@dev-loops/core 0.2.7 → 0.4.0

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@dev-loops/core",
-  "version": "0.2.7",
+  "version": "0.4.0",
   "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
   "description": "Shared deterministic support package for dev-loop skills, repo-local scripts, and GitHub automation.",
   "exports": {
     "./bash-exit-one": "./src/bash-exit-one.mjs",
@@ -28,6 +31,7 @@
     "./loop/copilot-ci-status": "./src/loop/copilot-ci-status.mjs",
     "./loop/copilot-loop-iterations": "./src/loop/copilot-loop-iterations.mjs",
     "./loop/copilot-loop-state": "./src/loop/copilot-loop-state.mjs",
+    "./loop/gate-fanin": "./src/loop/gate-fanin.mjs",
     "./loop/handoff-envelope": "./src/loop/handoff-envelope.mjs",
     "./loop/lifecycle-state": "./src/loop/lifecycle-state.mjs",
     "./loop/issue-refinement-artifact": "./src/loop/issue-refinement-artifact.mjs",
@@ -36,7 +40,9 @@
     "./loop/pr-gate-coordination": "./src/loop/pr-gate-coordination.mjs",
     "./loop/pr-title-markers": "./src/loop/pr-title-markers.mjs",
     "./loop/public-dev-loop-routing": "./src/loop/public-dev-loop-routing.mjs",
+    "./loop/queue-board-sync": "./src/loop/queue-board-sync.mjs",
     "./loop/queue-driver": "./src/loop/queue-driver.mjs",
+    "./loop/queue-membership": "./src/loop/queue-membership.mjs",
     "./loop/queue-parallel": "./src/loop/queue-parallel.mjs",
     "./loop/queue-state": "./src/loop/queue-state.mjs",
     "./loop/reviewer-loop-state": "./src/loop/reviewer-loop-state.mjs",

package/src/config/config.mjs

@@ -53,12 +53,52 @@ const GatesConfig = z.strictObject({
   // `requireCi` is only behaviorally configurable for the draft gate.
   // preApproval always requires CI even if config repeats `requireCi`.
   preApproval: GateConfig.optional(),
+  // Fail-closed enforcement that a gate verdict was produced by the
+  // fan-out/fan-in review sub-loop (executionMode === "fanout_fanin" plus a
+  // durable findings-log ledger), not an inline single-agent run. Default
+  // true (opt-out): a clean gate verdict requires fan-out/fan-in evidence
+  // unless explicitly disabled. See docs/gate-review-sub-loop-contract.md.
+  requireFanoutEvidence: z.boolean().default(true),
+  // Cap on how many scoped `review` reviewers the gate fan-out spawns in
+  // parallel. When the resolved angle set exceeds this cap, the overflow runs
+  // in sequential batches and the degradation is recorded in the gate evidence.
+  maxFanoutReviewers: z.number().int().min(1).max(64).default(8),
+  // Post the consolidated gate fan-out findings as a visible, marker-tagged PR
+  // comment so they are auditable and Copilot/humans are aware of them. Default
+  // true (opt-out). The disposition ledger is written regardless; this flag only
+  // suppresses the PR comment when explicitly false. See
+  // docs/gate-review-sub-loop-contract.md.
+  postFindingsComments: z.boolean().default(true),
 });
 
 const AutonomyConfig = z.strictObject({
   stopAt: z.array(
     z.enum(["refinement", "draft-pr", "pre-approval", "merge"])
   ),
+  // When true, merge is a fixed, non-overridable human action: the agent never
+  // runs `gh pr merge`, `resolveAutonomyStopAt` always includes "merge", and
+  // any per-run merge authorization (envelope flag / explicit instruction) is
+  // ignored — it fails closed. See resolveHumanMergeOnly / resolveEffectiveMergeAuthorized.
+  humanMergeOnly: z.boolean().optional(),
+});
+
+/**
+ * Human-handoff config (#920, Request B of #910): at the pre-approval /
+ * merge-handoff boundary, OFFER to assign the PR to a named human
+ * reviewer/assignee. Opt-in (default off). Pairs with autonomy.humanMergeOnly.
+ * `candidatesFrom` selects which sources the resolver queries; `assignees` is a
+ * static highest-priority candidate list. Absent/empty = disabled no-op.
+ */
+const HumanHandoffConfig = z.strictObject({
+  enabled: z.boolean().default(false),
+  candidatesFrom: z
+    .array(z.enum(["codeowners", "recent-committers"]))
+    .optional(),
+  assignees: z.array(z.string().trim().min(1)).optional(),
+});
+
+const ApprovalConfig = z.strictObject({
+  humanHandoff: HumanHandoffConfig.optional(),
 });
 
