@lchase/kiln 0.8.0 → 0.10.0

package/README.md

@@ -108,7 +108,7 @@ Then set the kiln config to `"sandbox": { "mode": "docker" }`.
 
 `kiln tick` and `kiln serve` name what is missing when sandbox mode is on: the docker binary, the docker daemon, each image, and the credential. They also refuse an installed `@lchase/yak` that does not pass `allowedDomains` from the agent step into the sandbox proxy. `@lchase/yak` 0.8.0 does. An older package drops `sandbox`, `image`, and `allowedDomains` while loading YAML and opens the proxy with only `api.anthropic.com`, so the job would run on the host with the open internet. Kiln leaves that job failed until `kiln retry`, after the installed package is 0.8.0 or newer.
 
-A step that fails with yak reason `sandbox-error` goes to Needs human. The card shows the failure detail. Kiln does not schedule an automatic retry for it. The card of a sandboxed job shows `sandbox · docker` in the same monospace metadata as the rest of the board.
+A sandbox or container start flake (the container never started, the daemon was unreachable) is transient and retries with the usual backoff. Any other yak `sandbox-error` is not retried. The card shows the failure detail, and a sandboxed job shows `sandbox · docker`.
 
 ## Register repos
 
@@ -271,12 +271,14 @@ while true; do npm run kiln -- tick; sleep 30; done
 
 A job is ready when its dependencies are met and the number of jobs in flight is under `maxConcurrent`. The default is after merged: every job in `dependsOn` is `done`. `--stack` is met when that one upstream has landed. A rejected gate does not unblock the next job. An ok run with no readable approval does not either. An authentication failure does not either: reason `auth-failed` stays in Needs human until `kiln retry`.
 
-`stallTimeoutMs` (default `900000`, 15 minutes), `maxAttempts` (default `3`), and `maxFixRounds` (default `2`) live in the kiln config. `stallTimeoutMs` of `0` or below turns stall detection off. A running job with no yak journal event and no log output for that long is killed, process tree included, and marked failed with reason `stalled`. A process that is already gone when `kiln tick` or `kiln serve` starts is `orphaned`. An agent or launch crash is `crashed`. A non-zero exit that is not a gate rejection is `failed`. Those four retry on their own after `10s × 2^(n-1)`, capped at 5 minutes. A rejected gate, a cancelled run, and an ok run with no readable approval do not. After `maxAttempts` the job is `dead`. Each attempt is a file under `<kiln-dir>/attempts/<job-id>.json`, so state stays derived. Status prints `attempts`, `reason`, and `next retry` from the same view `readStatus` returns. On the board, a dead card in Needs human shows `attempt N/M` and the reason. A failure that still has a scheduled retry stays in its stage column instead, with `retrying` and the local time.
+`stallTimeoutMs` (default `900000`, 15 minutes), `maxAttempts` (default `3`), and `maxFixRounds` (default `2`) live in the kiln config. `stallTimeoutMs` of `0` or below turns stall detection off. A running job with no yak journal event and no log output for that long is killed, process tree included, and marked failed with reason `stalled`. A process that is already gone when `kiln tick` or `kiln serve` starts is `orphaned`. An agent or launch crash is `crashed`. A non-zero exit that is not a gate rejection is `failed`. Those four retry on their own after `10s × 2^(n-1)`, capped at 5 minutes. A rejected gate, a cancelled run, and an ok run with no readable approval do not. After `maxAttempts` the failure is class `budget` and the job is `needs-human`. The same fingerprint does that after `maxSameFingerprint` (default 3) even sooner. A test, build, or type error is class `deterministic` and is not retried. `repos.<name>.maxAttempts` and `repos.<name>.maxFixRounds` override the global caps. `dailyDollarCap`, when set, blocks new runs once today's recorded dollars reach it. `kiln pause` does the same until `kiln resume`. In-flight runs finish. `kiln revise <id> --note <text>` sends a gated job around again with that note in the next prompt. Each attempt is a file under `<kiln-dir>/attempts/<job-id>.json`, so state stays derived. Status prints `attempts`, `reason`, and `next retry` from the same view `readStatus` returns. On the board, a dead card in Needs human shows `attempt N/M` and the reason. A failure that still has a scheduled retry stays in its stage column instead, with `retrying` and the local time.
 
