@dotdrelle/wiki-manager 0.15.54 → 0.15.57

package/src/orchestrator/agentRegistry.js

@@ -62,6 +62,11 @@ export function createAgentRegistry({
 } = {}) {
   const agentsByInstance = new Map();
   const instanceByServer = new Map();
+  // Whether the LAST probe of an instance failed. The "did not answer
+  // agent_describe" log is edge-triggered: it is emitted once when an instance
+  // stops answering, not on every re-scan while it stays down. A stopped agent
+  // is not an error to repeat every minute.
+  const lastProbeFailed = new Map();
 
   return {
     async discover(session, { signal = null } = {}) {
@@ -70,13 +75,18 @@ export function createAgentRegistry({
       const activeServers = new Set(endpoints.map(([serverName]) => serverName));
       for (const [serverName, endpoint] of endpoints) {
         const agent = await discoverServerAgent(session, serverName, endpoint, { callTool, signal, now });
-        discovered.push(registerAgent(session, agent, { agentsByInstance, instanceByServer }));
+        discovered.push(registerAgent(session, agent, { agentsByInstance, instanceByServer, lastProbeFailed }));
       }
       for (const [serverName, instanceId] of instanceByServer) {
         if (activeServers.has(serverName)) continue;
         const previous = agentsByInstance.get(instanceId);
         instanceByServer.delete(serverName);
         agentsByInstance.delete(instanceId);
+        // Same cleanup as the two maps above: without it, a long-running
+        // process that sees many renamed/reconnected connectors (the
+        // Connectors panel supports exactly this) accumulates one stale
+        // entry per retired instance for the process lifetime.
+        lastProbeFailed.delete(instanceId);
         if (previous) dispatchRegistryEvent(session, 'agent.unregistered', {
           agentInstanceId: instanceId,
           serverName,
@@ -140,7 +150,7 @@ async function discoverServerAgent(session, serverName, endpoint = {}, { callToo
   }
 }
 
-function registerAgent(session, agent, { agentsByInstance, instanceByServer }) {
+function registerAgent(session, agent, { agentsByInstance, instanceByServer, lastProbeFailed }) {
   const previousInstanceId = instanceByServer.get(agent.serverName);
   const previous = previousInstanceId ? agentsByInstance.get(previousInstanceId) : null;
 
@@ -166,13 +176,21 @@ function registerAgent(session, agent, { agentsByInstance, instanceByServer }) {
      the blindness — a probe that failed is a fact worth stating, once, where
      the panels and the shell already read.
 
+     "Once" is the operative word: the re-scan runs every minute, and a stopped
+     agent is not an error to repeat each time it is scanned. The log is
+     edge-triggered on the transition from answering to not answering.
+
      Deliberately NOT a health change: the endpoint is down but the agent stays
      usable by design here, and moving `health` would make `capabilityResolver`
      refuse it — trading a silent loss for a silent refusal.
-    */
-    dispatchRuntimeLog(session, `agent-registry: ${agent.serverName} did not answer agent_describe`
-      + `${agent.error ? ` (${agent.error})` : ''}; keeping its known capabilities`
-      + ` (${(previous.description?.capabilities ?? []).map((capability) => capability.id).join(', ') || 'none'}).`);
+     */
+    const wasAnswering = lastProbeFailed.get(previous.agentInstanceId) !== true;
+    lastProbeFailed.set(previous.agentInstanceId, true);
+    if (wasAnswering) {
+      dispatchRuntimeLog(session, `agent-registry: ${agent.serverName} did not answer agent_describe`
+        + `${agent.error ? ` (${agent.error})` : ''}; keeping its known capabilities`
+        + ` (${(previous.description?.capabilities ?? []).map((capability) => capability.id).join(', ') || 'none'}).`);
+    }
     return cloneAgent(previous);
   }
 
@@ -187,6 +205,7 @@ function registerAgent(session, agent, { agentsByInstance, instanceByServer }) {
   }
   agentsByInstance.set(next.agentInstanceId, next);
   instanceByServer.set(next.serverName, next.agentInstanceId);
+  if (lastProbeFailed) lastProbeFailed.set(next.agentInstanceId, false);
 
   if (!previous || previous.agentInstanceId !== next.agentInstanceId) {
     dispatchRegistryEvent(session, 'agent.registered', { agent: next });

package/src/orchestrator/agentRegistry.test.js

@@ -209,6 +209,47 @@ test('a failed re-discovery keeps a degraded orchestrator agent too', async () =
   assert.equal(agent.description.capabilities.length, 1);
 });
 
