@haiyangbg/buildbeat 2.0.0-beta.4 → 2.0.0-beta.5

package/src/v2/engine/reducer.js

@@ -23,6 +23,8 @@ export function initialState() {
     fingerprints: [],
     consecutiveSameFailure: 0,
     budgets: {},
+    budgetExtensions: {},
+    workReviewGrants: 0,
     pendingHuman: null,
     decisions: [],
     approvals: [],
@@ -107,7 +109,12 @@ export function applyEvent(state, event) {
           `step ${data.step} expected attempt ${expectedAttempt}, got ${data.attempt}`,
         );
       }
-      next.steps[data.step] = { status: "RUNNING", attempts: data.attempt, detail: null };
+      next.steps[data.step] = {
+        status: "RUNNING",
+        attempts: data.attempt,
+        detail: null,
+        infraAttempts: state.steps[data.step]?.infraAttempts ?? 0,
+      };
       next.currentStep = data.step;
       break;
     }
@@ -120,6 +127,11 @@ export function applyEvent(state, event) {
       }
       next.steps[data.step].status = data.status === "succeeded" ? "SUCCEEDED" : "FAILED";
       next.steps[data.step].detail = data.status;
+      if (data.infra === true) {
+        // A worker-infrastructure failure (backend outage, timeout, garbage
+        // output, exit 75) is not charged to the step's budget.
+        next.steps[data.step].infraAttempts = (step.infraAttempts ?? 0) + 1;
+      }
       next.currentStep = null;
       break;
     }
@@ -168,6 +180,19 @@ export function applyEvent(state, event) {
       next.budgets[data.kind] = { consumed: consumed + data.amount, remaining: data.remaining };
       break;
     }
+    case "BUDGET_EXTENDED": {
+      // A human approving resume-<step> after its budget ran out grants
+      // exactly one more attempt; the grant is a ledger fact, not a config
+      // edit, so the effective cap is replayable.
+      if (data.scope === "work") {
+        // Work-level review cap (budgets.reviewRoundsPerWork) lifted once by
+        // a human for this run.
+        next.workReviewGrants = (state.workReviewGrants ?? 0) + data.amount;
+      } else {
+        next.budgetExtensions[data.step] = (state.budgetExtensions?.[data.step] ?? 0) + data.amount;
+      }
+      break;
+    }
     case "HUMAN_REQUESTED": {
       next.pendingHuman = {
         transition: data.transition,
@@ -194,6 +219,7 @@ export function applyEvent(state, event) {
           transition: data.transition,
           subject: data.subject,
           stale: false,
+          ...(data.resumeAt ? { resumeAt: data.resumeAt } : {}),
         });
       }
       next.pendingHuman = null;

package/src/v2/runtime/decisions.js

@@ -185,6 +185,86 @@ export function approveRun(repoRoot, runId, { by = "human", transition, ts, poli
   }
 }
 
