@nanobpm/nano-workforce 0.137.0 → 0.138.1

package/openapi.yaml

@@ -1590,12 +1590,30 @@ components:
         message:
           type: string
           description: Human-actionable description of the failure.
-    DeliveryGraphTextSubmit:
+    DeliveryGraphPreviewSubmit:
       description: >-
-        The human-facing UI JSON-paste PREVIEW request (issue #386). The Delivery Graphs page's text
-        field cannot submit a structured object, so the operator's pasted delivery-graph is carried as
+        The human-facing UI JSON-paste PREVIEW request (issues #386 + #516). The Delivery Graphs page's
+        "Preview" action cannot submit a structured object, so the operator's pasted delivery-graph is
+        carried as a raw JSON STRING (`graphJson`), parsed server-side and handed to the SAME pure
+        `compileDeliveryGraph` compiler the agent-facing door uses. Preview compiles WITHOUT persisting.
+        Per-operation schema (not shared with the stage door) so each door's request stays independently
+        evolvable.
+      type: object
+      additionalProperties: false
+      required:
+        - graphJson
+      properties:
+        graphJson:
+          type: string
+          description: The pasted delivery-graph JSON (a serialised `DeliveryGraph`), parsed server-side.
+    DeliveryGraphStageSubmit:
+      description: >-
+        The human-facing UI JSON-paste STAGE request (issue #516) — the commit half of the preview/stage
+        split. The Delivery Graphs page's "Stage" action carries the operator's pasted delivery-graph as
         a raw JSON STRING (`graphJson`), parsed server-side and handed to the SAME pure
-        `compileDeliveryGraph` compiler the agent-facing door uses. No parallel compile path.
+        `compileDeliveryGraph` compiler the preview/agent doors use, then persisted as a `staged`
+        proposal. Per-operation schema (not shared with the preview door) so each door's request stays
+        independently evolvable.
       type: object
       additionalProperties: false
       required:
@@ -1820,6 +1838,13 @@ components:
           description: >-
             The side-effecting (`agent`/`connector`) actions the compiled graph WILL perform (preview)
             — what an approval authorises (Decision 7), rendered by the Delivery Graphs page (#441).
+        bpmn:
+          type: string
+          description: >-
+            The compiled BPMN 2.0 XML INCLUDING diagram interchange (`bpmndi:BPMNDiagram`) — returned by
+            the PURE preview door (`previewDeliveryGraph`) only, so the Delivery Graphs page can render
+            the laid-out BPMN in the host explorer WITHOUT staging (#516). Byte-identical to what a
+            dispatch would deploy. Omitted by the stage/dispatch outcomes.
     ResolvedDeliveryNode:
       description: >-
         A normalised node in the compiled graph (ADR 0005 slice S1) — its `id`, `kind`, the
@@ -2887,24 +2912,56 @@ paths:
   /actions/delivery-graph/preview:
     post:
       operationId: previewDeliveryGraph
-      summary: UI JSON-paste PREVIEW+STAGE — parse a pasted delivery-graph JSON string, compile it and stage it for operator dispatch. (ADR 0005 Decision 7 / #460)
+      summary: UI JSON-paste PURE PREVIEW — parse a pasted delivery-graph JSON string and compile it, without staging. (ADR 0005 Decision 7 / #460 / #516)
+      description: >-
+        The human-facing UI JSON-paste PURE PREVIEW ingress. The Delivery Graphs page's "Preview"
+        action posts the operator's pasted JSON as a STRING; this door parses it and runs the SAME
+        `compileDeliveryGraph` compiler the agent-facing door uses, but — unlike the compile/stage doors
+        — it does NOT persist anything (#516: preview and staging are separate operator actions). It
+        returns a compact preview summary (`staged:false`, the `digest`, node/human/side-effect counts,
+        the mermaid `diagram`, the human stops and side effects) PLUS the compiled `bpmn` (with diagram
+        interchange) so the page can render the laid-out BPMN in the host explorer without staging. It
+        never deploys, stages or dispatches. A blank/invalid JSON string, or a graph that fails
+        validation, is a 400 carrying a human `error` (and path-qualified `errors` for a compile failure).
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeliveryGraphPreviewSubmit"
+      responses:
+        "200":
+          description: The pasted graph parsed, validated and compiled — the preview summary and compiled BPMN are returned; nothing is staged.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DeliveryGraphTextResult"
+        "400":
+          description: The pasted text was not valid JSON, or the graph failed validation/compilation.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DeliveryGraphTextResult"
+  /actions/delivery-graph/stage:
+    post:
+      operationId: stageDeliveryGraph
+      summary: UI JSON-paste STAGE — parse a pasted delivery-graph JSON string, compile it and stage it for operator dispatch. (ADR 0005 Decision 7 / #460 / #516)
       description: >-
-        The human-facing UI JSON-paste PREVIEW+STAGE ingress. The Delivery Graphs page's "Preview &
-        stage" action posts the operator's pasted JSON as a STRING; this door parses it and runs the
-        SAME `compileDeliveryGraph` compiler the agent-facing door uses, and — like the agent compile
-        door (issue #460) — persists the compiled graph as a `staged` proposal (content-addressed by its
-        `digest`). It returns a compact preview summary (the `digest`, node/human/side-effect counts,
-        the mermaid `diagram`, the human stops and side effects) plus a navigational `reviewUrl`. It
-        never deploys or dispatches — dispatch is a separate operator action on the staged proposal
-        (the Dispatch button on the staged-proposals grid). A blank/invalid JSON string, or a graph that
-        fails validation, is a 400 carrying a human `error` (and path-qualified `errors` for a compile
-        failure); nothing is staged.
+        The human-facing UI JSON-paste STAGE ingress — the deliberate commit half of the preview/stage
+        split (#516). The Delivery Graphs page's "Stage" action posts the operator's pasted JSON as a
+        STRING; this door parses it, runs the SAME `compileDeliveryGraph` compiler the preview/agent
+        doors use, and — on success — persists the compiled graph as a `staged` proposal
+        (content-addressed by its `digest`). It returns the same preview summary as the preview door but
+        with `staged:true`. It never deploys or dispatches — dispatch is a separate operator action on
+        the staged proposal (the Dispatch button on the staged-proposals grid). A blank/invalid JSON
+        string, or a graph that fails validation, is a 400 carrying a human `error` (and path-qualified
+        `errors` for a compile failure); nothing is staged.
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: "#/components/schemas/DeliveryGraphTextSubmit"
+              $ref: "#/components/schemas/DeliveryGraphStageSubmit"
       responses:
         "200":
           description: The pasted graph parsed, validated and compiled — staged for operator dispatch; the preview summary is returned.

