@nanobpm/nano-workforce 0.129.0 → 0.130.0

package/app/mergeCiReattempt.test.ts

@@ -1,138 +0,0 @@
-// Structural regression guard for the CI-concurrency-cancellation drift class (issue #348).
-//
-// The merge loop escalated a human whenever `senior:fix-ci` returned `blocked` — even when the
-// failing required checks were STALE/TRANSIENT (CANCELLED runs superseded by a newer green run on
-// the identical head SHA) and the agent honestly pushed nothing. The `fix-ci` prompt actively
-// funnelled that self-healing case into `blocked`, and `blocked` routed straight to the merge
-// escalation user task. A phantom-blocked, self-healing merge paged a human.
-//
-// The fix adds a first-class re-attempt path and a reconcile-before-escalate guard:
-//
-//   1. `status = "reattempt"` (a first-class fix-ci verdict for stale/transient checks) routes to
-//      `arm-merge`, re-queuing the merge from ground truth — no human, and declared explicitly
-//      beside the `f_ci_reconcile` empty-status default rather than relying on the fall-through.
-//   2. A `blocked` verdict with no push (`pushed != true`) reconciles ONCE via ground truth
-//      (`gw-ci-blocked` → `ci-reconcile` → re-arm the poller) and escalates only if it is STILL
-//      blocked — so even a mislabelled `blocked` self-heals.
-//
-// Pure text assertions over the committed BPMN (no engine), matching the repo's lightweight
-// model-guard style (see mergeEscalationQuestion.test.ts, mergeRebaseArm.test.ts).
-
-import { test } from "node:test";
-import { assert, assertStringIncludes } from "#test-assert";
-import { readFileSync } from "node:fs";
-
-const bpmn = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
-// Collapse whitespace so attribute-order / line-wrapping churn doesn't make the assertions brittle.
-const flat = bpmn.replace(/\s+/g, " ");
-
-function flowElement(id: string): string | null {
-  const re = new RegExp(
-    `<bpmn:sequenceFlow\\b[^>]*?\\bid="${id}"[^>]*?(?:/>|>(?:(?!<bpmn:sequenceFlow\\b).)*?</bpmn:sequenceFlow>)`,
-  );
-  const m = flat.match(re);
-  return m ? m[0] : null;
-}
-
-function flowHasId(id: string, source: string, target: string): boolean {
-  const el = flowElement(id);
-  if (!el) return false;
-  return el.includes(`sourceRef="${source}"`) && el.includes(`targetRef="${target}"`);
-}
-
-function serviceTask(id: string): string | null {
-  const m = flat.match(new RegExp(`<bpmn:serviceTask\\b[^>]*\\bid="${id}"[\\s\\S]*?</bpmn:serviceTask>`));
-  return m ? m[0].replace(/&#34;/g, '"').replace(/&amp;/g, "&").replace(/&#10;/g, "\n") : null;
-}
-
-test("a first-class `reattempt` verdict re-attempts the merge (arm-merge), not escalation", () => {
-  // gw-ci-result must carry an explicit `status = "reattempt"` arm to arm-merge, declared beside
-  // (not folded into) the empty-status `f_ci_reconcile` default.
-  const gw = flat.match(/<bpmn:exclusiveGateway\b[^>]*\bid="gw-ci-result"[\s\S]*?<\/bpmn:exclusiveGateway>/);
-  assert(gw, "gw-ci-result gateway must exist");
-  assertStringIncludes(gw![0], "f_ci_reattempt", "gw-ci-result must declare the reattempt outgoing arm");
-
-  const reattempt = flowElement("f_ci_reattempt");
-  assert(reattempt, "f_ci_reattempt flow missing");
-  assert(
-    flowHasId("f_ci_reattempt", "gw-ci-result", "arm-merge"),
-    "a reattempt verdict must re-arm the merge poller (arm-merge), never escalate",
-  );
-  assertStringIncludes(reattempt!, 'status = "reattempt"', "the reattempt arm must be gated on status = reattempt");
-  // It must be an EXPLICIT labelled flow, not the empty-status default.
-  assert(!/default="f_ci_reattempt"/.test(flat), "reattempt must be an explicit arm, not the gateway default");
-});
-
-test("a fix-ci `reattempt` result does NOT create a merge escalation", () => {
-  // No flow originating from the reattempt classification may reach the merge-escalation task.
-  assert(
-    !flowHasId("f_ci_reattempt", "gw-ci-result", "merge-esc-attempt"),
-    "reattempt must never route to merge-esc-attempt",
-  );
-});
-
-test("a blocked-with-no-push verdict reconciles once from ground truth before escalating", () => {
-  // The `blocked` arm no longer flows straight into the escalation: it passes through gw-ci-blocked.
