@nanobpm/nano-workforce 0.104.0 → 0.105.0

package/resources/processes/retro.bpmn

@@ -13,6 +13,18 @@
           <nano:extend name="pr" type="string" optional="true" />
           <nano:extend name="summary" type="string" optional="true" />
         </nano:shape>
+        <nano:shape id="ConformanceRecordIn" name="Record conformance — input">
+          <nano:extend name="planKey" type="string" />
+          <nano:extend name="status" type="string" optional="true" />
+          <nano:extend name="commentUrl" type="string" optional="true" />
+          <nano:extend name="slicesMet" type="integer" optional="true" />
+          <nano:extend name="slicesReduced" type="integer" optional="true" />
+          <nano:extend name="slicesNotVerified" type="integer" optional="true" />
+          <nano:extend name="deviationsRaised" type="integer" optional="true" />
+          <nano:extend name="deviationsUnraised" type="integer" optional="true" />
+          <nano:extend name="hasDeviations" type="boolean" optional="true" />
+          <nano:extend name="summary" type="string" optional="true" />
+        </nano:shape>
       </nano:shapes>
     </bpmn:extensionElements>
     <bpmn:startEvent id="Start" name="Epic complete">
@@ -26,6 +38,29 @@
         </zeebe:properties>
       </bpmn:extensionElements>
       <bpmn:incoming>f_start</bpmn:incoming>
+      <bpmn:outgoing>f_toConformance</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:serviceTask id="conformance" name="Verify implementation vs spec (agent)">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="senior:conformance" />
+        <zeebe:linkedResources>
+          <zeebe:linkedResource resourceId="conformance.md" bindingType="latest" resourceType="GenericScript" linkName="prompt" />
+        </zeebe:linkedResources>
+        <zeebe:ioMapping>
+          <zeebe:input source="=conformanceDigest" target="appendPrompt" />
+        </zeebe:ioMapping>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_toConformance</bpmn:incoming>
+      <bpmn:outgoing>f_toRecordConformance</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:serviceTask id="record-conformance" name="Record conformance">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.conformance-record" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="ConformanceRecordIn" />
+        </zeebe:properties>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_toRecordConformance</bpmn:incoming>
       <bpmn:outgoing>f_toSynthesize</bpmn:outgoing>
     </bpmn:serviceTask>
     <bpmn:serviceTask id="synthesize" name="Synthesize &#38; promote (agent)">
@@ -55,7 +90,9 @@
       <bpmn:incoming>f_toEnd</bpmn:incoming>
     </bpmn:endEvent>
     <bpmn:sequenceFlow id="f_start" sourceRef="Start" targetRef="gather" />
-    <bpmn:sequenceFlow id="f_toSynthesize" sourceRef="gather" targetRef="synthesize" />
+    <bpmn:sequenceFlow id="f_toConformance" sourceRef="gather" targetRef="conformance" />
+    <bpmn:sequenceFlow id="f_toRecordConformance" sourceRef="conformance" targetRef="record-conformance" />
+    <bpmn:sequenceFlow id="f_toSynthesize" sourceRef="record-conformance" targetRef="synthesize" />
     <bpmn:sequenceFlow id="f_toRecord" sourceRef="synthesize" targetRef="record" />
     <bpmn:sequenceFlow id="f_toEnd" sourceRef="record" targetRef="End" />
   </bpmn:process>
@@ -70,34 +107,48 @@
       <bpmndi:BPMNShape id="BPMNShape_gather" bpmnElement="gather">
         <dc:Bounds x="216" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="BPMNShape_synthesize" bpmnElement="synthesize">
+      <bpmndi:BPMNShape id="BPMNShape_conformance" bpmnElement="conformance">
         <dc:Bounds x="416" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="BPMNShape_record" bpmnElement="record">
+      <bpmndi:BPMNShape id="BPMNShape_record-conformance" bpmnElement="record-conformance">
         <dc:Bounds x="616" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_synthesize" bpmnElement="synthesize">
+        <dc:Bounds x="816" y="80" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_record" bpmnElement="record">
+        <dc:Bounds x="1016" y="80" width="100" height="80" />
+      </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_End" bpmnElement="End">
-        <dc:Bounds x="816" y="102" width="36" height="36" />
+        <dc:Bounds x="1216" y="102" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="794" y="143" width="80" height="14" />
+          <dc:Bounds x="1194" y="143" width="80" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNEdge id="BPMNEdge_f_start" bpmnElement="f_start">
         <di:waypoint x="116" y="120" />
         <di:waypoint x="216" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_toSynthesize" bpmnElement="f_toSynthesize">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toConformance" bpmnElement="f_toConformance">
         <di:waypoint x="316" y="120" />
         <di:waypoint x="416" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_toRecord" bpmnElement="f_toRecord">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toRecordConformance" bpmnElement="f_toRecordConformance">
         <di:waypoint x="516" y="120" />
         <di:waypoint x="616" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_toEnd" bpmnElement="f_toEnd">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toSynthesize" bpmnElement="f_toSynthesize">
         <di:waypoint x="716" y="120" />
         <di:waypoint x="816" y="120" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toRecord" bpmnElement="f_toRecord">
+        <di:waypoint x="916" y="120" />
+        <di:waypoint x="1016" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toEnd" bpmnElement="f_toEnd">
+        <di:waypoint x="1116" y="120" />
+        <di:waypoint x="1216" y="120" />
+      </bpmndi:BPMNEdge>
     </bpmndi:BPMNPlane>
   </bpmndi:BPMNDiagram>
 </bpmn:definitions>

