@nanobpm/nano-workforce 0.163.1 → 0.163.3

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.163.3](https://github.com/nanobpm/nano-workforce/compare/v0.163.2...v0.163.3) (2026-08-31)
+
+### Bug Fixes
+
+* **overview:** Active Features grid reads the derived read model, not the base-status allowlist ([#639](https://github.com/nanobpm/nano-workforce/issues/639)) ([ed7ddc1](https://github.com/nanobpm/nano-workforce/commit/ed7ddc10c6e99d097e079eb2657e51e572f477df)), closes [#637](https://github.com/nanobpm/nano-workforce/issues/637) [#638](https://github.com/nanobpm/nano-workforce/issues/638)
+
+## [0.163.2](https://github.com/nanobpm/nano-workforce/compare/v0.163.1...v0.163.2) (2026-08-31)
+
+### Build System
+
+* **deps:** bump @nanobpm/urban-testkit to ^1.0.0 (native callActivity in e2e) ([#635](https://github.com/nanobpm/nano-workforce/issues/635)) ([2020817](https://github.com/nanobpm/nano-workforce/commit/2020817a2b5baeec347b2c808212720ab58328cb)), closes [#631](https://github.com/nanobpm/nano-workforce/issues/631) [#591](https://github.com/nanobpm/nano-workforce/issues/591) [nano-ide#503](https://github.com/nanobpm/nano-ide/issues/503) [#607](https://github.com/nanobpm/nano-workforce/issues/607) [nano-ide#503](https://github.com/nanobpm/nano-ide/issues/503) [#607](https://github.com/nanobpm/nano-workforce/issues/607) [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#607](https://github.com/nanobpm/nano-workforce/issues/607) [nano-ide#503](https://github.com/nanobpm/nano-ide/issues/503)
+
 ## [0.163.1](https://github.com/nanobpm/nano-workforce/compare/v0.163.0...v0.163.1) (2026-08-30)
 
 ### Bug Fixes

package/docs/mcp-runbook.md

@@ -130,7 +130,10 @@ and does **not** resolve `$ref`s, so every projected (non-`x-mcp`) request-body
 in `openapi.yaml` presents an inline `type: object` body with no `$ref`; the two graph doors
 additionally carry a worked `example` — an agent discovers the body shape (and calls the tool
 with a real object, not a
-stringified one) from the surface alone. The two graph doors split by convention:
+stringified one) from the surface alone — and even if an agent's client emits a
+stringified object body, the door itself now **faithfully parses** it rather than
+rejecting it (nano-ide#503, a server-side input-compatibility behavior that needs no
+client upgrade — see the faithful-transport note below). The two graph doors split by convention:
 `compileDeliveryGraph` takes the **structured `DeliveryGraph` object** (and *stages*);
 `previewDeliveryGraph` takes the **text shape `{ "graphJson": "<serialized DeliveryGraph>" }`**
 (and is *pure*). Every validation failure returns `issues`/`errors` as `[{ path, message }]`.
@@ -138,9 +141,14 @@ The inline bodies are **derived** from `components.schemas` by
 `scripts/inline-mcp-bodies.ts` (single source of truth; run `npm run gen:mcp-bodies` after
 editing a component), and `npm run check:mcp-bodies` + `test/mcp-tool-schemas.test.ts` (which
 runs the real projector) fail CI if a `$ref` ever re-leaks. The upstream projector fix that
-would make this mitigation unnecessary is tracked in
+would make the **schema** mitigation unnecessary is tracked in
 [nano-ide#501](https://github.com/nanobpm/nano-ide/issues/501) (#502 self-contained schemas,
-#503 faithful object-body transport, #504 real-spec conformance guard).
+#504 real-spec conformance guard). **#503 faithful object-body transport has landed** —
+`@nanobpm/urban` 0.87 ships ADR 0067's `normalizeBodyArg`, so the MCP door now **parses** a
+stringified object body and forwards it faithfully instead of rejecting it with `expected object,
+got string`. That retired the nwf-local stringified-body reject mitigation: the e2e guard in
+`e2e/mcp-surface.e2e.ts` now asserts the door faithfully parses a stringified body (the
+`assertObjectBodyAccepted` detector's teeth stay pinned synthetically).
 
