@humanbased/crosscheck 1.2.0-beta.81 → 1.3.0-beta.100

package/dist/lib/runner.js

@@ -4,12 +4,15 @@ import { readFileSync } from 'fs';
 import { join } from 'path';
 import chalk from 'chalk';
 import { filterStepsByTypes } from './repo-workflow.js';
+import { vendorDisplayName } from '../lib/vendor.js';
 import { runCodexReview } from '../reviewers/codex.js';
 import { runClaudeReview } from '../reviewers/claude.js';
 import { runFixStep, runCodexFixStep } from '../reviewers/fix.js';
 import { runConflictResolveStep, findConflictedFiles } from '../reviewers/conflict-resolve.js';
 import { parseVerdict, prependVerdictToComment, NULL_VERDICT_WARNING, applySeverityGate, SEVERITY_GATE_NOTE } from '../lib/verdict.js';
 import { createGithubClient, postReviewComment, getLastCrossCheckCommentId, getLastCrossCheckReviewComment } from '../github/client.js';
+import { autoFixBranchName, autoFixPRIntro, sourcePRHasMerged } from '../github/superseded-fix-pr.js';
+import { verifyReviewedSha, isVerifiedReviewedSha, reviewedShaRejection } from '../github/reviewed-sha.js';
 import { resolveLinearAuth, withWorker } from '../linear/identity.js';
 import { notifyLinear } from '../linear/notify.js';
 import { shouldPostToLinear } from '../linear/comment.js';
@@ -21,6 +24,8 @@ import { resolveClaudeModel, resolveCodexModel } from '../lib/review-models.js';
 import { resolveReviewStrategy, escalate, clampToLevels } from './review-strategy.js';
 import { CLAUDE_EFFORT_LEVELS, CODEX_EFFORT_LEVELS } from '../config/schema.js';
 import { buildStepIdentityFields } from '../lib/event-fields.js';
+import { planAutoFixDelivery, forceWithLeaseArgs, parseLsRemoteOid, isLeaseRejection, assessFixBranchOwnership, isInvalidBaseError } from '../lib/auto-fix-branch.js';
+import { prOpenToVerdictMs } from '../lib/adoption.js';
 import { buildAttributionFooter, buildFixAppliedCommentBody, buildFixFailedCommentBody, buildConflictResolvedCommentBody, buildRetriedReviewBanner } from '../lib/comment-bodies.js';
 import { linearWritePossible, loadWorkflow, loadHarnessSection, evaluateWhen } from '../lib/workflow.js';
 import { isSubscriptionLimitError, isVendorUnavailableError } from '../lib/smart-switch.js';
@@ -31,7 +36,6 @@ import { formatSkillAttribution } from '../skills/attribution.js';
 const MAX_CROSSCHECK_COMMITS = 5;
 const FIX_RETRY_DELAY_MS = 2 * 60 * 1000;
 const REVIEW_RETRY_DELAY_MS = 2 * 60 * 1000;
-const GIT_PUSH_RETRY_DELAY_MS = 3000;
 // Per-vendor configured timeout (seconds) → execa milliseconds, or undefined when
 // unset so the reviewer falls back to its built-in default. A per-run override
 // (ctx.overrideTimeoutMs, set by --timeout / --crazy / --halfcrazy) always wins
@@ -138,6 +142,52 @@ export function exceedsMaxRounds(effectiveType, originalStepType, maxRounds, rou
 export function anyFixApplied(results) {
     return Object.values(results).some(r => (r.applied_count ?? 0) > 0);
 }
+export function resolveFixLanding(deliveryMode) {
+    switch (deliveryMode) {
+        case 'comment': return 'comment';
+        case 'commit': return 'branch';
+        case 'pull_request': return 'branch-then-separate-pr';
+    }
+}
+// stepsRun holds every step the runner dispatched, skips included; results holds
+// what each one did. Split them so callers can report a run where nothing
+// happened without re-deriving the reasons from the log file.
+export function summariseStepOutcomes(stepsRun, results) {
+    const outcomes = { ran: [], skipped: [] };
+    for (const name of new Set(stepsRun)) {
+        const result = results[name];
+        if (result?.skipped)
+            outcomes.skipped.push({ step: name, reason: result.skipReason ?? 'unknown' });
+        else
+            outcomes.ran.push(name);
+    }
+    return outcomes;
+}
+// Accumulates outcomes across the fix→recheck rounds of one invocation, so the
+// completion line reports whether the run as a whole did work: a first round
+// that skips everything followed by a round that applies a fix is not a
+// "no step ran" run.
+//
+// Running once wins over skipping any number of times — the step demonstrably
+// happened. A step skipped in several rounds is reported once, carrying its
+// latest reason: that is the state the run ended in, and listing the same step
+// several times reads as several distinct problems.
+export function mergeStepOutcomes(base, next) {
+    if (!base)
+        return next;
+    if (!next)
+        return base;
+    const ran = [...new Set([...base.ran, ...next.ran])];
+    const ranSet = new Set(ran);
+    // Map.set on an existing key overwrites the reason but keeps the original
+    // position, so order stays first-seen while the reason stays last-seen.
+    const skipped = new Map();
+    for (const entry of [...base.skipped, ...next.skipped]) {
+        if (!ranSet.has(entry.step))
+            skipped.set(entry.step, entry.reason);
+    }
+    return { ran, skipped: [...skipped].map(([step, reason]) => ({ step, reason })) };
+}
 function countComments(reviewText) {
     const bullets = (reviewText.match(/^[-*•]\s/gm) ?? []).length;
     const numbered = (reviewText.match(/^\d+\.\s/gm) ?? []).length;
@@ -178,16 +228,54 @@ function resolveLimitFallbackVendor(failedVendor, stepType, config) {
     const fallback = failedVendor === 'claude' ? 'codex' : 'claude';
     return config.vendors[fallback].enabled && supportsStep(fallback, stepType) ? fallback : null;
 }
-// Extends resolveReviewer with a human-origin fallback for the fix step.