package/resources/prompts/conformance.md

@@ -0,0 +1,105 @@
+# Conformance agent — verify the implementation against the spec, by reading the code
+
+You are the **spec-conformance agent**. An epic (a fan-out `plan`) has finished — every one of its
+slices has reached a terminal state and the landed PRs are now in the tree. Your job is to answer a
+single, evidence-based question for a human:
+
+> **Did we actually build what the spec asked for — no more, no less?**
+
+You are NOT the retro agent (that one distils lessons). You are the auditor. Crucially, **you verify
+against the real implementation, not against what the agents claimed.** Transcripts, `learning`
+notes, and even a slice's own status can be optimistic or wrong. The diff cannot. Read the code.
+
+## Input
+
+The job payload (stdin JSON) carries:
+
+- `variables.planKey` — the epic's key, e.g. `owner/repo#123`.
+- `variables.repo` — the **target repo** `owner/repo` the work landed in.
+- `variables.issueUrl` — the epic's source issue. **This issue body is the SPEC.**
+- **`variables.conformanceDigest`** — appended below the `---` separator: the spec broken into
+  slices (each slice's planner-supplied `prompt` is its acceptance brief), the list of **delivered
+  PRs** you must examine, and the deviations that were **raised** during implementation
+  (`scope-change` entries). This tells you *what to check* and *where to look* — it does NOT tell
+  you the answer.
+
+You have `gh` / git authenticated for the target repository.
+
+## What to do
+
+1. **Read the spec.** `gh issue view <n> --repo <repo>` for the epic issue body, plus every slice's
+   `prompt` in the digest. Together these are the acceptance criteria you are auditing against.
+2. **Examine the ACTUAL implementation.** For every delivered PR in the digest:
+   `gh pr diff <n> --repo <repo>`, and read the touched source and tests (clone/checkout if you
+   need to navigate). Do not trust the PR description — read what the code does.
+3. **Distinguish real delivery from the appearance of it.** This is the whole point of examining
+   code. For each spec item, decide whether it is *load-bearing* in the shipped system:
+   - Is the new code actually **wired in / reachable**, or is it a dead entrypoint behind a flag,
+     a stub, or a synthetic path nothing calls?
+   - Do the **tests exercise the real behaviour**, or are they asserting on mocks/gated paths so
+     they pass without proving the feature works?
+   - Was the item delivered **in full**, or narrowed to a subset while looking complete?
+4. **Assign each spec item an acceptance verdict**, with a one-line evidence pointer (file / PR /
+   test) for each:
+   - **met** — delivered as specified, wired in, and genuinely tested.
+   - **met-in-unit-only** — implemented and unit-tested, but not proven wired into the live system.
+   - **reduced** — delivered in a narrower form than the spec asked for.
+   - **not-verified** — you could not confirm it from the implementation (missing, stubbed, dead
+     code, or tests that don't actually exercise it).
+5. **Reconcile the raised deviations.** For each `scope-change` entry in the digest, confirm the
