@cxi-lmai/ci-agent-platform 3.0.1 → 3.1.1

package/payload/ci-templates/scripts/lib/pipeline-common.sh

@@ -13,6 +13,8 @@ source "$SCRIPT_LIB_DIR/usage-capture.sh"
 source "$SCRIPT_LIB_DIR/usage-capture-omp.sh"
 # shellcheck source=./platform.sh
 source "$SCRIPT_LIB_DIR/platform.sh"
+# shellcheck source=./failure-notice.sh
+source "$SCRIPT_LIB_DIR/failure-notice.sh"
 
 # --- Defaults ---------------------------------------------------------------
 # Every PIPE_ variable has a default here so a project that overrides nothing
@@ -25,6 +27,7 @@ pipe_defaults() {
   : "${PIPE_CONFIG_PATH:=.claude/pipeline-config.md}"
   : "${PIPE_CONTEXT_DIR:=build/pipeline}"
   : "${PIPE_METRICS_DIR:=$PIPE_CONTEXT_DIR/metrics}"
+  : "${PIPE_AGENT_STDERR:=$PIPE_CONTEXT_DIR/agent-stderr.log}"
   : "${PIPE_TARGET_BRANCH:=main}"
   : "${PIPE_FIX_LOOP_CAP:=2}"
   : "${PIPE_CODER_CAP:=3}"
@@ -33,29 +36,78 @@ pipe_defaults() {
   # Model defaults track the active harness. Each PIPE_MODEL_* variable remains
   # explicitly overridable.
   if [ "$PIPE_HARNESS" = "omp" ]; then
-    : "${PIPE_MODEL_TRIAGE:=openrouter/anthropic/claude-haiku-4-5}"
-    : "${PIPE_MODEL_CODE:=openrouter/anthropic/claude-sonnet-5-0}"
-    : "${PIPE_MODEL_REVIEW:=openrouter/anthropic/claude-sonnet-5-0}"
+    : "${PIPE_MODEL_TRIAGE:=openrouter/anthropic/claude-haiku-4.5}"
+    : "${PIPE_MODEL_CODE:=openrouter/anthropic/claude-sonnet-5}"
+    : "${PIPE_MODEL_REVIEW:=openrouter/anthropic/claude-sonnet-5}"
   else
     : "${PIPE_MODEL_TRIAGE:=haiku}"
-    : "${PIPE_MODEL_CODE:=claude-sonnet-5-0}"
-    : "${PIPE_MODEL_REVIEW:=claude-sonnet-5-0}"
+    : "${PIPE_MODEL_CODE:=claude-sonnet-5}"
+    : "${PIPE_MODEL_REVIEW:=claude-sonnet-5}"
   fi
   : "${PIPE_COMMIT_TESTFIX:=Fix test errors}"
   : "${PIPE_COMMIT_REVIEWFIX:=Fix review findings}"
   : "${PIPE_COMMIT_COVERAGE:=Add coverage tests}"
+  : "${PIPE_COMMIT_DOCSSYNC:=Update docs per docs-sync findings}"
+  : "${PIPE_COMMIT_AUDIT:=docs: apply convention audit findings}"
+  : "${PIPE_COMMIT_CVEFIX:=Update dependencies to resolve CVEs}"
   : "${PIPE_LABEL_READY:=pipe-ready}"
   : "${PIPE_LABEL_WIP:=pipe-wip}"
   : "${PIPE_LABEL_STUCK:=pipe-stuck}"
   : "${PIPE_LABEL_BLOCKER:=pipe-blocker}"
   : "${PIPE_LABEL_BLOCKED:=pipe-blocked}"
   : "${PIPE_LABEL_DECOMPOSED:=pipe-decomposed}"
+  : "${PIPE_LABEL_AUDIT:=codebase-audit}"
   : "${PIPE_RESULT_REVIEW:=$PIPE_CONTEXT_DIR/code-review-result.txt}"
   : "${PIPE_RESULT_REVIEWFIX:=$PIPE_CONTEXT_DIR/review-fix-result.json}"
+  : "${PIPE_RESULT_DOCSSYNC:=$PIPE_CONTEXT_DIR/docs-sync.json}"
   : "${PIPE_VERIFY_CMD:=}"
   : "${PIPE_COMPILE_CMD:=${PIPE_VERIFY_CMD}}"
   : "${PIPE_TEST_REPORT_GLOB:=}"
+  : "${PIPE_COVERAGE_RATCHET:=0}"
+  : "${PIPE_COVERAGE_REPORT:=}"
+  : "${PIPE_COVERAGE_REPORT_KIND:=jacoco}"
   : "${PIPE_COVERAGE_SIGNAL:=}"
+  # CVE remediation. Off by default: project-local scanners provide the
+  # HIGH/CRITICAL identifier list when PIPE_CVE_FIX=1 enables this job.
+  : "${PIPE_CVE_FIX:=0}"
+  : "${PIPE_DEPENDENCY_MANIFEST:=build.gradle}"
+  : "${PIPE_CVE_SUPPRESSIONS:=owasp-suppressions.xml}"
+  # Issue-driven E2E generation. Off by default; PIPE_VERIFY_CMD is the
+  # configured verification command and must be non-empty before tests run.
+  : "${PIPE_E2E_TEST_GEN:=0}"
+  : "${PIPE_LABEL_TESTREADY:=test-ready}"
+  : "${PIPE_LABEL_E2E_SCOPE:=}"
+  : "${PIPE_E2E_TEST_DIR:=e2e/tests}"
+  : "${PIPE_E2E_BASE_URL:=}"
+  : "${PIPE_E2E_VERIFY_CMD:=}"
+  # Documentation sync. Off by default: the job only runs when the pipeline
+  # sets PIPE_DOCS_SYNC=1. PIPE_DOCS_ROOTS is the comma-separated set of paths
+  # the docs-sync agent may edit and the runner may commit.
+  : "${PIPE_DOCS_SYNC:=0}"