+// ─── commit subjects ──────────────────────────────────────────────────────────
+// The vendor is a parameter, not a constant: the vendor that ran the step is
+// known at every call site, and a subject crediting a different one contradicts
+// the Crosscheck-Reviewer trailer on its own commit.
+// The `[crosscheck]` prefix and the step word after it are parsed —
+// countCrosscheckCommitsForPR greps the prefix to enforce the commit cap — so
+// only the trailing attribution varies.
+export function fixCommitSubject(appliedCount, vendor) {
+    return `[crosscheck] fix: apply ${appliedCount} fix${appliedCount !== 1 ? 'es' : ''} from code review — by ${vendorDisplayName(vendor)}`;
+}
+export function fixPRCommitSubject(prNumber, vendor) {
+    return `[crosscheck] fix: apply CR fixes from review of PR #${prNumber} — by ${vendorDisplayName(vendor)}`;
+}
+export function conflictResolveCommitSubject(conflictCount, vendor) {
+    return `[crosscheck] resolve: resolve ${conflictCount} conflict${conflictCount !== 1 ? 's' : ''} — by ${vendorDisplayName(vendor)}`;
+}
+// Extends resolveReviewer with a human-origin fallback for the steps that write
+// code (fix, conflict-resolve).
 // Scoped to reviewer: 'origin' only — other reviewer types (claude, codex, auto)
 // already encode explicit vendor intent and need no fallback.
 // When origin is 'human' and no vendor resolved, honours routing.fallback_reviewer
-// so the fix step respects the same routing intent as the review step.
-// 'auto' mirrors resolveReviewer's auto path (config-enabled check, codex-first)
-// without async auth calls. null disables the fallback entirely.
-// Exported so callers can detect when the fallback was applied (e.g. for logging).
-export function resolveFixVendor(stepReviewer, origin, config, fallback) {
+// so the step respects the same routing intent as the review step.
+// 'auto' resolves against the vendors that can actually run stepType, so a step
+// only one vendor supports doesn't fall back to the other and skip a line later.
+// An explicit 'claude'/'codex' is an operator decision and is honoured as written
+// even when that vendor cannot run the step — the caller then reports a precise
+// unsupported-step skip instead of silently substituting a different vendor.
+// null disables the fallback entirely.
+function resolveStepVendor(stepType, stepReviewer, origin, config, fallback) {
     const vendor = resolveReviewer(stepReviewer, origin, config, fallback);
+    // Origin detection can assign a vendor that cannot run the step: conflict
+    // resolution is Claude-only, so a Codex-origin PR (reviewer: 'origin', origin:
+    // 'codex') resolves to 'codex' and the dispatch skips it as unsupported — the
+    // conflicts never get resolved. (#284's `Crosscheck-Reviewer: codex` detection
+    // introduced this: these crosscheck-authored fix PRs used to detect as 'human'
+    // and the auto fallback picked Claude.) Substitute a capable, enabled vendor.
+    // Scoped to origin-derived assignment only — an explicit reviewer: claude|codex,
+    // reviewer: auto, or routing.fallback_reviewer is an operator decision, left as
+    // written so the caller can report the precise unsupported-step skip.
+    if (stepReviewer === 'origin' &&
+        (origin === 'claude' || origin === 'codex') &&
+        vendor !== null &&
+        !supportsStep(vendor, stepType)) {
+        const capable = vendor === 'claude' ? 'codex' : 'claude';
+        if (config.vendors[capable].enabled && supportsStep(capable, stepType)) {
+            return { vendor: capable, usedHumanFallback: false, substitutedOriginVendor: vendor };
+        }
+    }
     if (vendor !== null || origin !== 'human' || stepReviewer !== 'origin') {
         return { vendor, usedHumanFallback: false };
     }
@@ -198,13 +286,25 @@ export function resolveFixVendor(stepReviewer, origin, config, fallback) {
     else if (fb === 'codex')
         humanFallback = config.vendors.codex.enabled ? 'codex' : null;
     else if (fb !== null) {
-        // 'auto': prefer codex then claude, same as resolveReviewer's auto path
-        humanFallback = config.vendors.codex.enabled ? 'codex' : config.vendors.claude.enabled ? 'claude' : null;
+        // 'auto': prefer codex then claude, same as resolveReviewer's auto path,
+        // narrowed to vendors that support this step type.
+        const usable = (v) => config.vendors[v].enabled && supportsStep(v, stepType);
+        humanFallback = usable('codex') ? 'codex' : usable('claude') ? 'claude' : null;
     }
     if (!humanFallback)
         return { vendor: null, usedHumanFallback: false };
     return { vendor: humanFallback, usedHumanFallback: true };
 }
+// Exported so callers can detect when the fallback was applied (e.g. for logging).
+export function resolveFixVendor(stepReviewer, origin, config, fallback) {
+    return resolveStepVendor('fix', stepReviewer, origin, config, fallback);
+}
+// The default workflow gives conflict-resolve `reviewer: origin`, so every PR
+// crosscheck cannot attribute resolved to null here and skipped with 'no_vendor'
+// — the fix step honoured routing.fallback_reviewer, this one did not.