package/operations/previewDeliveryGraph.test.ts

@@ -1,9 +1,9 @@
 // Tests for the POST /app/api/actions/delivery-graph/preview operation `previewDeliveryGraph` (ADR
-// 0005 Decision 7, issue #460) — the human-facing UI JSON-paste PREVIEW+STAGE ingress. It parses the
-// operator's pasted JSON STRING, runs the SAME `compileDeliveryGraph` compiler the agent door uses,
-// and — like the agent compile door — persists the compiled graph as a `staged` proposal, returning a
-// compact summary (200, `staged:true` + `reviewUrl`) or a human `error` + path-qualified `errors`
-// (400). It never dispatches — that is a separate operator action on the staged proposal.
+// 0005 Decision 7, issues #460 + #516) — the human-facing UI JSON-paste PURE PREVIEW ingress. It
+// parses the operator's pasted JSON STRING, runs the SAME `compileDeliveryGraph` compiler the agent
+// door uses, and returns a compact summary (200, `staged:false`, + the compiled `bpmn`) or a human
+// `error` + path-qualified `errors` (400). Unlike the stage door it persists NOTHING — preview and
+// staging are separate operator actions (#516).
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -42,12 +42,13 @@ const GOOD = JSON.stringify({
   edges: [{ from: "a", to: "b" }],
 });
 