+  : "${PIPE_DOCS_ROOTS:=docs,CLAUDE.md,.claude/memory}"
+  # Codebase audit. Off by default: the job only runs on a schedule that sets
+  # PIPE_CODEBASE_AUDIT=1. Reuses PIPE_DOCS_ROOTS for the optional auto-fix
+  # phase's coder scope.
+  : "${PIPE_CODEBASE_AUDIT:=0}"
+  # Agent architect. Off by default: a scheduled pipeline explicitly enables
+  # this evidence-backed proposal job after a project has reviewed its output.
+  : "${PIPE_AGENT_ARCHITECT:=0}"
+  : "${PIPE_ARCHITECT_WINDOW_DAYS:=7}"
+  : "${PIPE_ARCHITECT_DRY_RUN:=true}"
+  : "${PIPE_LABEL_IMPROVEMENT:=pipe-improvement}"
+  # Metrics aggregation. Off by default: the job only runs on a schedule that
+  # sets PIPE_METRICS_SNAPSHOT=1, and it publishes an artifact unless the
+  # project explicitly opts in to committing generated data to its repository.
+  : "${PIPE_METRICS_SNAPSHOT:=0}"
+  : "${PIPE_METRICS_OUTPUT_DIR:=data/metrics/snapshots}"
+  : "${PIPE_METRICS_WINDOW_DAYS:=1}"
+  : "${PIPE_METRICS_COMMIT_REPO:=false}"
+  : "${PIPE_METRICS_REVIEW_AGENTS:=code-reviewer,review-verdict,review-fix}"
+  # Commit subjects that mark a defect in already-merged work. Keep in sync with
+  # the Metrics Conventions section of the pipeline config.
+  : "${PIPE_METRICS_DEFECT_REVERT:=Reverts !}"
+  : "${PIPE_METRICS_DEFECT_REGRESSION:=Fixes regression from !}"
+  : "${PIPE_METRICS_DEFECT_REINTRODUCE:=Reintroduces work from !}"
   # Spec template path. GitHub projects usually keep it under .github, GitLab
   # under .gitlab, so the default follows the detected platform.
   if [ "$PIPE_PLATFORM" = "github" ]; then
@@ -69,12 +121,20 @@ pipe_defaults() {
   # would pick up result files (E2E finding N-6). A `*` gitignore inside the
   # dir hides everything in it, including itself, from any git add.
   [ -f "$PIPE_CONTEXT_DIR/.gitignore" ] || printf '*\n' > "$PIPE_CONTEXT_DIR/.gitignore"
-  export PIPE_PLATFORM PIPE_CONFIG_PATH PIPE_CONTEXT_DIR PIPE_METRICS_DIR \
+  export PIPE_PLATFORM PIPE_CONFIG_PATH PIPE_CONTEXT_DIR PIPE_METRICS_DIR PIPE_AGENT_STDERR \
     PIPE_TARGET_BRANCH PIPE_FIX_LOOP_CAP PIPE_CODER_CAP PIPE_ISSUE_SCAN PIPE_COMMIT_TESTFIX \
-    PIPE_COMMIT_REVIEWFIX PIPE_COMMIT_COVERAGE PIPE_LABEL_READY PIPE_LABEL_WIP \
-    PIPE_LABEL_STUCK PIPE_LABEL_BLOCKER PIPE_LABEL_BLOCKED PIPE_LABEL_DECOMPOSED \
-    PIPE_RESULT_REVIEW PIPE_RESULT_REVIEWFIX PIPE_VERIFY_CMD PIPE_COMPILE_CMD \
-    PIPE_TEST_REPORT_GLOB PIPE_COVERAGE_SIGNAL PIPE_SPEC_TEMPLATE_PATH \
+    PIPE_COMMIT_REVIEWFIX PIPE_COMMIT_COVERAGE PIPE_COMMIT_CVEFIX PIPE_LABEL_READY PIPE_LABEL_WIP \
+    PIPE_LABEL_STUCK PIPE_LABEL_BLOCKER PIPE_LABEL_BLOCKED PIPE_LABEL_DECOMPOSED PIPE_LABEL_AUDIT \
+    PIPE_RESULT_REVIEW PIPE_RESULT_REVIEWFIX PIPE_RESULT_DOCSSYNC PIPE_COMMIT_DOCSSYNC PIPE_COMMIT_AUDIT \
+    PIPE_CVE_FIX PIPE_DEPENDENCY_MANIFEST PIPE_CVE_SUPPRESSIONS PIPE_E2E_TEST_GEN PIPE_LABEL_TESTREADY \
+    PIPE_LABEL_E2E_SCOPE PIPE_E2E_TEST_DIR PIPE_E2E_BASE_URL PIPE_E2E_VERIFY_CMD PIPE_DOCS_SYNC PIPE_DOCS_ROOTS PIPE_VERIFY_CMD PIPE_COMPILE_CMD \
+    PIPE_TEST_REPORT_GLOB PIPE_COVERAGE_RATCHET PIPE_COVERAGE_REPORT PIPE_COVERAGE_REPORT_KIND \
+    PIPE_COVERAGE_SIGNAL PIPE_SPEC_TEMPLATE_PATH PIPE_CODEBASE_AUDIT PIPE_AGENT_ARCHITECT \
+    PIPE_ARCHITECT_WINDOW_DAYS PIPE_ARCHITECT_DRY_RUN PIPE_LABEL_IMPROVEMENT \
+    PIPE_METRICS_SNAPSHOT PIPE_METRICS_OUTPUT_DIR PIPE_METRICS_WINDOW_DAYS \
+    PIPE_METRICS_COMMIT_REPO PIPE_METRICS_REVIEW_AGENTS PIPE_METRICS_DEFECT_REVERT \
+    PIPE_METRICS_DEFECT_REGRESSION PIPE_METRICS_DEFECT_REINTRODUCE \
+    PIPE_METRICS_SNAPSHOT_DATE PIPE_METRICS_RAW_DIR PIPE_METRICS_MRS_FILE \
     PIPE_HARNESS PIPE_MODEL_TRIAGE PIPE_MODEL_CODE PIPE_MODEL_REVIEW
 }
 