+export function resolveConflictResolveVendor(stepReviewer, origin, config, fallback) {
+    return resolveStepVendor('conflict-resolve', stepReviewer, origin, config, fallback);
+}
 // ─── pr_complexity helpers ────────────────────────────────────────────────────
 const EXT_LANG = {
     ts: 'typescript', tsx: 'typescript', js: 'javascript', jsx: 'javascript',
@@ -456,7 +556,7 @@ async function pushWithNonFastForwardHandling(params) {
     const { tmpDir, branch, token, log, fileLog, owner, repoName, prNumber } = params;
     const env = { ...process.env, GITHUB_TOKEN: token, GH_TOKEN: token };
     try {
-        execSync(`git push origin HEAD:${branch}`, { cwd: tmpDir, env });
+        execFileSync('git', ['push', 'origin', `HEAD:${branch}`], { cwd: tmpDir, env });
     }
     catch (pushErr) {
         const pushMsg = pushErr instanceof Error ? pushErr.message : String(pushErr);
@@ -472,11 +572,11 @@ async function pushWithNonFastForwardHandling(params) {
             log(chalk.yellow(`⚠  push rejected (non-fast-forward) — fetching latest and rebasing...`));
             try {
                 // Fetch the latest state of the branch
-                execSync(`git fetch origin ${branch}`, { cwd: tmpDir, env, stdio: 'pipe' });
+                execFileSync('git', ['fetch', 'origin', branch], { cwd: tmpDir, env, stdio: 'pipe' });
                 // Rebase our changes onto the latest branch state
-                execSync(`git rebase origin/${branch}`, { cwd: tmpDir, env, stdio: 'pipe' });
+                execFileSync('git', ['rebase', `origin/${branch}`], { cwd: tmpDir, env, stdio: 'pipe' });
                 // Retry the push
-                execSync(`git push origin HEAD:${branch}`, { cwd: tmpDir, env });
+                execFileSync('git', ['push', 'origin', `HEAD:${branch}`], { cwd: tmpDir, env });
                 fileLog({
                     level: 'info',
                     event: 'push_rebase_succeeded',
@@ -692,7 +792,7 @@ export async function runWorkflow(ctx) {
             const effectiveType = getEffectiveStepType(step.type, ctx.isRecheckRun === true);
             if (exceedsMaxRounds(effectiveType, step.type, ctx.overrideMaxRounds ?? step.max_rounds, ctx.round)) {
                 fileLog({ level: 'info', event: 'step_skipped', repo: `${owner}/${repoName}`, pr: prNumber, step: step.name, reason: 'max_rounds' });
-                results[step.name] = { skipped: true };
+                results[step.name] = { skipped: true, skipReason: 'max_rounds' };
                 if (effectiveType === 'fix')
                     onPhaseChange('', { phase: 'fixed', fixCount: 0 });
                 else if (effectiveType === 'recheck')
@@ -704,7 +804,7 @@ export async function runWorkflow(ctx) {
             // Evaluate when condition — skip step if false
             if (step.when && !evaluateWhen(step.when, results)) {
                 fileLog({ level: 'info', event: 'step_skipped', repo: `${owner}/${repoName}`, pr: prNumber, step: step.name, reason: 'when_condition' });
-                results[step.name] = { skipped: true };
+                results[step.name] = { skipped: true, skipReason: 'when_condition' };
                 if (effectiveType === 'fix')
                     onPhaseChange('', { phase: 'fixed', fixCount: 0 });
                 else if (effectiveType === 'recheck')
@@ -718,7 +818,7 @@ export async function runWorkflow(ctx) {
             // review coerced to a recheck (isRecheckRun) is never blocked here.
             if (step.type === 'recheck' && reviewRanThisSession && !anyFixApplied(results)) {
                 fileLog({ level: 'info', event: 'step_skipped', repo: `${owner}/${repoName}`, pr: prNumber, step: step.name, reason: 'no_change_since_review' });
-                results[step.name] = { skipped: true };
+                results[step.name] = { skipped: true, skipReason: 'no_change_since_review' };
                 onPhaseChange('', { phase: 'rechecked' });
                 continue;
             }
@@ -727,7 +827,7 @@ export async function runWorkflow(ctx) {
                 let reviewer = resolveReviewer(step.reviewer, origin, config, ctx.smartSwitchFallback);
                 if (!reviewer) {
                     fileLog({ level: 'info', event: 'step_skipped', repo: `${owner}/${repoName}`, pr: prNumber, step: step.name, reason: 'no_reviewer' });
-                    results[step.name] = { skipped: true };
+                    results[step.name] = { skipped: true, skipReason: 'no_reviewer' };
                     continue;
                 }
                 // The recheck step is confirmed to run — clear the pending-recheck guard
@@ -756,7 +856,7 @@ export async function runWorkflow(ctx) {
                 const runReviewWithVendor = async (candidate) => {
                     if (candidate === 'codex') {
                         ;
-                        ({ review: rawReview, tokensUsed, model, effort, retried } = await runCodexReview(tmpDir, pr.base.ref, pr.title, quality, codexVendor, step.instructions, undefined, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec), log, ctx.issueContext, skillSession));
+                        ({ review: rawReview, tokensUsed, model, effort, retried } = await runCodexReview(tmpDir, pr.base.ref, pr.title, quality, codexVendor, step.instructions, undefined, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec), log, ctx.issueContext, skillSession, config.skills.codex_full_access));
                         inputTokens = undefined;
                         outputTokens = undefined;
                     }
@@ -851,7 +951,12 @@ export async function runWorkflow(ctx) {
                     ? `${buildRetriedReviewBanner(retried.timeoutMs, retried.delayMs)}\n\n${baseBody}`
                     : baseBody;
                 const commentCount = countComments(rawReview);
-                fileLog({ level: 'info', event: 'review_complete', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, model, ...stepIdentity, verdict, duration_ms: Date.now() - stepStart, tokens_used: tokensUsed, skills_activated: activatedSkills.map(skill => skill.name), ...(inputTokens !== undefined && { input_tokens: inputTokens }), ...(outputTokens !== undefined && { output_tokens: outputTokens }), ...(ctx.round !== undefined && { round: ctx.round }), ...(ctx.roundMode && { mode: ctx.roundMode }), ...triggerField });
+                // How long the PR waited for a verdict, measured from when its author opened
+                // it — the number a team feels, as distinct from duration_ms (how long the
+                // reviewer ran). Omitted rather than guessed when the PR event carried no
+                // created_at, so the metric never mixes real latencies with invented ones.