 const WorkflowConfig = z.strictObject({
@@ -85,6 +125,19 @@ const QueueConfig = z.strictObject({
   reDispatchMaxRetries: z.number().int().min(0).max(10).default(1),
   projectNumber: z.number().int().positive().optional(),
   boardTitle: z.string().trim().min(1).optional(),
+  archiveOlderThanDays: z.number().int().positive().optional(),
+});
+
+/**
+ * Worktree lifecycle config (#909): which gitignored files/dirs to provision
+ * into a fresh worktree from the main checkout. Entries are repo-relative
+ * literal paths OR glob patterns. `copyOnInit` → `fs.cp` (isolated per
+ * worktree); `linkOnInit` → absolute symlink into the main checkout (read-only
+ * data). Both optional; empty/absent is a valid no-op.
+ */
+const WorktreeConfig = z.strictObject({
+  copyOnInit: z.array(z.string().trim().min(1)).optional(),
+  linkOnInit: z.array(z.string().trim().min(1)).optional(),
 });
 
 /** Internal path whitelist for internal-only PR detection — flat array of regex strings */
@@ -106,6 +159,9 @@ const FileGateConfig = GateConfig.partial();
 const FileGatesConfig = z.strictObject({
   draft: FileGateConfig.optional(),
   preApproval: FileGateConfig.optional(),
+  requireFanoutEvidence: z.boolean().optional(),
+  maxFanoutReviewers: z.number().int().min(1).max(64).optional(),
+  postFindingsComments: z.boolean().optional(),
 });
 
 // Partial persona entries for file-level config (allows omitting fields)
@@ -127,11 +183,13 @@ export const DevLoopConfigSchema = z.strictObject({
   refinement: RefinementConfig.optional(),
   gates: GatesConfig.optional(),
   autonomy: AutonomyConfig.optional(),
+  approval: ApprovalConfig.optional(),
   workflow: WorkflowConfig.optional(),
   localImplementation: LocalImplementationConfig.optional(),
   queue: QueueConfig.optional(),
   personas: PersonasConfig.optional(),
   internalPathPatterns: InternalPatternsConfig.optional(),
+  worktree: WorktreeConfig.optional(),
 });
 
 // ============================================================================
@@ -145,7 +203,14 @@ export const BUILT_IN_DEFAULTS = Object.freeze({
   models: Object.freeze({}),
   refinement: Object.freeze({ fanOut: 3, mode: "parallel", maxCopilotRounds: 5, stopOnLowSignal: false, lowSignalRoundThreshold: 3, lowSignalMaxComments: 2 }),
   gates: Object.freeze({}),
-  autonomy: Object.freeze({ stopAt: Object.freeze(["merge"]) }),
+  autonomy: Object.freeze({ stopAt: Object.freeze(["merge"]), humanMergeOnly: false }),
+  approval: Object.freeze({
+    humanHandoff: Object.freeze({
+      enabled: false,
+      candidatesFrom: Object.freeze([]),
+      assignees: Object.freeze([]),
+    }),
+  }),
   workflow: Object.freeze({
     asyncStartMode: "required",
     requireRetrospective: false,
@@ -173,6 +238,7 @@ export const BUILT_IN_DEFAULTS = Object.freeze({
     "^\\.github/",
     "^test/",
   ]),
+  worktree: Object.freeze({ copyOnInit: Object.freeze([]), linkOnInit: Object.freeze([]) }),
 });
 
 // ============================================================================
@@ -187,11 +253,13 @@ export const FileConfigSchema = z.strictObject({
   refinement: RefinementConfig.partial().optional(),
   gates: FileGatesConfig.optional(),
   autonomy: AutonomyConfig.partial().optional(),
+  approval: ApprovalConfig.partial().optional(),
   workflow: WorkflowConfig.partial().optional(),
   localImplementation: LocalImplementationConfig.partial().optional(),
   queue: QueueConfig.partial().optional(),
   personas: FilePersonasConfig.optional(),
   internalPathPatterns: InternalPatternsConfig.optional(),
+  worktree: WorktreeConfig.partial().optional(),
 });
 