 While a `deliver=pr` job is `in-review`, tick reads that pull request with `gh`: check runs for the head, reviews, and unresolved review comments. The operator's inline comments and unresolved threads count; a top-level note counts only when it starts with `/kiln`, and that prefix is left out of the fix prompt. Comments from `kiln` or a `[bot]` login are ignored, and a resolved thread does not start a round. Pending checks are ignored. A completed failing check on a head that no round has recorded, or review feedback newer than the last round, starts `workflows/fix.yaml` with `yak run --from` that head. The prompt is the original spec plus the failing check names (with a short log excerpt) and the review comment bodies, including file and line. The agent commits on `yak/<run-id>` and does not push. Kiln fast-forwards the open pull request branch. It does not open a second pull request, force-push, merge, approve, or comment. The same head and the same feedback do not start two runs. Each round is a file under `<kiln-dir>/feedback/<job-id>.json`. A stall or crash during a fix uses the attempt ledger above. After `maxFixRounds` the job is `needs-human` with reason `feedback-exhausted`. Feedback Kiln cannot classify is `needs-human` with reason `feedback-ambiguous`. The person merges the pull request.
 
 `npm run kiln -- status` lists jobs across repos. When a job has `source`, status prints `source <kind> <ref>`. For `needs-human` it prints `approve: kiln approve <id>` and `reject: kiln reject <id>`. Run those as `npm run kiln -- approve <id>` and `npm run kiln -- reject <id>`. For `done` and `in-review` it prints the branch. `deliver=local` prints `branch yak/<run-id>`. `deliver=pr` prints the remote branch name recorded on the delivery, and the pull request url once one exists. `auth-failed` prints `Claude login rejected (401) — check CLAUDE_CODE_OAUTH_TOKEN / claude login, then Retry`. For an investigation whose findings file exists, it prints `findings <path>`. That path is `findingsPath` on the same status view `kiln serve` renders, and the console links it. For `blocked` on a dependency id that has no job file, it prints `blocked on missing job <id>`. While an upstream pull request is open, it prints `waiting for PR #N to merge`. `npm run kiln -- retry <id>` relaunches a failed or dead job, or delivers again when the only failure is opening the pull request, and clears the attempt ledger.
 
+`npm run kiln -- ledger` prints today's recorded dollars against `dailyDollarCap` (or `no cap`) and counts human interventions from `<kiln-home>/events.jsonl`: a rejected gate, a job retried by hand, an edit noted on a gate answer, and a needs-human stop. `--since 7d` (also `12h`, `30m`, `45s`, or an ISO time) keeps events at or after that instant. `--repo <name>` limits the count to one repo. A failed append is reported and does not fail the job. `GET /api/events?job_id=` on `kiln serve` returns that job's lines. A pull request body gains a short Evidence section from the same lines, with tokens and secret env values masked.
+
 State is derived from the yak journal, the gate files, and (for `deliver=pr`) `gh pr view`:
 
 | State | Meaning |
@@ -284,11 +286,11 @@ State is derived from the yak journal, the gate files, and (for `deliver=pr`) `g
 | `queued` | Dependencies are met, and the job has not started |
 | `blocked` | An after-merged dependency is not `done`, or a stacked dependency has not landed. A missing job id is named |
 | `running` | Yak is alive, or the launch process is alive and has not written a journal |
-| `needs-human` | The run is suspended on an open gate, or pull request feedback is exhausted (`feedback-exhausted`) or ambiguous (`feedback-ambiguous`) |
+| `needs-human` | A gate is open, feedback is exhausted or ambiguous, the attempt cap is used, or the same fingerprint has failed `maxSameFingerprint` times. `kiln retry` clears an attempt-cap or fingerprint stop. `kiln revise --note` sends a gate back with a note |
 | `approved` | The gate says approve and the run has not finished. This still holds a slot |
 | `rejected` | The run finished ok and the gate says reject |
 | `failed` | The run failed, the launch died before a journal, the run finished ok with no readable approval, a pull request could not be opened, a Claude login was rejected (`auth-failed`, not retried), or a transient failure is waiting to retry |
-| `dead` | The attempt budget is used up. Before the next tick, a journal whose process is already gone is also `dead`. Status prints the cancel command when a process is gone, and `kiln retry <id>` once attempts are exhausted |
+| `dead` | A journal whose process is already gone, before the next tick records it. Status prints the cancel command when a process is gone |
 | `in-review` | `deliver=pr` and the run has landed. The pull request is open, or the next tick still has to open it |
 | `done` | `deliver=local`: the run finished ok and the gate says approve. `deliver=pr`: that pull request has merged. An investigation is `done` when the gate says approve, including when the repo is `deliver=pr`. It does not enter `in-review` |
 

