@juzser/blacksmith 0.2.0 → 0.4.0

package/factory/orchestrator/dist/cli.js

@@ -14,22 +14,25 @@
 // the same modules are fine and stay up here: tsc erases them, so they cost
 // nothing at runtime. `test/cliBoot.test.ts` reads the built graph and fails if
 // the database layer creeps back into it.
-import { spawn } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { resetAgentMaxTurns, syncAgentMaxTurns } from './agentsSync.js';
 import { parseArgs } from './args.js';
 import { closeAudit, consolidateAudit, cutAudit, decideAudit, openAudit, recordAudit, resolveAudit, } from './audit.js';
 import { checkBudgetAlarm } from './budgetAlarm.js';
-import { loadBudgetPolicy } from './budgets.js';
+import { budgetEnvOverrides, loadBudgetPolicy } from './budgets.js';
 import { collectCommittedChanges, loadWorktreePolicy, postRunCheck, readClaimList, validateWave, writeRootCheck, } from './claims.js';
 import { collectCoverageEvidence } from './coverage.js';
 import { loadCrosscheckPolicy } from './crosscheck.js';
 import { independentFinderRequest, reconcile, runIndependentFinder, } from './crossFinding.js';
 import { checkDelegationGrants, checkDelegationLog, loadDelegationPolicy } from './delegation.js';
 import { checkDispatchAsymmetry } from './dispatchAudit.js';
+import { lintDispatchPrompt } from './dispatchLint.js';
 import { loadDotEnv } from './dotenv.js';
 import { loadEffortPolicy, resolveEffort } from './effort.js';
+import { ISSUE_CANDIDATE_EVENT_TYPES } from './errorIssues.js';
 import { SmithError } from './errors.js';
 import { checkEscalationLadder } from './escalation.js';
 import { appendEvent, filterEvents, followEvents, listSessionIds, mergeSessionLogs, readEvents, readLineageEvents, requireSession, sessionTree, startSession, tailEvents, } from './events.js';
@@ -41,25 +44,28 @@ import { decideHookPayload } from './hookDecision.js';
 import { checkWorktreeImmutable, fingerprintWorktree, } from './immutability.js';
 import { collectExportDiffs, exportImpact, waveImpact } from './impact.js';
 import { integrationHeadSha, runIntegrationCheck } from './integration.js';
+import { previewOutcomes, reportErrors } from './issueReporter.js';
 import { judgePreflight } from './judgePreflight.js';
 import { outstandingJudges, readJudgeTurns, recordJudgeDispatch, recordJudgeReport, } from './judges.js';
 import { addMcpSurface, resolveMcpSurface, runMcpCheck } from './mcp.js';
 import { DOTENV_PATH, LESSONS_MD_PATH, lessonsReadPath, REPO_ROOT, SANDBOX_LEASE_DIR, STATE_DB_PATH, } from './paths.js';
-import { diffPlans, livePlanTasks, resolveTaskId, validatePlan, } from './plan.js';
+import { bareTaskId, diffPlans, livePlanTasks, planProjectResolverForTaskRef, planSelfFallbackForTaskRef, resolveTaskId, validatePlan, } from './plan.js';
 import { runPlanQuorum } from './planQuorum.js';
 import { detectCurrentBranch, detectRepoRoot, evaluateCommand, loadGuardrailPolicy, } from './policy.js';
+import { factoryProjects } from './projects.js';
 import { recordUserPrompt } from './prompts.js';
 import { checkBrief, wrapIngested } from './provenance.js';
 import { runJudge } from './providers/index.js';
-import { admit, adopt, step } from './queue.js';
+import { admit, adopt, batchStep, groupForBatch, step } from './queue.js';
 import { stampResultEnvelope } from './results.js';
+import { FACTORY_PROJECT, isErrorTrackerWritable, loadRoadmap } from './roadmap.js';
 import { checkRuntime } from './runtime.js';
 import { checkSameMistakeKpi } from './sameMistakeKpi.js';
 import { activeSandboxFor, closeSandbox, listSandboxes, openSandbox, } from './sandbox.js';
 import { registerProjectInRoadmap, scaffoldProject } from './scaffold.js';
 import { loadSensitivePathsPolicy, securityTriggers, } from './security.js';
 import { parseLessons } from './severity.js';
-import { amendPlan, recordSpecReview } from './spec.js';
+import { amendPlan, recordSpecReview, taskSuccessors } from './spec.js';
 import { approveSpecChange, listSpecChanges, proposeSpecChange, rejectSpecChange, } from './specChange.js';
 import { checkStack, loadStackAnswers } from './stack.js';
 import { buildSymbolGraph, collectSources } from './symbols.js';
@@ -79,6 +85,29 @@ function printJson(value) {
 function readJsonFile(filePath) {
     return JSON.parse(readFileSync(filePath, 'utf8'));
 }
+/**
+ * `--checks <file>`'s intake, both places it's read (`gate run`,
+ * `integration check`). Same fail-closed shape as `boundedIntFlag`, moved
+ * from a flag to a JSON field: a check's own `timeout_ms` goes straight into
+ * a `setTimeout` call in testgate.ts, and a non-positive or non-integer value
+ * there does not fail loudly — it fails as either an instant, unexplained
+ * timeout or one that silently never fires. Above 2^31-1 Node clamps the
+ * delay to 1ms, so an oversized value is the instant kind too. Refused here,
+ * at the point the file is read, rather than let a gate run act on either.