+// A human (or the driving session) supplies the candidate: the fix was made
+// by hand in the run's worktree and committed, so the fixer step has nothing
+// to do. The pending request is answered with the adopted commit as its
+// subject and the run resumes at `resumeAt` (verify, by convention). Real
+// incident: hand fixes inside a run cost a no-op fixer and an extra verify
+// each time (a frontend run reached verify #5 and fix #3 for three hand
+// fixes). The commit must already be the worktree HEAD: git is read back,
+// the claim is not trusted.
+export function adoptCandidate(repoRoot, runId, { sha, by = "human", resumeAt, ts } = {}) {
+  if (!sha || typeof sha !== "string" || sha.length < 7) {
+    throw new DecisionError("adopt requires a commit sha (at least 7 characters)");
+  }
+  if (!resumeAt) {
+    throw new DecisionError("adopt requires the step to resume at (resumeAt)");
+  }
+  const ledger = openWaiting(repoRoot, runId);
+  const pending = ledger.state.pendingHuman;
+  if (pending.kind === "final-decision") {
+    throw new DecisionError("adopt is for a run waiting before fix/verify, not at the merge decision");
+  }
+  acquireLock(repoRoot, runId);
+  try {
+    const bound = ledger.state.workspaces[runId];
+    const worktreePath = bound ? resolveRepoRef(repoRoot, bound.worktreePath) : null;
+    if (!bound || !existsSync(worktreePath)) {
+      throw new DecisionError(`worktree missing for ${runId}; cannot adopt a candidate`);
+    }
+    const tree = readback(worktreePath);
+    if (tree.dirty) {
+      throw new DecisionError("worktree is dirty; commit the hand fix before adopting it");
+    }
+    if (!tree.head.startsWith(sha)) {
+      throw new DecisionError(`worktree HEAD is ${tree.head}, not ${sha}; adopt what git reads back`);
+    }
+    const when = ts ?? new Date().toISOString();
+    const lastEvidence = ledger.state.evidence[ledger.state.evidence.length - 1];
+    if (bound.candidate !== tree.head) {
+      ledger.append({
+        type: "CANDIDATE_PINNED",
+        actor: { kind: "human", id: by },
+        ts: when,
+        data: { workspaceId: runId, base: bound.base, candidate: tree.head, adopted: true },
+      });
+    }
+    const subject = {
+      candidate: tree.head,
+      planDigest: ledger.state.run.planDigest,
+      evidenceDigest: lastEvidence?.digest ?? "UNVERIFIED",
+    };
+    const decisionRef = `D-${runId}-${ledger.state.decisions.length + 1}`;
+    ledger.append({
+      type: "DECISION_RECORDED",
+      actor: { kind: "human", id: by },
+      ts: when,
+      data: {
+        decision: "approved",
+        transition: pending.transition,
+        subject,
+        decisionRef,
+        adopted: tree.head,
+        resumeAt,
+      },
+    });
+    recordDecisionFile(repoRoot, ledger.state.run.work, {
+      ts: when,
+      run: runId,
+      decisionRef,
+      decision: "approved",
+      transition: pending.transition,
+      subject,
+      by,
+      adopted: tree.head,
+      resumeAt,
+    });
+    return { adopted: tree.head, decisionRef, transition: pending.transition, resumeAt, state: ledger.state };
+  } finally {
+    releaseLock(repoRoot, runId);
+  }
+}
+
 // Accepts a work artifact (plan, intent, spec) by binding a decision to the
 // file's current digest in the Git plane. If the file changes afterwards,
 // artifact.accepted evaluates false again — acceptance cannot go stale