+test('a stopped agent is reported once, not on every re-scan', async () => {
+  // The re-scan runs every minute; a deliberately stopped agent must not flood
+  // the log with the same "did not answer" line. The message is edge-triggered:
+  // emitted on the transition from answering to not answering, then silent
+  // until it answers again.
+  const events = [];
+  const session = {
+    workspace: 'acpi',
+    mcp: { production: { status: 'connected', tools: [{ name: 'agent_describe' }] } },
+    _onAgentEvent: (event) => events.push(event),
+  };
+  let down = false;
+  const registry = createAgentRegistry({
+    callTool: async () => {
+      if (down) throw new Error('fetch failed');
+      return { content: [{ type: 'text', text: JSON.stringify(description()) }] };
+    },
+  });
+
+  await registry.discover(session);
+  down = true;
+  await registry.discover(session);
+  await registry.discover(session);
+  await registry.discover(session);
+
+  const reports = events.filter((event) => event.type === 'runtime_log'
+    && String(event.payload?.message ?? '').includes('agent-registry:'));
+  assert.equal(reports.length, 1, 'the down agent is reported once, not once per scan');
+
+  // It answers again, then drops again: the next failure is reported again.
+  down = false;
+  await registry.discover(session);
+  down = true;
+  await registry.discover(session);
+  assert.equal(
+    events.filter((event) => event.type === 'runtime_log'
+      && String(event.payload?.message ?? '').includes('agent-registry:')).length,
+    2,
+  );
+});
+
 test('discovery sends the workspace only to agents whose schema declares it', async () => {
   const seen = {};
   const registry = createAgentRegistry({

package/src/orchestrator/objectiveResolver.js

@@ -16,7 +16,10 @@ export class ObjectiveNotOrchestrableError extends Error {
 export async function resolveObjective(objective, session) {
   const candidates = capabilityCandidates(session);
   if (candidates.length === 0) throw new Error('No orchestrable capability is currently available.');
-  const deterministic = resolveMentionedRegistryOperation(objective, candidates);
+  // Resolution sees the primary intention only (notification + guardrails
+  // stripped). The delegated agent still receives the full objective.
+  const clean = objectiveForResolution(objective);
+  const deterministic = resolveMentionedRegistryOperation(clean, candidates);
   if (deterministic) return selectionWithProvider(session, deterministic, candidates);
   const llm = session?.llm;
   if (!llm?.completeWithTools) throw new Error('Objective resolution requires the configured workspace LLM.');
@@ -25,6 +28,7 @@ export async function resolveObjective(objective, session) {
     system: [
       'You resolve one user objective against a closed capability registry.',
       'Select exactly one listed capability and one of its supported operations.',
+      'The aliases of a capability are the strongest signal: match them before the generic description.',
       // Without an explicit way out, the model has to pick SOMETHING: an
       // objective no listed capability covers ("authorize Gmail") came back as
       // workspace.diagnose/doctor and launched an unrelated job. Declining is
@@ -36,7 +40,7 @@ export async function resolveObjective(objective, session) {
     tools: [],
     messages: [{
       role: 'user',
-      content: `Objective:\n${String(objective)}\n\nRegistry:\n${JSON.stringify(candidates, null, 2)}`,
+      content: `Objective:\n${clean}\n\nRegistry:\n${JSON.stringify(candidates, null, 2)}`,
     }],
     signal: session?._abortSignal,
   });
@@ -54,21 +58,72 @@ export async function resolveObjective(objective, session) {
   return selectionWithProvider(session, { capability, operation }, candidates);
 }
 