+                const openToVerdictMs = prOpenToVerdictMs(pr.created_at, verdict);
+                fileLog({ level: 'info', event: 'review_complete', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, model, ...stepIdentity, verdict, duration_ms: Date.now() - stepStart, ...(openToVerdictMs !== undefined && { open_to_verdict_ms: openToVerdictMs }), tokens_used: tokensUsed, skills_activated: activatedSkills.map(skill => skill.name), ...(inputTokens !== undefined && { input_tokens: inputTokens }), ...(outputTokens !== undefined && { output_tokens: outputTokens }), ...(ctx.round !== undefined && { round: ctx.round }), ...(ctx.roundMode && { mode: ctx.roundMode }), ...triggerField });
                 // Recheck verdict is stored separately to preserve the original review's commentCount on the board
                 const phaseUpdate = isRecheck
                     ? { recheckVerdict: verdict, phase: donePhase, recheckTokens: tokensUsed, recheckReviewer: reviewer, qualityTier: quality.tier }
@@ -890,6 +995,28 @@ export async function runWorkflow(ctx) {
                         annotationSha = execSync('git rev-parse HEAD', { cwd: tmpDir, encoding: 'utf8' }).trim();
                     }
                     catch { /* fall back to pr.head.sha if git is unavailable */ }
+                    // ...but the clone's HEAD is only trustworthy once it is in the repo. A fix
+                    // commit whose push failed leaves HEAD one commit ahead of the remote, and
+                    // stamping it attributes this verdict to code that does not exist — an APPROVE
+                    // on a phantom sha clears the previous BLOCK and reads as routine on the PR
+                    // page. Refuse to post rather than post an unattributable verdict: a missing
+                    // review is recoverable (the run fails, the pending status releases as
+                    // failure, the PR stays blocked), a phantom approval is not.
+                    const shaVerification = await verifyReviewedSha(octokit, owner, repoName, prNumber, annotationSha);
+                    if (!isVerifiedReviewedSha(shaVerification.status)) {
+                        const rejection = reviewedShaRejection(shaVerification, annotationSha, verdict);
+                        fileLog({ level: 'error', event: 'verdict_sha_unverified', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, ...stepIdentity, verdict, sha: annotationSha, head_sha: shaVerification.headSha, verification: shaVerification.status, ...(ctx.round !== undefined && { round: ctx.round }), ...triggerField });
+                        log(chalk.red(`✗ ${rejection}`));
+                        // The review itself cost vendor tokens — surface it rather than lose it.
+                        log(chalk.dim(`\n--- unposted review ---\n${commentBody}\n--- end ---`));
+                        throw new Error(rejection);
+                    }
+                    if (shaVerification.status === 'descendant') {
+                        // The reviewed commit is real but ahead of the PR head — the fix landed on a
+                        // separate auto-fix branch. Recorded so a verdict that does not cover HEAD is
+                        // explicable from the log rather than looking like the head-matching case.
+                        fileLog({ level: 'warn', event: 'verdict_sha_off_head', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, ...stepIdentity, verdict, sha: annotationSha, head_sha: shaVerification.headSha, ...(ctx.round !== undefined && { round: ctx.round }), ...triggerField });
+                    }
                     const commentId = await postReviewComment(octokit, owner, repoName, prNumber, commentBody, reviewer, config.brand, origin, verdict ?? undefined, priorReviewId, isRecheck, model, effectiveType, ctx.round ?? 1, annotationSha, nextStepAnnotation, ctx.trigger === 'kickass' ? 'kickass' : undefined, activatedSkills, effort, 
                     // Withheld when an explicit vendors.*.model overrode the tier map:
                     // citing a tier the run did not use would assert a routing decision
@@ -899,6 +1026,16 @@ export async function runWorkflow(ctx) {
                         : undefined);
                     const commentUrl = `github.com/${owner}/${repoName}/pull/${prNumber}`;
                     fileLog({ level: 'info', event: 'comment_posted', repo: `${owner}/${repoName}`, pr: prNumber, url: `https://${commentUrl}` });
+                    // A posted verdict that blocks the merge is the product's whole reason to
+                    // exist, so it gets its own event rather than being re-derived downstream.
+                    // BLOCK blocks by definition; a NEEDS WORK that reached here survived the
+                    // severity gate, which only lets it through when a Critical/High/Medium
+                    // finding backs it — a nit-only review was already downgraded to APPROVE.
+                    // Logged only here, after the comment actually posted, so dry runs and
+                    // failed postReviewComment calls are never counted as posted findings.
+                    if (verdict === 'BLOCK' || verdict === 'NEEDS WORK') {
+                        fileLog({ level: 'info', event: 'blocking_finding_posted', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, model, ...stepIdentity, verdict, ...(ctx.round !== undefined && { round: ctx.round }), ...triggerField });
+                    }
                     // Mirror the verdict onto the PR's Linear issue. `run` and `watch` both
                     // land here, so this is the path that matters — reviews posted from
                     // commands/review.ts are the exception, not the rule.
@@ -938,7 +1075,7 @@ export async function runWorkflow(ctx) {
                 const skipFix = (reason) => {
                     lastFixSkipReason = reason;
                     onPhaseChange('', { phase: 'fixed', fixCount: 0 });
-                    results[step.name] = { skipped: true };
+                    results[step.name] = { skipped: true, skipReason: reason };
                     fileLog({ level: 'info', event: 'step_skipped', repo: `${owner}/${repoName}`, pr: prNumber, step: step.name, reason });
                 };
                 if (ctx.dryRun) {
@@ -1028,7 +1165,7 @@ export async function runWorkflow(ctx) {
                 const skillSession = skillSessionFor(step.name, effectiveType);
                 const runFix = async (v) => {
                     if (v === 'codex') {
-                        return runCodexFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', codexFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec) ?? tierMs, skillSession, codexVendor.effort);
+                        return runCodexFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', codexFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec) ?? tierMs, skillSession, codexVendor.effort, config.skills.codex_full_access);
                     }
                     // roundConfig, not config: runFixStep reads vendors.claude.effort and
                     // quality.tier out of it, and both must be this round's values.