-  assert(
-    flowHasId("f_ci_blocked", "gw-ci-result", "gw-ci-blocked"),
-    "a blocked verdict must route through gw-ci-blocked, not straight to merge-esc-attempt",
-  );
-
-  const gw = flat.match(/<bpmn:exclusiveGateway\b[^>]*\bid="gw-ci-blocked"[^>]*>/);
-  assert(gw, "gw-ci-blocked gateway must exist");
-  // Default is escalate (still blocked), so a missing/true reconcile flag never wedges.
-  assertStringIncludes(gw![0], 'default="f_cib_esc"', "gw-ci-blocked must default to escalation");
-
-  // The reconcile-once arm: pushed nothing AND not yet reconciled → re-derive via ci-reconcile.
-  const recon = flowElement("f_cib_recon");
-  assert(recon, "f_cib_recon flow missing");
-  assert(flowHasId("f_cib_recon", "gw-ci-blocked", "ci-reconcile"), "reconcile arm must target ci-reconcile");
-  assertStringIncludes(recon!, "pushed != true", "reconcile only when the agent pushed nothing");
-  assertStringIncludes(recon!, "ciBlockedReconciled != true", "reconcile at most once");
-
-  // The escalate arm (default): still blocked → the human merge escalation.
-  assert(flowHasId("f_cib_esc", "gw-ci-blocked", "merge-esc-attempt"), "the still-blocked arm must escalate");
-  assert(
-    !/conditionExpression/.test(flowElement("f_cib_esc") ?? ""),
-    "f_cib_esc is the default arm and must not carry a conditionExpression",
-  );
-});
-
-test("ci-reconcile re-arms the canonical merge poller and marks the reconcile as spent", () => {
-  const el = serviceTask("ci-reconcile");
-  assert(el, "ci-reconcile service task must exist");
-  // Reuses the canonical arm-merge worker — one poller implementation, no second poller pass.
-  assertStringIncludes(el!, 'type="pr.arm-merge"', "ci-reconcile must reuse the canonical pr.arm-merge worker");
-  // Marks the reconcile spent so the SECOND blocked (still blocked after re-derivation) escalates.
-  const outs = el!.match(/<zeebe:output\b[^>]*\/>/g) ?? [];
-  assert(
-    outs.some((t) => t.includes('target="ciBlockedReconciled"') && t.includes('source="=true"')),
-    "ci-reconcile must set ciBlockedReconciled = true so a still-blocked PR escalates on the next pass",
-  );
-  // Re-derivation flows back through the mergeable wait (re-runs the ground-truth mergeable gate).
-  assert(flowHasId("f_cib_armed", "ci-reconcile", "wait-mergeable"), "ci-reconcile must re-enter wait-mergeable");
-});
-
-test("arm-merge clears the reconcile flag each loop so a fresh block episode gets its own reconcile", () => {
-  const el = serviceTask("arm-merge");
-  assert(el, "arm-merge service task must exist");
-  const outs = el!.match(/<zeebe:output\b[^>]*\/>/g) ?? [];
-  assert(
-    outs.some((t) => t.includes('target="ciBlockedReconciled"') && t.includes('source="=null"')),
-    "arm-merge must reset ciBlockedReconciled each loop so a later, unrelated block still reconciles once",
-  );
-});
-
-test("regression: a stale/transient fix-ci result can no longer page a human", () => {
-  // The old wedge: `status = "blocked"` flowing directly into merge-esc-attempt. The blocked
-  // verdict now routes through gw-ci-blocked (reconcile-before-escalate), never straight to the
-  // escalation.
-  assert(
-    !flowHasId("f_ci_blocked", "gw-ci-result", "merge-esc-attempt"),
-    "the blocked verdict must not route directly into merge-esc-attempt (the #348 phantom escalation)",
-  );
-  // The blocked arm targets the reconcile gateway; the reattempt arm re-arms the poller. Neither
-  // gw-ci-result arm may target the escalation directly.
-  assertStringIncludes(flowElement("f_ci_blocked") ?? "", 'targetRef="gw-ci-blocked"');
-  assertStringIncludes(flowElement("f_ci_reattempt") ?? "", 'targetRef="arm-merge"');
-});

package/app/mergeEscalationQuestion.test.ts

@@ -1,190 +0,0 @@
-// Regression guard for the question-less merge escalation defect (issue #329).
-//
-// The merge loop (`resources/processes/merge-loop.bpmn`) raised escalations with NO question
-// whenever a PR was blocked by anything other than a merge conflict: `merge-esc-attempt` called
-// `pr.persist-escalation` with no `question`/`status` ioMapping, and its output flowed
-// UNCONDITIONALLY into `wait-merge-answer`. Two coupled defects fell out of that:
-//
-//   1. A blank question surfaced on the merge-driving inbox — the human was asked to answer but
-//      told nothing (observed live on nano-ide PR #354).
