@hanzlaa/rcode 4.3.2 → 4.4.0

package/rcode/workflows/execute-sprint.md

@@ -375,6 +375,22 @@ If new untracked files appeared after running scripts or tools, decide for each:
 
 </task_commit>
 
+<hook_revert_detection_gate>
+## Post-Step Hook Revert Detection Gate
+
+After each task that writes or edits files, run:
+```bash
+git diff --name-only HEAD
+```
+If a file that was supposed to be written by this step shows NO diff (i.e. git thinks it's clean), that file was reverted by a hook. STOP — do NOT mark the step done. Report:
+```
+⚠ Revert detected: <filename> was written by this step but shows no diff vs HEAD.
+  Likely cause: a linter or pre-commit hook reverted the file.
+  Action required: inspect the hook output in the last git commit attempt, fix the root cause, then re-run this task.
+```
+Do not proceed to the next task until all expected file changes survive the git diff check.
+</hook_revert_detection_gate>
+
 <post_step_revert_gate>
 ## Post-Step Revert Detection Gate
 
@@ -497,6 +513,12 @@ If user_setup exists: create `{phase}-USER-SETUP.md` using template `.rcode/temp
 </step>
 
 <step name="create_summary">
+**Overwrite guard:** If `{phase}-{plan}-SUMMARY.md` already exists at `.planning/phases/XX-name/`, delete it first before writing:
+```bash
+rm -f ".planning/phases/XX-name/{phase}-{plan}-SUMMARY.md"
+```
+Never append to or skip an existing SUMMARY.md — always overwrite with the current sprint's completion data. Silently continuing with a stale SUMMARY.md is a critical bug.
+
 Create `{phase}-{plan}-SUMMARY.md` at `.planning/phases/XX-name/`. Use `.rcode/templates/summary.md`.
 
 **Frontmatter:** phase, plan, subsystem, tags | requires/provides/affects | tech-stack.added/patterns | key-files.created/modified | key-decisions | requirements-completed (**MUST** copy `requirements` array from SPRINT.md frontmatter verbatim) | duration ($DURATION), completed ($PLAN_END_TIME date).

package/rcode/workflows/execute.md

@@ -2,6 +2,16 @@
 Execute all plans in a phase using wave-based parallel execution. Orchestrator stays lean — delegates plan execution to subagents.
 </purpose>
 
+## Orchestrator Constraint — No Inline Implementation
+
+**The execute orchestrator MUST NOT implement code directly.** Its only role is to dispatch, monitor, and checkpoint. All implementation is delegated to `rcode-executor` subagents.
+
+If you are reading this as the main conversation loop and are tempted to write code, create files, or make commits directly instead of spawning a subagent:
+
+> **STOP.** Spawn `rcode-executor` as a subagent with the sprint plan as context. The main loop's job is to call the agent, present checkpoints, and update state — not to implement.
+
+Bypassing this constraint produces a built project with no execution trace, no SUMMARY.md, and a dashboard frozen at `planned`. See issue #915.
+
 <pre_flight>
 **Mandatory before execution begins.** Run these checks first and surface
 findings BEFORE any subagents are spawned. If any check fails, stop and
@@ -173,11 +183,11 @@ via filesystem and git state.
 @.rcode/references/git-preflight.md
 Read STATE.md before any operation to load project context.
 
-@.rcode/references/agent-contracts.md
-@.rcode/references/context-budget.md
-@.rcode/references/gates.md
 @.rcode/references/karpathy-guidelines.md
 @.rcode/references/execution-protocol.md
+<!-- Read .rcode/references/agent-contracts.md only if debugging agent contract violations -->
+<!-- Read .rcode/references/context-budget.md only if context degradation guidance is needed -->
+<!-- Read .rcode/references/gates.md only if implementing or troubleshooting gate logic -->
 </required_reading>
 
 <available_agent_types>
@@ -356,6 +366,7 @@ checkpoints between tasks. The user can review, modify, or redirect work at any
       their feedback before continuing. Otherwise proceed to next task.
 
    e. **After plan complete:** Show results, commit, create SUMMARY.md, then present next plan.
+      **Overwrite guard:** If the SUMMARY.md file already exists from a previous run, delete it first with `rm -f <path>` before writing the new version. Never append to or skip an existing SUMMARY.md — always overwrite with the current sprint's completion data.
 
