@event4u/agent-config 9.15.0 → 9.16.0

package/src/scripts/release.ts

@@ -634,13 +634,16 @@ export function _failed_checks_report(names: readonly string[]): string {
  * A short grace period gives GitHub time to register workflow runs on a
  * freshly-pushed branch.
  */
-function watch_pr_checks(): void {
+function watch_pr_checks(branch: string): void {
     // time.sleep(5) — blocking grace period. Never reached on any test path.
     const until = Date.now() + 5000;
     while (Date.now() < until) {
         // busy-wait stand-in for time.sleep(5) without an event-loop yield.
     }
-    const proc = spawnSync('gh', ['pr', 'checks', '--watch'], {
+    // The branch is passed explicitly — `gh` inferring the PR from HEAD
+    // resolved to `main` mid-run once (2026-08-03, 9.16.0 resume) and the
+    // whole release died on "no pull requests found for branch main".
+    const proc = spawnSync('gh', ['pr', 'checks', branch, '--watch'], {
         cwd: REPO_ROOT,
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'pipe'],
@@ -667,7 +670,7 @@ function watch_pr_checks(): void {
     if (output) {
         process.stderr.write(output + '\n');
     }
-    const summary = spawnSync('gh', ['pr', 'checks', '--json', 'name,bucket'], {
+    const summary = spawnSync('gh', ['pr', 'checks', branch, '--json', 'name,bucket'], {
         cwd: REPO_ROOT,
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'pipe'],
@@ -679,6 +682,105 @@ function watch_pr_checks(): void {
     die(`PR checks failed (exit ${returncode})`);
 }
 