package/src/v2/runtime/orchestrator.js

@@ -26,6 +26,7 @@ import {
   releaseLock,
 } from "../workspace/workspace-manager.js";
 import { writeRunRecord } from "./run-record.js";
+import { computeWorkCost } from "./work-cost.js";
 import { assertRequires } from "./env-contract.js";
 import { materialisePrompt } from "./envelope.js";
 import { cacheKey, findReusableEvidence, lastReviewedCandidate, treeHash } from "./cache.js";
@@ -142,8 +143,18 @@ function makeContext(options, ledger, workspace) {
     ledger,
     workspace,
   };
+  // Effective cap per step: run config `budgets:` beats the preset, the
+  // preset beats the global default, and every BUDGET_EXTENDED a human
+  // granted on this ledger adds to it. Real incident: the preset's two
+  // review rounds could not be raised from the run config, and approving
+  // resume-review re-asked the same question forever.
+  context.runBudgets = options.budgets ?? {};
   context.maxAttemptsFor = (step) =>
-    workflow.budgets?.maxAttempts?.[step] ?? maxAttemptsPerStep;
+    (context.runBudgets.maxAttempts?.[step] ??
+      workflow.budgets?.maxAttempts?.[step] ??
+      maxAttemptsPerStep) +
+    (ledger.state.budgetExtensions?.[step] ?? 0) +
+    (ledger.state.steps[step]?.infraAttempts ?? 0);
   context.policies = options.policies ?? [];
   context.allowedPaths = options.allowedPaths ?? null;
   context.reviewTriage = options.reviewTriage ?? null;
@@ -240,6 +251,7 @@ function settleOutcome(context, step, outcome, tree, exec) {
     if ((ledger.state.steps[step]?.attempts ?? 0) >= context.maxAttemptsFor(step)) {
       context.waitHuman(`resume-${step}`, [
         `budget exhausted: ${step} failed its final attempt (maxAttempts=${context.maxAttemptsFor(step)}); not routing to fix`,
+        `approving resume-${step} grants one more attempt; rejecting ends the run`,
       ]);
       return null;
     }
@@ -266,13 +278,13 @@ function settleOutcome(context, step, outcome, tree, exec) {
     },
   });
   if (!to) {
-    ledger.append({
-      type: "RUN_TERMINAL",
-      actor: KERNEL,
-      ts: now(),
-      data: { status: "FAILED", reason: `no transition for (${step}, ${outcome})` },
-    });
-    writeRunRecord({ repoRoot: context.repoRoot, ledger, ts: now() });
+    // A workflow without an edge for this outcome is not a verdict on the
+    // candidate; the person decides whether to rerun the step or end the
+    // run. Terminal FAILED here used to kill runs whose reviewer had merely
+    // errored out.
+    context.waitHuman(`resume-${step}`, [
+      `no transition for (${step}, ${outcome}); approve resume-${step} to rerun the step, reject to end the run`,
+    ]);
     return null;
   }
   ledger.append({
@@ -320,6 +332,30 @@ function drive(context, startStep, { skipBoundaryOnce = false } = {}) {
       return;
     }
 
+    // Work-level review cap (iteration 09): review rounds are counted across
+    // every run of the work, superseded ones included, so "one run per
+    // round" cannot slip past the per-run budget. Reaching the cap is a
+    // human decision (review once more, or merge/close as-is), not a stop.
+    const workCap = context.runBudgets.reviewRoundsPerWork;
+    if (workCap !== undefined && (stepDef.worker === "reviewer" || step === "review")) {
+      const prior = computeWorkCost(context.repoRoot, ledger.state.run.work, {
+        excludeRun: ledger.state.run.id,