 3. After all plans: proceed to verification (same as normal mode).
 
@@ -1036,6 +1047,9 @@ Read and follow `.rcode/workflows/transition.md`, passing through the `--auto` f
 /rcode-execute {next} — execute next phase
 ```
 
+**Next step — paste this to verify:**
+> /rcode-verify {X}
+
 Only suggest the commands listed above. Do not invent or hallucinate command names.
 </step>
 

package/rcode/workflows/lens-audit.md

@@ -1,7 +1,7 @@
 # Workflow: rcode-lens-audit
 
 <purpose>
-Run a structured 15-lens code audit against the current project. Each lens
+Run a structured 16-lens code audit against the current project. Each lens
 delegates to its mapped primary skill via Task() subagent dispatch — the skill
 provides domain expertise; this workflow handles orchestration, aggregation,
 and GH issue body generation. Never fixes anything; audit-first, fix-second.
@@ -26,6 +26,7 @@ and GH issue body generation. Never fixes anything; audit-first, fix-second.
 | 13 | Observability | `rcode-observability-auditor` | — |
 | 14 | Naming | `rcode-codebase-mapper` | `rcode-reviewer` |
 | 15 | Coverage | `rcode-nyquist-auditor` | `rcode-fatima` |
+| 16 | YAGNI / Over-engineering | `rcode-reviewer` | `rcode-lazy` |
 
 ## Step 0 — Usage check
 
@@ -33,8 +34,8 @@ If `$ARGUMENTS` is `--help` or `-h`:
 
 ```
 /rcode-lens-audit                # interactive — asks which lens
-/rcode-lens-audit all            # run all 15 lenses sequentially
-/rcode-lens-audit <N>            # run lens N (1-15) only
+/rcode-lens-audit all            # run all 16 lenses sequentially
+/rcode-lens-audit <N>            # run lens N (1-16) only
 /rcode-lens-audit <name>         # run by name, e.g. "security", "performance"
 
 Lenses and their primary skills:
@@ -53,6 +54,7 @@ Lenses and their primary skills:
   13. observability    — rcode-observability-auditor
   14. naming           — rcode-codebase-mapper + rcode-reviewer
   15. coverage         — rcode-nyquist-auditor + rcode-fatima
+  16. yagni            — rcode-reviewer + rcode-lazy (speculative abstractions, unused config, deps stdlib covers)
 ```
 
 STOP after printing help.
@@ -83,15 +85,15 @@ rcode-tools not found. Run: npx @hanzlaa/rcode install .
 ```
 
 Parse `$ARGUMENTS`:
-- `all` → `LENSES=(1 2 3 4 5 6 7 8 9 10 11 12 13 14 15)`
-- digit 1–15 → `LENSES=(<N>)`
+- `all` → `LENSES=(1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16)`
+- digit 1–16 → `LENSES=(<N>)`
 - known lens name → map to number → `LENSES=(<N>)`
 - empty → continue to Step 2 (interactive picker)
 
 Name → number mapping:
 `security=1, performance=2, testability=3, extensibility=4, dep-health=5,`
 `error-recovery=6, state-machine=7, i18n=8, documentation=9, cross-platform=10,`
-`karpathy=11, sxo=12, observability=13, naming=14, coverage=15`
+`karpathy=11, sxo=12, observability=13, naming=14, coverage=15, yagni=16`
 