+ */
+const MAX_CHECK_TIMEOUT_MS = 2_147_483_647;
+function readChecksFile(filePath) {
+    const checks = readJsonFile(filePath);
+    for (const check of checks) {
+        const timeoutMs = check.timeout_ms;
+        if (timeoutMs === undefined)
+            continue;
+        if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_CHECK_TIMEOUT_MS) {
+            throw new SmithError('gate.invalid-check-timeout', `"${check.name}" in ${filePath} has timeout_ms ${JSON.stringify(timeoutMs)}; it must be a positive whole number of milliseconds, at most ${MAX_CHECK_TIMEOUT_MS}.`, { name: check.name, timeout_ms: timeoutMs, file: filePath });
+        }
+    }
+    return checks;
+}
 /** A task spec's `budget.tokens` when it is a usable positive number, else null. */
 function declaredTokens(budget) {
     if (typeof budget !== 'object' || budget === null)
@@ -298,7 +327,111 @@ function eventContextFromFlags(flags) {
 function eventOptsFromFlags(flags) {
     return flags['state-dir'] ? { stateDir: flags['state-dir'] } : {};
 }
-/** Where plan version files are read from and written to; defaults to factory/specs/active. */
+/** The runner `issues report` hands to `reportErrors`: git and `gh` through one call, never a throw. */
+function issueCommandRunner(cmd, args) {
+    try {
+        const stdout = execFileSync(cmd, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+        return { status: 0, stdout, stderr: '' };
+    }
+    catch (err) {
+        const e = err;
+        return {
+            status: typeof e.status === 'number' ? e.status : null,
+            stdout: e.stdout ?? '',
+            stderr: e.stderr ?? '',
+            ...(typeof e.code === 'string' ? { spawnError: e.code } : {}),
+        };
+    }
+}
+/** `--epic`/`--since` narrow the CANDIDATES, never the `issue-reported` history dedup reads. */
+function scopeIssueCandidates(events, flags) {
+    const epic = flags.epic;
+    const since = flags.since;
+    if (epic === undefined && since === undefined)
+        return events;
+    return events.filter(({ record }) => {
+        if (!ISSUE_CANDIDATE_EVENT_TYPES.has(record.event_type))
+            return true;
+        if (epic !== undefined && !(record.task_id ?? '').startsWith(`${epic}/`))
+            return false;
+        return since === undefined || record.ts >= since;
+    });
+}
+/**
+ * Both `issues` actions read the same inputs; only the entry point differs.
+ *
+ * `resolveProject` and `selfFallback` together close the privacy-leak gap an
+ * unstamped row otherwise falls into: a session or plan driving a project
+ * other than this factory writes error/gate/task-added rows with no
+ * top-level `project` stamp. Both answer from the row's own task ref's
+ * epic's plan file (D-246's `db/projector.ts` precedent, restated here
+ * without a DB dependency `cli.ts`'s boot graph cannot carry) -- a plan on
+ * disk naming a project wins outright via `resolveProject`; a plan on disk
+ * naming none is this checkout's own epic, so `selfFallback` resolves it to
+ * `FACTORY_PROJECT`; no plan found at all (a foreign epic, or a bare ref)
+ * stays `null` from both, and `reportErrors`/`previewOutcomes` skip that row
+ * with `skipped-unresolved-project` rather than ever defaulting it into this
+ * factory's own repository.
+ *
+ * The two are kept as SEPARATE resolvers, not one combined
+ * `planProjectResolverForTaskRefOrSelf`, so `withSessionFallback`
+ * (`errorIssues.ts`) can try them as distinct tiers with a session's own
+ * stamp riding between them: `resolveProject` first, then any `project`
+ * stamp elsewhere in the same session (or a bare ref's `task-added`
+ * `epic_id` re-asked of `resolveProject`), and only then `selfFallback`
+ * (S2-c) -- a session-mate's real stamp naming a different project must
+ * outrank this weakest, locally-guessed signal, which a single combined
+ * resolver tried as one first tier could not guarantee.