-//   2. Per ADR 0002 §1 a blank question is a NON-escalation: `pr.persist-escalation` opens no row
-//      and returns `escalated:false`. The convergence loop honours this via a `gw-escalated`
-//      branch; the merge loop had none, so a question-less job still parked a dead
-//      `wait-merge-answer` with nothing for a human to answer.
-//
-// The fix (mirroring the convergence loop): give `merge-esc-attempt` a human-actionable
-// `status`/`question` that distinguishes its four trigger conditions, and add a `gw-merge-escalated`
-// guard so a `persist-escalation` returning `escalated:false` re-enters the loop (re-arms the
-// poller) instead of parking a dead wait.
-//
-// These are pure text assertions over the committed BPMN (no engine), matching the repo's
-// lightweight model-guard style (see mergeRebaseArm.test.ts, mergeEscalationUserTask.test.ts).
-
-import { test } from "node:test";
-import { assert, assertStringIncludes } from "#test-assert";
-import { readFileSync } from "node:fs";
-
-const bpmn = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
-// Collapse whitespace so attribute-order / line-wrapping churn doesn't make the assertions brittle.
-const flat = bpmn.replace(/\s+/g, " ");
-
-function flowHasId(id: string, source: string, target: string): boolean {
-  const m = flat.match(new RegExp(`<bpmn:sequenceFlow\\b[^>]*\\bid="${id}"[^>]*(?:/>|>)`));
-  if (!m) return false;
-  const tag = m[0];
-  return tag.includes(`sourceRef="${source}"`) && tag.includes(`targetRef="${target}"`);
-}
-
-function gatewayDefault(id: string, def: string): boolean {
-  const m = flat.match(new RegExp(`<bpmn:exclusiveGateway\\b[^>]*\\bid="${id}"[^>]*>`));
-  if (!m) return false;
-  return m[0].includes(`default="${def}"`);
-}
-
-// The <serviceTask> element for merge-esc-attempt, including its ioMapping. Unescape XML entities so
-// FEEL string literals (authored as `&#34;ready&#34;` inside the attribute) read naturally here.
-const escAttemptRaw = flat.match(/<bpmn:serviceTask\b[^>]*\bid="merge-esc-attempt"[\s\S]*?<\/bpmn:serviceTask>/);
-const escAttempt = escAttemptRaw
-  ? [escAttemptRaw[0].replace(/&#34;/g, '"').replace(/&amp;/g, "&").replace(/&#10;/g, "\n")]
-  : null;
-
-test("merge-esc-attempt carries a non-blank, human-actionable status + question", () => {
-  assert(escAttempt, "merge-esc-attempt service task must exist");
-  const el = escAttempt![0];
-  // Mirror the merge-esc-conflict mapping style: an explicit `blocked` status…
-  assertStringIncludes(el, "<zeebe:ioMapping", "merge-esc-attempt must set an ioMapping (was absent — the #329 defect)");
-  assertStringIncludes(el, 'target="status"', "merge-esc-attempt must set a `status`");
-  assertStringIncludes(el, 'target="question"', "merge-esc-attempt must set a non-blank `question`");
-  // Tighten: assert the explicit `status` INPUT MAPPING sets blocked, not merely the substring
-  // `="blocked"` (which the FEEL question's `agentVerdict = "blocked"` comparison would also satisfy
-  // even if the status mapping were removed/changed). Match tolerant of attribute order/spacing: the
-  // file is XML and a formatter could reorder `source`/`target` within the tag.
-  const escInputs = el.match(/<zeebe:input\b[^>]*\/>/g) ?? [];
-  const setsBlockedStatus = escInputs.some(
-    (t) => t.includes('target="status"') && t.includes('source="="blocked""'),
-  );
-  assert(setsBlockedStatus, "the explicit `status` input mapping must set `blocked`");
-});
-
-test("arm-merge clears the prior verdict `status` so a stale `blocked` cannot misclassify the CI-fix SLA escalation", () => {
-  // merge-esc-attempt captures `agentVerdict = status` to split its CI could-not-fix vs SLA question
-  // arms. On the SLA boundary path (`f_ci_sla`) no worker sets a fresh `status`, and every escalation
-  // task overwrites `status = "blocked"` (merge-esc-attempt line 194, merge-esc-conflict line 174).
-  // Without a reset, a retry after any prior escalation re-enters fix-ci with `status` still
-  // "blocked", so an SLA timeout would render the wrong ("could not fix") question. arm-merge is the
-  // single loop hub every fix-ci entry passes through, so clearing `status` there (to null) each
-  // iteration guarantees a genuine SLA reads no stale verdict. Nothing between arm-merge and the next
-  // verdict-setter (fix-ci/rebase) reads `status`, so the reset is safe.