 ## Step 2 — Interactive picker (when no argument given)
 
@@ -117,7 +119,8 @@ Options:
   13. observability    — rcode-observability-auditor (unguarded calls, silent fails)
   14. naming           — rcode-codebase-mapper (naming drift, PLAN.md vs SPRINT.md)
   15. coverage         — rcode-nyquist-auditor (parity gaps, untested commands)
-  16. all              — run all 15 lenses
+  16. yagni            — rcode-reviewer (speculative abstractions, single-impl interfaces, deps stdlib covers)
+  17. all              — run all 16 lenses
   0.  cancel
 ```
 
@@ -612,6 +615,44 @@ FINDINGS[coverage] = merge(PRIMARY, SECONDARY)
 
 ---
 
+### Lens 16 — YAGNI / Over-engineering
+
+```
+PRIMARY = Task(
+  subagent_type="rcode-code-reviewer",
+  model="{lens_model}",
+  prompt="YAGNI / over-engineering audit — do NOT fix code. {CONTEXT}
+
+  Run Lens 16 (YAGNI) audit against recent changes (HEAD~20..HEAD), using the
+  rcode-lazy ladder as the rubric (@.rcode/skills/core/rcode-lazy/SKILL.md).
+  This lens is narrower than Lens 11 (Karpathy): hunt ONLY for code that exists
+  but should not, or is bigger than the job needs. Flag:
+
+  - Speculative features / config / params for needs that do not exist yet
+  - Abstractions with a single implementation: an interface, factory, or
+    strategy with exactly one concrete user — inline it
+  - Wrapper layers that add a hop for one caller
+  - 'For later' scaffolding: extension points, plugin registries, generic
+    handlers with one case
+  - A new dependency for what stdlib or a native platform feature already does
+    (e.g. a date-picker lib vs <input type=\"date\">, a deep-clone lib vs
+    structuredClone)
+  - Config for a value that never changes (hardcode it)
+  - Hand-rolled code reproducing an already-installed dependency
+
+  Do NOT flag: validation at trust boundaries, error handling that prevents
+  data loss, security, accessibility, or anything explicitly requested — those
+  are never YAGNI violations even when verbose.
+
+  Return: file:line — YAGNI smell — what to delete/inline + the simpler form [critical|warn|info]
+  If clean: PASS"
+)
+
+FINDINGS[yagni] = PRIMARY
+```
+
+---
+
 ## Step 5 — Compile findings per lens
 
 For each lens that was run, print:
@@ -689,7 +730,7 @@ Next: file the GH issues above, then run /rcode-audit fix to address them.
 ## On Error
 
 - **rcode-tools not found**: print `Run: npx @hanzlaa/rcode install .` and STOP.
-- **Lens N out of range (not 1–15)**: print valid range and STOP.
+- **Lens N out of range (not 1–16)**: print valid range and STOP.
 - **Subagent skill not installed**: note `(skill not available — skipping)`, continue.
 - **Scope dirs empty**: note `(no source files in scope)` per lens, still run dispatch.
 - **Karpathy dispatch fails** (Lens 11): note failure, continue with remaining lenses.

package/rcode/workflows/new-milestone.md

@@ -17,6 +17,24 @@ Valid rcode subagent types (use exact names — do not fall back to 'general-pur
 
 <process>
 
+## --from-draft mode
+
+When `--from-draft <path>` is passed:
+1. Check for the file at `<path>`. Accept any markdown file — MILESTONE-CONTEXT.md, a scratch doc, or a ROADMAP partial.
+2. If found: read it as the milestone definition — do NOT re-run the interactive goal-gathering interview (steps 2–4). Jump directly to step 5 (Requirements scoping) using the draft as the source of truth.
+3. If not found: abort with:
+   ```
+   Error: --from-draft file not found: {path}
+   ```
+   Do not fall back to standard mode — an explicit path that does not exist is a user error, not a signal to start fresh.
+
+Surface a one-line banner when the draft is loaded:
+```
+◆ From-draft mode: using {path} as milestone definition (skipping goal interview)
+```
+
+This mode exists to skip expensive re-derivation when a human or prior agent has already drafted the milestone scope.
+
 ## 1. Parse arguments and load context
 
 Parse `$ARGUMENTS` before anything else:
@@ -27,20 +45,14 @@ Parse `$ARGUMENTS` before anything else:
 
 If `--from-draft` is absent, continue phase numbering from the previous milestone.
 
-**From-draft mode:**
+**From-draft mode (see dedicated section above):**
 
 When `FROM_DRAFT_MODE=true`:
 1. Read the draft file at `DRAFT_FILE`. Accept any markdown file — MILESTONE-CONTEXT.md, a scratch doc, or a ROADMAP partial.
 2. Extract milestone name (first `# Heading` or the filename stem), goals list, and any explicit phase list.
 3. Skip the interactive goal-gathering interview (steps 2–4). Jump directly to step 5 (Requirements scoping) using the draft as the source of truth.
-4. Surface a one-line banner:
-   ```
-   ◆ From-draft mode: using {DRAFT_FILE} as milestone definition (skipping goal interview)
-   ```
-5. If `DRAFT_FILE` does not exist, abort:
-   ```
-   Error: --from-draft file not found: {DRAFT_FILE}
-   ```
+4. Surface the one-line banner (see `## --from-draft mode` above).
+5. If `DRAFT_FILE` does not exist, abort (see `## --from-draft mode` above).
 
 Read these files in parallel:
 - `.planning/PROJECT.md` — existing project, validated requirements, decisions

package/rcode/workflows/new-project-create-roadmap.md

@@ -41,6 +41,8 @@ Create roadmap:
 6. Return ROADMAP CREATED with summary
 
 Write files first, then return. This ensures artifacts persist even if context is lost.
+
+**Scope constraint:** rcode-roadmapper creates ONLY: ROADMAP.md, STATE.md, and one PHASE.md per phase directory (if requested). It MUST NOT create SPRINT.md, PLAN.md, or any sprint-level planning files. Sprint planning is handled exclusively by `/rcode-plan`. If you find yourself about to write a SPRINT.md file, STOP — that file is out of scope for this agent.
 </instructions>
 ", subagent_type="rcode-roadmapper", model="${ROADMAPPER_MODEL}", description="Create roadmap")
 ```

