegrationEvidence({
       isContEvalImplementationOwningAgent(agent, {
         contEvalAgentId: roleBindings.contEvalAgentId,
       });
-    if (isSecurityReviewAgent(agent)) {
+    if (isSecurityReviewAgentForLane(agent, lanePaths)) {
       continue;
     }
     if (agent.agentId === roleBindings.contEvalAgentId) {
@@ -710,6 +712,7 @@ export function buildWaveDerivedState({
     benchmarkCatalogPath: lanePaths.laneProfile?.paths?.benchmarkCatalogPath,
     capabilityAssignments,
     dependencySnapshot,
+    securityRolePromptPath: lanePaths.securityRolePromptPath,
   });
   const inboxDir = waveInboxDir(lanePaths, wave.wave);
   const sharedSummary = compileSharedSummary({