package/assets/serve.css

@@ -61,6 +61,19 @@ header {
 }
 .ver { font-size: 12px; line-height: 16px; color: var(--faint); align-self: flex-end; margin: 0 0 4px -4px; }
 h1 { margin: 0; font-size: 18px; line-height: 24px; font-weight: 500; }
+.spend { font-family: var(--mono); font-size: 12px; line-height: 16px; color: var(--muted); }
+.pause { margin: 0; }
+.pause button, .d-actions .revise input {
+  font: inherit;
+  color: var(--ink);
+  background: var(--card);
+  border: 1px solid var(--line-strong);
+  border-radius: 6px;
+  padding: 6px 10px;
+}
+.pause button[aria-pressed="true"] { color: var(--human); }
+.d-actions .revise { display: flex; gap: 8px; align-items: center; }
+.d-actions .revise input { min-width: 16rem; }
 .status { margin-left: auto; font-family: var(--mono); font-size: 12px; line-height: 16px; color: var(--muted); }
 .status::before {
   content: "";

package/assets/serve.js

@@ -605,6 +605,8 @@
         base: repo.base || "",
         prTitle: repo.prTitle || "",
         branch: repo.branch || "",
+        maxAttempts: repo.maxAttempts != null ? String(repo.maxAttempts) : "",
+        maxFixRounds: repo.maxFixRounds != null ? String(repo.maxFixRounds) : "",
       };
     }
     return out;
@@ -625,7 +627,11 @@
     var attempts = document.getElementById("hint-attempts");
     var stall = document.getElementById("hint-stall");
     var rounds = document.getElementById("hint-fix");
-    if (attempts) attempts.textContent = "Default " + (settingsDefaults.maxAttempts != null ? settingsDefaults.maxAttempts : 3) + ". Transient failures before the job is dead.";
+    if (attempts) attempts.textContent = "Default " + (settingsDefaults.maxAttempts != null ? settingsDefaults.maxAttempts : 3) + ". Transient failures before the job needs a person.";
+    var fingerprint = document.getElementById("hint-fingerprint");
+    var cap = document.getElementById("hint-cap");
+    if (fingerprint) fingerprint.textContent = "Default " + (settingsDefaults.maxSameFingerprint != null ? settingsDefaults.maxSameFingerprint : 3) + ". Identical fingerprints before the job needs a person.";
+    if (cap) cap.textContent = "Empty means no daily cap. Recorded dollars, local day.";
     if (stall) stall.textContent = "Default " + (settingsDefaults.stallTimeoutMs != null ? settingsDefaults.stallTimeoutMs : 900000) + " (15 minutes). 0 disables stall detection.";
     if (rounds) rounds.textContent = "Default " + (settingsDefaults.maxFixRounds != null ? settingsDefaults.maxFixRounds : 2) + ". Fix rounds before the job needs a person.";
     var attemptInput = document.getElementById("max-attempts");
@@ -634,6 +640,8 @@
     if (attemptInput) attemptInput.placeholder = String(settingsDefaults.maxAttempts != null ? settingsDefaults.maxAttempts : 3);
     if (stallInput) stallInput.placeholder = String(settingsDefaults.stallTimeoutMs != null ? settingsDefaults.stallTimeoutMs : 900000);
     if (roundInput) roundInput.placeholder = String(settingsDefaults.maxFixRounds != null ? settingsDefaults.maxFixRounds : 2);
+    var fingerprintInput = document.getElementById("max-same-fingerprint");
+    if (fingerprintInput) fingerprintInput.placeholder = String(settingsDefaults.maxSameFingerprint != null ? settingsDefaults.maxSameFingerprint : 3);
   }
 