package/rcode/workflows/new-project-roadmap.md

@@ -199,6 +199,8 @@ Create roadmap:
 6. Return ROADMAP CREATED with summary
 
 Write files first, then return. This ensures artifacts persist even if context is lost.
+
+**Scope constraint:** rcode-roadmapper creates ONLY: ROADMAP.md, STATE.md, and one PHASE.md per phase directory (if requested). It MUST NOT create SPRINT.md, PLAN.md, or any sprint-level planning files. Sprint planning is handled exclusively by `/rcode-plan`. If you find yourself about to write a SPRINT.md file, STOP — that file is out of scope for this agent.
 </instructions>
 ", subagent_type="rcode-roadmapper", model="{roadmapper_model}", description="Create roadmap")
 ```

package/rcode/workflows/new-project.md

@@ -885,6 +885,9 @@ Present completion summary:
 > (a) `.planning/ROADMAP.md` contains real `## Phase N` headings — open it and add them if the file is still a stub.
 > (b) Run `npx rcode state sync --from-disk` to populate `.rcode/state.json` with the phases array so downstream commands (`/rcode-plan`, `/rcode-execute-sprint`, etc.) can read the phase list.
 
+**Next step — paste this to start planning:**
+> /rcode-plan 1 — [Phase 1 Name from ROADMAP.md]
+
 **If auto mode:**
 
 ```

package/rcode/workflows/plan.md

@@ -49,9 +49,9 @@ Read all files referenced by the invoking prompt's execution_context before star
 ${PHASE_GOAL_HAS_UI ? '@.rcode/references/ui-brand.md' : ''}
 @.rcode/references/revision-loop.md
 @.rcode/references/gate-prompts.md
-@.rcode/references/agent-contracts.md
-@.rcode/references/gates.md
 @.rcode/references/karpathy-guidelines.md
+<!-- Read .rcode/references/agent-contracts.md only if defining or debugging agent contracts -->
+<!-- Read .rcode/references/gates.md only if implementing or troubleshooting gate logic -->
 @.rcode/references/thinking-models-planning.md
 </required_reading>
 
@@ -64,6 +64,16 @@ Valid rcode subagent types (use exact names — do not fall back to 'general-pur
 