-  const armRaw = flat.match(/<bpmn:serviceTask\b[^>]*\bid="arm-merge"[\s\S]*?<\/bpmn:serviceTask>/);
-  assert(armRaw, "arm-merge service task must exist");
-  const armOutputs = armRaw![0].match(/<zeebe:output\b[^>]*\/>/g) ?? [];
-  const clearsStatus = armOutputs.some(
-    (t) => t.includes('target="status"') && t.includes('source="=null"'),
-  );
-  assert(clearsStatus, "arm-merge must reset `status` to null each loop iteration so a stale `blocked` cannot misclassify the SLA escalation");
-});
-
-test("the question distinguishes all four blocked/SLA triggers rather than a single generic string", () => {
-  // Four flows route into merge-esc-attempt — the gate `blocked` default, CI could-not-fix,
-  // rebase could-not-resolve, and the CI-fix SLA. Each is a legitimately different escalation and
-  // the question must explain which one fired.
-  assert(escAttempt, "merge-esc-attempt service task must exist");
-  const el = escAttempt![0];
-  // gate blocked (gw-merge default): distinguishes on the `ready` mergeState + surfaces mergeStatus.
-  assertStringIncludes(el, 'mergeState = "ready"', "must branch on the gate-blocked (ready) trigger");
-  assertStringIncludes(el, "mergeStatus", "the gate-blocked question must surface the merge result");
-  // rebase could-not-resolve (conflict arm).
-  assertStringIncludes(el, 'mergeState = "conflict"', "must branch on the rebase (conflict) trigger");
-  // CI could-not-fix vs CI SLA both arrive with mergeState = blocked — split on the agent verdict,
-  // captured into a dedicated `agentVerdict` binding so the escalation-classification `status =
-  // "blocked"` override in the SAME ioMapping cannot make the SLA branch unreachable (issue #329
-  // review). Assert the question branches on that binding, not on the overwritten `status`.
-  assertStringIncludes(el, "agentVerdict", "must capture the agent verdict into a dedicated binding");
-  assertStringIncludes(el, 'agentVerdict = "blocked"', "must branch CI could-not-fix vs SLA on the agent verdict binding, not the overwritten status");
-});
-
-test("retry-budget-exhausted escalation reads as a repeated race, not a generic merge refusal", () => {
-  // `f_mr_giveup` (transient merge-retry budget exhausted) routes into merge-esc-attempt with
-  // mergeState = "ready" AND mergeStatus = "retry". Without a dedicated branch this reused the
-  // generic gate-blocked ("Investigate why GitHub refused the merge") text, which is misleading for
-  // a repeated base/head-moved race whose retry budget simply ran out. The question must branch on
-  // mergeStatus = "retry" — ahead of the generic `mergeState = "ready"` arm — and name the budget.
-  assert(escAttempt, "merge-esc-attempt service task must exist");
-  const el = escAttempt![0];
-  assertStringIncludes(el, 'mergeStatus = "retry"', "must branch the retry-budget-exhausted escalation on mergeStatus = retry");
-  assertStringIncludes(el, "mergeRetryMax", "the retry-exhausted question must surface the retry budget");
-  // The retry branch must precede the generic `mergeState = "ready"` branch, or the generic arm
-  // (also true here) would shadow it and re-emit the misleading refusal text.
-  const retryIdx = el.indexOf('mergeStatus = "retry"');
-  const readyIdx = el.indexOf('mergeState = "ready"');
-  assert(retryIdx !== -1 && readyIdx !== -1 && retryIdx < readyIdx, "the retry branch must be evaluated before the generic ready branch");
-});
-
-test("a gw-merge-escalated guard honours persist-escalation's escalated:false (mirrors the convergence loop)", () => {
-  // The escalation output no longer flows UNCONDITIONALLY into the durable answer wait: it passes
-  // through a gateway that reads the worker's `escalated` output.
-  assert(
-    flowHasId("f_m_escA", "merge-esc-attempt", "gw-merge-escalated"),
-    "merge-esc-attempt must route through gw-merge-escalated, not straight to wait-merge-answer",
-  );
-  // escalated:true → park the native user task for a human to answer.
-  assert(
-    flowHasId("f_m_escWait", "gw-merge-escalated", "wait-merge-answer"),
-    "gw-merge-escalated → wait-merge-answer (escalated) missing",
-  );
-  const escWait = flat.match(/<bpmn:sequenceFlow[^>]*id="f_m_escWait"[\s\S]*?<\/bpmn:sequenceFlow>/);
-  assert(escWait, "f_m_escWait flow missing");
-  assertStringIncludes(escWait![0], "escalated = true", "the wait arm must be guarded by escalated = true");
-  // escalated:false (a non-escalation, e.g. a blank question) → re-enter the loop, NOT a dead wait.