-test("preview-delivery-graph: a pasted well-formed graph → 200 summary, staged, with digest + counts", async () => {
+test("preview-delivery-graph: a pasted well-formed graph → 200 summary, NOT staged, with digest + counts + bpmn", async () => {
   await withApp(async (app, data) => {
     const res = await call(app, { graphJson: GOOD });
     assertEquals(res.status, 200);
     assertEquals(res.body.ok, true);
-    assertEquals(res.body.staged, true);
+    // #516: preview is PURE — it compiles but never stages.
+    assertEquals(res.body.staged, false);
     assert(typeof res.body.digest === "string" && res.body.digest.length > 0);
     assert(typeof res.body.reviewUrl === "string" && res.body.reviewUrl.length > 0);
     assertEquals(res.body.nodeCount, 2);
@@ -56,8 +57,9 @@ test("preview-delivery-graph: a pasted well-formed graph → 200 summary, staged
     assertEquals(res.body.sideEffecting, true);
     assert(typeof res.body.diagram === "string" && res.body.diagram.length > 0);
     assertEquals(res.body.title, "runbook");
-    // The FULL preview detail (#441) — the human stop-points and side-effecting actions the page
-    // renders, not just the counts. `a` is the side-effecting agent node; `b` is the human stop.
+    // The PURE preview returns the laid-out BPMN so the page can render the DI without staging (#516).
+    assert(typeof res.body.bpmn === "string" && res.body.bpmn.includes("bpmndi:BPMNDiagram"));
+    // The FULL preview detail (#441) — the human stop-points and side-effecting actions the page renders.
     assert(Array.isArray(res.body.humanNodes) && res.body.humanNodes.length === 1);
     assertEquals(res.body.humanNodes[0].nodeId, "b");
     assertEquals(res.body.humanNodes[0].prompt, "do X");
@@ -65,19 +67,19 @@ test("preview-delivery-graph: a pasted well-formed graph → 200 summary, staged
     assertEquals(res.body.sideEffects[0].nodeId, "a");
     assertEquals(res.body.sideEffects[0].kind, "agent");
     assert(typeof res.body.sideEffects[0].description === "string" && res.body.sideEffects[0].description.length > 0);
-    // A staged proposal now exists for the operator to dispatch — and NO dispatch handle came back.
-    assertEquals((await deliveryGraphProposals(data).get(res.body.digest))?.status, "staged");
+    // NOTHING was staged, and no dispatch handle came back.
+    assertEquals((await deliveryGraphProposals(data).all()).length, 0);
     assertEquals(res.body.runKey, undefined);
     assertEquals(res.body.processInstanceKey, undefined);
   });
 });
 
-test("preview-delivery-graph: repeated previews stage the identical digest idempotently (one live row)", async () => {
+test("preview-delivery-graph: repeated previews are pure — the identical digest, still nothing staged", async () => {
   await withApp(async (app, data) => {
     const a = await call(app, { graphJson: GOOD });
     const b = await call(app, { graphJson: GOOD });
     assertEquals(a.body.digest, b.body.digest);
-    assertEquals((await deliveryGraphProposals(data).find({ digest: a.body.digest })).length, 1);
+    assertEquals((await deliveryGraphProposals(data).all()).length, 0);
   });
 });
 