@@ -1137,13 +1274,14 @@ export async function runWorkflow(ctx) {
                     continue;
                 }
                 const deliveryMode = config.post_review.auto_fix.delivery.mode;
-                if (deliveryMode === 'commit') {
+                const landing = resolveFixLanding(deliveryMode);
+                if (landing === 'branch') {
                     const fixModel = activeVendor === 'codex' ? codexFixModel : claudeFixModel;
                     execSync('git add -A', { cwd: tmpDir });
                     execFileSync('git', [
                         'commit',
                         '-m',
-                        `[crosscheck] fix: apply ${appliedCount} fix${appliedCount !== 1 ? 'es' : ''} from code review — by Claude Code`,
+                        fixCommitSubject(appliedCount, activeVendor),
                         '-m',
                         buildCommitTrailers({ reviewer: activeVendor, model: fixModel, step: 'fix', service: 'crosscheck' }),
                     ], { cwd: tmpDir });
@@ -1202,52 +1340,306 @@ export async function runWorkflow(ctx) {
                     }
                     results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
                 }
-                else if (deliveryMode === 'pull_request') {
+                else if (landing === 'branch-then-separate-pr') {
                     const fixModel = activeVendor === 'codex' ? codexFixModel : claudeFixModel;
-                    // Create a fix branch and open a PR targeting the original branch
-                    const fixBranch = `fix/cr-${prNumber}-review-issues`;
-                    execSync(`git checkout -b ${fixBranch}`, { cwd: tmpDir });
+                    // Commit the fix on the PR's own branch (already checked out in tmpDir) and
+                    // try to push it there, so the fix, recheck, and approval all stay on the
+                    // original PR. Only when that push can't land — e.g. the PR was merged and
+                    // its branch deleted, or the branch is protected — do we fall back to opening
+                    // a separate follow-up PR that carries the very same commit.
                     execSync('git add -A', { cwd: tmpDir });
                     execFileSync('git', [
                         'commit',
                         '-m',
-                        `[crosscheck] fix: apply CR fixes from review of PR #${prNumber} — by Claude Code`,
+                        fixPRCommitSubject(prNumber, activeVendor),
                         '-m',
                         buildCommitTrailers({ reviewer: activeVendor, model: fixModel, step: 'fix', service: 'crosscheck' }),
                     ], { cwd: tmpDir });
                     const newSha = execSync('git rev-parse HEAD', { cwd: tmpDir, encoding: 'utf8' }).trim();
-                    execSync(`git push origin HEAD:${fixBranch}`, {
-                        cwd: tmpDir,
-                        env: { ...process.env, GITHUB_TOKEN: token, GH_TOKEN: token },
-                    });
+                    let landedOnBranch = false;
+                    try {
+                        await pushWithNonFastForwardHandling({
+                            tmpDir,
+                            branch: pr.head.ref,
+                            token,
+                            log,
+                            fileLog: (entry) => fileLog({ ...entry, phase: 'fix' }),
+                            owner,
+                            repoName,
+                            prNumber,
+                        });
+                        landedOnBranch = true;
+                    }
+                    catch (pushErr) {
+                        fileLog({ level: 'warn', event: 'fix_branch_push_fell_back', repo: `${owner}/${repoName}`, pr: prNumber, sha: newSha, branch: pr.head.ref, error: pushErr instanceof Error ? pushErr.message.slice(0, 500) : String(pushErr), fallback: 'pull_request' });
+                    }
                     ctx.crosscheckShas.add(newSha);
-                    const octokit = createGithubClient(token);
-                    const fixPrTitle = config.post_review.auto_fix.delivery.pr_title.replace('#{original_pr_title}', pr.title);
-                    const { data: fixPr } = await octokit.rest.pulls.create({
-                        owner,
-                        repo: repoName,
-                        head: fixBranch,
-                        base: pr.head.ref,
-                        title: fixPrTitle,
-                        body: [
-                            `Auto-fix by crosscheck for CR issues found in #${prNumber}.`,
-                            '',
-                            `Review: https://github.com/${owner}/${repoName}/pull/${prNumber}`,
-                            '',
-                            fixAttributionFooter(),
-                        ].join('\n'),
-                    });
-                    if (config.post_review.auto_fix.delivery.label) {
+                    if (landedOnBranch) {
+                        // Fix landed on the PR branch — mirror `commit` delivery exactly: set the
+                        // pending status the following recheck releases, and post the fix-applied
+                        // comment so the push is visible on the PR timeline.
+                        const currentStepIdx = steps.indexOf(step);
+                        const hasRecheckAfterFix = steps.slice(currentStepIdx + 1).some(s => s.type === 'review' || s.type === 'recheck');
+                        if (hasRecheckAfterFix) {
+                            try {
+                                const lockOctokit = createGithubClient(token);
+                                await acquireRemoteLock(lockOctokit, owner, repoName, newSha);
+                                pushedShasNeedingRelease.push(newSha);
+                                fixPushedShaRequiresRecheck = newSha;
+                            }
+                            catch (err) {
+                                fileLog({ level: 'warn', event: 'remote_lock_refresh_failed', repo: `${owner}/${repoName}`, pr: prNumber, sha: newSha, error: err instanceof Error ? err.message : String(err) });
+                            }
+                        }
+                        onPhaseChange('fixed ✓', { fixCount: appliedCount, phase: 'fixed', fixTokens: fixTokensUsed });
+                        fileLog({ level: 'info', event: 'fix_complete', repo: `${owner}/${repoName}`, pr: prNumber, vendor: activeVendor, applied_count: appliedCount, sha: newSha, delivery: 'commit', tokens_used: fixTokensUsed, skills_activated: activatedSkills.map(skill => skill.name), duration_ms: Date.now() - fixStepStart, ...triggerField });
                         try {
-                            await octokit.rest.issues.addLabels({
-                                owner, repo: repoName, issue_number: fixPr.number, labels: [config.post_review.auto_fix.delivery.label],
+                            const octokit = createGithubClient(token);
+                            const body = buildFixAppliedCommentBody({
+                                owner, repo: repoName, sha: newSha, appliedCount,
+                                reviewCommentId,
+                                changedFiles: fixChangedFiles,
+                                vendor: activeVendor,
+                                reviewCommentBody,
+                                model: activeVendor === 'codex' ? codexFixModel : claudeFixModel,
+                                effort: fixEffort,
+                                skills: activatedSkills,
                             });
+                            await octokit.rest.issues.createComment({ owner, repo: repoName, issue_number: prNumber, body });
+                            fileLog({ level: 'info', event: 'fix_applied_comment_posted', repo: `${owner}/${repoName}`, pr: prNumber, sha: newSha });
+                        }
+                        catch (err) {
+                            fileLog({ level: 'warn', event: 'fix_applied_comment_failed', repo: `${owner}/${repoName}`, pr: prNumber, error: err instanceof Error ? err.message : String(err) });
                         }
-                        catch { /* label may not exist in this repo — skip */ }
+                        results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
+                    }
+                    else {
+                        // Fallback: the fix could not land on the PR branch. Push the same commit to a
+                        // dedicated branch and open a follow-up PR targeting the original branch.