-  assert(
-    gatewayDefault("gw-merge-escalated", "f_m_escReenter"),
-    "gw-merge-escalated must default to f_m_escReenter (re-enter, not park)",
-  );
-  assert(
-    flowHasId("f_m_escReenter", "gw-merge-escalated", "arm-merge"),
-    "f_m_escReenter must re-arm the merge poller instead of parking a dead wait-merge-answer",
-  );
-});
-
-test("regression: a question-less escalation can no longer park a dead wait-merge-answer", () => {
-  // The exact #329 wedge: `merge-esc-attempt → wait-merge-answer` as a direct, unconditional edge.
-  // It must be gone — the only path into the answer wait from the attempt arm is now guarded by
-  // `escalated = true`.
-  assert(
-    !flowHasId("f_m_escA", "merge-esc-attempt", "wait-merge-answer"),
-    "merge-esc-attempt must NOT flow directly into wait-merge-answer (the #329 dead-wait defect)",
-  );
-});
-
-// ── Draft PR escalation (issue #454) ─────────────────────────────────────────────────────────────
-//
-// A draft PR is never landable — `classifyMergeability` now yields a first-class `"draft"` verdict
-// (app/github.ts) that the poller (app/service.ts) publishes as `mergeState = "draft"`. It routes
-// through `gw-mergeable`'s default (`f_m_mBlocked → merge-esc-conflict`), so `merge-esc-conflict`'s
-// question must recognise `draft` and give the ACTIONABLE remedy (mark it ready) instead of the
-// generic "resolve the conflict or failing required check" text (which is the wrong remedy for a
-// draft), and — before this fix — instead of `merge-esc-attempt`'s misleading "the merge attempt did
-// not land (blocked), investigate why GitHub refused the merge".
-const escConflictRaw = flat.match(/<bpmn:serviceTask\b[^>]*\bid="merge-esc-conflict"[\s\S]*?<\/bpmn:serviceTask>/);
-const escConflict = escConflictRaw ? escConflictRaw[0].replace(/&#34;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, "&") : null;
-
-test("merge-esc-conflict gives a draft PR an actionable 'mark it ready' question (issue #454)", () => {
-  assert(escConflict, "merge-esc-conflict service task must exist");
-  const el = escConflict!;
-  // Branches on the draft verdict…
-  assertStringIncludes(el, 'mergeState = "draft"', "merge-esc-conflict must branch on the draft verdict");
-  // …with the actionable remedy (mark it ready), not the conflict/failing-check remedy.
-  assertStringIncludes(el, "draft and can't be merged", "the draft question must state the PR is in draft");
-  assertStringIncludes(el, "gh pr ready", "the draft question must tell the human to mark it ready");
-});
-
-test("merge-esc-conflict keeps the non-draft not-mergeable branch intact (regression guard, issue #454)", () => {
-  assert(escConflict, "merge-esc-conflict service task must exist");
-  const el = escConflict!;
-  // The original conflict/failing-check message must still be reachable for non-draft states.
-  assertStringIncludes(el, "This PR is not mergeable (state:", "the non-draft not-mergeable message must remain");
-  // The draft branch must precede the generic message so it isn't shadowed.
-  const draftIdx = el.indexOf('mergeState = "draft"');
-  const genericIdx = el.indexOf("This PR is not mergeable (state:");
-  assert(draftIdx !== -1 && genericIdx !== -1 && draftIdx < genericIdx, "the draft branch must be evaluated before the generic not-mergeable message");
-});

package/app/mergeRebaseArm.test.ts

@@ -1,140 +0,0 @@
-// Structural regression guard for the merge-loop rebase remediation arm (issue #42).
-//
-// #42: the conflict arm routed a human's escalation answer straight back to `arm-merge`
-// (`f_m_answer → arm-merge`) with NO actor that rebases the branch, so a `CONFLICTING`
-// (moved-base) PR re-escalated forever — a human-in-the-loop livelock. The fix mirrors the
-// CI-fix arm: a `mergeState = "conflict"` verdict goes to a budgeted `senior:rebase` agent, and
-// escalates to a human only on the result gate.
-//
-// This test asserts the arm's topology on the committed model so it cannot regress silently the
-// way it originally shipped. It is a pure text assertion over the BPMN (no engine), matching the
-// repo's lightweight model-guard style.
-
-import { test } from "node:test";
-import { assert, assertStringIncludes } from "#test-assert";
-import { readFileSync } from "node:fs";
-
-const bpmn = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
-
-// Collapse whitespace so attribute-order / line-wrapping churn doesn't make the assertions brittle.
-const flat = bpmn.replace(/\s+/g, " ");
-
-// A `<sequenceFlow>` whose source/target match, regardless of attribute order or an inline
-// conditionExpression child. Returns true if such a flow is present.