+ *
+ * `--specs-dir` (via `planOptsFromFlags`) and `--state-dir` (via
+ * `eventOptsFromFlags`) are two independent flags on purpose: `--state-dir`
+ * says where THIS session's own events live, `--specs-dir` says where the
+ * epics IT references keep their plans, and a session's events and the
+ * plans its tasks belong to are not always colocated (the daemon's own
+ * event log and a target checkout's specs tree, for one). Requiring them to
+ * travel together would make `issues report` unable to point one flag at a
+ * remote-events state dir while resolving projects from this checkout's own
+ * specs/active, which is `smith`'s ordinary daemon posture. Callers who do
+ * mean the same tree for both pass the same path to both flags.
+ *
+ * `lineageEvents` is the session's UNSCOPED lineage, read before
+ * `scopeIssueCandidates` narrows `events` to `--epic`/`--since` (S3):
+ * `ORIGIN_STAMP_EVENT_TYPES` overlaps the scoped `ISSUE_CANDIDATE_EVENT_TYPES`
+ * set, so `sessionProjectStamps` reading straight off the narrowed `events`
+ * could lose a session-mate's stamp purely because `--epic`/`--since`
+ * excluded that row, changing an unrelated in-scope row's resolved project
+ * -- and therefore its fingerprint -- based only on which scoping flags were
+ * passed. `reportErrors`/`previewOutcomes` fold `events` for candidates but
+ * consult `lineageEvents` for the session-stamp tier, so `--epic`/`--since`
+ * narrow what gets reported without perturbing how a row's project is
+ * resolved.
+ */
+async function issueInputs(flags) {
+    const sessionId = requireFlag(flags, 'session');
+    const eventOpts = eventOptsFromFlags(flags);
+    requireSession(sessionId, eventOpts);
+    const lineageEvents = await readLineageEvents(sessionId, eventOpts);
+    const events = scopeIssueCandidates(lineageEvents, flags);
+    const milestones = loadRoadmap(flags['roadmap-path']);
+    const isEnabled = (project) => isErrorTrackerWritable(milestones, project);
+    const planOpts = planOptsFromFlags(flags);
+    const resolveProject = planProjectResolverForTaskRef(planOpts);
+    const selfFallback = planSelfFallbackForTaskRef(FACTORY_PROJECT, planOpts);
+    return {
+        events,
+        isEnabled,
+        register: factoryProjects(),
+        eventOpts,
+        resolveProject,
+        selfFallback,
+        lineageEvents,
+    };
+}
+/**
+ * Where plan version files are read from and written to; defaults to
+ * factory/specs/active. See `issueInputs`'s doc comment for why this
+ * deliberately does not travel with `--state-dir`.
+ */
 function planOptsFromFlags(flags) {
     return flags['specs-dir'] ? { specsDir: flags['specs-dir'] } : {};
 }
@@ -687,8 +820,19 @@ async function nextWaveInputFrom(planFile, flags) {
         ? await readAddedTasks({ sessionId: flags.session }, eventOptsFromFlags(flags))
         : [];
     const planIds = new Set(planOnDisk.tasks.map((t) => t.task_id));
+    // A lineage is not one epic. `readAddedTasks` reads the WHOLE lineage
+    // (D-119), so a resumed session that ever ran a different, earlier epic
+    // carries that epic's `task-added` rows too — and a row an operator
+    // abandoned non-terminal (never merged, waived, or superseded) reads back
+    // here exactly like a genuine follow-up of THIS plan. Unfiltered, it was
+    // spliced into `plan.tasks` below and reached `computeNextWave` as a
+    // candidate or an occupied claim-holder: proposed as this epic's own work,
+    // and able to defer this epic's tasks on a claim overlap that has nothing
+    // to do with them. `wave check` never has this problem because it only
+    // ever looks at the ids an operator names — matching that, a follow-up
+    // only counts here when its own `task-added` named this plan's epic.
     const followUps = logged
-        .filter((t) => !planIds.has(t.taskId))
+        .filter((t) => !planIds.has(t.taskId) && t.epicId === planOnDisk.epic_id)
         .map((t) => ({
         task_id: t.taskId,
         // The log is the only register that holds this task's status, so a
@@ -853,7 +997,20 @@ async function main() {
     }
     if (namespace === 'audit' && action === 'resolve') {
         const [projectDir] = requirePositionals(positional, usageFor('audit resolve'));
-        printJson(await resolveAudit(projectDir, requireFlag(flags, 'epic'), eventContextFromFlags(flags), eventOptsFromFlags(flags)));
+        // Comma-split, not repeated: a fingerprint has no commas, and deferring
+        // more than one at a time is the common case (D-33's precedent, `plan
+        // amend --findings`).