+                        const fixBranch = autoFixBranchName(prNumber);
+                        const gitEnv = { ...process.env, GITHUB_TOKEN: token, GH_TOKEN: token };
+                        const octokit = createGithubClient(token);
+                        // The fallback commit exists only in this clone until something pushes it, so
+                        // every path that ends without delivering it as a PR has to put HEAD back on the
+                        // PR head. Otherwise a later recheck reviews that commit and stamps its verdict
+                        // either with a sha the repository cannot resolve — which verifyReviewedSha
+                        // refuses to post (#290) — or with one no open PR carries.
+                        const restorePRHeadInClone = () => {
+                            execSync('git reset --hard HEAD~1', { cwd: tmpDir, stdio: 'pipe' });
+                        };
+                        // Deliver the fix as a diff on the original PR. Used wherever opening the
+                        // follow-up PR would either create a stale artifact or overwrite a branch that
+                        // is not ours: the work still reaches a human, just not as a branch.
+                        const deliverFixAsComment = async (outcome) => {
+                            fileLog({ level: 'warn', event: outcome.event, repo: `${owner}/${repoName}`, pr: prNumber, branch: outcome.branch, reason: outcome.reason });
+                            log(chalk.yellow(`⚠  ${outcome.notice}`));
+                            let patch = '';
+                            try {
+                                patch = execSync('git diff HEAD~1', { cwd: tmpDir, encoding: 'utf8' });
+                            }
+                            catch { /* fall through to the empty check */ }
+                            if (patch) {
+                                await octokit.rest.issues.createComment({
+                                    owner, repo: repoName, issue_number: prNumber,
+                                    body: [
+                                        '### Suggested fixes (crosscheck auto-fix)',
+                                        '',
+                                        outcome.explanation,
+                                        '',
+                                        '```diff',
+                                        patch.slice(0, 16000),
+                                        '```',
+                                        '',
+                                        fixAttributionFooter(),
+                                    ].join('\n'),
+                                });
+                            }
+                            restorePRHeadInClone();
+                            onPhaseChange('fixed ✓', { fixCount: appliedCount, phase: 'fixed', fixTokens: fixTokensUsed });
+                            fileLog({ level: 'info', event: 'fix_complete', repo: `${owner}/${repoName}`, pr: prNumber, vendor: activeVendor, applied_count: appliedCount, sha: newSha, delivery: 'comment', tokens_used: fixTokensUsed, skills_activated: activatedSkills.map(skill => skill.name), duration_ms: Date.now() - fixStepStart, ...triggerField });
+                            results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
+                        };
+                        // Ask whether the intended base still exists BEFORE pushing anything. The most
+                        // common reason the PR-branch push failed is that the PR merged and GitHub
+                        // deleted its branch — and `pulls.create` rejects a missing base with
+                        // `field: base, code: invalid`. That used to throw after the branch was already
+                        // pushed, losing the fix and orphaning the branch (19 times in logged runs).
+                        let baseBranchExists = true;
+                        try {
+                            await octokit.rest.repos.getBranch({ owner, repo: repoName, branch: pr.head.ref });
+                        }
+                        catch (err) {
+                            if (err?.status === 404)
+                                baseBranchExists = false;
+                            else
+                                throw err;
+                        }
+                        const delivery = planAutoFixDelivery(baseBranchExists, pr.head.ref);
+                        if (delivery.kind === 'comment') {
+                            // A PR cut from this snapshot would be stale the moment it opened — it is
+                            // exactly the artifact the superseded-auto-fix cleanup exists to close. Post
+                            // the fix as a diff instead, so the work is still delivered and reviewable.
+                            await deliverFixAsComment({
+                                event: 'fix_pr_skipped',
+                                reason: delivery.reason,
+                                branch: pr.head.ref,
+                                notice: `${pr.head.ref} no longer exists — posting the fix as a diff instead of opening a stale follow-up PR`,
+                                explanation: `\`${pr.head.ref}\` no longer exists, so this PR has merged and there is no branch to land on. The fix is below rather than in a follow-up PR — a PR cut from the pre-merge state would reintroduce whatever the merged version changed.`,
+                            });
+                            continue;
+                        }
+                        // A fix branch left behind by an earlier round of this PR made a plain push
+                        // non-fast-forward and lost the fix (12 times in logged runs). Replace it under
+                        // a lease: this round's fix is built on the newer PR head and supersedes it,
+                        // and the lease still refuses if anything other than us moved the branch.