 ## 5. Fallback
 
@@ -178,13 +186,16 @@ depends on:
 
 - every projected tool schema is `$ref`-free with an explicit `type` (a leaked
   `$ref` is unresolvable in the MCP context);
-- an object argument arrives **as an object**, never coerced to a string;
+- an object argument arrives **as an object** — and a stringified one is faithfully
+  **parsed** by the door (ADR 0067 / nano-ide#503, `@nanobpm/urban` ≥ 0.87), never
+  rejected as `expected object, got string`;
 - validation failures answer uniformly with `issues[{path,message}]`;
 - side-effecting calls stage nothing, so the suite is safe to re-run.
 
 It runs in CI under `npm run e2e` (hermetic — no socket, no GitHub), so a
-reintroduced `$ref` or a stringified object body fails the build instead of
-reaching an agent.
+reintroduced `$ref` fails the build, and a stringified object body is asserted to be
+faithfully parsed by the door (ADR 0067 / nano-ide#503) instead of reaching an agent
+mis-serialized.
 
 **Extending it (new per-tool case).** Import `bootMcpHarness` from
 `e2e/support/mcp-harness.ts` in your own `e2e/<slice>.e2e.ts` and drive

package/e2e/mcp-surface.e2e.ts

@@ -6,7 +6,8 @@
 // `e2e/support/mcp-harness.ts` module. It PINS the client-visible contract the S0 defect broke:
 //
 //   • every projected tool schema is `$ref`-free with an explicit `type` (S0 / nano-ide#502);
-//   • an object argument arrives AS AN OBJECT, never coerced to a string (S0 / nano-ide#503);
+//   • an object argument arrives AS AN OBJECT — and a stringified one is faithfully PARSED, not
+//     rejected, now that ADR 0067 / nano-ide#503 landed upstream in @nanobpm/urban 0.87;
 //   • validation failures answer uniformly with `issues[{path,message}]`;
 //   • the reads parse; the mutating framework tools are gated; side-effecting calls leave NO live
 //     staged proposal behind (safe to run repeatedly).
@@ -192,9 +193,14 @@ describe("MCP surface e2e — the runtime-served /app/mcp handshake, per tool (S
     );
   });
 
-  // The falsifiable core (issue #607 acceptance): DELIBERATELY reintroducing either half of the S0
+  // The falsifiable core (issue #607 acceptance): DELIBERATELY reintroducing the SCHEMA half of the S0
   // defect makes the harness fail. These pin the detector's teeth independently of whether S0 has
-  // landed — so the guard cannot silently rot into a no-op.
+  // landed — so the guard cannot silently rot into a no-op. The object-body-stringification half
+  // (nano-ide#503) is now fixed UPSTREAM — @nanobpm/urban 0.87 lands ADR 0067 "faithful object-body
+  // transport" (`normalizeBodyArg`), so the door PARSES a stringified object body and forwards it
+  // faithfully instead of rejecting it. That retired the nwf-local reject mitigation (docs/mcp-runbook.md
+  // §4): the live door can no longer produce the S0 signature to exercise end-to-end, so that half is
+  // now covered by a live faithful-parse assertion plus a synthetic detector-teeth check below.
   describe("reintroducing the S0 defect fails the build", () => {
     test("a $ref in a tool schema is caught by the self-containment assertion", () => {
       const good = { type: "object", properties: { body: { type: "object", properties: { n: { type: "number" } } } } };
@@ -208,17 +214,42 @@ describe("MCP surface e2e — the runtime-served /app/mcp handshake, per tool (S
       assert.throws(() => assertSchemaSelfContained(typeless, "synthetic-typeless"), /type/, "a typeless schema must throw");
     });
 