@@ -99,6 +159,17 @@ pipe_git_identity() {
 # Checkout the real source branch so commits land on the branch tip, not on the
 # detached MR/PR ref that can fall behind and cause non-fast-forward push errors.
 pipe_checkout_source() {
+  # The MR/PR itself is the authoritative source of the branch name. A
+  # workflow_run or branch pipeline carries no merge-request source ref, and
+  # without one this checkout used to no-op silently, leaving the fix commit on
+  # a detached head that no push could land.
+  if [ -z "${PIPE_SOURCE_BRANCH:-}" ] && [ -n "${PIPE_MR_IID:-}" ]; then
+    # `|| PIPE_SOURCE_BRANCH=""` is the whole error path: an unreachable or
+    # unconfigured API must leave the caller where it was, not abort it.
+    PIPE_SOURCE_BRANCH=$(platform_mr_meta 2>/dev/null | jq -r '.source_branch // ""' 2>/dev/null) \
+      || PIPE_SOURCE_BRANCH=""
+    export PIPE_SOURCE_BRANCH
+  fi
   [ -z "${PIPE_SOURCE_BRANCH:-}" ] && return 0
   git fetch origin "$PIPE_TARGET_BRANCH" "$PIPE_SOURCE_BRANCH" 2>/dev/null || true
   git checkout -B "$PIPE_SOURCE_BRANCH" "origin/$PIPE_SOURCE_BRANCH" 2>/dev/null || true
@@ -117,15 +188,17 @@ pipe_rebase_and_push() {
 }
 