   function fillGlobal(data) {
@@ -644,6 +652,10 @@
     if (attempts) attempts.value = data.maxAttempts != null ? String(data.maxAttempts) : "";
     if (stall) stall.value = data.stallTimeoutMs != null ? String(data.stallTimeoutMs) : "";
     if (rounds) rounds.value = data.maxFixRounds != null ? String(data.maxFixRounds) : "";
+    var fingerprint = document.getElementById("max-same-fingerprint");
+    var cap = document.getElementById("daily-dollar-cap");
+    if (fingerprint) fingerprint.value = data.maxSameFingerprint != null ? String(data.maxSameFingerprint) : "";
+    if (cap) cap.value = data.dailyDollarCap != null ? String(data.dailyDollarCap) : "";
     setPressed("#sandbox-mode [data-sandbox]", "data-sandbox", data.sandbox && data.sandbox.mode === "docker" ? "docker" : "off");
     var domains = document.getElementById("sandbox-domains");
     if (domains) domains.value = data.sandbox && data.sandbox.allowDomains ? data.sandbox.allowDomains.join("\n") : "";
@@ -674,12 +686,16 @@
     var baseInput = document.getElementById("repo-base");
     var titleInput = document.getElementById("repo-pr-title");
     var branchInput = document.getElementById("repo-branch");
+    var attemptsInput = document.getElementById("repo-max-attempts");
+    var roundsInput = document.getElementById("repo-max-fix-rounds");
     if (nameInput) nameInput.value = name || "";
     if (pathInput) pathInput.value = repo.path || "";
     if (testInput) testInput.value = repo.test || "";
     if (baseInput) baseInput.value = repo.base || "";
     if (titleInput) titleInput.value = repo.prTitle || "";
     if (branchInput) branchInput.value = repo.branch || "";
+    if (attemptsInput) attemptsInput.value = repo.maxAttempts != null && repo.maxAttempts !== "" ? String(repo.maxAttempts) : "";
+    if (roundsInput) roundsInput.value = repo.maxFixRounds != null && repo.maxFixRounds !== "" ? String(repo.maxFixRounds) : "";
     setPressed("#repo-deliver [data-deliver]", "data-deliver", repo.deliver === "pr" ? "pr" : "local");
     var browser = document.getElementById("repo-browser");
     if (browser) { browser.hidden = true; browser.innerHTML = ""; }
@@ -698,6 +714,8 @@
       base: value("repo-base"),
       prTitle: value("repo-pr-title"),
       branch: value("repo-branch"),
+      maxAttempts: value("repo-max-attempts"),
+      maxFixRounds: value("repo-max-fix-rounds"),
     };
   }
 
@@ -763,6 +781,13 @@
     renderRepoList();
   }
 
+  function optionalNumber(raw) {
+    var text = String(raw == null ? "" : raw).trim();
+    if (!text) return undefined;
+    if (!/^\d+(\.\d+)?$/.test(text)) return text;
+    return Number(text);
+  }
+
   function optionalInt(raw) {
     var text = String(raw == null ? "" : raw).trim();
     if (!text) return undefined;
@@ -791,6 +816,10 @@
       if (repo.base) entry.base = repo.base;
       if (repo.prTitle) entry.prTitle = repo.prTitle;
       if (repo.branch) entry.branch = repo.branch;
+      var repoAttempts = optionalInt(repo.maxAttempts);
+      var repoRounds = optionalInt(repo.maxFixRounds);
+      if (repoAttempts !== undefined) entry.maxAttempts = repoAttempts;
+      if (repoRounds !== undefined) entry.maxFixRounds = repoRounds;
       repos[name] = entry;
     }
     var body = { revision: settingsDoc ? settingsDoc.revision : "", repos: repos };
@@ -800,6 +829,10 @@
     if (attempts !== undefined) body.maxAttempts = attempts;
     if (stall !== undefined) body.stallTimeoutMs = stall;
     if (rounds !== undefined) body.maxFixRounds = rounds;
+    var fingerprint = optionalInt(inputValue("max-same-fingerprint"));
+    var cap = optionalNumber(inputValue("daily-dollar-cap"));
+    if (fingerprint !== undefined) body.maxSameFingerprint = fingerprint;
+    if (cap !== undefined) body.dailyDollarCap = cap;
     var mode = selectedAttr("#sandbox-mode [data-sandbox]", "data-sandbox", "off");
     var domains = domainList(inputValue("sandbox-domains"));
     var sandbox = {};
@@ -820,7 +853,8 @@
       if (repoField) {
         setSettingsTab("repos");
         if (Object.prototype.hasOwnProperty.call(repoDraft, repoField[1])) startEdit(repoField[1]);
-        showSlot(repoField[2], message);
+        var slotName = repoField[2] === "maxAttempts" ? "repoAttempts" : repoField[2] === "maxFixRounds" ? "repoRounds" : repoField[2];
+        showSlot(slotName, message);
         continue;
       }
       if (key.indexOf("sandbox.allowDomains") === 0) {
@@ -828,7 +862,7 @@
         showSlot("sandbox.allowDomains", message);
         continue;
       }
-      if (key === "sandbox.mode" || key === "maxAttempts" || key === "stallTimeoutMs" || key === "maxFixRounds") {
+      if (key === "sandbox.mode" || key === "maxAttempts" || key === "stallTimeoutMs" || key === "maxFixRounds" || key === "maxSameFingerprint" || key === "dailyDollarCap") {
         setSettingsTab("global");
         showSlot(key, message);
         continue;
@@ -1154,6 +1188,18 @@
           location.reload();
           return;
         }
+        var toggle = document.getElementById("pause-toggle");
+        var form = document.getElementById("pause-form");
+        if (toggle && form && data && typeof data.paused === "boolean") {
+          toggle.textContent = data.paused ? "Resume" : "Pause";
+          toggle.setAttribute("aria-pressed", data.paused ? "true" : "false");
+          form.setAttribute("action", data.paused ? "/api/resume" : "/api/pause");
+        }
+        var spend = document.getElementById("spend");
+        if (spend && data && data.spend) {
+          var capText = data.spend.cap == null ? "no cap" : "$" + Number(data.spend.cap).toFixed(2);
+          spend.textContent = "today " + data.spend.day + "  $" + Number(data.spend.usd).toFixed(2) + " / " + capText;
+        }
         stamp(true);
       })
       .catch(function () { stamp(false); });

