@kontextmind/kxm 0.7.169 → 0.7.171

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.169",
+      "version": "0.7.171",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -617,6 +617,24 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Fixed
 
+- **`kxm supervise` keeps supervisor state across a restart.**
+  `status`, `record`, and `tick` store in-flight lanes, the last-seen pull
+  request and CI state, and backoff timers in `.kxm/state/supervisor.json`.
+  A later process reads that file. `tick` clears a backoff whose deadline
+  has passed and appends `.kxm/logs/supervisor.log`. An unknown schema is
+  refused and left unchanged. See the
+  [CLI reference](docs/reference/cli-reference.md#kxm-supervise).
+
+- **`kxm land` names a verify failure and refuses an UNKNOWN merge state.**
+  A failed `verify` records the exit code, the failing step, and a short
+  excerpt on the stage line and in `.kxm/logs/land-verify-<tree>.json`, and
+  writes the full output to `.kxm/logs/land-verify-<tree>.log`. The rebase
+  and merge stages poll `mergeStateStatus` while it is `UNKNOWN` and refuse
+  `land_merge_state_unknown` if it does not resolve. `CLEAN` and `HAS_HOOKS`
+  proceed; `BEHIND` and `DIRTY` still rebase; any other known state refuses
+  `land_merge_not_ready`. See the
+  [CLI reference](docs/reference/cli-reference.md#kxm-land).
+
 - **`kxm hub view` and `kxm hub bind` require a kxm hub body.** HTTP 200 HTML
   (an Authentik login page) and 30x redirects are not healthy. The JSON
   `health` field is `{ "error": "auth_proxy" }`, not the page. Bind refuses

package/docs/adr/ADR-0005-obscura-default-playwright.md

@@ -7,7 +7,7 @@ project: "kxm"
 status: "accepted"
 owner: "@operator"
 created: "2026-09-27"
-updated: "2026-09-27"
+updated: "2026-09-28"
 authority: "decision"
 confidence: "verified"
 summary: "Playwright testing and verification connect to pinned Obscura v0.2.3 over CDP. Steel stays the browser for human takeover, MFA, and the live session viewer."
@@ -74,7 +74,7 @@ Obscura v0.2.3 is a headless Chromium build that speaks the Chrome DevTools Prot
 
 - Playwright tests and verification use Obscura unless the operator sets `KXM_BROWSER=steel`.
 - Steel session create, release, takeover, and the session viewer are unchanged.
-- CI for this smoke test is `.github/workflows/e2e.yml` on `ubuntu-latest`. It does not enable the paused CI, Nightly, or Real Pi smoke workflows.
+- CI for this smoke test is `.github/workflows/e2e.yml` on `ubuntu-latest`. The `CI` workflow is on, and `CI / required` is a required check in `protect-main`. `Nightly` and `Real Pi smoke` stay disabled. This ADR does not enable them.
 - The `node --test` globs do not collect `test/e2e/`.
 
 ## Related

package/docs/architecture/hosted-direction.md

@@ -4,9 +4,9 @@ Target. This page is a direction, not a live deployment.
 