 # --- Cap counting -----------------------------------------------------------
-# Count consecutive commits from the tip back toward the target branch whose
-# subject matches a pattern. The skill also computes this, but the runner needs
-# it to decide whether the agent actually committed this run.
-
+# Count consecutive matching commits from the tip back toward the target branch.
+# Docs-sync commits are transparent: they do not count, but do not interrupt a
+# fix streak. The skills use the same exact-subject rules for their cap checks;
+# the runner needs this count only to detect whether a fix commit landed.
 pipe_count_fix_commits() {
   local pattern="$1" count=0 subject
   while IFS= read -r subject; do
-    if echo "$subject" | grep -qF "$pattern"; then
+    if [ "$subject" = "$pattern" ]; then
       count=$((count + 1))
+    elif [ "$subject" = "$PIPE_COMMIT_DOCSSYNC" ]; then
+      continue
     else
       break
     fi
@@ -368,23 +441,24 @@ pipe_get_env() {
 pipe_apply_escalation() {
   local pm_env="$PIPE_CONTEXT_DIR/postmortem.env"
   local pm_body="$PIPE_CONTEXT_DIR/postmortem.md"
-  local add remove category diag
+  local add remove category comment_file
   add=$(pipe_get_env "$pm_env" ADD_LABELS);       add=${add:-$PIPE_LABEL_STUCK}
   remove=$(pipe_get_env "$pm_env" REMOVE_LABELS); remove=${remove:-$PIPE_LABEL_WIP}
   category=$(pipe_get_env "$pm_env" FAILURE_CATEGORY); category=${category:-${1:-other}}
 
   platform_set_labels "$add" "$remove"
 
-  if [ -s "$pm_body" ]; then
-    diag=$(cat "$pm_body")
-  else
-    diag="Automated fixes were exhausted after $PIPE_FIX_LOOP_CAP attempts. A human needs to take over."
-  fi
-  platform_post_comment "🤖 **Auto-fix stuck after $PIPE_FIX_LOOP_CAP attempts. Diagnostic analysis:**
-
-$diag
-
-Human intervention needed."
+  comment_file="$PIPE_CONTEXT_DIR/auto-fix-stuck.md"
+  {
+    printf '🤖 **Auto-fix stuck after %s attempts. Diagnostic analysis:**\n\n' "$PIPE_FIX_LOOP_CAP"
+    if [ -s "$pm_body" ]; then
+      cat "$pm_body"
+    else
+      printf 'Automated fixes were exhausted after %s attempts. A human needs to take over.' "$PIPE_FIX_LOOP_CAP"
+    fi
+    printf '\n\nHuman intervention needed.\n'
+  } > "$comment_file"
+  platform_post_comment_file "$comment_file"
 
   pipe_metric_event postmortem dev_stuck \
     "$(jq -n --arg c "$category" --arg ctx "${2:-unknown}" '{failure_category: $c, context: $ctx}')"

package/payload/ci-templates/scripts/lib/platform.sh

@@ -8,7 +8,8 @@
 #   Common (both platforms):
 #     PIPE_MR_IID          MR iid (GitLab) or PR number (GitHub)
 #     PIPE_TARGET_BRANCH   branch the MR/PR targets
-#     PIPE_SOURCE_BRANCH   the MR/PR source branch
+#     PIPE_SOURCE_BRANCH   the MR/PR source branch (optional: platform_mr_meta
+#                          reports it as `source_branch` when the runtime does not)
 #     PIPE_HEAD_SHA        current head commit under review
 #     PIPE_PROJECT_PATH    namespace/project (for git push URL)
 #     PIPE_SERVER_HOST     git host (for git push URL)
@@ -58,7 +59,10 @@ _gl_get() {
     "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/merge_requests/$PIPE_MR_IID$1"
 }
 
-_gl_mr_meta()   { _gl_get "" | jq -r '{title: (.title // ""), description: (.description // ""), labels: ((.labels // []) | join(","))}'; }
+# `source_branch` is the branch the MR/PR was opened from. It comes from the API
+# rather than the CI runtime because branch and workflow_run pipelines carry no
+# merge-request source ref, and a runner that pushes needs it.
+_gl_mr_meta()   { _gl_get "" | jq -r '{title: (.title // ""), description: (.description // ""), labels: ((.labels // []) | join(",")), source_branch: (.source_branch // "")}'; }
 _gl_mr_labels() { _gl_get "" | jq -r '((.labels // []) | join(","))'; }
 # Callers take the LAST matching note, so the array must be chronological AND
 # must contain the newest notes. One asc page would return the oldest 100 on a
@@ -66,11 +70,12 @@ _gl_mr_labels() { _gl_get "" | jq -r '((.labels // []) | join(","))'; }
 _gl_notes()     { _gl_get "/notes?per_page=100&sort=desc" | jq -r '[.[] | {author: .author.username, body: .body}] | reverse'; }
 _gl_issue()     { curl -s -H "PRIVATE-TOKEN: $PIPE_TOKEN" "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/issues/$1" | jq -r '{iid: .iid, title: (.title // ""), description: (.description // "")}'; }
 