+        const except = flags.except
+            ? flags.except
+                .split(',')
+                .map((fp) => fp.trim())
+                .filter((fp) => fp !== '')
+            : undefined;
+        printJson(await resolveAudit(projectDir, requireFlag(flags, 'epic'), eventContextFromFlags(flags), eventOptsFromFlags(flags), {
+            ...(except ? { except } : {}),
+            ...(flags.plan ? { plan: readJsonFile(flags.plan) } : {}),
+            planOpts: planOptsFromFlags(flags),
+        }));
         return 0;
     }
     if (namespace === 'audit' && action === 'close') {
@@ -959,6 +1116,14 @@ async function main() {
         // what went unnoticed.
         const edges = await emitEdgesRecorded(plan, ctx, opts);
         const added = written.filter((e) => e.record.event_type === 'task-added').length;
+        // Criterion 7: a plan that serializes by claim geometry alone used to be
+        // invisible until `/bs run` actually hit the ceiling. Dynamic for the
+        // same reason `wave schedule` imports it dynamically -- nothing an
+        // ingest that never schedules needs should be on the boot path every
+        // `smith --help` walks. No repo scan here: `parallel_with` is
+        // claims-and-edges only, so the input carries no crossings.
+        const { computePlanParallelism } = await import('./waveSchedule.js');
+        const parallelism = computePlanParallelism(plan, loadWorktreePolicy());
         printJson({
             epic: plan.epic_id,
             version: plan.version,
@@ -966,6 +1131,7 @@ async function main() {
             superseded: written.length - added,
             skipped: plan.tasks.length - added,
             edges: edges.length,
+            parallelism,
         });
         return 0;
     }
@@ -1197,7 +1363,15 @@ async function main() {
         if (result.valid && !coupled && !blocked && flags.dry !== 'true') {
             await emitWaveAdmitted(plan, taskIds, eventContextFromFlags(flags), eventOptsFromFlags(flags), admissionBudget(budget, overridden ? rationale : undefined));
         }
-        printJson({ ...result, symbolImpact, budget });
+        // Names only, and only when some differ from budgets.yml: which caps came
+        // from the box's env rather than the file.
+        const envOverrides = budgetEnvOverrides(loadBudgetPolicy(flags['budget-policy'], {}));
+        printJson({
+            ...result,
+            symbolImpact,
+            budget,
+            ...(envOverrides.length > 0 ? { budgetEnvOverrides: envOverrides } : {}),
+        });
         return result.valid && !coupled && !blocked ? 0 : 1;
     }
     if (namespace === 'wave' && action === 'next') {
@@ -1227,9 +1401,13 @@ async function main() {
         // Static would be fine — waveSchedule.js reaches nothing waveNext.js has
         // not already put on the boot path — but the input assembly it is handed
         // may dynamically import `db/projector.js`, so the await is here anyway.
-        const { scheduleWaves } = await import('./waveSchedule.js');
-        const schedule = scheduleWaves(await nextWaveInputFrom(planFile, flags));
-        printJson(schedule);
+        const { computePlanParallelism, scheduleWaves } = await import('./waveSchedule.js');
+        const input = await nextWaveInputFrom(planFile, flags);
+        const schedule = scheduleWaves(input);
+        // Same `size` block `plan ingest` prints under `parallelism`, so the
+        // operator sees the small-epic bound from either command.
+        const { size } = computePlanParallelism(input.plan, input.policy);
+        printJson({ ...schedule, size });
         // Writes nothing, for the reason `wave next` writes nothing and one more:
         // every round after the first is a simulation. The tasks it marks complete
         // were completed by nobody, and a log that recorded them would be claiming
@@ -1348,7 +1526,21 @@ async function main() {
         const projectDirs = resolveProjectDirs(repeated.project, {
             self: flags['no-self'] !== 'true',
         });
-        const input = { events, now, projectDirs };
+        // Same resolver `issues report`/`preview` and the daemon use (D-246): an
+        // error-report proposal's fingerprint is hashed over its `project`
+        // (computeFingerprint), so this verb has to resolve a row's project the
+        // same way the reporter that later clears the proposal does. A divergent
+        // resolver here -- or none, which folds every row to `project: null` --
+        // hashes a different fingerprint than the reporter's `issue-reported`
+        // event names, so the proposal `scheduler run` keeps proposing never
+        // matches the one already answered and is re-appended forever (S1-b).