 Read from `plans/plan-per-tenant-hosting.md`.
 `plans/plan-greenfield-infra.md` is in this checkout as a `kxm.doc.v1`
-stub (status draft, authority instruction): the long-form proposal was
-never committed, and the canonical facts below come from the
-implementation-plan greenfield bullets.
+stub committed in #373 (status draft, authority instruction). The
+long-form proposal is not in this repository. The canonical facts below
+come from the implementation-plan greenfield bullets.
 
 ```mermaid
 flowchart LR
@@ -47,10 +47,10 @@ roadmap question. The tracker wins.
 
 ## Greenfield infra plan
 
-`plans/plan-greenfield-infra.md` is observed from this checkout as a
-`kxm.doc.v1` stub (status draft, authority instruction, updated
-2026-09-28). Its delivery position is unchanged: none of the delivery is
-scheduled there.
+`plans/plan-greenfield-infra.md` is a `kxm.doc.v1` stub committed in #373
+(status draft, authority instruction, updated 2026-09-28). The long-form
+proposal is not in this repository. Its delivery position is unchanged:
+none of the delivery is scheduled there.
 
 The tracker names that file. The sentences that can be repeated without a
 hostname, an account name, or a secret are: a first move is recorded as

package/docs/contributing/assignment-runner.md

@@ -402,20 +402,21 @@ regenerates documentation (`docs`), then runs the GitHub stages: `push`,
 
 | Stage | Role |
 |---|---|
-| `verify` | Clean tree, then `npm run verify`, skipped when a receipt for this tree is younger than 30 minutes |
+| `verify` | Clean tree, then `npm run verify`, skipped when an `ok: true` receipt for this tree is younger than 30 minutes. A failure names the exit code, the failing step, and a short excerpt, and writes the full log |
 | `docs` | Regenerate the roadmap after verify and before the merge. Absent generator: pass, skipped |
 | `push` | `git push -u origin <branch>`, with `--force-with-lease` after a rebase in this run |
 | `pr` | Reuse the open pull request, or create one from `--body-file` |
-| `rebase` | Up to five rounds onto `origin/main`. Only the dist rebuild, the CHANGELOG Unreleased union, and the tracker "Landed in this tree" union are resolved automatically |
+| `rebase` | Polls `UNKNOWN` until it resolves. `CLEAN` and `HAS_HOOKS` proceed. `BEHIND` and `DIRTY` rebase, up to five rounds onto `origin/main`. Only the dist rebuild, the CHANGELOG Unreleased union, and the tracker "Landed in this tree" union are resolved automatically. Any other known state blocks |
 | `unblock` | Rerun one failed check. A required review is reported |
-| `merge` | Squash only. Poll until `MERGED`, up to 20 minutes |
+| `merge` | Squash only after `CLEAN` or `HAS_HOOKS`. Poll until `MERGED`, up to 20 minutes. `UNKNOWN` does not merge |
 | `release` | Auto-release tag, Release workflow, then npm for 10 minutes. Prints `PUBLISHED <version>` |
 | `milestone` | Report `deep_review_required` when a phase completes or the body has a `Milestone:` line. Does not run the review |
 
 Refusals (exit 1): `land_dirty_tree`, `land_verify_failed`, `land_docs_failed`,
 `land_push_rejected`, `land_pr_body_missing`, `land_conflict_manual`,
-`land_blocked`, `land_merge_failed`, `land_release_failed`,
-`land_publish_timeout`, `land_milestone_failed`. Usage errors exit 2.
+`land_merge_state_unknown`, `land_merge_not_ready`, `land_blocked`,
+`land_merge_failed`, `land_release_failed`, `land_publish_timeout`,
+`land_milestone_failed`. Usage errors exit 2.
 `--stage <name>` runs one stage. `--dry-run` prints the plan and does not mutate.
 
 The same stages are command gates in `.kxm/gates.yaml` (`land-verify`,

package/docs/contributing/decisions.md

@@ -2,7 +2,7 @@
 title: "Decisions"
 description: "Decisions of medium significance or higher made by automated KXM work in this repository. One entry per decision: the options evaluated with their weights, and why the selected option won. Recorded the turn the decision is taken."
 audience: "agents and maintainers"
-updated: "2026-09-27"
+updated: "2026-09-28"
 ---
 
 # Decisions

package/docs/contributing/learnings.md

@@ -2,7 +2,7 @@
 title: "Learnings"
 description: "Durable lessons from running the writer, critic, and landing loop on this repository. One entry per lesson, with the evidence and where it applies. Pruned when a lesson stops being true."
 audience: "agents and maintainers"
-updated: "2026-09-26"
+updated: "2026-09-28"
 ---
 
 # Learnings
@@ -97,9 +97,14 @@ entry whose fix has landed is deleted, not archived.
 
 - **Auto-merge cannot be enabled on a PR that is already `CLEAN`**; the
   mutation answers "clean status" and the REST squash merge is the path.
-  While CI is paused every PR is clean, so this is the normal path.
-- **A verify failure inside `kxm land` shows only the child's last output
-  line.** Re-run verify by hand to see the cause until backlog S19 lands.
+  `CI` is on and `CI / required` is a required check in `protect-main`, so