-_gl_post_comment() {
+_gl_post_comment_file() {
+  # $1 = body file under PIPE_CONTEXT_DIR.
   curl --fail-with-body -s -X POST \
     -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
     "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/merge_requests/$PIPE_MR_IID/notes" \
-    --data-urlencode "body=$1" > /dev/null
+    --data-urlencode "body@$1" > /dev/null
 }
 
 _gl_set_labels() {
@@ -102,15 +107,22 @@ _gl_compute_diff_base() {
 
 _gh_get() { gh api "repos/$PIPE_REPO/$1"; }
 
-_gh_mr_meta()   { _gh_get "pulls/$PIPE_MR_IID" | jq -r '{title: (.title // ""), description: (.body // ""), labels: ((.labels // []) | map(.name) | join(","))}'; }
+_gh_mr_meta()   { _gh_get "pulls/$PIPE_MR_IID" | jq -r '{title: (.title // ""), description: (.body // ""), labels: ((.labels // []) | map(.name) | join(",")), source_branch: (.head.ref // "")}'; }
 _gh_mr_labels() { _gh_get "pulls/$PIPE_MR_IID" | jq -r '((.labels // []) | map(.name) | join(","))'; }
 # The per-issue comments endpoint has no sort param, so paginate all pages to
 # guarantee the newest comments are present (callers take the last match).
 _gh_notes()     { gh api --paginate "repos/$PIPE_REPO/issues/$PIPE_MR_IID/comments?per_page=100" --jq '.[] | {author: .user.login, body: .body}' | jq -s '.'; }
 _gh_issue()     { _gh_get "issues/$1" | jq -r '{iid: .number, title: (.title // ""), description: (.body // "")}'; }
 
-_gh_post_comment() {
-  gh api -X POST "repos/$PIPE_REPO/issues/$PIPE_MR_IID/comments" -f "body=$1" > /dev/null
+_gh_post_comment_file() {
+  # $1 = body file under PIPE_CONTEXT_DIR.
+  local payload status=0
+  payload=$(mktemp "$PIPE_CONTEXT_DIR/github-comment.XXXXXX.json")
+  jq -n --rawfile body "$1" '{body:$body}' > "$payload"
+  gh api -X POST "repos/$PIPE_REPO/issues/$PIPE_MR_IID/comments" \
+    -H "Content-Type: application/json" --input "$payload" > /dev/null || status=$?
+  rm -f "$payload"
+  return "$status"
 }
 