+      });
+      const rounds = prior.reviewRounds + (ledger.state.steps[step]?.attempts ?? 0);
+      const allowed = workCap + (ledger.state.workReviewGrants ?? 0);
+      if (rounds >= allowed) {
+        context.waitHuman(
+          `enter-${step}`,
+          [
+            `work review cap reached: ${rounds} review round(s) across ${prior.runs + 1} run(s) of ${ledger.state.run.work} (budgets.reviewRoundsPerWork=${workCap})`,
+            `approve enter-${step} to review once more, or reject and merge/close the work on the evidence you have`,
+          ],
+          "work-review-cap",
+        );
+        return;
+      }
+    }
+
     const preGate = runPolicyGate(context, "pre", step);
     if (preGate.action === "block") {
       ledger.append({
@@ -341,6 +377,7 @@ function drive(context, startStep, { skipBoundaryOnce = false } = {}) {
     if (attempt > maxAttempts) {
       context.waitHuman(`resume-${step}`, [
         `budget exhausted: ${step} would exceed maxAttempts=${maxAttempts}`,
+        `approving resume-${step} grants one more attempt; rejecting ends the run`,
       ]);
       return;
     }
@@ -531,18 +568,53 @@ function drive(context, startStep, { skipBoundaryOnce = false } = {}) {
     } else {
       stepStatus = "succeeded";
     }
+    // Infrastructure failure vs candidate failure. A timeout, a crash,
+    // garbage output or the worker's own "environment unavailable" signal
+    // (exit 75, EX_TEMPFAIL) says nothing about the candidate: no failure
+    // fingerprint, no fixer, the attempt is refunded, and a human decides
+    // when the backend is back. Real incidents: a worker backend outage
+    // (review exit 97) and non-JSON reviewer output killed five runs in two
+    // days as "no transition for (review, failed)"; PATH, port and host-load
+    // verify failures dispatched fixers five times.
+    const infra =
+      stepStatus === "timeout" ||
+      stepStatus === "crashed" ||
+      stepStatus === "invalid-output" ||
+      (stepStatus === "failed" && exec.exitCode === 75);
     ledger.append({
       type: "STEP_FINISHED",
       actor: KERNEL,
       ts: now(),
-      data: { step, attempt, status: stepStatus, exitCode: exec.exitCode },
+      data: { step, attempt, status: stepStatus, exitCode: exec.exitCode, ...(infra ? { infra: true } : {}) },
     });
     ledger.append({
       type: "BUDGET_CONSUMED",
       actor: KERNEL,
       ts: now(),
-      data: { kind: "attempts", amount: 1, remaining: maxAttempts - attempt },
+      data: {
+        kind: "attempts",
+        amount: infra ? 0 : 1,
+        remaining: context.maxAttemptsFor(step) - attempt,
+      },
     });
+    if (infra) {
+      const cause =
+        stepStatus === "failed"
+          ? "exit 75 (worker reports its environment unavailable)"
+          : stepStatus === "invalid-output"
+            ? "output is not a worker envelope"
+            : stepStatus;
+      context.waitHuman(
+        `resume-${step}`,
+        [
+          `worker infrastructure failure at ${step}: ${cause}; not a candidate defect, attempt not charged`,
+          ...(tree.dirty ? [`the failed worker left the worktree dirty; inspect before rerunning`] : []),
+          `approve resume-${step} to rerun once the backend/environment is back; reject to end the run`,
+        ],
+        "infra",
+      );
+      return;
+    }
 