package/dist/attention.js

@@ -24,6 +24,8 @@ const RETRYABLE_REASONS = new Set(["stalled", "crashed", "orphaned", "failed"]);
  * so a waiting retry is not a call for a person.
  */
 export function scheduledRetry(job) {
+    if (job.waitReason)
+        return false;
     if (job.state !== "failed")
         return false;
     if (!job.nextRetryAt || !Number.isFinite(Date.parse(job.nextRetryAt)))
@@ -92,13 +94,18 @@ function toItem(job) {
         reason: attentionReason(job, tail),
         ...(tail ? { errorTail: tail } : {}),
         ...(findings ? { findings } : {}),
-        retry: job.state === "failed" || job.state === "dead",
+        retry: (job.state === "failed" || job.state === "dead" || (job.state === "needs-human" && Boolean(job.stopReason))) &&
+            job.gates.length === 0,
         ...(since ? { since } : {}),
     };
 }
 export function attentionReason(job, tail = errorTail(job)) {
     switch (job.state) {
         case "needs-human": {
+            if (job.stopReason === "attempt-cap")
+                return "Attempt cap reached";
+            if (job.stopReason === "fingerprint")
+                return "Same failure repeated";
             if (job.feedbackReason)
                 return job.feedbackReason;
             const question = gateQuestion(job);
@@ -109,6 +116,8 @@ export function attentionReason(job, tail = errorTail(job)) {
                 return AUTH_FAILED_LINE;
             return job.sandboxError ? `Sandbox: ${oneLine(job.sandboxError)}` : "Run died before it finished";
         case "failed": {
+            if (job.waitReason)
+                return job.waitReason;
             if (job.lastFailureReason === "auth-failed")
                 return AUTH_FAILED_LINE;
             if (job.sandboxError)
@@ -124,8 +133,6 @@ export function attentionReason(job, tail = errorTail(job)) {
             return "In review";
         case "invalid":
             return job.invalidReason ? `Invalid: ${oneLine(job.invalidReason)}` : "Job file is invalid";
-        case "blocked":
-            return oneLine(waitingOn(job));
         case "running": {
             const current = job.steps.find((step) => step.phase === "current" || step.phase === "failed");
             return current ? `Running ${current.id}` : "Running";
@@ -133,7 +140,9 @@ export function attentionReason(job, tail = errorTail(job)) {
         case "approved":
             return "Approved, still finishing";
         case "queued":
-            return "Queued, ready to launch";
+            return job.waitReason ?? "Queued, ready to launch";
+        case "blocked":
+            return job.waitReason ?? oneLine(waitingOn(job));
         case "done":
             return job.prUrl ? "Merged" : "Done";
         case "rejected":