 _gh_set_labels() {
@@ -135,6 +147,179 @@ _gh_compute_diff_base() {
   fi
 }
 
+# --- Pipeline and artifact helpers ------------------------------------------
+
+_gl_completed_pipelines() {
+  local updated_after
+  updated_after=$(date -u -d "$1 days ago" '+%Y-%m-%dT%H:%M:%SZ') || return 1
+  curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/pipelines?scope=finished&updated_after=$updated_after&per_page=100" |
+    jq -c '[.[] | {id, status: (.status // ""), ref: (.ref // ""), updated_at: (.updated_at // "")}]'
+}
+
+_gl_pipeline_artifacts() {
+  curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/pipelines/$1/jobs?per_page=100" |
+    jq -c '[.[] | {job_id: .id, job_name: (.name // ""), artifact_available: (((.artifacts_file // {}) | .filename) != null)}]'
+}
+
+_gl_download_artifact() {
+  curl -sSL --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/jobs/$1/artifacts" -o "$2"
+}
+
+_gl_latest_success_coverage() {
+  curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/pipelines?ref=$1&status=success&per_page=1" |
+    jq -r '.[0].coverage // ""'
+}
+
+_gl_merge_requests_updated_since() {
+  local page response page_size results
+  page=1
+  results='[]'
+  while :; do
+    response=$(curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+      "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/merge_requests?updated_after=$1&per_page=100&page=$page&scope=all") || return 1
+    page_size=$(jq -r 'length' <<< "$response") || return 1
+    results=$(jq -c --argjson results "$results" \
+      '$results + [.[] | {iid, title: (.title // ""), state: (.state // ""), author: (.author.username // ""), labels: (.labels // []), created_at: (.created_at // ""), merged_at: .merged_at, target_branch: (.target_branch // ""), description: (.description // "")}]' <<< "$response") || return 1
+    [ "$page_size" -lt 100 ] && break
+    page=$((page + 1))
+  done
+  printf '%s\n' "$results"
+}
+
+# Merged MRs targeting a branch, newest first, filtered to iid > since_iid.
+# Used by the codebase-audit job to find work since the last audit.
+_gl_merged_mrs() {
+  # $1=target_branch $2=since_iid $3=limit. One page, newest merged first;
+  # matches the source script's own non-paginated fetch. Captured into a
+  # variable (not piped straight into jq) so a curl failure propagates: a
+  # pipeline's exit status is jq's, not curl's, without `set -o pipefail`.
+  local response
+  response=$(curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/merge_requests?target_branch=$1&state=merged&per_page=$3&order_by=created_at&sort=desc") || return 1
+  jq -c --argjson since "$2" '[.[] | select(.iid > $since) | {iid, title: (.title // ""), created_at: (.created_at // "")}]' <<< "$response"
+}
+
+_gl_mr_changes() {
+  # $1=iid $2=limit. Changed file paths for one merged MR, capped at limit.
+  local response
+  response=$(curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/merge_requests/$1/changes?per_page=$2") || return 1
+  jq -r --argjson limit "$2" '[.changes[]?.new_path] | .[0:$limit][]' <<< "$response" 2>/dev/null
+}
+
+# $1=iid $2=limit $3=sort("asc"|"desc"). Normalized, non-system MR notes.
+_gl_mr_notes() {
+  local response
+  [[ "$2" =~ ^[1-9][0-9]*$ ]] || return 1
+  [[ "$3" = "asc" || "$3" = "desc" ]] || return 1
+  response=$(curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$PIPE_API_URL/projects/$PIPE_PROJECT_ID/merge_requests/$1/notes?per_page=$2&sort=$3") || return 1
+  jq --argjson limit "$2" '[.[] | select(.system != true)
+    | {author: (.author.username // ""), body: (.body // "")}] | .[0:$limit]' <<< "$response"
+}
+
+# These APIs return downloadable binary responses as well as JSON. Use curl
+# rather than gh so artifact downloads remain a silent, status-only operation.
+_gh_pipeline_api() {
+  local token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+  curl -s --fail \
+    -H "Accept: application/vnd.github+json" \
+    -H "Authorization: Bearer $token" \
+    "${GITHUB_API_URL:-https://api.github.com}/repos/$PIPE_REPO/$1"
+}
+
+_gh_completed_pipelines() {
+  local updated_after page response page_size results
+  updated_after=$(date -u -d "$1 days ago" '+%Y-%m-%dT%H:%M:%SZ') || return 1
+  page=1
+  results='[]'
+  while :; do
+    response=$(_gh_pipeline_api "actions/runs?status=completed&per_page=100&page=$page") || return 1