     let blockingFindings = [];
     if (envelope?.findings) {
@@ -920,12 +992,51 @@ export function resumeRun(options) {
         });
         return { runId, ledgerPath, state: ledger.state, resumed: true, stale: true, reason: null };
       }
-      const step = resumeStepFromTransition(approval.transition);
+      // An adopted candidate names where to resume (verify, by convention):
+      // the fixer step the request was waiting on has nothing left to do.
+      const step = approval.resumeAt ?? resumeStepFromTransition(approval.transition);
       if (!step || !context.workflow.stepIds.has(step)) {
         throw new OrchestratorError(
           `cannot derive a resume step from approved transition ${approval.transition}`,
         );
       }
+      // An approved resume-<step> on an exhausted budget is the human saying
+      // "one more"; record the grant before driving or the same request
+      // comes straight back (the pilot's app-login runs ended CANCELLED
+      // with their candidates in production because of exactly that).
+      const requestKind = [...ledger.events]
+        .reverse()
+        .find((event) => event.type === "HUMAN_REQUESTED" && event.data.transition === approval.transition)
+        ?.data.kind;
+      if (requestKind === "work-review-cap") {
+        ledger.append({
+          type: "BUDGET_EXTENDED",
+          actor: KERNEL,
+          ts: now(),
+          data: {
+            step,
+            amount: 1,
+            scope: "work",
+            maxAttempts: (context.runBudgets.reviewRoundsPerWork ?? 0) + (state.workReviewGrants ?? 0) + 1,
+            approvalRef: approval.decisionRef,
+          },
+        });
+      } else if (
+        approval.transition.startsWith("resume-") &&
+        (state.steps[step]?.attempts ?? 0) >= context.maxAttemptsFor(step)
+      ) {
+        ledger.append({
+          type: "BUDGET_EXTENDED",
+          actor: KERNEL,
+          ts: now(),
+          data: {
+            step,
+            amount: 1,
+            maxAttempts: context.maxAttemptsFor(step) + 1,
+            approvalRef: approval.decisionRef,
+          },
+        });
+      }
       ledger.append({ type: "RUN_STARTED", actor: KERNEL, ts: now(), data: {} });
       drive(context, step, { skipBoundaryOnce: true });
       return { runId, ledgerPath, state: ledger.state, resumed: true, reason: null };

package/src/v2/runtime/overview.js

@@ -16,12 +16,13 @@ import { join } from "node:path";
 import { EventLedger } from "../storage/event-ledger.js";
 import { latestAdjudications, readFindingsAccount } from "./findings.js";
 import { nextReply } from "./notify.js";
+import { computeWorkCost, renderWorkCost } from "./work-cost.js";
 
 function sha256File(path) {
   return `sha256:${createHash("sha256").update(readFileSync(path, "utf8"), "utf8").digest("hex")}`;
 }
 