package/operations/previewDeliveryGraph.ts

@@ -1,92 +1,34 @@
 // POST /app/api/actions/delivery-graph/preview → operationId `previewDeliveryGraph` (ADR 0005
-// Decision 7, issue #460). The human-facing UI JSON-paste PREVIEW+STAGE ingress: the Delivery Graphs
-// page's "Preview & stage" action posts the operator's pasted delivery-graph as a raw JSON STRING;
-// this door parses it (`parseDeliveryGraphText`) and runs the SAME `compileDeliveryGraph` compiler the
-// agent-facing door uses, and — like the agent compile door — persists the compiled graph as a
-// `staged` proposal (content-addressed by its `digest`).
+// Decision 7, issues #460 + #516). The human-facing UI JSON-paste PURE PREVIEW ingress: the Delivery
+// Graphs page's "Preview" action posts the operator's pasted delivery-graph as a raw JSON STRING; this
+// door parses it (`parseDeliveryGraphText`) and runs the SAME `compileDeliveryGraph` compiler the
+// agent-facing door uses — but, unlike the compile/stage doors, it does NOT persist anything. It is a
+// side-effect-free compile: preview and STAGING are now separate operator actions (#516), so an
+// operator can compile-and-inspect a graph (its diagram, human stop-points, side-effects) and iterate
+// before committing it to the staged-proposals list via the separate "Stage" action (stageDeliveryGraph).
 //
-// It returns a compact preview summary (the `digest`, node/human/side-effect counts, the mermaid
-// `diagram`, and the full human-stop / side-effect detail) plus a navigational `reviewUrl`. It never
-// deploys or dispatches — dispatch is a separate OPERATOR action on the staged proposal (the Dispatch
-// button on the staged-proposals grid). A blank/invalid paste, or a graph that fails validation, is a
-// 400 carrying a human `error` (and path-qualified `errors` for a compile failure); nothing is staged.
+// It returns a compact preview summary (`staged:false`, the `digest`, node/human/side-effect counts,
+// the mermaid `diagram`, the human stops and side effects) PLUS the compiled `bpmn` (with diagram
+// interchange) so the page can render the laid-out BPMN in the host explorer WITHOUT staging. It never
+// deploys or dispatches — dispatch is a separate operator action on a staged proposal. A blank/invalid
+// JSON string, or a graph that fails validation, is a 400 carrying a human `error` (and path-qualified
+// `errors` for a compile failure); nothing is compiled past the failure.
 
-import { compileDeliveryGraph } from "../app/deliveryGraphCompiler.ts";
-import {
-  buildProposalPreview,
-  buildProposalRow,
-  proposalLogicalKey,
-  proposalReviewUrl,
-  stageProposal,
-} from "../app/deliveryGraphProposals.ts";
-import { parseDeliveryGraphText } from "../app/deliveryGraphText.ts";
-import { deliveryGraphDigest } from "../app/deliveryRunner.ts";
+import { buildTextPreviewBody, parseAndCompileText } from "../app/deliveryGraphTextIngress.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
 
 export default defineOperation("previewDeliveryGraph", async ({ body }, app) => {
-  const parsed = parseDeliveryGraphText(body);
-  if (!parsed.ok) {
-    app.log.warn("preview-delivery-graph rejected: parse", { message: parsed.error });
-    return { status: 400, body: { ok: false, error: parsed.error } };
+  const ingress = await parseAndCompileText(body);
+  if (!ingress.ok) {
+    app.log.warn("preview-delivery-graph rejected", { message: ingress.body.error });
+    return { status: ingress.status, body: ingress.body };
   }
-  const compiled = await compileDeliveryGraph(parsed.graph);
-  if (!compiled.ok) {
-    app.log.warn("preview-delivery-graph rejected: compile", { errors: compiled.errors.length });
-    return {
-      status: 400,
-      body: {
-        ok: false,
-        error: `graph failed validation: ${compiled.errors.length} error(s)`,
-        errors: compiled.errors,
-      },
-    };
-  }
-
-  const digest = deliveryGraphDigest(compiled.bpmn);
-  const name =
-    typeof compiled.resolved.name === "string" && compiled.resolved.name.trim() !== ""
-      ? compiled.resolved.name.trim()
-      : null;
-  const preview = buildProposalPreview(compiled);
-  await stageProposal(
-    app.data,
-    buildProposalRow({
-      digest,
-      logicalKey: proposalLogicalKey(name, digest),
-      title: name,
-      graphJson: JSON.stringify(parsed.graph),
-      preview,
-      nodeCount: compiled.resolved.nodes.length,
-      humanNodeCount: compiled.humanNodes.length,
-      sideEffectCount: compiled.sideEffects.length,
-      sideEffecting: compiled.sideEffects.length > 0,
-    }),
-  );
 