+   code matches what was said, and note it as a **raised** deviation.
+6. **Hunt for UNRAISED deviations** — things the code does that the spec did *not* ask for, or spec
+   items silently dropped, that were **never** flagged on the blackboard. These are the most
+   valuable finding: scope drift nobody surfaced.
+7. **Post the conformance report as a comment on the epic issue**
+   (`gh issue comment <n> --repo <repo> --body-file <file>`). Structure it: a one-line verdict, a
+   per-item table (item → verdict → evidence), the raised deviations, and the unraised deviations.
+   Be specific and cite files/PRs — this comment is the deliverable a human reads.
+
+## Do not
+
+- Do **not** open, modify, or merge any PR. You audit; you do not remediate. (A later stage decides
+  whether a finding warrants a follow-up task.)
+- Do **not** soften a `not-verified` into a `met` because the transcript sounded confident. Absence
+  of evidence in the code is `not-verified`.
+- Do **not** manufacture deviations to look thorough. A clean epic that fully met its spec is a
+  perfectly good — and common — result.
+
+## Output contract
+
+Write a JSON object of **result variables** to the file named by the `AGENT_RESULT_FILE`
+environment variable:
+
+```json
+{
+  "status": "filed",
+  "commentUrl": "https://github.com/owner/repo/issues/123#issuecomment-456",
+  "slicesMet": 4,
+  "slicesReduced": 1,
+  "slicesNotVerified": 1,
+  "deviationsRaised": 2,
+  "deviationsUnraised": 1,
+  "hasDeviations": true,
+  "summary": "6 items: 4 met, 1 reduced (auth rate-limit narrowed to per-IP), 1 not-verified (webhook retry path is dead code). 2 raised + 1 unraised deviation (added a /debug route not in spec)."
+}
+```
+
+Rules:
+
+- `status` — one of:
+  - `filed` — you examined the implementation and posted the report comment. Set `commentUrl`.
+  - `skipped` — there was no landed implementation to examine (nothing shipped). Explain in
+    `summary`; omit the counts.
+  - `blocked` — you could not proceed (e.g. no read access, could not fetch a PR). Explain in
+    `summary`.
+- `commentUrl` — the URL of the report comment you posted on the epic issue, for `filed`.
+- `slicesMet` / `slicesReduced` / `slicesNotVerified` — integer counts of your per-item verdicts
+  (count `met-in-unit-only` under `slicesReduced`, since it is not full live delivery).
+- `deviationsRaised` — count of `scope-change` deviations you reconciled.
+- `deviationsUnraised` — count of deviations you found that were never flagged.
+- `hasDeviations` — `true` when anything is reduced / not-verified / an unraised deviation exists;
+  i.e. the epic did not cleanly meet its spec. A later stage uses this to decide escalation.
+- `summary` — a short human-readable verdict.
+
+You are advisory and post-merge: you gate no delivery. Your value is an honest, code-grounded
+account of what shipped versus what was asked — surface it plainly, and let the humans act on it.

package/resources/prompts/retro.md

@@ -10,6 +10,11 @@ so the *next* fleet — and human contributors — never re-learn it the hard wa
 You are the mechanism that lifts a lesson from "a thing one agent happened to hit" to "a thing the
 repo now tells everyone up front."
 