-// Prefer an operation explicitly named by the user when that name resolves to
-// exactly one entry in the live registry. This is deliberately generic: the
-// resolver knows neither capability ids nor business verbs. Prefix matching
-// covers natural inflections such as an operation name followed by a suffix.
-function resolveMentionedRegistryOperation(objective, candidates) {
-  const words = String(objective ?? '')
+// The best-effort notification sentence and the negative guardrails
+// ("Do not …", "Never …") are execution constraints, not the thing being
+// resolved. They are kept intact for the delegated agent (prepareDelegation
+// passes the original objective), but stripped here so they cannot poison the
+// lexical matcher or the LLM prompt.
+const NOTIFICATION_RE = /\s*[^.!?]*\bnotification\b[^.!?]*[.!?]/g;
+const GUARDRAIL_RE = /\s*\b(?:Do not|do not|Never|never)\b[^.]*\./g;
+
+export function objectiveForResolution(objective) {
+  return String(objective ?? '')
+    .replace(NOTIFICATION_RE, ' ')
+    .replace(GUARDRAIL_RE, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function normalizeText(text) {
+  return String(text ?? '')
     .normalize('NFKD')
     .replace(/\p{Diacritic}/gu, '')
-    .toLowerCase()
-    .match(/[a-z0-9]+/g) ?? [];
-  const matches = candidates.flatMap((candidate) => candidate.operations
-    .filter((operation) => String(operation).split(/[._-]+/).some((token) =>
-      token.length >= 4 && words.some((word) => word.startsWith(token))))
-    .map((operation) => ({ capability: candidate.id, operation })));
-  return matches.length === 1 ? matches[0] : null;
+    .toLowerCase();
+}
+
+function normalizePhrase(value) {
+  return normalizeText(value).replace(/[._-]+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+
+function phraseIn(phrase, words, text) {
+  if (!phrase) return false;
+  if (!phrase.includes(' ')) return words.includes(phrase);
+  const escaped = phrase.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(?:^|\\s)${escaped}(?:\\s|$)`).test(text);
+}
+
+// Deterministic fast path, safe by construction:
+// - whole-word/phrase matching only — no sub-token split (so `ingest_plan`
+//   never matches the generic word "plan") and no prefix stemming (so
+//   "exported"/"builds" never match "export"/"build");
+// - aliases (declared by each agent in agent_describe) are authoritative and
+//   disambiguate overloaded verbs ("export" CME vs publish);
+// - it fires only when exactly one capability is named, otherwise the LLM
+//   resolver decides. A new external agent registers simply by declaring its
+//   aliases; nothing here is hardcoded.
+function resolveMentionedRegistryOperation(objective, candidates) {
+  const words = normalizeText(objective).match(/[a-z0-9]+/g) ?? [];
+  const text = normalizeText(objective);
+
+  const aliasHits = candidates
+    .filter((candidate) => (candidate.aliases ?? []).some((alias) =>
+      phraseIn(normalizePhrase(alias), words, text)))
+    .map((candidate) => ({ capability: candidate.id, operation: candidate.operations[0] }));
+  if (aliasHits.length === 1) return aliasHits[0];
+  if (aliasHits.length > 1) return null;
+
+  const opHits = [];
+  for (const candidate of candidates) {
+    const matched = candidate.operations.filter((operation) =>
+      phraseIn(normalizePhrase(operation), words, text));
+    if (matched.length === 1) opHits.push({ capability: candidate.id, operation: matched[0] });
+    else if (matched.length > 1) opHits.push({ capability: candidate.id, operation: matched[0], ambiguous: true });
+  }
+  if (opHits.length === 1 && !opHits[0].ambiguous) {
+    const { capability, operation } = opHits[0];
+    return { capability, operation };
+  }
+  return null;
 }
 
 function selectionWithProvider(session, selection, candidates) {
@@ -86,8 +141,9 @@ export function capabilityCandidates(session) {
   for (const [versionedId, providers] of Object.entries(snapshot)) {
     const id = versionedId.includes('@') ? versionedId.slice(0, versionedId.lastIndexOf('@')) : versionedId;
     const operations = [...new Set((providers ?? []).flatMap((provider) => provider?.capability?.supportedOperations ?? []))].sort();
+    const aliases = [...new Set((providers ?? []).flatMap((provider) => provider?.capability?.aliases ?? []))].sort();
     const description = (providers ?? []).map((provider) => provider?.capability?.description).find(Boolean) ?? '';
-    byId.set(id, { id, description, operations });
+    byId.set(id, { id, description, operations, aliases });
   }
   return [...byId.values()].filter((item) => item.operations.length > 0).sort((a, b) => a.id.localeCompare(b.id));
 }

package/src/orchestrator/objectiveResolver.test.js

@@ -1,73 +1,171 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { capabilityCandidates, resolveObjective } from './objectiveResolver.js';
+import {
+  capabilityCandidates,
+  objectiveForResolution,
+  resolveObjective,
+  ObjectiveNotOrchestrableError,
+} from './objectiveResolver.js';
 