+        const input = {
+            events,
+            now,
+            projectDirs,
+            resolveProjectForTaskRef: planProjectResolverForTaskRef(planOptsFromFlags(flags)),
+            selfFallbackForTaskRef: planSelfFallbackForTaskRef(FACTORY_PROJECT, planOptsFromFlags(flags)),
+        };
         if (dry) {
             printJson({ proposals: computeProposals(input) });
             return 0;
@@ -1395,11 +1587,17 @@ async function main() {
         // This clone joins the pass by default (contract clause 1); `--no-self`
         // is the refusal path.
         const { resolveProjectDirs } = await import('./projects.js');
+        // Same resolver as `scheduler run` above, for the same reason (S1-b): a
+        // divergent or absent resolver hashes a different fingerprint than the
+        // reporter's `issue-reported` event names, so an already-answered
+        // error-report proposal never clears.
         const proposals = computeProposals({
             events,
             now,
             policy,
             projectDirs: resolveProjectDirs(repeated.project, { self: flags['no-self'] !== 'true' }),
+            resolveProjectForTaskRef: planProjectResolverForTaskRef(planOptsFromFlags(flags)),
+            selfFallbackForTaskRef: planSelfFallbackForTaskRef(FACTORY_PROJECT, planOptsFromFlags(flags)),
         });
         // A RecheckProposal names a task and no paths, so without this the
         // security match would see an opaque id and clear a recheck of
@@ -1448,6 +1646,15 @@ async function main() {
             ...eventOptsFromFlags(flags),
             projectDirs: resolveProjectDirs(repeated.project, { self }),
             readProjects: () => factoryProjects().filter((ref) => self || !ref.self),
+            // Same D-246 self-fallback as issueInputs (see its doc comment): a
+            // plan on disk naming no project is this checkout's own epic, so it
+            // reads as FACTORY_PROJECT rather than staying an unresolved null the
+            // daemon would report as an unlabeled finding and the on/off switch
+            // for 'black-smith' would never get asked about. Split into strict
+            // (resolveProjectForTaskRef) and self-only (selfFallbackForTaskRef)
+            // tiers so a session's own stamp can ride between them (S2-c).
+            resolveProjectForTaskRef: planProjectResolverForTaskRef(planOptsFromFlags(flags)),
+            selfFallbackForTaskRef: planSelfFallbackForTaskRef(FACTORY_PROJECT, planOptsFromFlags(flags)),
             ...(flags.db ? { dbPath: flags.db } : {}),
             ...(flags['no-db'] === 'true' ? { projectDb: false } : {}),
         };
@@ -1583,6 +1790,25 @@ async function main() {
     }
     if (namespace === 'worktree' && action === 'create') {
         const [projectDir, epic, taskId] = requirePositionals(positional, usageFor('worktree create'));
+        if (flags.from !== undefined) {
+            // `--from` reuses a predecessor's commits, so it may only be spent on a
+            // task the log actually names as that predecessor's successor — never
+            // on a bare "I want the same branch history" request. `--session` is
+            // what supplies the log to check against; without it there is nothing
+            // to refuse against, so demand it explicitly rather than silently
+            // trusting an unauthenticated `--from`.
+            const sessionId = requireFlag(flags, 'session');
+            const events = await readLineageEvents(sessionId, eventOptsFromFlags(flags));
+            const successors = taskSuccessors(events, epic);
+            const from = flags.from;
+            const expected = bareTaskId(epic, taskId);
+            const actual = successors.get(from) ?? successors.get(`${epic}/${from}`);
+            if (actual === undefined || bareTaskId(epic, actual) !== expected) {
+                throw new SmithError('worktree.not-a-successor', `${epic}/${taskId} is not logged as the successor of ${epic}/${from}; run \`plan propose\`/\`plan approve\` with a supersede pairing them first.`, { epic, taskId, from });
+            }
+            printJson(createTaskWorktree(projectDir, epic, taskId, { from }));
+            return 0;
+        }
         printJson(createTaskWorktree(projectDir, epic, taskId));
         return 0;
     }
@@ -1699,6 +1925,28 @@ async function main() {
         if (events && !flags.plan) {
             throw new SmithError('cli.missing-flag', 'queue run --session also needs --plan <plan.json>: a merge may only be logged under the task id the plan declares.', { epic });
         }
+        // --batch (roadmap merge-lanes) groups tasks with groupForBatch before
+        // any of them run, and that grouping needs two things `--tasks` alone
+        // does not carry: the plan's `edges`, so a task never stacks with
+        // something it depends_on, and — for a tasks-file entry that omits its
+        // own `claims` — the plan's claim list, so a hand-typed batch run is not
+        // blind to a disjointness `wave admit` already knows. Same shape as the
+        // `--session` guard just above, and for the same reason: refuse the run
+        // whole rather than group some tasks correctly and others by guesswork.