-function readJsonl(path) {
+export function readJsonl(path) {
   if (!existsSync(path)) {
     return [];
   }
@@ -38,7 +39,7 @@ function readJsonl(path) {
     .filter(Boolean);
 }
 
-function artifactStatus(workDir, decisions, artifact) {
+export function artifactStatus(workDir, decisions, artifact) {
   const path = join(workDir, `${artifact}.md`);
   if (!existsSync(path)) {
     return { exists: false, accepted: false, stale: false };
@@ -93,6 +94,8 @@ function runsFor(repoRoot, workId) {
         candidate: state.workspaces[state.run.id]?.candidate ?? null,
         createdAt: ledger.events[0]?.ts ?? null,
         lastAt: ledger.events[ledger.events.length - 1]?.ts ?? null,
+        workflow: state.run.workflowRef ?? null,
+        steps: Object.keys(state.steps),
         state,
         source: "runtime",
       });
@@ -118,6 +121,8 @@ function runsFor(repoRoot, workId) {
           candidate: record.workspaces?.[entry]?.candidate ?? null,
           createdAt: record.startedAt ?? null,
           lastAt: record.finishedAt ?? null,
+          workflow: record.workflow ?? null,
+          steps: Object.keys(record.attempts ?? {}),
           state: null,
           source: "run-record",
         });
@@ -156,14 +161,31 @@ export function computeOverview(repoRoot, { work = null, repoLabel = "." } = {})
     const runs = runsFor(repoRoot, workId);
     const live = runs.filter((run) => run.status !== "SUPERSEDED");
     const latest = live[live.length - 1] ?? null;
-    let merged = false;
-    if (latest?.candidate) {
-      merged = isAncestor(repoRoot, latest.candidate, mainRef);
-    }
+    // "Merged" is a fact about any candidate of the work, not only the
+    // latest run's: a pilot's shipped candidate sat behind a CANCELLED run
+    // (its in-run review budget ran out and closure happened elsewhere) and
+    // overview reported the shipped work as STOPPED_CANCELLED.
+    const mergedRun =
+      [...runs].reverse().find((run) => run.candidate && isAncestor(repoRoot, run.candidate, mainRef)) ?? null;
+    const merged = Boolean(mergedRun);
+    const RELEASE_STEPS = ["preflight", "apply-readback", "observe"];
+    const isReleaseLane = (run) =>
+      Boolean(run) && (run.workflow === "release-readback" || run.steps.some((step) => RELEASE_STEPS.includes(step)));
+
+    // A Work is closed by an explicit row in decisions.jsonl:
+    //   {"transition":"close-work","decision":"closed"|"cancelled","subject":{"result":"..."}}
+    // A live run (RUNNING / WAITING_HUMAN) contradicts a closure and wins, so a
+    // stale close row can never hide something that still needs a human.
+    const closure = [...decisions].reverse().find((row) => row.transition === "close-work");
+    const liveRun = latest && (latest.status === "RUNNING" || latest.status === "WAITING_HUMAN");
 