 // ============================================================================
@@ -230,6 +298,8 @@ const BUILTIN_PERSONAS = Object.freeze({
   "state-concurrency": { persona: "review", defaultModel: null },
   "renderer-security": { persona: "review", defaultModel: null },
   determinism:          { persona: "review", defaultModel: null },
+  "acceptance-criteria": { persona: "review", defaultModel: null },
+  "ac-dod":              { persona: "review", defaultModel: null },
 });
 
 const DEFAULT_REVIEWER_PERSONA = "default-reviewer";
@@ -705,10 +775,66 @@ export function resolveConductorModel(config) {
  * @returns {string[]}
  */
 export function resolveAutonomyStopAt(config) {
-  if (config?.autonomy?.stopAt && Array.isArray(config.autonomy.stopAt)) {
-    return [...config.autonomy.stopAt];
+  const base = (config?.autonomy?.stopAt && Array.isArray(config.autonomy.stopAt))
+    ? [...config.autonomy.stopAt]
+    : ["merge"];
+  // Fail closed: humanMergeOnly forces a human stop at merge regardless of
+  // what stopAt is configured (even an explicit []).
+  if (resolveHumanMergeOnly(config) && !base.includes("merge")) {
+    base.push("merge");
   }
-  return ["merge"];
+  return base;
+}
+
+/**
+ * Resolve the fixed human-merge-only invariant from the merged dev-loop config.
+ *
+ * When true, the agent must never perform the merge itself: `gh pr merge` is a
+ * human-only action and any per-run merge authorization is ignored. Defaults to
+ * false (the agent may merge once authorized).
+ *
+ * @param {DevLoopConfig} config
+ * @returns {boolean}
+ */
+export function resolveHumanMergeOnly(config) {
+  return config?.autonomy?.humanMergeOnly === true;
+}
+
+/**
+ * Authoritative gate: resolve the effective merge authorization for the agent.
+ *
+ * This is the single chokepoint that decides whether the agent is cleared to
+ * run `gh pr merge`. When `humanMergeOnly` is set on the repo config, this
+ * ALWAYS returns false — the per-run `mergeAuthorized` flag (envelope flag or
+ * explicit "merge" instruction) cannot override the repo invariant. Fails
+ * closed: a non-boolean `mergeAuthorized` is treated as not authorized.
+ *
+ * @param {boolean} mergeAuthorized per-run authorization signal
+ * @param {DevLoopConfig} config merged dev-loop config
+ * @returns {boolean}
+ */
+export function resolveEffectiveMergeAuthorized(mergeAuthorized, config) {
+  if (resolveHumanMergeOnly(config)) return false;
+  return mergeAuthorized === true;
+}
+
+/**
+ * Authoritative gate for callers that load the config themselves and hold its
+ * `{ config, errors }` load result. FAILS CLOSED on any config load/validation
+ * error: `loadDevLoopConfig` never throws (it returns an `errors` array), so a
+ * caller must not assume "no exception" means "config is safe". If the config
+ * could not be loaded/validated, the `.devloops` file declaring `humanMergeOnly`
+ * may be the very one that failed — so merge authorization is denied rather than
+ * silently granted from a fallback config that lacks the invariant.
+ *
+ * @param {boolean} mergeAuthorized per-run authorization signal
+ * @param {{ config?: DevLoopConfig, errors?: Array<unknown> }} loadResult result of `loadDevLoopConfig`
+ * @returns {boolean}
+ */
+export function resolveEffectiveMergeAuthorizedFromLoad(mergeAuthorized, loadResult) {
+  const errors = loadResult?.errors ?? [];
+  if (errors.length > 0) return false;
+  return resolveEffectiveMergeAuthorized(mergeAuthorized, loadResult?.config);
 }
 
 const DEFAULT_REFINEMENT_CONFIG = BUILT_IN_DEFAULTS.refinement;
@@ -814,6 +940,66 @@ export function resolveGateConfig(config, gate) {
   };
 }
 