+> **Scope:** a separate **conformance** agent runs before you and audits whether the epic met its
+> spec (posting its own report on the epic issue). That is *not* your job — do **not** re-verify
+> acceptance or re-litigate scope here. Focus purely on distilling reusable **lessons** and
+> promoting them into the repo.
+
 ## Input
 
 The job payload (stdin JSON) carries:

package/workers/conformance-record/worker.test.ts

@@ -0,0 +1,199 @@
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { noopLog } from "../../test/log.ts";
+import handler from "./worker.ts";
+
+function fakeApp() {
+  const stores: Record<string, any[]> = { plan_conformance: [] };
+  const seq: Record<string, number> = {};
+  function tbl(name: string, pk = "id") {
+    const rows = (stores[name] ??= [] as any[]);
+    const match = (r: any, where: any) => Object.entries(where).every(([k, v]) => r[k] === v);
+    return {
+      async insert(row: any) {
+        const id = (seq[name] = (seq[name] ?? 0) + 1);
+        rows.push(pk === "id" ? { id, ...row } : { ...row });
+        return pk === "id" ? id : row[pk];
+      },
+      async find(where: any = {}) {
+        return rows.filter((r) => match(r, where));
+      },
+      async findOne(where: any = {}) {
+        return rows.find((r) => match(r, where));
+      },
+      async get(id: any) {
+        return rows.find((row) => row[pk] === id);
+      },
+      async update(id: any, patch: any) {
+        const r = rows.find((row) => row[pk] === id);
+        if (r) Object.assign(r, patch);
+      },
+    };
+  }
+  const app = { data: { table: (n: string, pk?: string) => tbl(n, pk) }, log: noopLog() };
+  return { app, stores };
+}
+
+test("conformance-record: persists a filed conformance from hoisted result vars", async () => {
+  const { app, stores } = fakeApp();
+  await handler(
+    {
+      variables: {
+        planKey: "o/r#5",
+        status: "filed",
+        commentUrl: "https://github.com/o/r/issues/5#issuecomment-1",
+        slicesMet: 4,
+        slicesReduced: 1,
+        slicesNotVerified: 1,
+        deviationsRaised: 2,
+        deviationsUnraised: 1,
+        hasDeviations: true,
+        summary: "6 items, 4 met",
+        "io.nanobpm.agentResult": { output: "the full conformance report" },
+      },
+    } as any,
+    app as any,
+  );
+
+  assertEquals(stores.plan_conformance.length, 1);
+  const row = stores.plan_conformance[0];
+  assertEquals(row.status, "filed");
+  assertEquals(row.comment_url, "https://github.com/o/r/issues/5#issuecomment-1");
+  assertEquals(row.slices_met, 4);
+  assertEquals(row.slices_reduced, 1);
+  assertEquals(row.slices_not_verified, 1);
+  assertEquals(row.deviations_raised, 2);
+  assertEquals(row.deviations_unraised, 1);
+  assertEquals(row.has_deviations, 1);
+  assertEquals(row.report, "the full conformance report");
+});
+
+test("conformance-record: derives has_deviations from ground truth even when the agent flag is absent", async () => {
+  const { app, stores } = fakeApp();
+  await handler(
+    { variables: { planKey: "o/r#6", status: "filed", commentUrl: "https://x/6#c", slicesNotVerified: 1 } } as any,
+    app as any,
+  );
+  // The agent didn't set hasDeviations, but a not-verified item means the epic didn't cleanly meet spec.
+  assertEquals(stores.plan_conformance[0].has_deviations, 1);
+});
+
+test("conformance-record: a clean epic records has_deviations = 0", async () => {
+  const { app, stores } = fakeApp();
+  await handler(
+    { variables: { planKey: "o/r#7", status: "filed", commentUrl: "https://x/7#c", slicesMet: 3, hasDeviations: false } } as any,
+    app as any,
+  );
+  assertEquals(stores.plan_conformance[0].has_deviations, 0);
+  assertEquals(stores.plan_conformance[0].slices_met, 3);
+});
+
+test("conformance-record: coerces filed without a comment URL to skipped", async () => {
+  const { app, stores } = fakeApp();
+  await handler(