package/dist/cli.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 import { addRepo, renderRepoList, resolveKilnConfig } from "./config.js";
 import { renderSandboxStatus, runSandboxBuild } from "./sandbox.js";
-import { answerJob, retryJob, runStatus, runTick } from "./driver.js";
+import { answerJob, retryJob, reviseJob, runStatus, runTick } from "./driver.js";
+import { pauseFactory, resumeFactory } from "./rails.js";
+import { parseSince, renderLedgerFile } from "./ledger.js";
 import { startServe } from "./serve.js";
 import { addFromFile } from "./intake/file.js";
 import { addFromJira } from "./intake/jira.js";
@@ -18,7 +20,11 @@ function usage() {
         "       kiln status [jobId] [--config <file>]",
         "       kiln approve <jobId> [--config <file>]",
         "       kiln reject <jobId> [--config <file>]",
+        "       kiln revise <jobId> --note <text> [--config <file>]",
         "       kiln retry <jobId> [--config <file>]",
+        "       kiln pause [--config <file>]",
+        "       kiln resume [--config <file>]",
+        "       kiln ledger [--since 7d] [--repo <name>] [--config <file>]",
         "       kiln sandbox [build] [--config <file>]",
         "       kiln serve [--port 4100] [--tick <seconds>|--no-tick] [--config <file>]",
         "",
@@ -27,7 +33,7 @@ function usage() {
         "A relative path is stored absolute, resolved from the working directory.",
         "~ is expanded from the home directory.",
         "",
-        "Config, jobs, logs, and deliveries live in one kiln home: --config <file>",
+        "Config, jobs, logs, events, and deliveries live in one kiln home: --config <file>",
         "if given, otherwise $KILN_HOME/kiln.config.json when KILN_HOME is set,",
         "otherwise ~/.kiln/kiln.config.json. repo add creates that directory.",
         "Run kiln repo add <name> <path> from any directory. A leftover",
@@ -64,8 +70,20 @@ function usage() {
         "or a process that is already gone when tick or serve starts (orphaned) retries",
         "after 10s, 20s, 40s, and so on, capped at 5 minutes, up to maxAttempts",
         "A rejected Claude login (401 or an invalid bearer token) is auth-failed and is not retried.",
-        "(default 3). The job is then dead. A rejected gate is not retried.",
+        "(default 3, overridable per repo). Hitting the cap is a budget failure and the",
+        "job needs a person. The same failure fingerprint stops the job after",
+        "maxSameFingerprint (default 3). A test, build, or type error is not retried.",
+        "A rejected gate is not retried. revise sends the job around again with the",
+        "note in the next prompt. pause stops new runs until resume. In-flight runs",
+        "finish. A daily dollar cap, when set, does the same once today's recorded",
+        "spend reaches it. ledger prints that spend.",
         "Attempts are files under the kiln home, not fields on the job.",
+        "Events are one JSON line each in <kiln-home>/events.jsonl. A write",
+        "failure is reported and does not stop the job. kiln ledger counts",
+        "human interventions from that log: a rejected gate, a manual retry,",
+        "an edit noted on a gate, and a needs-human stop. --since 7d (or 12h,",
+        "30m, 45s, or an ISO time) keeps events at or after that time. --repo",
+        "limits the count to one registered repo name.",
         "Once a pull request is open, tick watches it. A failed check or a review",
         "that requests changes starts a fix on that same branch, up to maxFixRounds",
         "(default 2). Kiln does not merge, approve, or comment. Past that bound the",
@@ -219,6 +237,20 @@ function parseFlags(argv) {
             bag.noTick = true;
             continue;
         }
+        if (flag === "--note") {
+            if (!next || next.startsWith("--"))
+                usage();
+            bag.note = next;
+            i += 1;
+            continue;
+        }
+        if (flag === "--since") {
+            if (!next || next.startsWith("--"))
+                usage();
+            bag.since = next;
+            i += 1;
+            continue;
+        }
         if (flag?.startsWith("--"))
             usage();
         if (flag !== undefined)
@@ -226,9 +258,11 @@ function parseFlags(argv) {
     }
     return bag;
 }
-function rejectServeFlags(flags) {
+function rejectServeFlags(flags, options = {}) {
     if (flags.port !== undefined || flags.tickSeconds !== undefined || flags.noTick)
         usage();
+    if (options.since !== false && flags.since)
+        usage();
 }
 function repoCommand(argv) {
     const sub = argv[0];
@@ -363,7 +397,7 @@ function sandboxCommand(argv) {
 function tickCommand(argv) {
     const flags = parseFlags(argv);
     rejectServeFlags(flags);
-    if (flags.positionals.length !== 0 || flags.test || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
+    if (flags.positionals.length !== 0 || flags.test || flags.note || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
         usage();
     }
     const config = resolveKilnConfig({ configPath: flags.configPath });
@@ -372,7 +406,7 @@ function tickCommand(argv) {
 function statusCommand(argv) {
     const flags = parseFlags(argv);
     rejectServeFlags(flags);
-    if (flags.positionals.length > 1 || flags.test || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
+    if (flags.positionals.length > 1 || flags.test || flags.note || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
         usage();
     }
     const config = resolveKilnConfig({ configPath: flags.configPath });
@@ -382,17 +416,71 @@ function retryCommand(argv) {
     const flags = parseFlags(argv);
     rejectServeFlags(flags);
     const jobId = flags.positionals[0];
-    if (!jobId || flags.positionals.length !== 1 || flags.test || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
+    if (!jobId || flags.positionals.length !== 1 || flags.test || flags.note || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
         usage();
     }
     const config = resolveKilnConfig({ configPath: flags.configPath });
     process.stdout.write(retryJob(config, jobId));
 }
+function ledgerCommand(argv) {
+    const flags = parseFlags(argv);
+    rejectServeFlags(flags, { since: false });
+    if (flags.positionals.length !== 0 ||
+        flags.test ||
+        flags.spec ||
+        flags.prompt ||
+        flags.jira ||
+        flags.title ||
+        flags.issue ||
+        flags.workflow ||
+        flags.context ||
+        flags.dryRun ||
+        flags.stack ||
+        flags.after.length > 0 ||
+        flags.deliver ||
+        flags.base) {
+        usage();
+    }
+    const config = resolveKilnConfig({ configPath: flags.configPath });
+    const since = flags.since ? parseSince(flags.since) : undefined;
+    process.stdout.write(renderLedgerFile(config.kilnDir, {
+        ...(since ? { since } : {}),
+        ...(flags.repo ? { repo: flags.repo } : {}),
+        ...(config.dailyDollarCap !== undefined ? { dailyDollarCap: config.dailyDollarCap } : {}),
+    }));
+}
+function reviseCommand(argv) {
+    const flags = parseFlags(argv);
+    rejectServeFlags(flags);
+    const jobId = flags.positionals[0];
+    if (!jobId ||
+        flags.positionals.length !== 1 ||
+        !flags.note ||
+        flags.test ||
+        hasIntakeFlags(flags) ||
+        flags.deliver ||
+        flags.base ||
+        flags.stack) {
+        usage();
+    }
+    const config = resolveKilnConfig({ configPath: flags.configPath });
+    process.stdout.write(reviseJob(config, jobId, flags.note));
+}
+function pauseCommand(argv, pause) {
+    const flags = parseFlags(argv);
+    rejectServeFlags(flags);
+    if (flags.positionals.length !== 0 || flags.test || hasIntakeFlags(flags) || flags.note || flags.deliver || flags.base || flags.stack) {
+        usage();
+    }
+    const config = resolveKilnConfig({ configPath: flags.configPath });
+    const changed = pause ? pauseFactory(config.kilnDir) : resumeFactory(config.kilnDir);
+    process.stdout.write(pause ? (changed ? "paused\n" : "already paused\n") : changed ? "resumed\n" : "already running\n");
+}
 function gateCommand(choice, argv) {
     const flags = parseFlags(argv);
     rejectServeFlags(flags);
     const jobId = flags.positionals[0];
-    if (!jobId || flags.positionals.length !== 1 || flags.test || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
+    if (!jobId || flags.positionals.length !== 1 || flags.test || flags.note || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
         usage();
     }
     const config = resolveKilnConfig({ configPath: flags.configPath });
@@ -468,6 +556,22 @@ async function main() {
         retryCommand(argv.slice(1));
         return;
     }
+    if (command === "revise") {
+        reviseCommand(argv.slice(1));
+        return;
+    }
+    if (command === "pause") {
+        pauseCommand(argv.slice(1), true);
+        return;
+    }
+    if (command === "resume") {
+        pauseCommand(argv.slice(1), false);
+        return;
+    }
+    if (command === "ledger") {
+        ledgerCommand(argv.slice(1));
+        return;
+    }
     if (command === "sandbox") {
         sandboxCommand(argv.slice(1));
         return;