+/**
+ * Resolve whether fan-out/fan-in review evidence is required for a gate verdict.
+ *
+ * Default-on (opt-out): enforcement is ON unless `gates.requireFanoutEvidence`
+ * is explicitly set to false. When ON, the pre-merge evidence check fails
+ * closed unless a required gate's recorded executionMode is "fanout_fanin" and
+ * a durable findings-log ledger exists for that gate + head SHA. Using a
+ * `!== false` test (rather than `=== true`) keeps the opt-out semantics robust
+ * for programmatically-built config objects that bypass schema defaulting. See
+ * docs/gate-review-sub-loop-contract.md.
+ *
+ * @param {DevLoopConfig} config
+ * @returns {boolean}
+ */
+export function resolveRequireFanoutEvidence(config) {
+  return config?.gates?.requireFanoutEvidence !== false;
+}
+
+/** Default parallel fan-out reviewer cap (mirrors GatesConfig.maxFanoutReviewers). */
+export const DEFAULT_MAX_FANOUT_REVIEWERS = 8;
+
+/**
+ * Resolve the parallel fan-out reviewer cap for the gate sub-loop.
+ *
+ * Returns the configured `gates.maxFanoutReviewers` when it is an integer in
+ * the schema-bounded range 1..64; otherwise the built-in default (8). Clamping
+ * here (not just the Zod schema) keeps programmatically-constructed config
+ * objects that bypass schema validation within the same bound. The fan-out
+ * spawns at most this many scoped `review` reviewers in parallel; overflow runs
+ * sequentially.
+ *
+ * @param {DevLoopConfig} config
+ * @returns {number}
+ */
+export function resolveMaxFanoutReviewers(config) {
+  const raw = config?.gates?.maxFanoutReviewers;
+  if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 64) {
+    return raw;
+  }
+  return DEFAULT_MAX_FANOUT_REVIEWERS;
+}
+
+/**
+ * Resolve whether the consolidated gate fan-out findings should be posted as a
+ * visible, marker-tagged PR comment.
+ *
+ * Returns true (post the comment) unless `gates.postFindingsComments` is
+ * explicitly set to false. Using a `!== false` test (rather than `=== true`)
+ * keeps the opt-out semantics robust for programmatically-built config objects
+ * that bypass schema defaulting. The disposition ledger is written regardless;
+ * this flag only suppresses the auditable PR comment. See
+ * docs/gate-review-sub-loop-contract.md.
+ *
+ * @param {DevLoopConfig} config
+ * @returns {boolean}
+ */
+export function resolveGatePostFindingsComments(config) {
+  return config?.gates?.postFindingsComments !== false;
+}
+
 /**
  * Resolve local implementation light mode config.
  *
@@ -971,6 +1157,61 @@ const DEFAULT_INTERNAL_PATH_PATTERNS = BUILT_IN_DEFAULTS.internalPathPatterns;
  * @param {DevLoopConfig} config
  * @returns {string[]}
  */
+/**
+ * Resolve the worktree lifecycle config from the merged dev-loop config.
+ *
+ * Returns `{ copyOnInit, linkOnInit }` with empty-array defaults when the
+ * config omits the `worktree` section or either list. Entries are trimmed,
+ * repo-relative literal paths or glob patterns expanded against the main
+ * checkout at provision time. See scripts/loop/provision-worktree.mjs.
+ *
+ * @param {DevLoopConfig} config
+ * @returns {{ copyOnInit: string[], linkOnInit: string[] }}
+ */
+export function resolveWorktreeConfig(config) {
+  const wt = config?.worktree;
+  const list = (v) =>
+    Array.isArray(v)
+      ? v.map((s) => (typeof s === "string" ? s.trim() : "")).filter((s) => s.length > 0)
+      : [];
+  return { copyOnInit: list(wt?.copyOnInit), linkOnInit: list(wt?.linkOnInit) };
+}
+
+/**
+ * Resolve the human-handoff config from the merged dev-loop config (#920).
+ *
+ * Returns a normalized `{ enabled, candidatesFrom, assignees }`. Defaults to
+ * disabled with empty arrays when the `approval.humanHandoff` section is absent.
+ * When disabled (default), this is a no-op: callers must not source candidates
+ * or assign anyone. Pairs with `autonomy.humanMergeOnly`: when human-merge is
+ * enforced, this names who should take the merge.
+ *
+ * @param {DevLoopConfig} config
+ * @returns {{ enabled: boolean, candidatesFrom: ("codeowners"|"recent-committers")[], assignees: string[] }}
+ */
+export function resolveHumanHandoffConfig(config) {
+  const hh = config?.approval?.humanHandoff;
+  const enabled = hh?.enabled === true;
+  const list = (v) =>
+    Array.isArray(v)
+      ? v.map((s) => (typeof s === "string" ? s.trim() : "")).filter((s) => s.length > 0)
+      : [];
+  const candidatesFrom = list(hh?.candidatesFrom).filter(
+    (s) => s === "codeowners" || s === "recent-committers"
+  );
+  // Normalize assignees: strip a leading `@`, trim, and drop empties so an empty
+  // login (e.g. config value of `"@"` or `""`) can never leak downstream into
+  // `gh pr edit --add-assignee ""`.
+  const assignees = list(hh?.assignees)
+    .map((s) => s.replace(/^@/, "").trim())
+    .filter((s) => s.length > 0);
+  return {
+    enabled,
+    candidatesFrom: enabled ? candidatesFrom : [],
+    assignees: enabled ? assignees : [],
+  };
+}
+
 export function resolveInternalPathPatterns(config) {
   if (
     config?.internalPathPatterns &&