     let stage;
     let next;
-    if (!intent.exists) {
+    if (closure && !liveRun) {
+      stage = closure.decision === "cancelled" ? "CANCELLED" : "CLOSED";
+      const result = typeof closure.subject?.result === "string" && closure.subject.result.length > 0 ? closure.subject.result : "see decisions.jsonl";
+      next = `${stage.toLowerCase()} @ ${closure.ts ?? "?"}: ${result.slice(0, 160)}`;
+    } else if (!intent.exists) {
       stage = "NO_INTENT";
       next = `write delivery/work/${workId}/intent.md (what and why), then plan.md`;
     } else if (!latest) {
@@ -181,7 +203,7 @@ export function computeOverview(repoRoot, { work = null, repoLabel = "." } = {})
         next =
           configs.length > 0
             ? `buildbeat-v2 start --config delivery/work/${workId}/${configs[0]} --attempt new`
-            : `no run-config in delivery/work/${workId}: write one, or record the work as closed in decisions.jsonl if it was doc-only`;
+            : `no run-config in delivery/work/${workId}: write one, or close it with a decisions.jsonl row {"transition":"close-work","decision":"closed","subject":{"result":"..."}} if it was doc-only`;
       }
     } else if (latest.status === "RUNNING") {
       stage = "RUNNING";
@@ -190,16 +212,21 @@ export function computeOverview(repoRoot, { work = null, repoLabel = "." } = {})
       stage = latest.pendingHuman?.kind === "final-decision" ? "MERGE_DECISION" : "WAITING_HUMAN";
       const replies = latest.state ? nextReply({ repoLabel, state: latest.state }) : [];
       next = replies[0] ?? `buildbeat-v2 inbox --repo ${repoLabel}`;
+    } else if (latest.status === "SUCCEEDED" && isReleaseLane(latest)) {
+      // A release-readback lane that reached wait-close and was approved is
+      // a closed release window, not "nothing to merge".
+      stage = "RELEASED";
+      next = `release window closed by ${latest.id}; close the work with a decisions.jsonl row {"transition":"close-work","decision":"closed","subject":{"result":"released"}}`;
+    } else if (merged) {
+      stage = "MERGED";
+      next =
+        `candidate ${mergedRun.candidate.slice(0, 7)} (${mergedRun.id}) is on ${mainRef}; release/deploy stays a human action; then buildbeat-v2 gc --repo ${repoLabel}` +
+        (latest.status !== "SUCCEEDED" ? `   # latest run ${latest.id} ended ${latest.status} after the merge` : "");
     } else if (latest.status === "SUCCEEDED") {
-      if (merged) {
-        stage = "MERGED";
-        next = `release/deploy stays a human action; then buildbeat-v2 gc --repo ${repoLabel}`;
-      } else {
-        stage = "MERGE_READY";
-        next = latest.candidate
-          ? `merge ${latest.candidate.slice(0, 7)} (run/${latest.id}) into ${mainRef} — manual, then push`
-          : "run succeeded without a candidate; nothing to merge";
-      }
+      stage = "MERGE_READY";
+      next = latest.candidate
+        ? `merge ${latest.candidate.slice(0, 7)} (run/${latest.id}) into ${mainRef} — manual, then push`
+        : "run succeeded without a candidate; nothing to merge";
     } else {
       stage = `STOPPED_${latest.status}`;
       next = plan.accepted
@@ -214,10 +241,12 @@ export function computeOverview(repoRoot, { work = null, repoLabel = "." } = {})
       envFacts,
       openFindings,
       runs: runs.length,
+      cost: runs.length > 0 ? computeWorkCost(repoRoot, workId) : null,
       latest: latest
         ? { id: latest.id, status: latest.status, candidate: latest.candidate, at: latest.lastAt, source: latest.source, terminalReason: latest.terminal?.reason ?? null, waiting: latest.pendingHuman?.transition ?? null }
         : null,
       merged,
+      mergedCandidate: mergedRun?.candidate ?? null,
       next,
     });
   }
@@ -242,7 +271,8 @@ export function renderOverview(rows) {
   for (const row of rows) {
     lines.push(`${row.work}  ${row.stage}`);
     const parts = [`intent ${mark(row.intent)}`, `plan ${mark(row.plan)}`, `runs ${row.runs}`];
-    if (row.openFindings > 0) {
+    const settled = ["MERGED", "RELEASED", "CLOSED", "CANCELLED"].includes(row.stage);
+    if (row.openFindings > 0 && !settled) {
       // Unadjudicated, not necessarily unresolved: a fixer may have closed
       // them without anyone recording a verdict. The number says "nobody
       // ruled on these", which is exactly what a human should know.
@@ -252,8 +282,15 @@ export function renderOverview(rows) {
       parts.push("env-facts ✓");
     }
     lines.push(`  ${parts.join(" · ")}`);
+    if (row.cost) {
+      // What this work has already consumed across every run, superseded
+      // ones included: the number a "continue or cut" decision needs.
+      lines.push(`  cost: ${renderWorkCost(row.cost)}`);
+    }
     if (row.latest) {
-      const cand = row.latest.candidate ? ` candidate ${row.latest.candidate.slice(0, 7)}${row.merged ? " (merged)" : ""}` : "";
+      const cand = row.latest.candidate
+        ? ` candidate ${row.latest.candidate.slice(0, 7)}${row.latest.candidate === row.mergedCandidate ? " (merged)" : ""}`
+        : "";
       const wait = row.latest.waiting ? ` waiting ${row.latest.waiting}` : "";
       const why = row.latest.terminalReason ? ` — ${row.latest.terminalReason.slice(0, 100)}` : "";
       lines.push(`  latest ${row.latest.id} ${row.latest.status}${cand}${wait} @ ${row.latest.at ?? "?"}${why}`);