+                        let remoteOid = null;
+                        try {
+                            remoteOid = parseLsRemoteOid(execFileSync('git', ['ls-remote', '--heads', 'origin', fixBranch], { cwd: tmpDir, env: gitEnv, encoding: 'utf8' }));
+                        }
+                        catch { /* treat an unreadable remote as "branch absent"; the lease catches a wrong guess */ }
+                        // `--force-with-lease` only protects against changes made *after* this lookup —
+                        // it happily accepts a branch a human just created or moved as the lease value
+                        // and overwrites it. So establish that the branch is crosscheck's own artifact
+                        // before replacing it, from GitHub's record of who opened the PR from it rather
+                        // than from anything the pusher can write into a commit.
+                        if (remoteOid !== null) {
+                            let crosscheckLogin = null;
+                            let candidates = [];
+                            try {
+                                const [{ data: viewer }, { data: branchPrs }] = await Promise.all([
+                                    octokit.rest.users.getAuthenticated(),
+                                    octokit.rest.pulls.list({ owner, repo: repoName, state: 'all', head: `${owner}:${fixBranch}` }),
+                                ]);
+                                crosscheckLogin = viewer.login;
+                                candidates = branchPrs;
+                            }
+                            catch { /* unreadable identity or PR list — treated as not ours, never overwrite */ }
+                            const ownership = assessFixBranchOwnership({ sourcePrNumber: prNumber, crosscheckLogin, candidates });
+                            if (!ownership.owned) {
+                                await deliverFixAsComment({
+                                    event: 'fix_branch_push_skipped',
+                                    reason: ownership.reason,
+                                    branch: fixBranch,
+                                    notice: `${fixBranch} exists but crosscheck has no PR of its own from it — leaving it in place and posting the fix as a diff instead`,
+                                    explanation: `\`${fixBranch}\` already exists and crosscheck cannot show it opened a pull request from it, so the branch was left untouched rather than force-replaced. The fix is posted here instead.`,
+                                });
+                                continue;
+                            }
+                        }
+                        // From #296: the merged-PR handler sweeps for auto-fix PRs once, so a PR opened
+                        // after that sweep is never seen by it and stays open and mergeable against a
+                        // tree that no longer exists. The base-exists check above already covers a merge
+                        // that deleted the branch; this catches a merge in a repo that keeps its
+                        // branches. It sits immediately before the push — every lookup above widens the
+                        // window it has to close, and nothing has been written to the remote yet, so a
+                        // skip here cannot orphan a branch.
+                        if (await sourcePRHasMerged(octokit, owner, repoName, prNumber)) {
+                            restorePRHeadInClone();
+                            skipFix('source_pr_merged');
+                            continue;
+                        }
+                        try {
+                            execFileSync('git', forceWithLeaseArgs(fixBranch, remoteOid), { cwd: tmpDir, env: gitEnv, stdio: 'pipe' });
+                        }
+                        catch (pushErr) {
+                            const pushMsg = pushErr instanceof Error ? pushErr.message : String(pushErr);
+                            fileLog({
+                                level: 'error', event: 'fix_branch_push_failed', repo: `${owner}/${repoName}`, pr: prNumber,
+                                branch: fixBranch, lease: remoteOid ?? 'absent',
+                                reason: isLeaseRejection(pushMsg) ? 'lease_rejected' : 'push_failed',
+                                error: pushMsg.slice(0, 500),
+                            });
+                            throw pushErr;
+                        }
+                        if (remoteOid !== null) {
+                            fileLog({ level: 'info', event: 'fix_branch_replaced', repo: `${owner}/${repoName}`, pr: prNumber, branch: fixBranch, previous_sha: remoteOid, sha: newSha });
+                        }
+                        // Undo this run's push when the follow-up PR turns out not to be creatable after
+                        // all. Only a branch this run brought into existence is removed — one that was
+                        // already crosscheck's is left at the newer commit rather than deleted out from
+                        // under whatever else references it.
+                        const rollBackPushedFixBranch = () => {
+                            if (remoteOid !== null)
+                                return;
+                            try {
+                                execFileSync('git', ['push', 'origin', '--delete', fixBranch], { cwd: tmpDir, env: gitEnv, stdio: 'pipe' });
+                                fileLog({ level: 'info', event: 'fix_branch_rolled_back', repo: `${owner}/${repoName}`, pr: prNumber, branch: fixBranch, sha: newSha });
+                            }
+                            catch (deleteErr) {
+                                fileLog({ level: 'warn', event: 'fix_branch_rollback_failed', repo: `${owner}/${repoName}`, pr: prNumber, branch: fixBranch, error: deleteErr instanceof Error ? deleteErr.message.slice(0, 500) : String(deleteErr) });
+                            }
+                        };
+                        // The source PR can still merge in the window between the check above and this
+                        // point. Asking again here is what keeps the push from becoming a stale fix PR:
+                        // the branch is already on the remote, so the answer decides whether it stays.
+                        if (await sourcePRHasMerged(octokit, owner, repoName, prNumber)) {
+                            rollBackPushedFixBranch();
+                            restorePRHeadInClone();
+                            skipFix('source_pr_merged');
+                            continue;
+                        }
+                        const fixPrTitle = config.post_review.auto_fix.delivery.pr_title.replace('#{original_pr_title}', pr.title);
+                        // An earlier round may already have an open PR from this branch; the force-push
+                        // above updated it, so opening a second one would be rejected as a duplicate.
+                        const { data: existingFixPrs } = await octokit.rest.pulls.list({
+                            owner, repo: repoName, state: 'open', head: `${owner}:${fixBranch}`,
+                        });
+                        let fixPrNumber;
+                        if (existingFixPrs.length > 0) {
+                            fixPrNumber = existingFixPrs[0].number;
+                            fileLog({ level: 'info', event: 'fix_pr_updated', repo: `${owner}/${repoName}`, pr: prNumber, fix_pr: fixPrNumber, sha: newSha });
+                        }
+                        else {
+                            let fixPr;
+                            try {
+                                const created = await octokit.rest.pulls.create({
+                                    owner,
+                                    repo: repoName,
+                                    head: fixBranch,
+                                    base: delivery.base,
+                                    title: fixPrTitle,
+                                    body: [
+                                        autoFixPRIntro(prNumber),
+                                        '',
+                                        `Review: https://github.com/${owner}/${repoName}/pull/${prNumber}`,
+                                        '',
+                                        fixAttributionFooter(),
+                                    ].join('\n'),
+                                });
+                                fixPr = created.data;
+                            }
+                            catch (createErr) {
+                                // A merge landing in a repo that deletes its branches takes the base away
+                                // between the checks above and this call, and `pulls.create` reports that as
+                                // `field: base, code: invalid` — the original failure this fallback exists to
+                                // stop, just in a narrower window. Take the branch back out and deliver the
+                                // fix as a diff rather than leaving it orphaned.