package/src/config/extension-defaults.yaml

@@ -382,6 +382,18 @@ personas:
       Do not block on formatting preferences other than checkbox correctness.
     defaultModel: null
 
+  acceptance-criteria:
+    persona: review
+    prompt: >-
+      Verify that each acceptance criterion and definition-of-done item from the
+      linked issue/PR is actually satisfied by the implementation — not merely
+      listed. For every criterion, cite the concrete code/test/behavior evidence
+      that meets it; flag any criterion that is unmet, only partially met, or
+      unverifiable from the diff as a blocking finding. Confirm definition-of-done
+      items (tests, docs, validation) are done and that declared non-goals are
+      respected (no scope creep).
+    defaultModel: null
+
   pr-checklist-matrix:
     persona: review
     prompt: >-

package/src/github/copilot-helpers.mjs

@@ -9,6 +9,7 @@
 const SUBMITTED_REVIEW_STATES = new Set(["APPROVED", "CHANGES_REQUESTED", "COMMENTED", "DISMISSED"]);
 const GATE_REVIEW_NAMES = new Set(["draft_gate", "pre_approval_gate"]);
 const GATE_REVIEW_VERDICTS = new Set(["clean", "findings_present", "blocked"]);
+const GATE_EXECUTION_MODES = new Set(["fanout_fanin", "inline_single_agent"]);
 
 export function isCopilotLogin(login) {
   return typeof login === "string" && /^copilot(?:[^a-z]|$)/i.test(login);
@@ -63,6 +64,11 @@ function normalizeGateReviewHeadSha(value) {
   return /^[0-9a-f]{7,64}$/i.test(normalized) ? normalized : null;
 }
 
+function normalizeGateExecutionMode(value) {
+  const normalized = stripOptionalCodeTicks(value).toLowerCase();
+  return GATE_EXECUTION_MODES.has(normalized) ? normalized : null;
+}
+
 function parseGateReviewCommentFields(body) {
   if (typeof body !== "string" || body.trim().length === 0) {
     return null;
@@ -74,6 +80,8 @@ function parseGateReviewCommentFields(body) {
     verdict: null,
     findingsSummary: null,
     nextAction: null,
+    executionMode: null,
+    inlineReason: null,
   };
 