-function sessionWithSelection(selection) {
-  const provider = {
-    agentInstanceId: 'production-1',
-    serverName: 'production',
-    capability: {
-      id: 'knowledge.update',
-      version: '1',
-      description: 'Update knowledge from pending sources.',
-      supportedOperations: ['ingest'],
-    },
-  };
+function makeCapability(id, { operations = [], aliases = [], description = '' } = {}) {
+  return { id, version: '1', description, supportedOperations: operations, aliases };
+}
+
+function provider(agentInstanceId, capability) {
+  return { agentInstanceId, serverName: agentInstanceId.split('-')[0], capability };
+}
+
+function sessionWith(providers, llmSelection = {}) {
+  const snapshot = {};
+  for (const entry of providers) {
+    const key = `${entry.capability.id}@${entry.capability.version ?? '1'}`;
+    (snapshot[key] ??= []).push(entry);
+  }
   return {
     capabilityRegistry: {
-      snapshot: () => ({ 'knowledge.update@1': [provider] }),
-      providersFor: () => [provider],
-    },
-    llm: {
-      completeWithTools: async () => ({ content: JSON.stringify(selection) }),
+      snapshot: () => snapshot,
+      providersFor: (capability) => Object.entries(snapshot)
+        .filter(([key]) => key === capability || key.startsWith(`${capability}@`))
+        .flatMap(([, ps]) => ps),
     },
+    llm: { completeWithTools: async () => ({ content: JSON.stringify(llmSelection) }) },
   };
 }
 
-test('capabilityCandidates exposes only the closed live registry', () => {
-  assert.deepEqual(capabilityCandidates(sessionWithSelection({})), [{
+const knowledge = makeCapability('knowledge.update', {
+  operations: ['ingest', 'ingest_plan', 'ingest_apply'],
+  aliases: ['ingest', 'ingestion'],
+  description: 'Update knowledge from pending sources.',
+});
+const cme = makeCapability('external-source.export', {
+  operations: ['export'],
+  aliases: ['confluence', 'confluence export', 'source export'],
+  description: 'Export configured Confluence sources.',
+});
+const publish = makeCapability('document.publish', {
+  operations: ['export', 'polish'],
+  aliases: ['publish', 'export deliverable'],
+  description: 'Export or polish existing deliverables.',
+});
+const diagnose = makeCapability('workspace.diagnose', {
+  operations: ['doctor'],
+  aliases: ['diagnose', 'diagnostic', 'doctor'],
+  description: 'Diagnose workspace configuration.',
+});
+const sendEmail = makeCapability('communication.send-email', {
+  operations: ['send'],
+  description: 'Send an email.',
+});
+
+test('capabilityCandidates exposes aliases from the closed live registry', () => {
+  assert.deepEqual(capabilityCandidates(sessionWith([provider('production-1', knowledge)])), [{
     id: 'knowledge.update',
     description: 'Update knowledge from pending sources.',
-    operations: ['ingest'],
+    operations: ['ingest', 'ingest_apply', 'ingest_plan'],
+    aliases: ['ingest', 'ingestion'],
   }]);
 });
 
 test('resolveObjective selects and validates one real provider', async () => {
-  const result = await resolveObjective('Ingère tous les fichiers en attente', sessionWithSelection({
-    capability: 'knowledge.update',
-    operation: 'ingest',
-  }));
+  const result = await resolveObjective('Ingère tous les fichiers en attente', sessionWith(
+    [provider('production-1', knowledge)],
+    { capability: 'knowledge.update', operation: 'ingest' },
+  ));
   assert.equal(result.capability, 'knowledge.update');
   assert.equal(result.operation, 'ingest');
   assert.equal(result.provider.agentInstanceId, 'production-1');
 });
 
-test('resolveObjective uses an unambiguously mentioned registry operation without asking the LLM', async () => {
-  const session = sessionWithSelection({ capability: 'external-source.export', operation: 'export' });
-  session.capabilityRegistry.snapshot = () => ({
-    'knowledge.update@1': [sessionWithSelection({}).capabilityRegistry.snapshot()['knowledge.update@1'][0]],
-    'external-source.export@1': [{
-      agentInstanceId: 'cme-1',
-      serverName: 'cme',
-      capability: { id: 'external-source.export', version: '1', supportedOperations: ['export'] },
-    }],
-  });
-  session.capabilityRegistry.providersFor = (capability) =>
-    session.capabilityRegistry.snapshot()[`${capability}@1`] ?? [];
+test('resolveObjective disambiguates "export" of a Confluence source via alias, without the LLM', async () => {
+  const session = sessionWith([
+    provider('production-1', knowledge),
+    provider('production-2', publish),
+    provider('cme-1', cme),
+  ]);
   session.llm.completeWithTools = async () => {
-    throw new Error('the explicit operation must not depend on LLM selection');
+    throw new Error('the explicit alias must not depend on LLM selection');
   };
+  const result = await resolveObjective('Export the requested Confluence source', session);
+  assert.equal(result.capability, 'external-source.export');
+  assert.equal(result.operation, 'export');
+  assert.equal(result.provider.agentInstanceId, 'cme-1');
+});
 