-  app.log.info("preview-delivery-graph staged", {
-    nodes: compiled.resolved.nodes.length,
-    humanNodes: compiled.humanNodes.length,
-    sideEffects: compiled.sideEffects.length,
-    digest,
+  app.log.info("preview-delivery-graph compiled (not staged)", {
+    nodes: ingress.compiled.resolved.nodes.length,
+    humanNodes: ingress.compiled.humanNodes.length,
+    sideEffects: ingress.compiled.sideEffects.length,
+    digest: ingress.digest,
   });
-  return {
-    status: 200,
-    body: {
-      ok: true,
-      staged: true,
-      digest,
-      reviewUrl: proposalReviewUrl(digest),
-      ...(name !== null ? { title: name } : {}),
-      sideEffecting: compiled.sideEffects.length > 0,
-      nodeCount: compiled.resolved.nodes.length,
-      humanNodeCount: compiled.humanNodes.length,
-      sideEffectCount: compiled.sideEffects.length,
-      diagram: compiled.diagram,
-      // The FULL extracted preview detail (not just the counts): the human stop-points and the
-      // side-effecting actions. The Delivery Graphs page renders these so the operator sees WHERE it
-      // parks on a person and WHAT it will do — the "preview before dispatch" principle made visible.
-      humanNodes: compiled.humanNodes,
-      sideEffects: compiled.sideEffects,
-    },
-  };
+  return { status: 200, body: buildTextPreviewBody(ingress, { staged: false, includeBpmn: true }) };
 });