   for (const rawLine of body.split(/\r?\n/u)) {
@@ -112,6 +120,24 @@ function parseGateReviewCommentFields(body) {
       fields.nextAction = match[1].trim();
       continue;
     }
+
+    match = line.match(/^(?:[-*]\s*)?execution\s+mode\s*:\s*(.+)$/iu);
+    if (match) {
+      const rest = match[1].trim();
+      // Split on the first em-dash / en-dash / " - " separator to recover an
+      // optional inline reason: "inline_single_agent — <reason>".
+      const sepMatch = rest.match(/^(.*?)\s*(?:[—–]|\s-\s)\s*(.*)$/u);
+      const modeToken = sepMatch ? sepMatch[1].trim() : rest;
+      const reasonToken = sepMatch ? sepMatch[2].trim() : "";
+      fields.executionMode = normalizeGateExecutionMode(modeToken);
+      // Only record an inline reason for inline_single_agent. A trailing
+      // "— text" on a fanout_fanin (or invalid) mode line must not surface an
+      // inconsistent mode/reason pair, so leave inlineReason null otherwise.
+      if (reasonToken.length > 0 && fields.executionMode === "inline_single_agent") {
+        fields.inlineReason = reasonToken;
+      }
+      continue;
+    }
   }
 
   // Lenient fallback: detect gate name and head SHA anywhere in body
@@ -178,6 +204,8 @@ export function parseGateReviewCommentMarkerBody(body) {
     verdict: fields.verdict,
     findingsSummary: fields.findingsSummary,
     nextAction: fields.nextAction,
+    executionMode: fields.executionMode,
+    inlineReason: fields.inlineReason,
     contractComplete: Boolean(fields.verdict && fields.findingsSummary && fields.nextAction),
   };
 }
@@ -205,6 +233,8 @@ export function summarizeGateReviewComments(comments) {
       verdict: parsed.verdict,
       findingsSummary: parsed.findingsSummary,
       nextAction: parsed.nextAction,
+      executionMode: parsed.executionMode ?? null,
+      inlineReason: parsed.inlineReason ?? null,
       commentId: Number.isInteger(comment?.id) ? comment.id : null,
       commentUrl: typeof comment?.html_url === "string" && comment.html_url.trim().length > 0 ? comment.html_url.trim() : null,
       updatedAt: typeof (comment?.updated_at ?? comment?.updatedAt) === "string"
@@ -253,6 +283,8 @@ export function summarizeGateReviewCommentMarkers(comments, { headSha } = {}) {
       verdict: parsed.verdict,
       findingsSummary: parsed.findingsSummary,
       nextAction: parsed.nextAction,
+      executionMode: parsed.executionMode ?? null,
+      inlineReason: parsed.inlineReason ?? null,
       contractComplete: parsed.contractComplete,
       commentId: Number.isInteger(comment?.id) ? comment.id : null,
       commentUrl: typeof comment?.html_url === "string" && comment.html_url.trim().length > 0 ? comment.html_url.trim() : null,
@@ -274,6 +306,39 @@ export function summarizeGateReviewCommentMarkers(comments, { headSha } = {}) {
   return summary;
 }
 
+/**
+ * Resolve the draft-gate round-reset timestamp (ms) used to suppress stale Copilot
+ * review rounds from the count (#896 consistency).
+ *
+ * When the draft gate was re-passed clean on a DIFFERENT head than the current one,
+ * only Copilot reviews submitted after that re-pass should count toward the round
+ * cap. Returning the re-pass `updatedAt` (ms) lets {@link summarizeCopilotReviews}
+ * drop earlier rounds. Returns null when no reset applies (no clean draft gate, or
+ * the clean draft gate is already on the current head).
+ *
+ * Both detect-pr-gate-coordination-state and request-copilot-review must derive the
+ * reset identically, or the two scripts disagree on the completed round count and
+ * the cap (the inconsistency reported in #896). This is the single shared source.
+ *
+ * @param {object} params
+ * @param {{ verdict?: string|null, headSha?: string|null, updatedAt?: string|null }|null} params.draftGate
+ * @param {string|null} params.currentHeadSha
+ * @returns {number|null} reset timestamp in ms, or null
+ */
+export function resolveDraftGateRoundResetMs({ draftGate, currentHeadSha } = {}) {
+  const draftGateHeadSha = typeof draftGate?.headSha === "string" ? draftGate.headSha : null;
+  const draftGateOnCurrentHead = typeof draftGateHeadSha === "string"
+    && typeof currentHeadSha === "string"
+    && currentHeadSha.startsWith(draftGateHeadSha);
+  if (draftGate?.verdict === "clean"
+    && typeof draftGateHeadSha === "string"
+    && !draftGateOnCurrentHead
+    && typeof draftGate?.updatedAt === "string") {
+    return normalizeTimestamp(draftGate.updatedAt);
+  }
+  return null;
+}
+
 export function summarizeCopilotReviews(reviews, { headSha, draftGateResetAtMs } = {}) {
   const allReviews = Array.isArray(reviews) ? reviews : [];
   const copilotReviews = allReviews.filter((review) => isCopilotLogin(review?.author?.login));