+        if (flags.batch === 'true' && !flags.plan) {
+            throw new SmithError('cli.missing-flag', 'queue run --batch also needs --plan <plan.json>: grouping reads its dependency edges and claim lists from there.', { epic });
+        }
+        // `attemptCandidate` runs the epic's test command directly against the
+        // whole batch candidate — there is no per-task file set to narrow it to,
+        // so a `--select-test-cmd` template would either render nonsensically or
+        // silently run the full suite while the outcome claimed it was selected
+        // (the same lie D-260 refuses above). Refuse the combination instead of
+        // ignoring the flag.
+        if (flags.batch === 'true' && selectTestCmd !== undefined) {
+            throw new SmithError('cli.incompatible-flags', 'queue run --batch does not support --select-test-cmd: a batch candidate has no single task to narrow the test command to.', { epic });
+        }
+        let edges = [];
+        let claimsById = new Map();
         if (flags.plan) {
             const plan = readJsonFile(flags.plan);
             // …and the plan is not the only register: a follow-up minted by
@@ -1710,6 +1958,11 @@ async function main() {
             const loggedIds = logged.map((t) => t.taskId);
             for (const task of tasks)
                 task.taskId = resolveTaskId(plan, task.taskId, loggedIds);
+            edges = plan.edges.map((e) => ({ task: e.task, dependsOn: e.dependsOn }));
+            claimsById = new Map(plan.tasks.map((t) => [
+                t.task_id,
+                Array.isArray(t.claims) ? t.claims.filter((c) => typeof c === 'string') : [],
+            ]));
             // D-186: the ids are the plan's now, so the order can be too. `--tasks`
             // is hand-written, and merging in the order someone typed lets a task
             // land before the task it declares `depends_on` — the epic's cumulative
@@ -1717,21 +1970,81 @@ async function main() {
             // and blames the wrong branch when it goes red. `admit()` exists for
             // exactly this and had no caller until here; a follow-up the plan never
             // declared carries no edges, so it just sorts by id among its peers.
-            const order = admit(tasks.map((t) => ({ task_id: t.taskId })), plan.edges.map((e) => ({ task: e.task, dependsOn: e.dependsOn })));
+            const order = admit(tasks.map((t) => ({ task_id: t.taskId })), edges);
             // Stable: two tasks the plan does not order keep the order admit gave
             // them, and a duplicated id is still run twice rather than dropped.
             tasks.sort((a, b) => order.indexOf(a.taskId) - order.indexOf(b.taskId));
         }
+        const stepOpts = {
+            projectDir,
+            epic,
+            testCmd,
+            ...(selectTestCmd !== undefined ? { selectTestCmd } : {}),
+            ...(events ? { events } : {}),
+        };
         const outcomes = [];
         let allMerged = true;
+        if (flags.batch === 'true') {
+            const byId = new Map(tasks.map((t) => [t.taskId, t]));
+            // A tasks-file entry's own `claims` wins over the plan's — the plan
+            // describes what the task was authored to touch, the tasks file is
+            // what actually ran, and the two can disagree the same way a diff can
+            // outgrow the claim it was cut from.
+            const groupable = tasks.map((t) => ({
+                taskId: t.taskId,
+                claims: t.claims ?? claimsById.get(t.taskId),
+            }));
+            const groups = groupForBatch(groupable, edges, loadWorktreePolicy().serializeAlwaysGlobs);
+            const batches = [];
+            for (const group of groups) {
+                const groupTasks = group.map((id) => {
+                    const t = byId.get(id);
+                    if (!t) {
+                        // groupForBatch only ever returns ids it was handed, so this
+                        // would mean the group and --tasks have drifted apart — a wrong
+                        // candidate is worse than a refusal.
+                        throw new SmithError('queue.batch-unknown-task', `--batch grouped task "${id}" but no task by that id was in --tasks.`, { epic, taskId: id });
+                    }
+                    return t;
+                });
+                // groupForBatch's own contract (see its doc comment): a group of one
+                // is not a batch, it's a task that closed the open group before it —
+                // no candidate to stack, so it runs through the plain step it would
+                // have taken without --batch at all, rather than through batchStep's
+                // fold/candidate-worktree machinery for a "stack" of one.
+                if (groupTasks.length === 1) {
+                    const [only] = groupTasks;
+                    const outcome = await step(only, stepOpts);
+                    outcomes.push(outcome);
+                    const landed = outcome.outcome === 'merged';
+                    // `step` refuses before any test runs on `nothing-to-merge` (D-30's
+                    // uncommitted-work guard) and `rebase-conflict` — 0 suites ran, not
+                    // 1, for either. Every other outcome it can return (`merged`,
+                    // `tests-failed`, `integration-dirty`) only happens after
+                    // `runTestCmd`.