+  a pull request is not clean until that check passes.
+- **A verify failure inside `kxm land` names the exit code, the failing
+  step, and a short excerpt, and keeps the full output in
+  `.kxm/logs/land-verify-<tree>.log`.** The receipt
+  `.kxm/logs/land-verify-<tree>.json` records the same fields with
+  `ok: false`. `mergeStateStatus: UNKNOWN` is polled and refused at the
+  bound; it is not treated as ready to merge.
 
 ## Reviews
 

package/docs/reference/cli-reference.md

@@ -160,6 +160,7 @@ Exit 2 covers an unknown command or option, a missing argument or required optio
 | Create and drive a run | [`kxm run`](#kxm-run), [`kxm runs drive`](#kxm-runs-drive), [`kxm runtime status`](#kxm-runtime-status) |
 | Work in an isolated checkout | [`kxm lane`](#kxm-lane), [`kxm run --lane`](#kxm-run) |
 | Land the current branch | [`kxm land`](#kxm-land) |
+| Resume the roadmap supervisor | [`kxm supervise`](#kxm-supervise) |
 | Delegate and accept a developer assignment | [`kxm assign`](#kxm-assign) |
 | Inspect runs | [`kxm runs list`](#kxm-runs-list), [`kxm runs status`](#kxm-runs-status), [`kxm runs receipt`](#kxm-runs-receipt), [`kxm tenant status`](#kxm-tenant-status), [`kxm workflow list`](#kxm-workflow-list) |
 | Message peers | [`kxm peer list`](#kxm-peer-list), [`kxm peer send`](#kxm-peer-send), [`kxm peer await`](#kxm-peer-await), [`kxm peer fanout`](#kxm-peer-fanout) |
@@ -1454,20 +1455,42 @@ Outside a KXM project the command refuses `project_required` (exit 1). Unknown a
 
 | Stage | What it does |
 |---|---|
-| `verify` | Refuses `land_dirty_tree` unless `git status --porcelain` is empty. Skips when `.kxm/logs/land-verify-<tree>.json` for `HEAD^{tree}` is younger than 30 minutes. Otherwise runs `npm run verify` and writes that receipt. |
+| `verify` | Refuses `land_dirty_tree` unless `git status --porcelain` is empty. Skips when `.kxm/logs/land-verify-<tree>.json` for `HEAD^{tree}` is younger than 30 minutes and records `ok: true`. Otherwise runs `npm run verify` and writes that receipt. A failure writes the full output to `.kxm/logs/land-verify-<tree>.log` and a receipt with `ok: false`, the exit code, the failing step, and a short excerpt. The stage line names that exit code, the failing lines, and the log path. |
 | `docs` | Runs `plans/kxm-roadmap/update-dashboard.mjs` when that file exists. Commits changes under `docs/roadmap/`, `plans/kxm-roadmap/`, or `docs/architecture/` as `docs(roadmap): regenerate after verify`. Any other path, including `state.json`, is `land_docs_failed`. When the generator is absent the stage passes with `docs: skipped (generator absent)`. |
 | `push` | `git push -u origin <branch>`. After a rebase in this run, the push uses `--force-with-lease`. |
 | `pr` | Reuses the branch's open pull request, or creates one with `gh pr create --body-file`. The title is `--title` when that option is set; otherwise it is the subject of the first commit (`git log --reverse --format=%s origin/main..HEAD`). `--dry-run` prints that title. |
-| `rebase` | When `mergeStateStatus` is `BEHIND` or `DIRTY`: fetch, rebase onto `origin/main`, and resolve only three conflicts (take `plugins/kxm/dist` from main and rebuild; union CHANGELOG Unreleased bullets, ours first; union the tracker "Landed in this tree" list, newest first). Runs `docs` again when the tree changed, re-verifies unless `git merge-tree --write-tree origin/main HEAD` was clean, and pushes with the lease. Five rounds, then `land_conflict_manual`. |
+| `rebase` | Polls `mergeStateStatus` while it is `UNKNOWN`, with bounded backoff (`KXM_LAND_MERGE_STATE_POLL_MS`, default 1 second, doubling up to 30 seconds, for at most `KXM_LAND_MERGE_STATE_WAIT_MS`, default 2 minutes). `UNKNOWN` at that bound is `land_merge_state_unknown` and is never treated as ready. `CLEAN` and `HAS_HOOKS` proceed. `BEHIND` and `DIRTY` fetch and rebase onto `origin/main`, resolving only three conflicts (take `plugins/kxm/dist` from main and rebuild; union CHANGELOG Unreleased bullets, ours first; union the tracker "Landed in this tree" list, newest first). Any other known state, including `BLOCKED`, is `land_merge_not_ready`. Runs `docs` again when the tree changed, re-verifies unless `git merge-tree --write-tree origin/main HEAD` was clean, and pushes with the lease. Five rounds, then `land_conflict_manual`. |
 | `unblock` | Reads `statusCheckRollup` and `reviewDecision`. Reruns one failed check with `gh run rerun --failed`. A second failure or `REVIEW_REQUIRED` is `land_blocked`. |
-| `merge` | Enables auto-merge with `enablePullRequestAutoMerge` and `mergeMethod: SQUASH`. When the response contains "clean status", squash-merges with `PUT /repos/{owner}/{repo}/pulls/{n}/merge` and commit title `<title> (#n)`. Polls `gh pr view --json state` every 30 seconds for up to 20 minutes. |