package/dist/config.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "no
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { KilnConfigError } from "./errors.js";
-import { DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_FIX_ROUNDS, DEFAULT_STALL_TIMEOUT_MS, KilnConfigFileSchema, REPO_NAME, } from "./schemas.js";
+import { DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_FIX_ROUNDS, DEFAULT_MAX_SAME_FINGERPRINT, DEFAULT_STALL_TIMEOUT_MS, KilnConfigFileSchema, REPO_NAME, } from "./schemas.js";
 const CONFIG_NAME = "kiln.config.json";
 export function loadKilnConfig(configPath, options = {}) {
     const home = options.home ?? homedir();
@@ -31,6 +31,8 @@ export function loadKilnConfig(configPath, options = {}) {
             ...(entry.base ? { base: entry.base } : {}),
             ...(entry.prTitle ? { prTitle: entry.prTitle } : {}),
             ...(entry.branch ? { branchTemplate: entry.branch } : {}),
+            ...(entry.maxAttempts !== undefined ? { maxAttempts: entry.maxAttempts } : {}),
+            ...(entry.maxFixRounds !== undefined ? { maxFixRounds: entry.maxFixRounds } : {}),
         };
     }
     const kilnDir = configDir;
@@ -46,6 +48,8 @@ export function loadKilnConfig(configPath, options = {}) {
         stallTimeoutMs: parsed.data.stallTimeoutMs ?? DEFAULT_STALL_TIMEOUT_MS,
         maxAttempts: parsed.data.maxAttempts ?? DEFAULT_MAX_ATTEMPTS,
         maxFixRounds: parsed.data.maxFixRounds ?? DEFAULT_MAX_FIX_ROUNDS,
+        maxSameFingerprint: parsed.data.maxSameFingerprint ?? DEFAULT_MAX_SAME_FINGERPRINT,
+        ...(parsed.data.dailyDollarCap !== undefined ? { dailyDollarCap: parsed.data.dailyDollarCap } : {}),
         adapter: parsed.data.adapter ?? "claude-code",
         sandbox: parsed.data.sandbox ?? {},
         workflowSandbox: workflowSandboxFrom(parsed.data.workflows),
@@ -112,6 +116,12 @@ export function addRepo(options) {
     const branchTemplate = previousString(previous, "branch");
     if (branchTemplate)
         entry.branch = branchTemplate;
+    const maxAttempts = previousNumber(previous, "maxAttempts");
+    if (maxAttempts !== undefined)
+        entry.maxAttempts = maxAttempts;
+    const maxFixRounds = previousNumber(previous, "maxFixRounds");
+    if (maxFixRounds !== undefined)
+        entry.maxFixRounds = maxFixRounds;
     repos[options.name] = entry;
     raw.repos = repos;
     const parsed = KilnConfigFileSchema.safeParse(raw);
@@ -138,6 +148,14 @@ export function addRepo(options) {
     lines.push(`wrote ${configPath}`);
     return `${lines.join("\n")}\n`;
 }
+/** Attempt cap for one repo: the repo override, otherwise the global cap. */
+export function attemptsFor(config, repo) {
+    return config.repos[repo]?.maxAttempts ?? config.maxAttempts;
+}
+/** Fix-round cap for one repo: the repo override, otherwise the global cap. */
+export function fixRoundsFor(config, repo) {
+    return config.repos[repo]?.maxFixRounds ?? config.maxFixRounds;
+}
 export function renderRepoList(config) {
     const names = Object.keys(config.repos).sort();
     if (names.length === 0)
@@ -226,6 +244,12 @@ function previousString(previous, key) {
     const value = previous[key];
     return typeof value === "string" && value.length > 0 ? value : undefined;
 }
+function previousNumber(previous, key) {
+    if (typeof previous !== "object" || previous === null || !(key in previous))
+        return undefined;
+    const value = previous[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
 function previousDeliver(previous) {
     const value = previousString(previous, "deliver");
     if (value === "local" || value === "pr")