package/src/v2/runtime/run-record.js

@@ -9,6 +9,7 @@ import { join, relative } from "node:path";
 
 import { canonicalJson } from "../storage/event-ledger.js";
 import { normalizeRepoRef } from "./repo-ref.js";
+import { ledgerCost } from "./work-cost.js";
 
 const KERNEL = { kind: "kernel", id: "orchestrator" };
 
@@ -40,12 +41,14 @@ export function writeRunRecord({ repoRoot, ledger, ts }) {
   const record = {
     run: first.run,
     work: first.work,
+    workflow: state.run?.workflowRef ?? null,
     terminal: state.terminal,
     events: { from: first.seq, to: last.seq, lastDigest: last.digest },
     startedAt: first.ts,
     finishedAt: last.ts,
     attempts,
     budgets: state.budgets,
+    cost: ledgerCost(ledger),
     workspaces,
     evidence,
     decisions: state.decisions,

package/src/v2/runtime/work-cost.js

@@ -0,0 +1,147 @@
+// Work-level cost (iteration 09): what a work has already consumed across
+// every run of it, superseded ones included. Per-run budgets were bypassed
+// by "one run per review round" (a pilot work ran 21 runs and 9 review
+// rounds while the preset's two-round cap never fired), and a work that ate
+// ten runs and a day was cut by the owner as "cost > benefit" with no
+// number in front of them. Derived only: runtime ledgers first, run-records
+// for runs whose runtime was wiped. Nothing is written.
+
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+
+import { EventLedger } from "../storage/event-ledger.js";
+import { readFindingsAccount } from "./findings.js";
+
+function emptyCost() {
+  return {
+    runs: 0,
+    reviewRounds: 0,
+    findings: 0,
+    humanWaits: 0,
+    infraFailures: 0,
+    workerMs: 0,
+    firstAt: null,
+    lastAt: null,
+  };
+}
+
+// Cost facts of one ledger: review rounds, human waits, infra failures and
+// worker wall time (STEP_STARTED → STEP_FINISHED per attempt).
+export function ledgerCost(ledger) {
+  const cost = { reviewRounds: 0, humanWaits: 0, infraFailures: 0, workerMs: 0 };
+  const open = new Map();
+  for (const event of ledger.events) {
+    if (event.type === "STEP_STARTED") {
+      open.set(`${event.data.step}#${event.data.attempt}`, Date.parse(event.ts));
+    } else if (event.type === "STEP_FINISHED") {
+      const key = `${event.data.step}#${event.data.attempt}`;
+      const startedAt = open.get(key);
+      if (startedAt !== undefined) {
+        const ms = Date.parse(event.ts) - startedAt;
+        if (Number.isFinite(ms) && ms > 0) {
+          cost.workerMs += ms;
+        }
+        open.delete(key);
+      }
+      if (event.data.step === "review") {
+        cost.reviewRounds += 1;
+      }
+      if (event.data.infra === true) {
+        cost.infraFailures += 1;
+      }
+    } else if (event.type === "HUMAN_REQUESTED") {
+      cost.humanWaits += 1;
+    }
+  }
+  return cost;
+}
+
+export function computeWorkCost(repoRoot, workId, { excludeRun = null } = {}) {
+  const cost = emptyCost();
+  const seen = new Set();
+  const runsDir = join(repoRoot, ".buildbeat", "runtime", "runs");
+  if (existsSync(runsDir)) {
+    for (const entry of readdirSync(runsDir)) {
+      const path = join(runsDir, entry, "events.jsonl");
+      if (!existsSync(path)) {
+        continue;
+      }
+      const ledger = EventLedger.open(path);
+      const state = ledger.state;
+      if (ledger.corruption || !state.run || state.run.work !== workId) {
+        continue;
+      }
+      seen.add(state.run.id);
+      if (state.run.id === excludeRun) {
+        continue;
+      }
+      const row = ledgerCost(ledger);
+      cost.runs += 1;
+      cost.reviewRounds += row.reviewRounds;
+      cost.humanWaits += row.humanWaits;
+      cost.infraFailures += row.infraFailures;
+      cost.workerMs += row.workerMs;
+      track(cost, ledger.events[0]?.ts, ledger.events[ledger.events.length - 1]?.ts);
+    }
+  }
+  const recordsDir = join(repoRoot, "delivery", "work", workId, "runs");
+  if (existsSync(recordsDir)) {
+    for (const entry of readdirSync(recordsDir)) {
+      if (seen.has(entry) || entry === excludeRun) {
+        continue;
+      }
+      const path = join(recordsDir, entry, "run-record.json");
+      if (!existsSync(path)) {
+        continue;
+      }
+      let record;
+      try {
+        record = JSON.parse(readFileSync(path, "utf8"));
+      } catch {
+        continue;
+      }
+      cost.runs += 1;
+      // Records written before iteration 09 carry attempts and decisions
+      // only; the cost block is preferred when present.
+      cost.reviewRounds += record.cost?.reviewRounds ?? record.attempts?.review ?? 0;
+      cost.humanWaits += record.cost?.humanWaits ?? record.decisions?.length ?? 0;
+      cost.infraFailures += record.cost?.infraFailures ?? 0;
+      cost.workerMs += record.cost?.workerMs ?? 0;
+      track(cost, record.startedAt, record.finishedAt);
+    }
+  }
+  cost.findings = readFindingsAccount(repoRoot, workId).filter((row) => row.kind === "finding").length;
+  return cost;
+}
+
+function track(cost, firstAt, lastAt) {
+  if (firstAt && (!cost.firstAt || firstAt < cost.firstAt)) {
+    cost.firstAt = firstAt;
+  }
+  if (lastAt && (!cost.lastAt || lastAt > cost.lastAt)) {
+    cost.lastAt = lastAt;
+  }
+}
+
+export function formatWorkerMs(ms) {
+  if (!ms || ms < 1000) {
+    return "0s";
+  }
+  if (ms < 60000) {
+    return `${Math.round(ms / 1000)}s`;
+  }
+  const totalMinutes = Math.round(ms / 60000);
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  return hours > 0 ? `${hours}h${String(minutes).padStart(2, "0")}m` : `${minutes}m`;
+}
+
+export function renderWorkCost(cost) {
+  return [
+    `review rounds ${cost.reviewRounds}`,
+    `findings ${cost.findings}`,
+    `human waits ${cost.humanWaits}`,
+    ...(cost.infraFailures > 0 ? [`infra failures ${cost.infraFailures}`] : []),
+    `worker ${formatWorkerMs(cost.workerMs)}`,
+  ].join(" · ");
+}