package/src/loop/async-start-contract.mjs

@@ -10,10 +10,9 @@
  * async context marker. When the marker is absent, the check fails closed
  * and returns a machine-readable rejection rather than silently proceeding.
  *
- * Async context markers (required when workflow.asyncStartMode is `required`),
- * neutral-first — see `@dev-loops/core/loop/run-context`:
+ * Async context marker (required when workflow.asyncStartMode is `required`)
+ * — see `@dev-loops/core/loop/run-context`:
  * - DEVLOOPS_RUN_ID env var (neutral, harness-agnostic)
- * - PI_SUBAGENT_RUN_ID env var (Pi subagent framework; retained as a compatibility alias)
  *
  * Allowed modes:
  * - workflow.asyncStartMode: required | allowed
@@ -30,11 +29,10 @@ import { RUN_ID_MARKERS, isClaudeHarness } from "./run-context.mjs";
 // ---------------------------------------------------------------------------
 
 /**
- * Environment variable names that indicate an async context, neutral-first.
+ * Environment variable names that indicate an async context.
  * Sourced from the shared run-context contract so the markers stay in one place.
- * The historical name is kept for back-compat; it now includes DEVLOOPS_RUN_ID.
  */
-export const PI_ASYNC_CONTEXT_MARKERS = RUN_ID_MARKERS;
+export const ASYNC_CONTEXT_MARKERS = RUN_ID_MARKERS;
 
 /** Supported workflow async-start modes. */
 export const ASYNC_START_MODE = Object.freeze({
@@ -130,8 +128,8 @@ export function validateAsyncStartContext({
     };
   }
 
-  // Check for any async context marker (neutral DEVLOOPS_RUN_ID or the Pi alias)
-  for (const marker of PI_ASYNC_CONTEXT_MARKERS) {
+  // Check for any async context marker (DEVLOOPS_RUN_ID)
+  for (const marker of ASYNC_CONTEXT_MARKERS) {
     const value = env[marker];
     if (typeof value === "string" && value.trim().length > 0) {
       return {
@@ -150,24 +148,7 @@ export function validateAsyncStartContext({
     };
   }
 
-  const sessionOnlyMarker =
-    (typeof env.PI_SESSION_ID === "string" && env.PI_SESSION_ID.trim().length > 0)
-      ? "PI_SESSION_ID"
-      : ((typeof env.PI_ASYNC_CONTEXT === "string" && env.PI_ASYNC_CONTEXT.trim().length > 0)
-          ? "PI_ASYNC_CONTEXT"
-          : null);
-  if (sessionOnlyMarker !== null) {
-    return {
-      status: ASYNC_START_STATUS.REJECTED,
-      reason:
-        `Detected ${sessionOnlyMarker}, but GitHub-first async-start requires a visible ` +
-        "subagent run id for inspectable startup/resume evidence. " +
-        "Set DEVLOOPS_RUN_ID (or the PI_SUBAGENT_RUN_ID alias) to proceed. Any exception must come from repository-maintained workflow policy.",
-      detectedMarker: null,
-    };
-  }
-
-  if (env.PI_DEV_LOOP_DETACHED === "1") {
+  if (env.DEVLOOPS_DETACHED === "1") {
     return {
       status: ASYNC_START_STATUS.REJECTED,
       reason:
@@ -185,7 +166,7 @@ export function validateAsyncStartContext({
       "No async context detected. " +
       "The dev-loop must run within a visible async subagent session, " +
       "not as a detached local process. " +
-      `Set ${PI_ASYNC_CONTEXT_MARKERS[0]} (or the PI_SUBAGENT_RUN_ID alias) to proceed. ` +
+      `Set ${ASYNC_CONTEXT_MARKERS[0]} to proceed. ` +
       "Repository-maintained workflow policy controls any exceptions.",
     detectedMarker: null,
   };