+                    const suiteRuns = outcome.outcome === 'nothing-to-merge' || outcome.outcome === 'rebase-conflict' ? 0 : 1;
+                    batches.push({ task_ids: group, suite_runs: suiteRuns, landed });
+                    if (!landed) {
+                        allMerged = false;
+                        break;
+                    }
+                }
+                else {
+                    const result = await batchStep(groupTasks, stepOpts);
+                    outcomes.push(...result.outcomes);
+                    const landed = result.outcomes.every((o) => o.outcome === 'merged');
+                    batches.push({ task_ids: group, suite_runs: result.suiteRuns, landed });
+                    if (!landed) {
+                        allMerged = false;
+                        break;
+                    }
+                }
+            }
+            printJson({ outcomes, batches });
+            return allMerged ? 0 : 1;
+        }
         for (const task of tasks) {
-            const outcome = await step(task, {
-                projectDir,
-                epic,
-                testCmd,
-                ...(selectTestCmd !== undefined ? { selectTestCmd } : {}),
-                ...(events ? { events } : {}),
-            });
+            const outcome = await step(task, stepOpts);
             outcomes.push(outcome);
             if (outcome.outcome !== 'merged') {
                 allMerged = false;
@@ -1960,6 +2273,27 @@ async function main() {
         printJson(report);
         return report.ok ? 0 : 1;
     }
+    if (namespace === 'dispatch' && action === 'lint') {
+        // dispatch.md "Carry into the prompt" / "Declare each judge's artifact":
+        // catches a stated turn budget that disagrees with the template's
+        // `maxTurns` in either direction, a template it cannot read at all, and a
+        // judge prompt missing (or mismatching) its declared-artifact line,
+        // before the agent ever runs. Fails closed: any applicable status but
+        // `ok` exits 1. See dispatchLint.ts for why each status means what it
+        // means. `-` reads stdin, same convention as `prompt wrap`/`prompt record`.
+        const [file] = requirePositionals(positional, usageFor('dispatch lint'), 1);
+        const prompt = file === '-' ? readFileSync(0, 'utf8') : readFileSync(file, 'utf8');
+        const report = await lintDispatchPrompt({
+            prompt,
+            role: requireFlag(flags, 'role'),
+            taskId: requireFlag(flags, 'task'),
+            sessionId: requireFlag(flags, 'session'),
+            ...(flags['agents-dir'] ? { agentsDir: flags['agents-dir'] } : {}),
+            eventOpts: eventOptsFromFlags(flags),
+        });
+        printJson(report);
+        return report.exitCode;
+    }
     if (namespace === 'tester' && action === 'check') {
         // The other half of `dispatch check`: that one asks whether the critic ran
         // on the finder's model, this one asks whether a tester ran at all, in a
@@ -2087,7 +2421,10 @@ async function main() {
         const spec = readJsonFile(specFile);
         // The worktree is a full checkout, so it is both halves of the question:
         // the diff this task committed, and everyone in the repo who imports it.
-        const diffs = collectExportDiffs(worktreeDir, collectCommittedChanges(worktreeDir));
+        // The promises go in too: a promised file the collector cannot read is
+        // reported unverified rather than dropped, which is the only way absent
+        // from the diff keeps meaning untouched.
+        const diffs = collectExportDiffs(worktreeDir, collectCommittedChanges(worktreeDir), spec.keeps_exports ?? []);
         const graph = buildSymbolGraph(collectSources(worktreeDir));
         const report = exportImpact(graph, diffs, spec.claims, spec.keeps_exports ?? []);
         printJson(report);
@@ -2121,6 +2458,24 @@ async function main() {
         printJson(result);
         return 0;
     }
+    if (namespace === 'issues' && action === 'report') {
+        // The one path in this epic that runs `gh` for real.
+        const { events, isEnabled, register, eventOpts, resolveProject, selfFallback, lineageEvents } = await issueInputs(flags);
+        const clock = () => new Date().toISOString();
+        printJson(await reportErrors(events, isEnabled, register, issueCommandRunner, clock, eventOpts, resolveProject, selfFallback, lineageEvents));
+        return 0;
+    }
+    if (namespace === 'issues' && action === 'preview') {
+        // Same inputs, no `gh` and no event: the runner throws if anything
+        // reaches it, so a preview that spawned would fail loudly, not quietly.