 <process>
 
+## --from-stub mode
+
+When `--from-stub` is passed:
+1. Check for existing `PLAN.md` in the phase directory
+2. If found: read it as the planning skeleton — do NOT re-derive phase goals or re-research the phase
+3. Expand the stub into full SPRINT.md files using the stories already listed in PLAN.md
+4. If no PLAN.md exists: fall back to standard planning mode (derive from ROADMAP + RESEARCH.md)
+
+This mode exists to skip expensive re-derivation when a human or prior agent has already produced a planning skeleton.
+
 ## 0. Project-Status Preflight
 
 ```bash
@@ -1023,6 +1033,9 @@ Verification: {Passed | Passed with override | Skipped}
 
 /rcode-execute {X} ${RCODE_WS}
 
+**Next step — paste this to execute:**
+> /rcode-execute {X}
+
 ───────────────────────────────────────────────────────────────
 
 **Also available:**

package/server/dashboard.js

@@ -38,6 +38,10 @@ const { renderHtml } = require('./lib/html/shell');
 const PORT = parseInt(process.env.PORT || '7717', 10);
 const RCODE_DIR = process.env.RCODE_DIR || path.join(process.cwd(), '.rcode');
 const PROJECT_ROOT = path.dirname(RCODE_DIR);
+// Fallback root for agent prompts when rcode is installed as a package (not run
+// from inside the rcode source repo). server/dashboard.js lives at <pkg>/server/,
+// so <pkg> is one level up.
+const PACKAGE_ROOT = path.join(__dirname, '..');
 
 // Shared orchestrator token — passed to the orchestrator via env and embedded
 // in the HTML. Persisted to ~/.rcode/orch-token so it stays STABLE across
@@ -93,12 +97,12 @@ function handleRequest(req, res) {
   }
 
   if (url === '/api/agents') {
-    handleApiAgents(req, res, PROJECT_ROOT);
+    handleApiAgents(req, res, PROJECT_ROOT, PACKAGE_ROOT);
     return;
   }
 
   if (url.startsWith('/api/file')) {
-    handleApiFile(req, res, PROJECT_ROOT);
+    handleApiFile(req, res, PROJECT_ROOT, PACKAGE_ROOT);
     return;
   }
 

package/server/lib/api.js

@@ -120,7 +120,7 @@ function handleApiFiles(req, res, projectRoot) {
   res.end(JSON.stringify(groups));
 }
 
-function handleApiFile(req, res, projectRoot) {
+function handleApiFile(req, res, projectRoot, packageRoot) {
   const url = req.url || '';
   const params = new URLSearchParams(url.split('?')[1] || '');
   const relPath = params.get('path') || '';
@@ -128,24 +128,33 @@ function handleApiFile(req, res, projectRoot) {
     res.writeHead(400); res.end('Missing path parameter'); return;
   }
   // Fix #321: decode URL-encoded characters before resolving
-  const decoded = decodeURIComponent(relPath);
-  const resolved = path.resolve(projectRoot, decoded.replace(/^\//, ''));
-  if (!resolved.startsWith(projectRoot + path.sep) && resolved !== projectRoot) {
-    res.writeHead(403); res.end('Forbidden'); return;
+  const decoded = decodeURIComponent(relPath).replace(/^\//, '');
+
+  if (!decoded.endsWith('.md')) {
+    res.writeHead(403); res.end('Forbidden: only .md files'); return;
   }
-  // Dereference symlinks so a symlink outside projectRoot cannot bypass the guard
-  let realResolved;
-  try { realResolved = fs.realpathSync(resolved); }
-  catch { res.writeHead(404); res.end('File not found'); return; }
-  if (!realResolved.startsWith(projectRoot + path.sep) && realResolved !== projectRoot) {
-    res.writeHead(403); res.end('Forbidden'); return;
+
+  // Helper: try to read `decoded` relative to `root`; returns content string or null.
+  function tryRead(root) {
+    const resolved = path.resolve(root, decoded);
+    if (!resolved.startsWith(root + path.sep) && resolved !== root) return null;
+    let real;
+    try { real = fs.realpathSync(resolved); } catch { return null; }
+    if (!real.startsWith(root + path.sep) && real !== root) return null;
+    try { return fs.readFileSync(resolved, 'utf8'); } catch { return null; }