+    { variables: { planKey: "o/r#8", status: "filed", summary: "forgot to post" } } as any,
+    app as any,
+  );
+  assertEquals(stores.plan_conformance[0].status, "skipped");
+  assertEquals(stores.plan_conformance[0].comment_url, null);
+});
+
+test("conformance-record: a non-filed status carries no verdict counts or deviations", async () => {
+  const { app, stores } = fakeApp();
+  // A "filed" that downgrades to skipped (no comment) must not persist the agent's counts /
+  // has_deviations — a skipped/blocked audit produced no verified verdict, so the row would be
+  // internally inconsistent (status=skipped yet has_deviations=1 with non-zero counts).
+  await handler(
+    {
+      variables: {
+        planKey: "o/r#11",
+        status: "filed",
+        slicesMet: 4,
+        slicesReduced: 1,
+        slicesNotVerified: 1,
+        deviationsRaised: 2,
+        deviationsUnraised: 1,
+        hasDeviations: true,
+        summary: "audit ran but never posted",
+        "io.nanobpm.agentResult": { output: "transcript explaining why" },
+      },
+    } as any,
+    app as any,
+  );
+  const row = stores.plan_conformance[0];
+  assertEquals(row.status, "skipped");
+  assertEquals(row.slices_met, 0);
+  assertEquals(row.slices_reduced, 0);
+  assertEquals(row.slices_not_verified, 0);
+  assertEquals(row.deviations_raised, 0);
+  assertEquals(row.deviations_unraised, 0);
+  assertEquals(row.has_deviations, 0);
+  // summary + report are human-readable context — retained so a skipped/blocked row still explains itself.
+  assertEquals(row.summary, "audit ran but never posted");
+  assertEquals(row.report, "transcript explaining why");
+});
+
+test("conformance-record: coerces string-encoded numeric counts hoisted by the agent", async () => {
+  const { app, stores } = fakeApp();
+  // The agentTask runner hoists result-JSON keys as-is; an agent may emit counts as strings ("1").
+  // These must be parsed, not silently coerced to 0 (which would wrongly clear the verdict).
+  await handler(
+    {
+      variables: {
+        planKey: "o/r#12",
+        status: "filed",
+        commentUrl: "https://x/12#c",
+        slicesMet: "4",
+        slicesReduced: "1",
+        slicesNotVerified: "0",
+        deviationsRaised: "2",
+        deviationsUnraised: "0",
+        hasDeviations: false,
+      },
+    } as any,
+    app as any,
+  );
+  const row = stores.plan_conformance[0];
+  assertEquals(row.slices_met, 4);
+  assertEquals(row.slices_reduced, 1);
+  assertEquals(row.deviations_raised, 2);
+  // A reduced item is ground truth for a deviation even though the agent's flag was false.
+  assertEquals(row.has_deviations, 1);
+});
+
+test("conformance-record: honours a string-encoded hasDeviations flag", async () => {
+  const { app, stores } = fakeApp();
+  // A clean epic (no reduced / not-verified / unraised) where the agent emits hasDeviations as the
+  // string "true" must still record a deviation — a stringified boolean can't silently be dropped.
+  await handler(
+    {
+      variables: {
+        planKey: "o/r#13",
+        status: "filed",
+        commentUrl: "https://x/13#c",
+        slicesMet: 3,
+        hasDeviations: "true",
+      },
+    } as any,
+    app as any,
+  );
+  assertEquals(stores.plan_conformance[0].has_deviations, 1);
+});
+
+test("conformance-record: honours an explicit blocked status", async () => {
+  const { app, stores } = fakeApp();
+  await handler(
+    { variables: { planKey: "o/r#9", status: "blocked", summary: "no read access" } } as any,
+    app as any,
+  );
+  assertEquals(stores.plan_conformance[0].status, "blocked");
+});
+
+test("conformance-record: defaults to skipped when the agent reported nothing", async () => {
+  const { app, stores } = fakeApp();
+  await handler(
+    { variables: { planKey: "o/r#10", summary: "nothing shipped" } } as any,
+    app as any,
+  );
+  assertEquals(stores.plan_conformance[0].status, "skipped");
+});