+| `merge` | Refuses `land_merge_state_unknown` when `mergeStateStatus` stays `UNKNOWN`, and `land_merge_not_ready` for any known state other than `CLEAN` or `HAS_HOOKS`. Otherwise enables auto-merge with `enablePullRequestAutoMerge` and `mergeMethod: SQUASH`. When the response contains "clean status", squash-merges with `PUT /repos/{owner}/{repo}/pulls/{n}/merge` and commit title `<title> (#n)`. Polls `gh pr view --json state` every 30 seconds for up to 20 minutes. |
 | `release` | Records the newest `v*` tag before the merge, waits for the Auto-Release run whose title contains the pull request title, requires a newer tag from `git ls-remote --tags origin`, then waits for the first `release.yml` run whose `createdAt` is after that Auto-Release run, with no title filter. Both run ids are written to `.kxm/logs/land-release-context.json` and printed in the stage detail (`PUBLISHED <version> auto-release <id> release <id>`). Each wait prints one JSON line every 2 minutes (`waiting auto-release.yml 4m`). The npm poll is `npm view @kontextmind/kxm@<version> version` every 30 seconds for 10 minutes. |
 | `milestone` | Compares `plans/kxm-roadmap/state.json` from before and after `docs`. When a phase goes from an open task to all tasks `done`, or the pull request body contains a `Milestone:` line, prints `deep_review_required: true` and exits 0. The review is the `/reanalyze-roadmap` skill, not this command. An absent state file passes with skipped. |
 
-Refusals (exit 1): `project_required`, `land_dirty_tree`, `land_verify_failed`, `land_docs_failed`, `land_push_rejected`, `land_pr_body_missing`, `land_pr_title_missing`, `land_conflict_manual`, `land_blocked`, `land_merge_failed`, `land_release_failed`, `land_publish_timeout`, `land_milestone_failed`.
+Refusals (exit 1): `project_required`, `land_dirty_tree`, `land_verify_failed`, `land_docs_failed`, `land_push_rejected`, `land_pr_body_missing`, `land_pr_title_missing`, `land_conflict_manual`, `land_merge_state_unknown`, `land_merge_not_ready`, `land_blocked`, `land_merge_failed`, `land_release_failed`, `land_publish_timeout`, `land_milestone_failed`.
 
 `land_pr_title_missing`: the `pr` stage was not given `--title`, and the first commit subject on `origin/main..HEAD` is empty.
 
+`land_verify_failed`: `npm run verify` exited non-zero. The stage line and `.kxm/logs/land-verify-<tree>.json` include `exitCode`, the failing step when the output names one, a short excerpt of the failing lines, and `log` (the full output).
+
+`land_merge_state_unknown`: `mergeStateStatus` stayed `UNKNOWN` until the wait bound. The stage does not pass and does not merge.
+
+`land_merge_not_ready`: GitHub reported a known merge state that is not `CLEAN` or `HAS_HOOKS`, and the rebase stage is not going to rebase it (`BLOCKED`, and on the merge stage also `BEHIND` or `DIRTY`). The detail names the status.
+
+## `kxm supervise`
+
+Persist the roadmap supervisor's memory in `.kxm/state/supervisor.json` (`kxm.supervisor.v1`, mode `0600`). The file holds in-flight lanes, the last-seen pull request number and merge state, the last-seen CI status and conclusion, and backoff timers. A missing file is empty. A malformed file or any other schema is refused and left unchanged. A later process reads the same file and continues.
+
+```text
+kxm supervise status
+kxm supervise record --lane <unit> [--pr <n> --merge-state <status>] [--ci-status <status> --ci-conclusion <conclusion>] [--backoff-ms <n>] [--settled]
+kxm supervise tick
+```
+
+`record` updates one lane and keeps fields that this call does not set. `--settled` marks the lane not in flight. `--backoff-ms 0` clears the timer. `tick` clears backoff timers whose deadline has passed, leaves the lane in flight with its last-seen pull request and CI state, and appends one line to `.kxm/logs/supervisor.log`. A timer still in the future is unchanged. `--dry-run` prints the writes and does not change the file or the log. `KXM_SUPERVISE_NOW` overrides the clock with an ISO-8601 UTC timestamp.
+
+Outside a KXM project the command refuses `project_required` (exit 1).
+
+Refusals (exit 1): `project_required`, `supervisor_unreadable`, `supervisor_schema_unsupported`, `supervisor_clock_invalid`, `lane_unit_invalid`, `supervisor_pr_invalid`, `supervisor_ci_invalid`, `supervisor_backoff_invalid`.
+
 ## `kxm assign`
 
 `kxm assign` is the entry to this repository's developer assignment runner. Each verb spawns `node scripts/assignment-run.mjs <verb> ...` from the project root with that argument list, `stdio: "inherit"`, and the process environment unchanged. The command returns the child's exit code. It does not load a `.env` file, resolve paths, or repeat any runner check. Every validation rule, refusal code, and file the runner writes stays in [`scripts/assignment-run.mjs`](../../scripts/assignment-run.mjs). The loop, the records, and those codes are documented in [Assignment runner](../contributing/assignment-runner.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.169",
+  "version": "0.7.171",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.169",
+  "version": "0.7.171",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",