+    page_size=$(jq -r '(.workflow_runs // []) | length' <<< "$response") || return 1
+    results=$(jq -c --argjson results "$results" --arg updated_after "$updated_after" \
+      '$results + [.workflow_runs[] | select((.updated_at // "") >= $updated_after) | {id, status: (.conclusion // .status // ""), ref: (.head_branch // ""), updated_at: (.updated_at // "")}]' <<< "$response") || return 1
+    [ "$page_size" -lt 100 ] && break
+    page=$((page + 1))
+  done
+  printf '%s\n' "$results"
+}
+
+_gh_pipeline_artifacts() {
+  _gh_pipeline_api "actions/runs/$1/artifacts?per_page=100" |
+    jq -c '[.artifacts[] | {job_id: .id, job_name: (.name // ""), artifact_available: ((.expired // true) | not)}]'
+}
+
+_gh_download_artifact() {
+  local token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+  curl -sSL --fail \
+    -H "Accept: application/vnd.github+json" \
+    -H "Authorization: Bearer $token" \
+    "${GITHUB_API_URL:-https://api.github.com}/repos/$PIPE_REPO/actions/artifacts/$1/zip" -o "$2"
+}
+
+_gh_latest_success_coverage() {
+  _gh_pipeline_api "actions/runs?branch=$1&status=success&per_page=1" |
+    jq -r '.workflow_runs[0].coverage // ""'
+}
+
+# The pull-request API has no updated-since filter, so the newest-first listing
+# is walked until a page carries nothing inside the window.
+_gh_merge_requests_updated_since() {
+  local page response page_size kept kept_size results
+  page=1
+  results='[]'
+  while :; do
+    response=$(_gh_pipeline_api "pulls?state=all&sort=updated&direction=desc&per_page=100&page=$page") || return 1
+    page_size=$(jq -r 'length' <<< "$response") || return 1
+    kept=$(jq -c --arg since "$1" \
+      '[.[] | select((.updated_at // "") >= $since) | {iid: .number, title: (.title // ""), state: (if .merged_at then "merged" else (.state // "") end), author: (.user.login // ""), labels: [(.labels // [])[].name], created_at: (.created_at // ""), merged_at: .merged_at, target_branch: (.base.ref // ""), description: (.body // "")}]' <<< "$response") || return 1
+    kept_size=$(jq -r 'length' <<< "$kept") || return 1
+    results=$(jq -nc --argjson results "$results" --argjson kept "$kept" '$results + $kept') || return 1
+    [ "$kept_size" -lt "$page_size" ] && break
+    [ "$page_size" -lt 100 ] && break
+    page=$((page + 1))
+  done
+  printf '%s\n' "$results"
+}
+
+# Merged PRs targeting a branch, newest first, filtered to number > since_iid.
+# GitHub's closed-PR listing has no server-side merged-only filter, so
+# merged_at != null is applied client-side.
+_gh_merged_mrs() {
+  # $1=target_branch $2=since_iid $3=limit.
+  local response
+  response=$(_gh_pipeline_api "pulls?base=$1&state=closed&per_page=$3&sort=created&direction=desc") || return 1
+  jq -c --argjson since "$2" '[.[] | select(.merged_at != null and .number > $since) | {iid: .number, title: (.title // ""), created_at: (.created_at // "")}]' <<< "$response"
+}
+
+_gh_mr_changes() {
+  # $1=iid $2=limit. Changed file paths for one merged PR, capped at limit.
+  local response
+  response=$(_gh_pipeline_api "pulls/$1/files?per_page=$2") || return 1
+  jq -r --argjson limit "$2" '[.[]?.filename] | .[0:$limit][]' <<< "$response" 2>/dev/null
+}
+
+# $1=iid $2=limit $3=sort("asc"|"desc"). GitHub returns comments oldest
+# first, so descend requests paginate before reversing and slicing to preserve
+# real newest-first semantics rather than reversing an arbitrary first page.
+_gh_mr_notes() {
+  local response filter
+  [[ "$2" =~ ^[1-9][0-9]*$ ]] || return 1
+  [[ "$3" = "asc" || "$3" = "desc" ]] || return 1
+  if [ "$3" = "asc" ]; then
+    response=$(gh api "repos/$PIPE_REPO/issues/$1/comments?per_page=$2") || return 1
+  else
+    response=$(gh api --paginate "repos/$PIPE_REPO/issues/$1/comments?per_page=100") || return 1
+  fi
+  filter='[.[] | {author: (.user.login // ""), body: (.body // "")}]'
+  [ "$3" = "desc" ] && filter="$filter | reverse"
+  jq --argjson limit "$2" "$filter | .[0:\$limit]" <<< "$response"
+}
+
 # --- Bot identity -------------------------------------------------------------
 # The scripts filter MR/PR comments by the bot's username to recognise their own
 # previous output. The token already knows whose it is, so an empty
@@ -155,12 +340,84 @@ platform_resolve_bot_user() {
 