-function hasFlow(source: string, target: string): boolean {
-  const re = new RegExp(
-    `<bpmn:sequenceFlow\\b[^>]*\\bsourceRef="${source}"[^>]*\\btargetRef="${target}"|` +
-      `<bpmn:sequenceFlow\\b[^>]*\\btargetRef="${target}"[^>]*\\bsourceRef="${source}"`,
-  );
-  return re.test(flat);
-}
-
-// Assert a specific `<sequenceFlow>` (matched by id) has the given source/target, regardless of
-// attribute order. Unlike `hasFlow`, this pins the *named* flow so a test can't be satisfied by a
-// sibling flow that happens to share the same source/target (e.g. a success arm masking a default).
-function flowHasId(id: string, source: string, target: string): boolean {
-  const m = flat.match(new RegExp(`<bpmn:sequenceFlow\\b[^>]*\\bid="${id}"[^>]*/?>`));
-  if (!m) return false;
-  const tag = m[0];
-  return tag.includes(`sourceRef="${source}"`) && tag.includes(`targetRef="${target}"`);
-}
-
-// Assert an `<exclusiveGateway>` (matched by id) declares the given `default` flow, regardless of
-// attribute order. Matching the start tag by id and reading `default` from it keeps the guard
-// robust to harmless XML reformatting (attribute reordering / wrapping) that a fixed-order literal
-// substring would spuriously trip on.
-function gatewayDefault(id: string, def: string): boolean {
-  const m = flat.match(new RegExp(`<bpmn:exclusiveGateway\\b[^>]*\\bid="${id}"[^>]*>`));
-  if (!m) return false;
-  return m[0].includes(`default="${def}"`);
-}
-
-test("conflict routes to the rebase budget gate, not straight to a human", () => {
-  // The conflict verdict must reach the auto-rebase gate…
-  assert(hasFlow("gw-mergeable", "gw-rebase"), "gw-mergeable → gw-rebase (conflict) missing");
-  // …guarded by the exact conflict condition (DIRTY → mergeState = "conflict").
-  assertStringIncludes(flat, 'mergeState = "conflict"');
-});
-
-test("rebase arm mirrors the fix-ci arm: budget gate → agent → result gate", () => {
-  // Budget gate: within budget → the agent; exhausted → the (existing) conflict escalation.
-  assert(hasFlow("gw-rebase", "rebase"), "gw-rebase → rebase (within budget) missing");
-  assert(hasFlow("gw-rebase", "merge-esc-conflict"), "gw-rebase → merge-esc-conflict (budget exhausted) missing");
-  assertStringIncludes(flat, "rebaseRound &lt; rebaseMax");
-
-  // The agent is the senior:rebase fleet task, carrying its base prompt via the rebase.md linked resource.
-  assertStringIncludes(flat, 'type="senior:rebase"');
-  assertStringIncludes(flat, 'resourceId="rebase.md"');
-
-  // Agent → result gate; the round counter advances so the budget can actually be exhausted.
-  assert(hasFlow("rebase", "gw-rebase-result"), "rebase → gw-rebase-result missing");
-  assertStringIncludes(flat, "=rebaseRound + 1");
-});
-
-test("rebase result: success re-arms the poller; unresolved escalates to a human", () => {
-  // Success loops back to re-attempt the merge — forward progress, no human needed.
-  assert(hasFlow("gw-rebase-result", "arm-merge"), "gw-rebase-result → arm-merge (rebased) missing");
-  assertStringIncludes(flat, 'status = "rebased"');
-  // A genuine (semantic) conflict the agent can't resolve escalates to the human attempt path.
-  assert(
-    hasFlow("gw-rebase-result", "merge-esc-attempt"),
-    "gw-rebase-result → merge-esc-attempt (could not resolve) missing",
-  );
-});
-
-test("rebase result: a missing/ambiguous status reconciles from ground truth, not escalation (#134)", () => {
-  // #134 / Magikcraft/nano-bpm#751: the rebase agent resolved everything and the PR became
-  // MERGEABLE, but it emitted no machine-readable `status`, so the old default arm escalated a
-  // PR that was already landable. Ground truth is authoritative: the default (no-verdict) arm
-  // now re-arms the merge poller, which re-checks `gw-mergeable` from GitHub state — bounded by
-  // the existing rebaseMax budget — instead of pulling in a human.
-  assert(
-    gatewayDefault("gw-rebase-result", "f_reb_reconcile"),
-    'gw-rebase-result must default to f_reb_reconcile (reconcile)',
-  );
-  // Pin the *default* reconcile flow itself, not just any gw-rebase-result → arm-merge edge (the
-  // success arm `f_reb_rebased` shares that target), so a mis-wired default can't pass silently.