   }
-  if (!resolved.endsWith('.md')) {
-    res.writeHead(403); res.end('Forbidden: only .md files'); return;
+
+  // For rcode/agents/ paths fall back to the package install dir when the file
+  // doesn't exist under the project root (rcode installed as a dependency).
+  const isAgentPath = decoded.startsWith('rcode/agents/');
+  let content = tryRead(projectRoot);
+  if (content === null && isAgentPath && packageRoot && packageRoot !== projectRoot) {
+    content = tryRead(packageRoot);
+  }
+
+  if (content === null) {
+    res.writeHead(404); res.end('File not found'); return;
   }
-  let content;
-  try { content = fs.readFileSync(resolved, 'utf8'); }
-  catch { res.writeHead(404); res.end('File not found'); return; }
   res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
   res.end(content);
 }
@@ -242,11 +251,17 @@ function parseAgentFrontmatter(raw) {
 // returns one small frontmatter summary per agent .md file. Full prompt
 // bodies are NOT included; the client fetches those lazily per agent via the
 // existing /api/file handler when a card is opened.
-function handleApiAgents(req, res, projectRoot) {
-  const agentsDir = path.join(projectRoot, 'rcode', 'agents');
+function handleApiAgents(req, res, projectRoot, packageRoot) {
+  // Prefer the project's own rcode/agents/ dir; fall back to the package install
+  // dir so the drawer works in any project where rcode is an npm dependency.
+  let agentsDir = path.join(projectRoot, 'rcode', 'agents');
   let entries = [];
-  try { entries = fs.readdirSync(agentsDir, { withFileTypes: true }); }
-  catch { /* no agents dir — return an empty roster */ }
+  try { entries = fs.readdirSync(agentsDir, { withFileTypes: true }); } catch { /* ignore */ }
+  const mdEntries = entries.filter(e => e.isFile() && e.name.endsWith('.md'));
+  if (mdEntries.length === 0 && packageRoot && packageRoot !== projectRoot) {
+    agentsDir = path.join(packageRoot, 'rcode', 'agents');
+    try { entries = fs.readdirSync(agentsDir, { withFileTypes: true }); } catch { entries = []; }
+  }
   const agents = [];
   for (const e of entries) {
     if (!e.isFile() || !e.name.endsWith('.md')) continue;

package/server/lib/html/client/components/OrchPanel.js

@@ -50,6 +50,9 @@ function closeStream(storyId) {
 
 // ── Component ─────────────────────────────────────────────────────────────────
 
+const STORAGE_KEY = 'rcode-orch-panel-w';
+const MIN_W = 360;
+
 export function OrchPanel() {
   const { orchPanel, activeSessions } = useStore();
   const open     = !!(orchPanel && orchPanel.open);
@@ -60,7 +63,15 @@ export function OrchPanel() {
   // sessionsMap: { [storyId]: { title, lines, fileOps, status } }
   const [sessionsMap, setSessionsMap] = useState({});
   const [activeTab,   setActiveTab  ] = useState(null);
-  const bodyRef = useRef(null);
+  const bodyRef  = useRef(null);
+  const panelRef = useRef(null);
+
+  // Restore saved width on open
+  useEffect(() => {
+    if (!open || !panelRef.current) return;
+    const saved = localStorage.getItem(STORAGE_KEY);
+    if (saved) panelRef.current.style.setProperty('--orch-w', saved + 'px');
+  }, [open]);
 
   // Scroll to bottom whenever lines change for the active tab
   useEffect(() => {
@@ -167,6 +178,35 @@ export function OrchPanel() {
     setState({ orchPanel: null });
   }, []);
 
+  // Horizontal resize via the left-edge drag handle
+  function handleResizeDown(e) {
+    e.preventDefault();
+    const startX = e.clientX;
+    const el = panelRef.current;
+    if (!el) return;
+    const startW = el.getBoundingClientRect().width;
+    const handle = e.currentTarget;
+    handle.classList.add('dragging');
+
+    function onMove(ev) {
+      const delta = startX - ev.clientX;