package/operations/stageDeliveryGraph.test.ts

@@ -0,0 +1,106 @@
+// Tests for the POST /app/api/actions/delivery-graph/stage operation `stageDeliveryGraph` (ADR 0005
+// Decision 7, issues #460 + #516) — the STAGE half of the preview/stage split. It parses the
+// operator's pasted JSON STRING, runs the SAME compiler the preview/agent doors use, and — on success
+// — persists the compiled graph as a `staged` proposal (200, `staged:true`). Unlike the pure preview
+// door it PERSISTS; unlike dispatch it never launches (no run key / instance key comes back).
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import type { AppApi, DataLayer } from "@nanobpm/urban";
+import { bootTestApp } from "@nanobpm/urban-testkit";
+import { deliveryGraphProposals } from "../app/deliveryGraphProposals.ts";
+import { noopLog } from "../test/log.ts";
+import handler from "./stageDeliveryGraph.ts";
+
+const APP_ROOT = resolve(import.meta.dirname, "..");
+
+async function withApp(fn: (app: AppApi, data: DataLayer) => Promise<void>): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), "nwf-dgstage-"));
+  const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(dir, "app.db")}` } });
+  try {
+    const edge = { data: app.db, log: noopLog() } as unknown as AppApi;
+    await fn(edge, app.db);
+  } finally {
+    await app.stop?.();
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function call(app: AppApi, body: unknown) {
+  return (await handler({ req: {} as any, params: {}, query: {}, body } as any, app)) as any;
+}
+
+const GOOD = JSON.stringify({
+  name: "runbook",
+  nodes: [
+    { id: "a", kind: "agent", agent: { jobType: "senior:feature" } },
+    { id: "b", kind: "human", human: { prompt: "do X" } },
+  ],
+  edges: [{ from: "a", to: "b" }],
+});
+
+test("stage-delivery-graph: a pasted well-formed graph → 200, staged, with digest + counts", async () => {
+  await withApp(async (app, data) => {
+    const res = await call(app, { graphJson: GOOD });
+    assertEquals(res.status, 200);
+    assertEquals(res.body.ok, true);
+    assertEquals(res.body.staged, true);
+    assert(typeof res.body.digest === "string" && res.body.digest.length > 0);
+    assert(typeof res.body.reviewUrl === "string" && res.body.reviewUrl.length > 0);
+    assertEquals(res.body.nodeCount, 2);
+    assertEquals(res.body.humanNodeCount, 1);
+    assertEquals(res.body.sideEffectCount, 1);
+    assertEquals(res.body.sideEffecting, true);
+    assertEquals(res.body.title, "runbook");
+    // Full preview detail is still returned so the page renders the same summary as preview.
+    assert(Array.isArray(res.body.humanNodes) && res.body.humanNodes.length === 1);
+    assert(Array.isArray(res.body.sideEffects) && res.body.sideEffects.length === 1);
+    // The stage door persists a `staged` proposal — and returns NO dispatch handle (#460).
+    assertEquals((await deliveryGraphProposals(data).get(res.body.digest))?.status, "staged");
+    assertEquals(res.body.runKey, undefined);
+    assertEquals(res.body.processInstanceKey, undefined);
+    // The stage summary omits the heavy BPMN (the staged grid recompiles by digest for its DI preview).
+    assertEquals(res.body.bpmn, undefined);
+  });
+});
+
+test("stage-delivery-graph: repeated stages of the same graph → one live row (idempotent on digest)", async () => {
+  await withApp(async (app, data) => {
+    const a = await call(app, { graphJson: GOOD });
+    const b = await call(app, { graphJson: GOOD });
+    assertEquals(a.body.digest, b.body.digest);
+    assertEquals((await deliveryGraphProposals(data).find({ digest: a.body.digest })).length, 1);
+  });
+});
+
+test("stage-delivery-graph: text that is not valid JSON → 400, nothing staged", async () => {
+  await withApp(async (app, data) => {
+    const res = await call(app, { graphJson: "{ not json" });
+    assertEquals(res.status, 400);
+    assertEquals(res.body.ok, false);
+    assert(typeof res.body.error === "string" && res.body.error.includes("not valid JSON"));
+    assertEquals((await deliveryGraphProposals(data).all()).length, 0);
+  });
+});
+
+test("stage-delivery-graph: a valid-JSON but malformed graph → 400 with path-qualified errors, nothing staged", async () => {
+  await withApp(async (app, data) => {
+    const res = await call(app, {
+      graphJson: JSON.stringify({ nodes: [{ id: "a", kind: "agent", agent: { jobType: "j" } }], edges: [{ from: "a", to: "ghost" }] }),
+    });
+    assertEquals(res.status, 400);
+    assertEquals(res.body.ok, false);
+    assert(Array.isArray(res.body.errors) && res.body.errors.length > 0);
+    assertEquals((await deliveryGraphProposals(data).all()).length, 0);
+  });
+});
+
+test("stage-delivery-graph: a blank paste → 400, never a 500", async () => {
+  await withApp(async (app) => {
+    const res = await call(app, { graphJson: "   " });
+    assertEquals(res.status, 400);
+    assertEquals(res.body.ok, false);
+  });
+});