 # --- Public dispatch --------------------------------------------------------
 
-platform_mr_meta()      { case "$PIPE_PLATFORM" in gitlab) _gl_mr_meta ;; github) _gh_mr_meta ;; esac; }
-platform_mr_labels()    { case "$PIPE_PLATFORM" in gitlab) _gl_mr_labels ;; github) _gh_mr_labels ;; esac; }
-platform_notes()        { case "$PIPE_PLATFORM" in gitlab) _gl_notes ;; github) _gh_notes ;; esac; }
-platform_issue()        { case "$PIPE_PLATFORM" in gitlab) _gl_issue "$1" ;; github) _gh_issue "$1" ;; esac; }
-platform_post_comment() { case "$PIPE_PLATFORM" in gitlab) _gl_post_comment "$1" ;; github) _gh_post_comment "$1" ;; esac; }
-platform_set_labels()   { case "$PIPE_PLATFORM" in gitlab) _gl_set_labels "$1" "$2" ;; github) _gh_set_labels "$1" "$2" ;; esac; }
+platform_mr_meta()           { case "$PIPE_PLATFORM" in gitlab) _gl_mr_meta ;; github) _gh_mr_meta ;; esac; }
+platform_mr_labels()         { case "$PIPE_PLATFORM" in gitlab) _gl_mr_labels ;; github) _gh_mr_labels ;; esac; }
+platform_notes()             { case "$PIPE_PLATFORM" in gitlab) _gl_notes ;; github) _gh_notes ;; esac; }
+platform_issue()             { case "$PIPE_PLATFORM" in gitlab) _gl_issue "$1" ;; github) _gh_issue "$1" ;; esac; }
+platform_post_comment_file() { case "$PIPE_PLATFORM" in gitlab) _gl_post_comment_file "$1" ;; github) _gh_post_comment_file "$1" ;; esac; }
+platform_set_labels()        { case "$PIPE_PLATFORM" in gitlab) _gl_set_labels "$1" "$2" ;; github) _gh_set_labels "$1" "$2" ;; esac; }
+
+platform_completed_pipelines() {
+  [ "$#" -eq 1 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_completed_pipelines "$1" ;;
+    github) _gh_completed_pipelines "$1" ;;
+    *) return 1 ;;
+  esac
+}
+
+platform_pipeline_artifacts() {
+  [ "$#" -eq 1 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_pipeline_artifacts "$1" ;;
+    github) _gh_pipeline_artifacts "$1" ;;
+    *) return 1 ;;
+  esac
+}
+
+platform_download_artifact() {
+  [ "$#" -eq 2 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_download_artifact "$1" "$2" ;;
+    github) _gh_download_artifact "$1" "$2" ;;
+    *) return 1 ;;
+  esac
+}
+
+platform_latest_success_coverage() {
+  [ "$#" -eq 1 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_latest_success_coverage "$1" ;;
+    github) _gh_latest_success_coverage "$1" ;;
+    *) return 1 ;;
+  esac
+}
+
+platform_merge_requests_updated_since() {
+  [ "$#" -eq 1 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_merge_requests_updated_since "$1" ;;
+    github) _gh_merge_requests_updated_since "$1" ;;
+    *) return 1 ;;
+  esac
+}
+
+platform_merged_mrs() {
+  [ "$#" -eq 3 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_merged_mrs "$1" "$2" "$3" ;;
+    github) _gh_merged_mrs "$1" "$2" "$3" ;;
+    *) return 1 ;;
+  esac
+}
+
+platform_mr_changes() {
+  [ "$#" -eq 2 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_mr_changes "$1" "$2" ;;
+    github) _gh_mr_changes "$1" "$2" ;;
+    *) return 1 ;;
+  esac
+}
+
+platform_mr_notes() {
+  [ "$#" -eq 3 ] || return 1
+  case "$PIPE_PLATFORM" in
+    gitlab) _gl_mr_notes "$1" "$2" "$3" ;;
+    github) _gh_mr_notes "$1" "$2" "$3" ;;
+    *) return 1 ;;
+  esac
+}
 
 # Sets PIPE_DIFF_BASE and PIPE_IS_INCREMENTAL. Call before building the diff.
 platform_compute_diff_base() {

package/payload/ci-templates/scripts/lib/usage-capture-omp.sh

@@ -110,7 +110,13 @@ capture_omp() {
       omp_exit_code: $exit_code
     }' > "$record_file"
 
-  # If omp failed, forward stderr so debugging still works.
+  # If the agent failed, forward stderr so debugging still works, and keep a
+  # durable copy: the failure detector runs after the invocation returns and
+  # cannot read a temp file the wrapper already deleted.
+  if [ -n "${PIPE_AGENT_STDERR:-}" ]; then
+    mkdir -p "$(dirname "$PIPE_AGENT_STDERR")" 2>/dev/null || true
+    cp "$stderr_file" "$PIPE_AGENT_STDERR" 2>/dev/null || true
+  fi
   [ "$exit_code" -ne 0 ] && cat "$stderr_file" >&2
   rm -f "$stream_file" "$stderr_file"
   return "$exit_code"

package/payload/ci-templates/scripts/lib/usage-capture.sh

@@ -103,7 +103,13 @@ capture_claude() {
       claude_exit_code: $exit_code
     }' > "$record_file"
 
-  # If Claude failed, forward stderr so debugging still works
+  # If the agent failed, forward stderr so debugging still works, and keep a
+  # durable copy: the failure detector runs after the invocation returns and
+  # cannot read a temp file the wrapper already deleted.
+  if [ -n "${PIPE_AGENT_STDERR:-}" ]; then
+    mkdir -p "$(dirname "$PIPE_AGENT_STDERR")" 2>/dev/null || true
+    cp "$stderr_file" "$PIPE_AGENT_STDERR" 2>/dev/null || true
+  fi
   [ "$exit_code" -ne 0 ] && cat "$stderr_file" >&2
   rm -f "$stream_file" "$stderr_file"
   return "$exit_code"