package/workers/conformance-record/worker.ts

@@ -0,0 +1,95 @@
+// pr.conformance-record — persist the `senior:conformance` agent's result into `plan_conformance`
+// (052_plan_conformance.sql): the outcome status, the report comment it posted on the epic issue,
+// the per-item verdict counts, and the two deviation counts (raised / unraised). Advisory only —
+// this gates no control flow; it exists so the epic surface can show what the conformance audit
+// concluded, and (in a later slice) drive escalation off `has_deviations`.
+//
+// The agentTask runner hoists the agent's result-JSON keys (`status`, `commentUrl`, the counts,
+// `hasDeviations`, `summary`) into top-level process variables (same mechanism pr.retro-record
+// reads `status`/`pr`/`summary` through), and exposes the raw transcript under the
+// `io.nanobpm.agentResult` envelope's `.output`.
+import type { AppJobHandler } from "@nanobpm/urban";
+import { recordConformance } from "../../app/conformance.ts";
+import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
+
+const AGENT_RESULT_KEY = "io.nanobpm.agentResult";
+
+// Input typed off the model data envelope (`ConformanceRecordIn` in retro.bpmn) — ADR 0040.
+type In = WorkerInputs["pr.conformance-record"];
+
+function asStr(v: unknown): string | null {
+  return typeof v === "string" && v.trim() !== "" ? v.trim() : null;
+}
+
+function asInt(v: unknown): number {
+  // Tolerate a numeric string ("1") too — the agentTask runner hoists result-JSON keys as-is, and an
+  // agent may emit counts as strings; silently coercing those to 0 would wrongly clear the verdict.
+  const n = typeof v === "number" ? v : typeof v === "string" && v.trim() !== "" ? Number(v) : Number.NaN;
+  return Number.isFinite(n) ? Math.max(0, Math.trunc(n)) : 0;
+}
+
+// Tolerant boolean coercion mirroring record-plan-review's `isApproved`: honour boolean `true` OR a
+// case-insensitive "true" string, so a stringified flag the agent hoists isn't silently dropped.
+function asBool(v: unknown): boolean {
+  return v === true || (typeof v === "string" && v.trim().toLowerCase() === "true");
+}
+
+function asStatus(v: unknown, hasComment: boolean): "filed" | "skipped" | "blocked" {
+  const s = asStr(v);
+  if (s === "filed" || s === "skipped" || s === "blocked") {
+    // A "filed" with no report comment is not really filed — downgrade to skipped so the record
+    // never claims a report a human can't open.
+    if (s === "filed" && !hasComment) return "skipped";
+    return s;
+  }
+  return hasComment ? "filed" : "skipped";
+}
+
+const handler: AppJobHandler<In> = async (job, app) => {
+  const planKey = job.variables.planKey;
+
+  const commentUrl = asStr(job.variables.commentUrl);
+  const status = asStatus(job.variables.status, commentUrl !== null);
+  const summary = asStr(job.variables.summary);
+
+  // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
+  const env = (job.variables as Record<string, unknown>)[AGENT_RESULT_KEY] as { output?: unknown } | undefined;
+  const report = typeof env?.output === "string" ? env.output : null;
+
+  // Only a "filed" audit produced a verified verdict; a skipped/blocked one has no trustworthy
+  // per-item counts or deviations, so persist zeros rather than whatever the agent hoisted. This
+  // keeps the row internally consistent (no status="skipped" with has_deviations=1) and honours the
+  // schema/prompt contract that skipped/blocked audits omit counts. summary + report are retained as
+  // human-readable context explaining why the audit didn't file.
+  const filed = status === "filed";
+  const slicesReduced = filed ? asInt(job.variables.slicesReduced) : 0;
+  const slicesNotVerified = filed ? asInt(job.variables.slicesNotVerified) : 0;
+  const deviationsUnraised = filed ? asInt(job.variables.deviationsUnraised) : 0;
+  // Derive `has_deviations` from ground truth rather than trusting the agent's boolean alone: any
+  // reduced / not-verified item, or any unraised deviation, means the epic did not cleanly meet its
+  // spec. The agent's flag is honoured as an additional trigger but can't suppress a real signal.
+  // Forced false for a non-filed audit (all counts are zeroed above, and there is no verified verdict).
+  const hasDeviations = filed &&
+    (asBool(job.variables.hasDeviations) ||
+      slicesReduced > 0 || slicesNotVerified > 0 || deviationsUnraised > 0);
+
+  await recordConformance(app.data, planKey, {
+    status,
+    commentUrl: filed ? commentUrl : null,
+    slicesMet: filed ? asInt(job.variables.slicesMet) : 0,
+    slicesReduced,
+    slicesNotVerified,
+    deviationsRaised: filed ? asInt(job.variables.deviationsRaised) : 0,
+    deviationsUnraised,
+    hasDeviations,
+    summary,
+    report,
+  });
+
+  app.log.info(
+    `conformance-record: ${planKey} — status=${status} deviations=${hasDeviations ? "yes" : "no"}`,
+  );
+  return {};
+};
+
+export default handler;