package/dist/delivery.js

@@ -1,6 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
+import { evidenceSectionFor } from "./evidence.js";
+import { appendEvent } from "./events.js";
 import { HostError } from "./host.js";
 import { readJobSpec } from "./jobs.js";
 import { jobBasename } from "./paths.js";
@@ -181,6 +183,20 @@ export function deliverJob(request) {
             prNumber: pr.number,
             prUrl: pr.url,
         });
+        if (!sameRun?.prNumber && remoteName) {
+            appendEvent(request.config.kilnDir, {
+                job_id: request.job.id,
+                run_id: request.runId,
+                event: "pr.opened",
+                properties: {
+                    number: pr.number,
+                    url: pr.url,
+                    branch: remoteName,
+                    base: request.baseBranch,
+                    once: `pr.opened:${pr.number}`,
+                },
+            });
+        }
         return { ok: true, detail: pr.url, prUrl: pr.url, prNumber: pr.number };
     }
     catch (error) {
@@ -213,6 +229,8 @@ export function pullRequestBody(request) {
         "## Reviewers",
         ...(reviews.length > 0 ? reviews : ["- (no reviewer artifacts)"]),
         "",
+        evidenceSectionFor(request.config.kilnDir, request.job.id).trimEnd(),
+        "",
     ].join("\n");
 }
 export function specSummary(specText) {