+      const maxW = Math.floor(window.innerWidth * 0.7);
+      const w = Math.min(maxW, Math.max(MIN_W, startW + delta));
+      el.style.setProperty('--orch-w', w + 'px');
+    }
+
+    function onUp(ev) {
+      document.removeEventListener('mousemove', onMove);
+      document.removeEventListener('mouseup', onUp);
+      handle.classList.remove('dragging');
+      const w = Math.round(el.getBoundingClientRect().width);
+      localStorage.setItem(STORAGE_KEY, w);
+    }
+
+    document.addEventListener('mousemove', onMove);
+    document.addEventListener('mouseup', onUp);
+  }
+
   // Open (or focus) a session tab and attach its live stream. Used both for
   // locally-opened tabs and for sessions discovered via the orchestrator API.
   function handleTabClick(storyId) {
@@ -221,7 +261,8 @@ export function OrchPanel() {
   const panelCls = 'orch-panel' + (open ? ' open' : '');
 
   return html`
-    <div class=${panelCls}>
+    <div class=${panelCls} ref=${panelRef}>
+      <div class="orch-panel-resize" onMouseDown=${handleResizeDown}></div>
       <div class="orch-panel-header">
         <div class="orch-panel-title">
           <span class=${'orch-status-dot' + (runningCount > 0 ? ' up' : '')}></span>

package/server/lib/html/client/components/dashboard/InProgress.js

@@ -7,7 +7,8 @@
  *   1. Live orchestrator sessions (store.activeSessions, status==='running') —
  *      pulsing dot, title from storyId (or the command for cmd-* runs),
  *      elapsed time since startTime; clicking opens the session's orchestrator
- *      panel (existing openOrchPanel mechanism).
+ *      panel — opens the interactive xterm terminal (openTermPanel) since
+ *      these rows are always live sessions you may want to talk to.
  *   2. Scanned tasks from `tasks.inProgress[{ title, pct }]` (pct null → the
  *      percent pill is omitted).
  *
@@ -19,7 +20,7 @@
 import { html } from '../../preact.js';
 import { useStore } from '../../store.js';
 import { orchElapsed, rowLink } from '../../util.js';
-import { openOrchPanel } from '../../orchestrator.js';
+import { openTermPanel } from '../../orchestrator.js';
 import { pressable } from '../shared.js';
 import { TaskPipeline } from '../TaskPipeline.js';
 
@@ -31,8 +32,8 @@ function sessionTitle(s) {
 
 function LiveRow({ session: s }) {
   return html`
-    <li class="ip-row ip-live-row" title=${'Open session ' + s.storyId}
-      ...${pressable(() => openOrchPanel(s.storyId))}>
+    <li class="ip-row ip-live-row" title=${'Open terminal for ' + s.storyId}
+      ...${pressable(() => openTermPanel(s.storyId, sessionTitle(s)))}>
       <span class="live-dot"></span>
       <span class="ip-title ip-live-title">${sessionTitle(s)}</span>
       <span class="ip-live-elapsed">${orchElapsed(s.startTime)}</span>

package/server/lib/html/client/components/shared.js

@@ -354,6 +354,20 @@ export function TaskCard({ task: t }) {
           ` : null}
           ${t.acceptance ? html`<div class="task-detail-row"><strong>Acceptance:</strong> ${t.acceptance}</div>` : null}
           ${t.assignee ? html`<div class="task-detail-row"><strong>Assignee:</strong> ${t.assignee}</div>` : null}
+          ${(t.actions && t.actions.length) ? html`
+            <div class="task-actions">
+              <div class="task-actions-title">Actions performed</div>
+              <ol class="task-actions-list">
+                ${t.actions.map((step, i) => html`<li key=${i} class="task-action-step">${step}</li>`)}
+              </ol>
+            </div>
+          ` : null}
+          ${t.outcome ? html`
+            <div class="task-outcome">
+              <span class="task-outcome-label">Result</span>
+              <span class="task-outcome-text">${t.outcome}</span>
+            </div>
+          ` : null}
           ${taskCmds.length ? html`