package/workers/merge/worker.test.ts

@@ -26,6 +26,10 @@ function fakeApp() {
               Promise.resolve(
                 store.filter((r) => Object.entries(q).every(([f, v]) => r[f] === v)),
               ),
+            findOne: (q: any) =>
+              Promise.resolve(
+                store.find((r) => Object.entries(q).every(([f, v]) => r[f] === v)) ?? null,
+              ),
             insert: (row: any) => {
               store.push(row);
               return Promise.resolve(store.length);

package/workers/merge/worker.ts

@@ -12,11 +12,11 @@
 // shapes the escalation payload on a block.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { matchTags, tag } from "@nanobpm/urban/effect";
-import { ABANDONED_STATUS, abandonTokenFromUrl } from "../../app/abandon.ts";
+import { abandonTokenFromUrl } from "../../app/abandon.ts";
 import { checkBaseTarget, classifyBaseGuard } from "../../app/baseGuard.ts";
 import { classifyPrLiveness, enqueueViaComment, fetchPrState, mergePr } from "../../app/github.ts";
 import { classifyMergeLanding, DEFAULT_MERGE_PROTOCOL, loadMergeProtocol } from "../../app/mergeProtocol.ts";
-import { ensurePr, MERGE_ADMIN, MERGE_METHOD } from "../../app/service.ts";
+import { abandonClosedPr, ensurePr, MERGE_ADMIN, MERGE_METHOD } from "../../app/service.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
 
 // Input typed off the model data envelope (`MergeAttemptIn` in merge-loop.bpmn) — ADR 0040.
@@ -74,22 +74,17 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
   // user task: a closed PR is terminal state, not a human decision. Symmetric with the merged
   // short-circuit above and runs on the same live-state read, so one `fetchPrState` classifies both.
   if (liveness === "closed") {
-    await app.data.table("merges", "id").insert({
-      pr_key: prKey,
-      outcome: "abandoned",
-      method: "pr-closed",
-      detail: "PR was closed on GitHub without merging (e.g. superseded) — abandoning the merge loop",
-      at: now,
-    });
-    // Terminal status write. This branch drives the model's terminate/abandon end event, which runs
-    // NO mark-merged worker (the merged path's `pr.mark-merged` is what sets `status:"merged"`). If
-    // we don't flip the row here it lingers on its in-flight status (e.g. the transient `merging`),
-    // so `activePrs`/delivery keep treating a dead PR as live. Symmetric with mark-merged's write;
-    // `ensurePr` above guarantees the row exists to update.
-    await app.data.table("pull_requests", "pr_key").update(prKey, {
-      status: ABANDONED_STATUS,
-      updated_at: now,
-    });
+    // One canonical abandon writer (`abandonClosedPr`, app/service.ts) records the terminal `merges`
+    // audit row and flips the `pull_requests` row — and every `plan_tasks` row keyed to this PR — to
+    // `abandoned`. Flipping the task row (not just the PR row) drops a dead wave member out of the
+    // wave-merge gate (#352). This branch drives the model's terminate/abandon end event, which runs
+    // NO mark-merged worker, so the terminal write must happen here; `ensurePr` above guarantees the
+    // PR row exists to update. Symmetric with the merged short-circuit on the same live-state read.
+    await abandonClosedPr(
+      app.data,
+      prKey,
+      "PR was closed on GitHub without merging (e.g. superseded) — abandoning the merge loop",
+    );
     return { mergeStatus: "abandoned" };
   }
 