+                                if (!isInvalidBaseError(createErr))
+                                    throw createErr;
+                                rollBackPushedFixBranch();
+                                await deliverFixAsComment({
+                                    event: 'fix_pr_create_failed',
+                                    reason: 'base_branch_gone_after_push',
+                                    branch: delivery.base,
+                                    notice: `${delivery.base} disappeared while the fix branch was being pushed — posting the fix as a diff instead of opening a stale follow-up PR`,
+                                    explanation: `\`${delivery.base}\` existed when this fix started and was gone by the time the follow-up PR was opened, so this PR merged mid-run. The fix is below rather than in a follow-up PR — a PR cut from the pre-merge state would reintroduce whatever the merged version changed.`,
+                                });
+                                continue;
+                            }
+                            fixPrNumber = fixPr.number;
+                        }
+                        if (config.post_review.auto_fix.delivery.label) {
+                            try {
+                                await octokit.rest.issues.addLabels({
+                                    owner, repo: repoName, issue_number: fixPrNumber, labels: [config.post_review.auto_fix.delivery.label],
+                                });
+                            }
+                            catch { /* label may not exist in this repo — skip */ }
+                        }
+                        onPhaseChange('fixed ✓', { fixCount: appliedCount, phase: 'fixed', fixTokens: fixTokensUsed });
+                        fileLog({ level: 'info', event: 'fix_complete', repo: `${owner}/${repoName}`, pr: prNumber, vendor: activeVendor, applied_count: appliedCount, sha: newSha, delivery: 'pull_request', fix_pr: fixPrNumber, tokens_used: fixTokensUsed, skills_activated: activatedSkills.map(skill => skill.name), duration_ms: Date.now() - fixStepStart, ...triggerField });
+                        results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
                     }
-                    onPhaseChange('fixed ✓', { fixCount: appliedCount, phase: 'fixed', fixTokens: fixTokensUsed });
-                    fileLog({ level: 'info', event: 'fix_complete', repo: `${owner}/${repoName}`, pr: prNumber, vendor: activeVendor, applied_count: appliedCount, sha: newSha, delivery: 'pull_request', fix_pr: fixPr.number, tokens_used: fixTokensUsed, skills_activated: activatedSkills.map(skill => skill.name), duration_ms: Date.now() - fixStepStart, ...triggerField });
-                    results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
                 }
                 else {
                     // comment: post the diff as a suggested-fix comment, no code push needed (works for fork PRs too)
@@ -1269,7 +1661,7 @@ export async function runWorkflow(ctx) {
             else if (effectiveType === 'conflict-resolve') {
                 const skipConflictResolve = (reason) => {
                     onPhaseChange('', { phase: 'fixed', fixCount: 0 });
-                    results[step.name] = { skipped: true };
+                    results[step.name] = { skipped: true, skipReason: reason };
                     fileLog({ level: 'info', event: 'step_skipped', repo: `${owner}/${repoName}`, pr: prNumber, step: step.name, reason });
                 };
                 if (ctx.dryRun) {
@@ -1316,7 +1708,16 @@ export async function runWorkflow(ctx) {
                     skipConflictResolve('no_conflicts');
                     continue;
                 }
-                const vendor = resolveReviewer(step.reviewer, origin, config, ctx.smartSwitchFallback);
+                // resolveConflictResolveVendor extends resolveReviewer with the same human-origin
+                // fallback the fix step uses, so a PR crosscheck cannot attribute still gets its
+                // conflicts resolved instead of skipping with 'no_vendor'.
+                const { vendor, usedHumanFallback, substitutedOriginVendor } = resolveConflictResolveVendor(step.reviewer, origin, config, ctx.smartSwitchFallback);
+                if (usedHumanFallback && vendor) {
+                    fileLog({ level: 'info', event: 'conflict_resolve_vendor_fallback', repo: `${owner}/${repoName}`, pr: prNumber, from: 'none', to: vendor, reason: 'human_origin' });
+                }
+                else if (substitutedOriginVendor && vendor) {
+                    fileLog({ level: 'info', event: 'conflict_resolve_vendor_fallback', repo: `${owner}/${repoName}`, pr: prNumber, from: substitutedOriginVendor, to: vendor, reason: 'unsupported_vendor' });
+                }
                 if (!vendor) {
                     try {
                         execSync('git merge --abort', { cwd: tmpDir });
@@ -1458,7 +1859,7 @@ export async function runWorkflow(ctx) {
                 execFileSync('git', [
                     'commit',
                     '-m',
-                    `[crosscheck] resolve: resolve ${conflictedFiles.length} conflict${conflictedFiles.length !== 1 ? 's' : ''} — by Claude Code`,
+                    conflictResolveCommitSubject(conflictedFiles.length, vendor),
                     '-m',
                     buildCommitTrailers({ reviewer: vendor, model: conflictResolveModel, step: 'conflict-resolve', service: 'crosscheck' }),
                 ], { cwd: tmpDir });
@@ -1522,6 +1923,7 @@ export async function runWorkflow(ctx) {
         return {
             verdict: verdict ?? null,
             fixAppliedCount,
+            stepOutcomes: summariseStepOutcomes(stepsRun, results),
             ...(fixAppliedCount === undefined && lastFixSkipReason !== undefined && { fixSkipReason: lastFixSkipReason }),
             ...(latestReviewResult?.commentBody && {
                 latestReviewComment: {