-  const result = await resolveObjective("lance l'ingestion", session);
+test('resolveObjective resolves the ingest step of wiki-sync deterministically despite notification and guardrails', async () => {
+  const session = sessionWith([
+    provider('production-1', knowledge),
+    provider('production-2', publish),
+    provider('cme-1', cme),
+    provider('connectors-1', sendEmail),
+  ]);
+  session.llm.completeWithTools = async () => {
+    throw new Error('the aliased intention must not depend on LLM selection');
+  };
+  const objective = 'Ingest the newly exported Markdown into the wiki. Do not build or publish deliverables. If a messaging connector and a notification recipient are available, send a short best-effort summary; otherwise skip notification silently.';
+  const result = await resolveObjective(objective, session);
   assert.equal(result.capability, 'knowledge.update');
   assert.equal(result.operation, 'ingest');
-  assert.equal(result.provider.agentInstanceId, 'production-1');
+});
+
+test('resolveObjective resolves diagnose via alias despite the notification "send"', async () => {
+  const session = sessionWith([
+    provider('production-1', diagnose),
+    provider('connectors-1', sendEmail),
+  ]);
+  session.llm.completeWithTools = async () => {
+    throw new Error('the alias must resolve without the LLM');
+  };
+  const objective = 'Run a complete read-only diagnostic. If a messaging connector is available, send a short summary; otherwise skip notification silently.';
+  const result = await resolveObjective(objective, session);
+  assert.equal(result.capability, 'workspace.diagnose');
+  assert.equal(result.operation, 'doctor');
+});
+
+test('objectiveForResolution strips notification and negative guardrails', () => {
+  const clean = objectiveForResolution(
+    'Ingest files. Do not build or publish deliverables. If a messaging connector is available, send a summary; otherwise skip notification silently.',
+  );
+  assert.ok(!/\bsend\b/.test(clean), 'notification "send" must be stripped');
+  assert.ok(!/\bbuild\b/.test(clean), 'guardrail "build" must be stripped');
+  assert.ok(!/\bnotification\b/.test(clean), 'the word "notification" must be stripped');
+  assert.match(clean, /Ingest files/);
+});
+
+test('resolveObjective never binds the generic word "plan" to ingest_plan', async () => {
+  const session = sessionWith(
+    [provider('production-1', knowledge)],
+    { capability: null, reason: 'no capability' },
+  );
+  await assert.rejects(
+    resolveObjective('Preserve the delivery capability internal execution plan', session),
+    (err) => {
+      assert.equal(err.name, 'ObjectiveNotOrchestrableError');
+      return true;
+    },
+  );
+});
+
+test('resolveObjective never binds the past participle "exported" to an export operation', async () => {
+  const session = sessionWith([
+    provider('production-1', publish),
+    provider('cme-1', cme),
+  ]);
+  session.llm.completeWithTools = async () => ({ content: JSON.stringify({ capability: null, reason: 'no capability' }) });
+  // "newly exported Markdown" describes state, not the action to run.
+  await assert.rejects(
+    resolveObjective('Review the newly exported Markdown', session),
+    (err) => {
+      assert.equal(err.name, 'ObjectiveNotOrchestrableError');
+      return true;
+    },
+  );
 });
 
 test('resolveObjective declines an objective no listed capability covers', async () => {
-  // Forcing a pick is how "cree l'auth pour le gmail" became a doctor run on
-  // the production agent. Declining must be reported as such, not as a defect.
-  const session = sessionWithSelection({ capability: null, reason: 'Gmail authorization is not an orchestrable capability.' });
+  const session = sessionWith(
+    [provider('production-1', knowledge)],
+    { capability: null, reason: 'Gmail authorization is not an orchestrable capability.' },
+  );
   await assert.rejects(
     resolveObjective("cree l'auth pour le gmail", session),
     (err) => {
@@ -82,7 +180,7 @@ test('resolveObjective declines an objective no listed capability covers', async
 