             <div class="task-detail-cmds">
               ${taskCmds.map(([cmd, desc]) => html`<${CmdHint} key=${cmd} cmd=${cmd} desc=${desc}/>`)}

package/server/lib/html/client/orchestrator.js

@@ -178,6 +178,19 @@ export function fetchRejections() {
     .catch(() => []);
 }
 
+/**
+ * POST /api/task-status — persist a kanban column move for storyId.
+ * status is the target column id (todo | in_progress | blocked | done).
+ */
+export function setTaskStatus(storyId, status) {
+  const tok = orchToken();
+  return fetch(ORCH_HTTP + '/api/task-status', {
+    method: 'POST',
+    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ storyId, status }),
+  }).then(r => r.json()).catch(() => ({}));
+}
+
 /**
  * POST /api/clean-sessions — remove ended sessions.
  * olderThanDays = 0 removes all ended sessions; > 0 keeps recent ones.

package/server/lib/html/client/views/KanbanView.js

@@ -10,7 +10,7 @@
 import { html, useState, useCallback } from '../preact.js';
 import { useStore, refresh } from '../store.js';
 import { allTasks, currentPhaseName } from '../util.js';
-import { stopStory, openOrchPanel } from '../orchestrator.js';
+import { stopStory, openOrchPanel, openTermPanel, setTaskStatus } from '../orchestrator.js';
 import { openRunnerPicker } from '../components/RunnerPicker.js';
 import { showToast } from '../components/shared.js';
 
@@ -56,6 +56,12 @@ function KanbanCard({ task, col, live, orchDown, onDragStart, onDragEnd }) {
     e.stopPropagation();
     stopStory(sid);
   }
+  // Live session → full interactive xterm terminal (you can type to the agent).
+  function handleTerm(e) {
+    e.stopPropagation();
+    openTermPanel(sid, sid);
+  }
+  // Ended session → lightweight read-only log view (no live TUI to mangle).
   function handleView(e) {
     e.stopPropagation();
     openOrchPanel(sid);
@@ -92,7 +98,7 @@ function KanbanCard({ task, col, live, orchDown, onDragStart, onDragEnd }) {
               onClick=${handleRun}>▶ Run</button>
           ` : isRunning ? html`
             <button class="kanban-stop-btn" onClick=${handleStop}>■ Stop</button>
-            <button class="kanban-view-btn" onClick=${handleView}>↗ View</button>
+            <button class="kanban-view-btn" onClick=${handleTerm}>↗ Terminal</button>
           ` : html`
             <button class="kanban-view-btn" onClick=${handleView}>↗ Logs</button>
           `}
@@ -188,9 +194,32 @@ export function KanbanView() {
 
   function handleDrop(e, colId) {
     if (!dragging || !dragging.id) return;
-    setVisualMoves(prev => ({ ...prev, [dragging.id]: colId }));
+    const taskId = dragging.id;
+    const prevCol = effCol(dragging, runningByStory);
+    const isRunning = !!(runningByStory && runningByStory[taskId]);
+
+    // Optimistic visual move
+    setVisualMoves(prev => ({ ...prev, [taskId]: colId }));
+
+    const anchor = document.querySelector('[data-story-id="' + taskId + '"]') || e.currentTarget;
+
+    if (colId === 'in_progress' && (prevCol === 'todo' || prevCol === 'blocked') && !isRunning) {
+      openRunnerPicker(anchor, {
+        kind: 'session', storyId: taskId, cmd: '/rcode-dev-story ' + taskId, title: taskId,
+      });
+      setTaskStatus(taskId, 'in_progress').then(() => {
+        refresh();
+        setVisualMoves(prev => { const n = { ...prev }; delete n[taskId]; return n; });
+      });
+    } else {
+      setTaskStatus(taskId, colId).then(() => {
+        refresh();
+        setVisualMoves(prev => { const n = { ...prev }; delete n[taskId]; return n; });
+      });
+      showToast('Moved to ' + (COLS.find(c => c.id === colId)?.label || colId));
+    }
+
     setDragging(null);
-    showToast('Moved (visual only — not persisted)'); // visual only — not persisted
   }
 
   // ---- Manual refresh ----