+        const { events, isEnabled, register, resolveProject, selfFallback, lineageEvents } = await issueInputs(flags);
+        const neverRun = (cmd) => {
+            throw new Error(`issues preview must never run a command, asked for ${cmd}`);
+        };
+        const clock = () => new Date().toISOString();
+        printJson(await previewOutcomes(events, isEnabled, register, neverRun, clock, resolveProject, selfFallback, lineageEvents));
+        return 0;
+    }
     // The judge sandbox (A3). `worktree fingerprint`/`verify` above detect a
     // judge that wrote; these three refuse it up front. The orchestrator opens a
     // lease before handing a worktree to a judge and closes it when the verdict
@@ -2185,6 +2540,18 @@ async function main() {
         printJson(summarizeHarnesses({ policy: loadHarnessPolicy(flags.policy) }));
         return 0;
     }
+    // A turn cap is per role (the template's frontmatter), never per task, and
+    // Claude Code reads it at spawn — so the box-level override has to land in
+    // the file. The edit is local and left uncommitted on purpose; `--reset`
+    // puts back what git HEAD says.
+    if (namespace === 'agents' && action === 'sync') {
+        const agentsDir = flags['agents-dir'];
+        const dryRun = flags['dry-run'] === 'true';
+        printJson(flags.reset === 'true'
+            ? resetAgentMaxTurns({ ...(agentsDir ? { agentsDir } : {}), dryRun })
+            : syncAgentMaxTurns({ ...(agentsDir ? { agentsDir } : {}), dryRun }));
+        return 0;
+    }
     if (namespace === 'harness' && action === 'plan') {
         const tier = flags.tier;
         const invocation = planWorkerTurn({
@@ -2281,7 +2648,7 @@ async function main() {
         const { runGate } = await import('./gate.js');
         const [taskId] = requirePositionals(positional, usageFor('gate run'));
         const worktreeDir = requireFlag(flags, 'worktree');
-        const checks = readJsonFile(requireFlag(flags, 'checks'));
+        const checks = readChecksFile(requireFlag(flags, 'checks'));
         // The result file has the same two intake shapes as findings below, and for
         // the same reason. With `--agent`, `--result` is the worker's half —
         // run_status/structured_output/artifacts — and the dispatcher stamps the
@@ -2337,7 +2704,7 @@ async function main() {
         // close per role: a judge that splits its findings across two files still
         // owes one turn, and a second report against it would be a duplicate.
         //
-        // FD-1 (csb-audit-1): `--grader` is the same hand-over for the grader. Its
+        // FD-1: `--grader` is the same hand-over for the grader. Its
         // verdict document is not a findings list, so until `judge report` learned
         // the shape the grader's turn stayed open with its verdict on the command
         // line, and the gate blocked on the judge it was about to read.
@@ -2449,7 +2816,8 @@ async function main() {
             sessionId,
             ...(flags.epic ? { epicId: flags.epic } : {}),
         });
-        printJson(report);
+        const envOverrides = budgetEnvOverrides(loadBudgetPolicy(flags.policy, {}));
+        printJson(envOverrides.length > 0 ? { ...report, budgetEnvOverrides: envOverrides } : report);
         return report.ok ? 0 : 1;
     }
     // The consumer architecture §9.7's "monotonically decreasing same-mistake
@@ -2477,7 +2845,7 @@ async function main() {
     if (namespace === 'integration' && action === 'check') {
         const epicId = requireFlag(flags, 'epic');
         const projectDir = requireFlag(flags, 'project');
-        const checks = readJsonFile(requireFlag(flags, 'checks'));
+        const checks = readChecksFile(requireFlag(flags, 'checks'));
         const ctx = eventContextFromFlags(flags);
         const record = await runIntegrationCheck({
             epicId,

package/factory/orchestrator/dist/crossFinding.js

@@ -123,6 +123,26 @@ export function reconcile(input) {
         if (!nativeByFingerprint.has(finding.fingerprint)) {
             nativeByFingerprint.set(finding.fingerprint, finding);
         }
+        // Also key by the fingerprint computeFingerprint() would produce for this
+        // record TODAY, not just the one stored at raise time. `input.native`
+        // comes straight out of listFindings() (a lineage-wide, possibly
+        // long-lived read) while `group.fingerprint` below is always computed
+        // fresh from the independent provider's evidence -- so a native finding
+        // raised before issue #178 widened the normalizer (its summary containing
+        // a line span the old algorithm did not strip) would otherwise never
+        // match an independent finder's evidence for the identical bug, and get
+        // reported as `co-located`/`independent-only` plus a duplicate
+        // `native-only` instead of `corroborated`.
+        if (finding.file_path !== undefined) {
+            const recomputed = computeFingerprint({
+                filePath: finding.file_path,
+                category: finding.finding_category,
+                summary: finding.summary,
+            });
+            if (!nativeByFingerprint.has(recomputed)) {
+                nativeByFingerprint.set(recomputed, finding);
+            }
+        }
         if (finding.file_path === undefined)
             continue;
         const key = coLocationKey(finding.file_path, finding.finding_category);