package/operations/stageDeliveryGraph.ts

@@ -0,0 +1,53 @@
+// POST /app/api/actions/delivery-graph/stage → operationId `stageDeliveryGraph` (ADR 0005 Decision 7,
+// issues #460 + #516). The human-facing UI JSON-paste STAGE ingress: the Delivery Graphs page's
+// "Stage" action posts the operator's pasted delivery-graph as a raw JSON STRING; this door parses it,
+// runs the SAME `compileDeliveryGraph` compiler the preview/agent doors use, and — on success —
+// persists the compiled graph as a `staged` proposal (content-addressed by its `digest`) for an
+// operator to dispatch from the Staged proposals grid.
+//
+// It is the STAGE half of the preview/stage split (#516): preview (`previewDeliveryGraph`) compiles
+// WITHOUT persisting; this door is the deliberate commit step. It never deploys or dispatches —
+// dispatch is a separate OPERATOR action on the staged proposal (the Dispatch button on the
+// staged-proposals grid, #460). A blank/invalid JSON string, or a graph that fails validation, is a
+// 400 carrying a human `error` (and path-qualified `errors` for a compile failure); nothing is staged.
+
+import {
+  buildProposalPreview,
+  buildProposalRow,
+  proposalLogicalKey,
+  stageProposal,
+} from "../app/deliveryGraphProposals.ts";
+import { buildTextPreviewBody, parseAndCompileText } from "../app/deliveryGraphTextIngress.ts";
+import { defineOperation } from "../nano-generated/operations.ts";
+
+export default defineOperation("stageDeliveryGraph", async ({ body }, app) => {
+  const ingress = await parseAndCompileText(body);
+  if (!ingress.ok) {
+    app.log.warn("stage-delivery-graph rejected", { message: ingress.body.error });
+    return { status: ingress.status, body: ingress.body };
+  }
+
+  const { compiled, digest, name, graph } = ingress;
+  await stageProposal(
+    app.data,
+    buildProposalRow({
+      digest,
+      logicalKey: proposalLogicalKey(name, digest),
+      title: name,
+      graphJson: JSON.stringify(graph),
+      preview: buildProposalPreview(compiled),
+      nodeCount: compiled.resolved.nodes.length,
+      humanNodeCount: compiled.humanNodes.length,
+      sideEffectCount: compiled.sideEffects.length,
+      sideEffecting: compiled.sideEffects.length > 0,
+    }),
+  );
+
+  app.log.info("stage-delivery-graph staged", {
+    nodes: compiled.resolved.nodes.length,
+    humanNodes: compiled.humanNodes.length,
+    sideEffects: compiled.sideEffects.length,
+    digest,
+  });
+  return { status: 200, body: buildTextPreviewBody(ingress, { staged: true }) };
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.137.0",
+  "version": "0.138.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -66,12 +66,12 @@
     "@biomejs/biome": "^2.4.11",
     "@nanobpm/urban-testkit": "^0.13.1",
     "@nanobpm/workflow": "^0.14.0",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/git": "^11.0.0",
     "@semantic-release/npm": "^13.1.5",
-    "@types/node": "^22",
+    "@types/node": "^24.0.0",
     "conventional-changelog-conventionalcommits": "^8.0.0",
-    "semantic-release": "^24.2.9",
+    "semantic-release": "^25.0.0",
     "typescript": "^5.6.0"
   },
   "overrides": {

package/pages/delivery-graphs/delivery-graphs.css

@@ -33,6 +33,53 @@
   border-color: rgba(63, 185, 80, 0.5);
 }
 
+/* The compose panel is a native <details> so it can collapse (#516). Its <summary> is the disclosure
+   header; the caret rotates on open, and the body hides when collapsed (the textarea keeps its value). */
+.dg .compose > summary {
+  cursor: pointer;
+  list-style: none;
+  display: flex;
+  align-items: baseline;
+  gap: 10px;
+  font-size: 15px;
+  font-weight: 600;
+  user-select: none;
+}
+
+.dg .compose > summary::-webkit-details-marker {
+  display: none;
+}
+
+.dg .compose > summary::before {
+  content: "\25B6";
+  font-size: 10px;
+  color: #8aa0b8;
+  transition: transform 0.15s ease;
+}
+
+.dg .compose[open] > summary::before {
+  transform: rotate(90deg);
+}
+
+.dg .compose > summary:focus-visible {
+  outline: 2px solid #388bfd;
+  outline-offset: 3px;
+  border-radius: 4px;
+}
+
+.dg .compose > summary .hint {
+  font-size: 12px;
+  font-weight: 400;
+}
+
+.dg .compose[open] > summary .hint {
+  display: none;
+}
+
+.dg .compose-body {
+  margin-top: 12px;
+}
+
 .dg h2 {
   margin: 0 0 8px;
   font-size: 15px;

package/pages/delivery-graphs/embed.html

@@ -24,7 +24,7 @@
       const cfg = window.__NANO_APP_VIEW__ ?? {};
       mountDeliveryGraphs(cfg.host ?? document.getElementById("delivery-graphs-root"), {
         previewUrl: cfg.previewUrl,
-        dispatchUrl: cfg.dispatchUrl,
+        stageUrl: cfg.stageUrl,
         hookSecret: cfg.hookSecret,
       });
     </script>