package/workers/retro-gather/worker.test.ts

@@ -37,6 +37,8 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
 test("retro-gather: emits a digest brief + learning count for the plan", async () => {
   const { data, stores } = memData();
   stores["plans"] = [{ plan_key: "o/r#3", repo: "o/r", issue_url: "https://x/3", title: "Epic" }];
+  stores["plan_tasks"] = [{ id: 1, plan_key: "o/r#3", task_index: 0, task_id: "t1", title: "Auth", prompt: "add auth", status: "opened", pr_key: "o/r#10" }];
+  stores["pull_requests"] = [{ pr_key: "o/r#10", status: "merged" }];
   await appendEntry(data, "o/r#3", { author_task: "t1", kind: "learning", body: "regen before build" });
   await appendEntry(data, "o/r#3", { author_task: "t2", kind: "learning", body: "use nextest" });
 
@@ -50,6 +52,10 @@ test("retro-gather: emits a digest brief + learning count for the plan", async (
   assertStringIncludes(String(out.retroDigest), "regen before build");
   assertStringIncludes(String(out.retroDigest), "use nextest");
   assertStringIncludes(String(out.retroDigest), "o/r#3");
+  // The gather step also produces the conformance brief pointing at the landed PR + slice spec.
+  assertStringIncludes(String(out.conformanceDigest), "Conformance input");
+  assertStringIncludes(String(out.conformanceDigest), "o/r#10");
+  assertStringIncludes(String(out.conformanceDigest), "add auth");
 });
 
 test("retro-gather: an epic with no learnings still renders a valid brief", async () => {

package/workers/retro-gather/worker.ts

@@ -1,9 +1,13 @@
 // pr.retro-gather — first step of the `retro` process. Assemble the plan's accumulated
 // coordination knowledge (the `learning` blackboard entries agents posted while implementing, plus
-// the task-delta rollup and any other blackboard notes) into a compact markdown brief, and emit it
-// as `retroDigest`. The next step maps that onto the `senior:retro` agent's `appendPrompt`, so the
-// agent reflects on real material rather than re-deriving it.
+// the task-delta rollup and any other blackboard notes) into a compact markdown brief, emitted as
+// `retroDigest`, AND the spec-conformance material (the spec + the landed PRs to examine + the
+// deviations raised during implementation) as `conformanceDigest`. The two downstream agent steps
+// (`senior:conformance` then `senior:retro`) map these onto their `appendPrompt`, so each reflects
+// on real material rather than re-deriving it.
 import type { AppJobHandler } from "@nanobpm/urban";
+import { readBlackboard } from "../../app/blackboard.ts";
+import { gatherConformance, renderConformanceBrief } from "../../app/conformance.ts";
 import { gatherRetro, renderRetroBrief } from "../../app/retro.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
 
@@ -13,15 +17,23 @@ type In = WorkerInputs["pr.retro-gather"];
 interface Out extends Record<string, unknown> {
   retroDigest: string;
   retroLearnings: number;
+  conformanceDigest: string;
 }
 
 const handler: AppJobHandler<In, Out> = async (job, app) => {
   const planKey = job.variables.planKey;
-  const digest = await gatherRetro(app.data, planKey);
-  app.log.info(`retro-gather: ${planKey} — ${digest.counts.learnings} learnings, ${digest.counts.deltas} deltas`);
+  // Both gatherRetro and gatherConformance need the plan's blackboard; scan it once here and share
+  // the snapshot so a retro run does a single blackboard read, not one per gatherer.
+  const entries = await readBlackboard(app.data, planKey);
+  const digest = await gatherRetro(app.data, planKey, entries);
+  const conformance = await gatherConformance(app.data, planKey, entries);
+  app.log.info(
+    `retro-gather: ${planKey} — ${digest.counts.learnings} learnings, ${digest.counts.deltas} deltas, ${conformance.deliveredPrs.length} delivered PR(s)`,
+  );
   return {
     retroDigest: renderRetroBrief(digest),
     retroLearnings: digest.counts.learnings,
+    conformanceDigest: renderConformanceBrief(conformance),
   };
 };