+/**
+ * Push the release branch, integrating a remote that moved under us.
+ *
+ * A GitHub-side "Update branch" click (or a concurrent resume run) advances
+ * `origin/<branch>` while the local ref stays behind; a bare `git push` is
+ * then rejected with "fetch first" and the whole release run dies (measured
+ * 2026-08-03, 9.15.0). Same-branch commits are never ours to drop, so the
+ * recovery is merge-and-retry, never force-push.
+ */
+function push_release_branch(branch: string): void {
+    const first = run(['git', 'push', '-u', REMOTE, branch], { check: false });
+    if (first.returncode === 0) {
+        return;
+    }
+    process.stdout.write(`↻  ${REMOTE}/${branch} moved — integrating and retrying push\n`);
+    run(['git', 'fetch', REMOTE, branch]);
+    run(['git', 'merge', '--no-edit', `${REMOTE}/${branch}`]);
+    run(['git', 'push', '-u', REMOTE, branch]);
+}
+
+/** mergeStateStatus of the branch's PR ('' when the probe fails). */
+function _pr_merge_state(branch: string): string {
+    const r = run(
+        ['gh', 'pr', 'view', branch, '--json', 'mergeStateStatus', '--jq', '.mergeStateStatus'],
+        {
+            check: false,
+            capture: true,
+        },
+    );
+    return r.returncode === 0 ? r.stdout.trim() : '';
+}
+
+/**
+ * Bound on update-and-retry rounds in merge_release_pr. Three is deliberate:
+ * main receiving unrelated merges three times inside one checks-wait window
+ * means the queue is hot and a human should decide, not a loop.
+ */
+const _MERGE_UPDATE_ROUNDS = 3;
+
+/**
+ * Merge the release PR, absorbing a moving base branch.
+ *
+ * Branch protection requires the head to be up to date with `main`, and
+ * `main` moves constantly (dependabot, unrelated merges) — so between the
+ * checks-wait and the merge the PR routinely flips to BEHIND and a bare
+ * `gh pr merge` dies with "the head branch is not up to date with the base
+ * branch" (measured 2026-08-03, 9.16.0). Recovery is mechanical and safe by
+ * construction: merging `origin/main` into `release/X.Y.Z` makes the fix
+ * files identical on both sides, so the release-PR diff stays inside the
+ * version-bump allowlist (docs/contracts/release-pr-gating.md § Mid-release
+ * fixes) — do it here instead of aborting the run.
+ */
+function merge_release_pr(branch: string, wait_for_checks: boolean): void {
+    if (git(['rev-parse', '--abbrev-ref', 'HEAD'], { capture: true }) !== branch) {
+        run(['git', 'checkout', branch]);
+    }
+    for (let round = 0; round <= _MERGE_UPDATE_ROUNDS; round++) {
+        if (_pr_merge_state(branch) !== 'BEHIND') {
+            const merged = run(['gh', 'pr', 'merge', branch, '--merge', '--delete-branch'], {
+                check: false,
+            });
+            if (merged.returncode === 0) {
+                return;
+            }
+            if (_pr_merge_state(branch) !== 'BEHIND') {
+                // Not the moving-base failure — surface it unchanged.
+                throw new CalledProcessError(merged.returncode, [
+                    'gh',
+                    'pr',
+                    'merge',
+                    branch,
+                    '--merge',
+                    '--delete-branch',
+                ]);
+            }
+            // BEHIND appeared between the probe and the merge — fall through
+            // to the update below.
+        }
+        if (round === _MERGE_UPDATE_ROUNDS) {
+            break;
+        }
+        process.stdout.write(
+            `↻  head behind ${MAIN_BRANCH} (update round ${round + 1}/${_MERGE_UPDATE_ROUNDS}) — ` +
+                `merging ${REMOTE}/${MAIN_BRANCH} into ${branch} and re-running checks\n`,
+        );
+        run(['git', 'fetch', REMOTE, MAIN_BRANCH]);
+        run(['git', 'merge', '--no-edit', `${REMOTE}/${MAIN_BRANCH}`]);
+        push_release_branch(branch);
+        if (wait_for_checks) {
+            watch_pr_checks(branch);
+        }
+    }
+    die(
+        `release PR is still behind ${MAIN_BRANCH} after ${_MERGE_UPDATE_ROUNDS} update round(s) — ` +
+            `${MAIN_BRANCH} is moving faster than the checks complete. ` +
+            'Re-run when the queue quiets down: task release -- --resume --yes',
+    );
+}
+
 function have(bin: string): boolean {
     const res = spawnSync('which', [bin], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
     if (res.error) {
@@ -1596,9 +1698,10 @@ function execute(
         _step(4, total, 'PR already merged — skip push');
     } else {
         // `git push -u` is naturally idempotent — it prints "Everything
-        // up-to-date" when remote already matches. No probe needed.
+        // up-to-date" when remote already matches. push_release_branch
+        // additionally absorbs a remote that moved under us.
         _step(4, total, `Push ${branch} to ${REMOTE}`);
-        run(['git', 'push', '-u', REMOTE, branch]);
+        push_release_branch(branch);
     }
 
     // ─── 5. PR ──────────────────────────────────────────────────────────────
@@ -1637,7 +1740,7 @@ function execute(
         _step(6, total, 'PR already merged — skip checks wait');
     } else if (wait_for_checks) {
         _step(6, total, 'Wait for PR checks');
-        watch_pr_checks();
+        watch_pr_checks(branch);
     } else {
         _step(6, total, 'Skip waiting for checks (--no-wait)');
     }
@@ -1647,7 +1750,7 @@ function execute(
         _step(7, total, `PR #${pr_info!['number']} already merged — skip`);
     } else {
         _step(7, total, 'Merge pull request (merge commit) and delete branch');
-        run(['gh', 'pr', 'merge', '--merge', '--delete-branch']);
+        merge_release_pr(branch, wait_for_checks);
     }
 