-  assert(
-    flowHasId("f_reb_reconcile", "gw-rebase-result", "arm-merge"),
-    "f_reb_reconcile must default gw-rebase-result → arm-merge (reconcile)",
-  );
-  // Escalation is now reserved for the agent's explicit "I cannot proceed" verdict.
-  assertStringIncludes(flat, 'id="f_reb_blocked"');
-  const rebBlocked = flat.match(/<bpmn:sequenceFlow[^>]*id="f_reb_blocked"[\s\S]*?<\/bpmn:sequenceFlow>/);
-  assert(rebBlocked, "f_reb_blocked flow missing");
-  assertStringIncludes(rebBlocked![0], 'status = "blocked"');
-});
-
-test("ci-fix result: a missing/ambiguous status reconciles from ground truth, not escalation (#134)", () => {
-  // Symmetric to the rebase arm: the CI-fix agent's no-verdict default re-arms the merge poller
-  // (ground-truth re-check, bounded by ciFixMax) rather than escalating a possibly-green PR.
-  assert(
-    gatewayDefault("gw-ci-result", "f_ci_reconcile"),
-    'gw-ci-result must default to f_ci_reconcile (reconcile)',
-  );
-  // Pin the *default* reconcile flow itself, not just any gw-ci-result → arm-merge edge (the
-  // success arm `f_ci_fixed` shares that target), so a mis-wired default can't pass silently.
-  assert(
-    flowHasId("f_ci_reconcile", "gw-ci-result", "arm-merge"),
-    "f_ci_reconcile must default gw-ci-result → arm-merge (reconcile)",
-  );
-  // Escalation reserved for the agent's explicit `blocked` verdict — but now via a
-  // reconcile-before-escalate guard (issue #348): a `blocked` with no push reconciles once from
-  // ground truth, and only a still-blocked PR reaches the human escalation.
-  const ciBlocked = flat.match(/<bpmn:sequenceFlow[^>]*id="f_ci_blocked"[\s\S]*?<\/bpmn:sequenceFlow>/);
-  assert(ciBlocked, "f_ci_blocked flow missing");
-  assertStringIncludes(ciBlocked![0], 'status = "blocked"');
-  assert(hasFlow("gw-ci-result", "gw-ci-blocked"), "blocked verdict must pass through gw-ci-blocked (reconcile-before-escalate)");
-  assert(hasFlow("gw-ci-blocked", "merge-esc-attempt"), "gw-ci-blocked → merge-esc-attempt (still blocked) missing");
-});
-
-test("regression: the conflict verdict passes through the rebase actor, not straight to escalation", () => {
-  // The original #42 livelock had the conflict verdict escalate to a human with no remediation
-  // actor. The primary target of the conflict verdict must now be the rebase gate.
-  assert(
-    hasFlow("gw-mergeable", "gw-rebase"),
-    "conflict must reach the rebase gate (the #42 remediation actor)",
-  );
-  // Sanity: the untouched ready path still lands the merge directly.
-  assert(hasFlow("gw-mergeable", "attempt-merge"), "ready → attempt-merge path should still exist");
-});

package/app/mergeRetryArm.test.ts

@@ -1,100 +0,0 @@
-// Structural regression guard for the merge-loop transient-retry arm (issue #334).
-//
-// #334: a transient, GitHub-flagged-retryable merge race ("Base branch was modified. Review and
-// try the merge again.") was mapped to `blocked` → a decision-required human escalation on a PR
-// that was actually mergeable once the base settled. The fix adds a `retry` merge outcome that
-// re-enters the merge loop on the settled base through a *bounded* budget gate — mirroring the
-// `gw-ci-fix` within-budget / budget-exhausted pattern — WITHOUT any remediation agent, and
-// escalates via the existing `merge-esc-attempt` only when the retry budget is exhausted (so a
-// continuously-moving base still escalates promptly rather than spinning forever).
-//
-// This test asserts the arm's topology on the committed model so it cannot regress silently. It is
-// a pure text assertion over the BPMN (no engine), matching the repo's lightweight model-guard style.
-
-import { test } from "node:test";
-import { assert, assertStringIncludes } from "#test-assert";
-import { readFileSync } from "node:fs";
-
-const bpmn = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
-const flat = bpmn.replace(/\s+/g, " ");
-
-function hasFlow(source: string, target: string): boolean {
-  const re = new RegExp(
-    `<bpmn:sequenceFlow\\b[^>]*\\bsourceRef="${source}"[^>]*\\btargetRef="${target}"|` +
-      `<bpmn:sequenceFlow\\b[^>]*\\btargetRef="${target}"[^>]*\\bsourceRef="${source}"`,
-  );
-  return re.test(flat);
-}
-
-function flowHasId(id: string, source: string, target: string): boolean {
-  const m = flat.match(new RegExp(`<bpmn:sequenceFlow\\b[^>]*\\bid="${id}"[^>]*/?>`));
-  if (!m) return false;
-  const tag = m[0];
-  return tag.includes(`sourceRef="${source}"`) && tag.includes(`targetRef="${target}"`);
-}
-
-function gatewayDefault(id: string, def: string): boolean {
-  const m = flat.match(new RegExp(`<bpmn:exclusiveGateway\\b[^>]*\\bid="${id}"[^>]*>`));
-  if (!m) return false;
-  return m[0].includes(`default="${def}"`);
-}
-
-// Assert the conditionExpression *of a specific sequenceFlow* contains `needle`, so the guard
-// cannot be satisfied by the same substring appearing on an unrelated flow (e.g. the
-// merge-esc-attempt question FEEL also mentions `mergeStatus = "retry"`).