 test('resolveObjective treats a malformed selection as a resolution defect, not a decline', async () => {
   await assert.rejects(
-    resolveObjective('Traite tout', sessionWithSelection({ reason: 'missing capability' })),
+    resolveObjective('Traite tout', sessionWith([provider('production-1', knowledge)], { reason: 'missing capability' })),
     (err) => {
       assert.notEqual(err.name, 'ObjectiveNotOrchestrableError');
       assert.match(err.message, /unknown capability/);
@@ -93,7 +191,7 @@ test('resolveObjective treats a malformed selection as a resolution defect, not
 
 test('resolveObjective rejects invented capability and operation', async () => {
   await assert.rejects(
-    resolveObjective('Traite tout', sessionWithSelection({ capability: 'ingest', operation: 'ingest_all_pending' })),
+    resolveObjective('Traite tout', sessionWith([provider('production-1', knowledge)], { capability: 'ingest', operation: 'ingest_all_pending' })),
     /unknown capability "ingest"/,
   );
 });

package/src/orchestrator/scheduler.test.js

@@ -245,6 +245,82 @@ function task(id, overrides = {}) {
   };
 }
 
+/*
+  Cas observé le 2026-08-22 (workspace acpi) : `/wiki-ingest` planifie 13
+  ingest_plan (groupe `ingest`) + 13 ingest_apply (groupe `apply`, sérialisés
+  sur le lock `workspace-write`, derrière la barrière `ingest`) + 1 taxonomy
+  (barrière `apply`). Le grant run-scope émis par le bouton Approve est « nu » :
+  `approvalClasses: []`, `planRevision: null`. Après la fin des 13 ingest_plan,
+  le scheduler a déclaré `no_ready_plan_task` au lieu de démarrer les apply.
+
+  Ce test verrouille la couverture du grant nu : les apply `waiting_approval`
+  DOIVENT redevenir ready quand le grant run-scope (même sans classes ni
+  révision) les couvre.
+*/
+test('un grant run-scope « nu » (sans classes ni révision) débloque les apply derrière une barrière', () => {
+  const plan = {
+    runId: 'run-1',
+    workspace: 'acpi',
+    planRevision: 1,
+    tasks: [
+      // 13 ingest_plan du groupe ingest, tous done.
+      ...Array.from({ length: 13 }, (_, i) => task(`ingest-plan-${i}`, {
+        groupId: 'ingest',
+        status: 'done',
+        requiredCapability: 'knowledge.update',
+        operation: 'ingest_plan',
+      })),
+      // 13 apply : groupe apply, barrière ingest, lock workspace-write.
+      ...Array.from({ length: 13 }, (_, i) => task(`ingest-apply-${i}`, {
+        groupId: 'apply',
+        dependsOnGroup: 'ingest',
+        barrier: true,
+        dependsOn: [`ingest-plan-${i}`],
+        status: 'waiting_approval',
+        requiredCapability: 'knowledge.update',
+        operation: 'ingest_apply',
+        locks: ['workspace-write'],
+        parallelizable: false,
+        requiresApproval: true,
+        approvalClass: 'mutation',
+        priority: i + 1,
+      })),
+      task('taxonomy', {
+        dependsOnGroup: 'apply',
+        barrier: true,
+        status: 'waiting_approval',
+        requiredCapability: 'knowledge.update',
+        operation: 'taxonomy',
+        requiresApproval: true,
+        approvalClass: 'mutation',
+      }),
+    ],
+  };
+
+  // Sans grant : rien n'est ready.
+  assert.deepEqual(readyTasks(plan).map((item) => item.id), []);
+
+  // Grant run-scope « nu » — exactement ce que le bouton Approve émet.
+  // La couverture ne bloque pas : les 13 apply sont tous prêts.
+  const ready = readyTasks(plan, {
+    approvals: [{
+      status: 'approved',
+      scope: 'run',
+      runId: 'run-1',
+      workspaceId: 'acpi',
+      planRevision: null,
+      approvalClasses: [],
+    }],
+  });
+
+  assert.deepEqual(ready.map((item) => item.id), [
+    'ingest-apply-0', 'ingest-apply-1', 'ingest-apply-2', 'ingest-apply-3',
+    'ingest-apply-4', 'ingest-apply-5', 'ingest-apply-6', 'ingest-apply-7',
+    'ingest-apply-8', 'ingest-apply-9', 'ingest-apply-10', 'ingest-apply-11',
+    'ingest-apply-12',
+  ]);
+});
+
 /*
  Cas observé le 2026-08-04 (workspace juno) : une ingestion de dix fichiers,
  neuf réussis, le dixième en échec sur du JSON malformé. La barrière de groupe