     // ─── 8. tag main + push tag ─────────────────────────────────────────────

package/src/scripts/routing_doctor.ts

@@ -119,6 +119,67 @@ export interface OrchestrationReport {
     mode: string | null;
     reason: string;
   } | null;
+  /** Budget-routing delivery evidence (external review 2026-08-03, Finding 2). */
+  delivery: {
+    eligible_dispatches: number;
+    budget_evidence_lines: number;
+    warning: string;
+  };
+}
+
+/**
+ * Adherence ≠ delivery: budget routing binds via policy prose, so the
+ * doctor checks the DELIVERY evidence — orchestration audit lines that
+ * carry a tier decision. Eligible dispatches recorded while
+ * `budget_routing != off` but ZERO tier-carrying lines → WARN with the
+ * exact reason. Read-only over agents/runtime/state/audit/*.jsonl; no
+ * new state. This closes the same blind-spot class the session-canary
+ * incident exposed (policy present, delivery silently absent).
+ */
+export function check_budget_delivery(
+  workspace_root: string,
+  budget_routing: string,
+): OrchestrationReport["delivery"] {
+  const out = { eligible_dispatches: 0, budget_evidence_lines: 0, warning: "" };
+  if (budget_routing === "off") {
+    return out;
+  }
+  const auditDir = path.join(workspace_root, "agents", "runtime", "state", "audit");
+  let files: string[] = [];
+  try {
+    files = fs.readdirSync(auditDir).filter((f) => f.endsWith(".jsonl"));
+  } catch {
+    return out; // no audit dir — nothing dispatched, nothing to warn about
+  }
+  for (const f of files) {
+    let text = "";
+    try {
+      text = fs.readFileSync(path.join(auditDir, f), "utf-8");
+    } catch {
+      continue;
+    }
+    for (const line of text.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line) as Record<string, unknown>;
+        const spawns = Number(rec["spawn_count"] ?? 0);
+        if (!Number.isFinite(spawns) || spawns < 1) continue;
+        out.eligible_dispatches += 1;
+        if (typeof rec["tier"] === "string" && rec["tier"] !== "") {
+          out.budget_evidence_lines += 1;
+        }
+      } catch {
+        // non-record line — audit files are shared JSONL surfaces
+      }
+    }
+  }
+  if (out.eligible_dispatches > 0 && out.budget_evidence_lines === 0) {
+    out.warning =
+      `budget_routing=${budget_routing} is policy-bound but shows no delivery evidence: ` +
+      `${out.eligible_dispatches} orchestration dispatch(es) recorded, 0 carry a tier decision — ` +
+      `the relation may not be running (adherence != delivery)`;
+  }
+  return out;
 }
 
 export interface DoctorReport {
@@ -160,8 +221,14 @@ export function collect_orchestration(
   const cost_budgets = (cost["budgets"] ?? {}) as Record<string, unknown>;
   const tracking_dir = path.join(workspace_root, "agents", "cost-tracking");
   const ledger_present = fs.existsSync(path.join(tracking_dir, "sessions.jsonl"));
+  // YAML 1.1 trap: an unquoted `off` parses as boolean false — coerce it
+  // back to the enum string so the check honors the user's intent.
   const budget_routing =
-    typeof sub["budget_routing"] === "string" ? (sub["budget_routing"] as string) : "ask";
+    sub["budget_routing"] === false
+      ? "off"
+      : typeof sub["budget_routing"] === "string"
+        ? (sub["budget_routing"] as string)
+        : "ask";
   const per_tier = (cost_budgets["per_tier"] ?? {}) as Record<string, unknown>;
   const cooldowns = readCooldowns(tracking_dir);
   const tier_budgets: OrchestrationReport["tier_budgets"] = {};
@@ -197,6 +264,7 @@ export function collect_orchestration(
     cost_budgets,
     ledger_present,
     sample,
+    delivery: check_budget_delivery(workspace_root, budget_routing),
   };
 }
 
@@ -407,6 +475,13 @@ function _render(report: DoctorReport): string {
     return `${t}=${cap}${cool}`;
   });
   lines.push(`  tier budgets (rolling-24h): ${tierBits.join(" · ")}`);
+  if (o.delivery.warning) {
+    lines.push(`  ⚠️ ${o.delivery.warning}`);
+  } else if (o.delivery.eligible_dispatches > 0) {
+    lines.push(
+      `  delivery evidence: ${o.delivery.budget_evidence_lines}/${o.delivery.eligible_dispatches} dispatches carry a tier decision`,
+    );
+  }
   lines.push(`  activation probe: ${o.activation.action} — ${o.activation.reason}`);
   if (o.sample) {
     lines.push(

package/src/shared/userMd/utils.ts

@@ -23,7 +23,7 @@
  * Drop once no consumer ships the legacy file.
  */
 
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 
 /** Frontmatter fence used by the legacy `.agent-user.md` format. */
 const FRONTMATTER_FENCE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;