-function flowHasCondition(id: string, needle: string): boolean {
-  const m = flat.match(
-    new RegExp(`<bpmn:sequenceFlow\\b[^>]*\\bid="${id}"[^>]*>(.*?)</bpmn:sequenceFlow>`),
-  );
-  if (!m) return false;
-  const cond = m[1].match(/<bpmn:conditionExpression\b[^>]*>(.*?)<\/bpmn:conditionExpression>/);
-  return cond ? cond[1].includes(needle) : false;
-}
-
-test("gw-merge routes the retry outcome to a dedicated budget gate, not to a human", () => {
-  // A `retry` merge result must reach the retry-budget gate…
-  assert(hasFlow("gw-merge", "gw-merge-retry"), "gw-merge → gw-merge-retry (retry) missing");
-  // …guarded by the exact retry condition (mergeStatus = "retry").
-  assert(flowHasId("f_m_gRetry", "gw-merge", "gw-merge-retry"), "f_m_gRetry must be gw-merge → gw-merge-retry");
-  // Assert the retry condition on f_m_gRetry ITSELF — not merely anywhere in the model — so the
-  // guard cannot be satisfied by the identical substring in the merge-esc-attempt question FEEL.
-  assert(
-    flowHasCondition("f_m_gRetry", 'mergeStatus = "retry"'),
-    'f_m_gRetry conditionExpression must be mergeStatus = "retry"',
-  );
-});
-
-test("retry arm mirrors the fix-ci arm: budget gate → re-arm, exhausted → escalate", () => {
-  // Within budget → re-arm the merge poller (re-attempt on the settled base). No remediation agent.
-  assert(hasFlow("gw-merge-retry", "arm-merge"), "gw-merge-retry → arm-merge (within budget) missing");
-  assert(flowHasId("f_mr_go", "gw-merge-retry", "arm-merge"), "f_mr_go must be gw-merge-retry → arm-merge");
-  assertStringIncludes(flat, "mergeRetryRound &lt;= mergeRetryMax");
-
-  // Budget exhausted → the EXISTING human escalation (merge-esc-attempt), and it is the gateway default
-  // so a continuously-moving base can never spin past the cap.
-  assert(
-    hasFlow("gw-merge-retry", "merge-esc-attempt"),
-    "gw-merge-retry → merge-esc-attempt (budget exhausted) missing",
-  );
-  assert(gatewayDefault("gw-merge-retry", "f_mr_giveup"), "gw-merge-retry must default to f_mr_giveup");
-  assert(
-    flowHasId("f_mr_giveup", "gw-merge-retry", "merge-esc-attempt"),
-    "f_mr_giveup must default gw-merge-retry → merge-esc-attempt",
-  );
-});
-
-test("the retry arm advances the attempt counter only on a transient retry outcome", () => {
-  // The counter advances ONLY when the merge attempt returned `retry` — mirroring how fix-ci/rebase
-  // advance their own rounds only on their own remediation — so unrelated merge attempts (initial,
-  // post-rebase, post-fix-ci, post-evict) can't consume the transient-retry budget. N consecutive
-  // transient races then trip the `mergeRetryRound <= mergeRetryMax` gate at exactly the cap.
-  assertStringIncludes(flat, "=if mergeStatus = &#34;retry&#34; then mergeRetryRound + 1 else mergeRetryRound");
-});
-
-test("the retry arm has NO remediation agent (contrast the conflict/rebase arm)", () => {
-  // The base-moved race needs only a re-attempt on the settled base — no rebase/CI-fix agent. The
-  // within-budget flow goes straight back to arm-merge, never through a `senior:*` task.
-  assert(flowHasId("f_mr_go", "gw-merge-retry", "arm-merge"), "retry within-budget must go directly to arm-merge");
-  // Sanity: the untouched blocked path still escalates directly (a genuine refusal is unchanged).
-  assert(flowHasId("f_m_gBlocked", "gw-merge", "merge-esc-attempt"), "blocked → merge-esc-attempt must remain");
-});