-    test("a stringified object body is rejected by the door and caught by assertObjectBodyAccepted", async () => {
-      // Simulate the S0 client coercion: send the body as a JSON STRING instead of an object.
-      const res = await h.callTool("compileDeliveryGraph", { body: JSON.stringify(MINIMAL_VALID_GRAPH) });
-      assert.ok(res.isError, "a stringified object body must be rejected by the door");
+    test("a stringified object body is faithfully parsed by the door (ADR 0067 / nano-ide#503)", async () => {
+      // Simulate the old S0 client coercion: send the body as a JSON STRING instead of an object.
+      // @nanobpm/urban 0.87's faithful object-body transport (ADR 0067 `normalizeBodyArg`) now PARSES
+      // it and forwards it faithfully — no longer the "expected object, got string" rejection the
+      // nwf-local S0 mitigation used to raise. Drive the PURE previewDeliveryGraph door so the
+      // parsed-and-compiled graph stages nothing.
+      const res = await h.callTool("previewDeliveryGraph", {
+        body: JSON.stringify({ graphJson: JSON.stringify(MINIMAL_VALID_GRAPH) }),
+      });
+      assert.ok(!res.isError, `the door must faithfully parse a stringified object body: ${res.text}`);
       assert.ok(
-        res.text.includes(STRINGIFIED_BODY_MESSAGE),
-        `the door must report "${STRINGIFIED_BODY_MESSAGE}": ${res.text}`,
+        !res.text.includes(STRINGIFIED_BODY_MESSAGE),
+        `faithful transport must not reject with "${STRINGIFIED_BODY_MESSAGE}": ${res.text}`,
       );
-      // The harness's guard must recognize that signature as a failure.
+      assert.doesNotThrow(
+        () => assertObjectBodyAccepted(res, "previewDeliveryGraph"),
+        "a faithfully parsed object body must pass assertObjectBodyAccepted",
+      );
+      const json = res.json as { ok?: boolean; staged?: boolean } | undefined;
+      assert.equal(json?.ok, true, `previewDeliveryGraph must compile the parsed graph: ${res.text}`);
+      assert.equal(json?.staged, false, "previewDeliveryGraph is PURE — it must never stage");
+    });
+
+    test("assertObjectBodyAccepted still flags an S0 stringified-body signature (detector teeth)", () => {
+      // The live door can no longer produce the S0 signature (fixed upstream, ADR 0067), so pin the
+      // detector's teeth SYNTHETICALLY — mirroring the $ref/typeless guards above — so the helper
+      // cannot rot into a no-op if the signature ever re-surfaces from another surface.
+      const s0Result = {
+        isError: true,
+        text: `validation failed: body: ${STRINGIFIED_BODY_MESSAGE}`,
+        json: undefined,
+        httpStatus: 422,
+        raw: undefined,
+      };
       assert.throws(
-        () => assertObjectBodyAccepted(res, "compileDeliveryGraph"),
+        () => assertObjectBodyAccepted(s0Result, "synthetic-stringified"),
         /stringified/,
         "assertObjectBodyAccepted must flag a stringified-body result",
       );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.163.1",
+  "version": "0.163.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -61,12 +61,12 @@
   },
   "dependencies": {
     "@nanobpm/agentic": "^0.4.0",
-    "@nanobpm/urban": "^0.86.0",
+    "@nanobpm/urban": "^0.87.0",
     "bpmn-auto-layout": "^2.0.0-alpha.2"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.11",
-    "@nanobpm/urban-testkit": "^0.14.0",
+    "@nanobpm/urban-testkit": "^1.0.0",
     "@nanobpm/workflow": "^0.14.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/git": "^11.0.0",

package/pages/overview.page.json

@@ -177,9 +177,9 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "feature_runs",
+          "table": "feature_read_model",
           "orderBy": { "field": "updated_at", "dir": "desc" },
-          "filter": [{ "field": "status", "in": ["running", "escalated", "awaiting_operator"] }]
+          "filter": [{ "field": "list_bucket", "in": ["active"] }]
         },
         "columns": [
           { "field": "title", "template": "{{title}}", "header": "Item", "subtitleField": "feature_key", "truncate": true, "width": "36%", "link": { "kind": "page", "page": "feature", "keyField": "feature_key" } },

package/scripts/pages-contract.test.ts

@@ -317,21 +317,24 @@ test("issue #205: overview is the landing page and first nav item", async () =>
     );
   }
 
-  // Three collapsible active-work sections, one per dispatch surface, each with a
+  // Four collapsible active-work sections, one per dispatch surface, each with a
   // live count in its header (showCount) and a persisted collapse toggle (collapsible). Each filters
-  // its Active list on a `{field, in:[...]}` predicate: the PR / feature surfaces on `status`, but the
-  // EPIC surface buckets on the DERIVED `list_bucket` (issue #298) — NOT raw `status` — so a `done`
-  // epic still converging, or landed-but-unpromoted, does not vanish from the in-flight Epics section
-  // the instant `status=done`. Guarding the field here is the regression guard for that defect class.
-  // The epic surface binds the derived `plan_read_model` VIEW (epic #412 — the single source of truth
-  // for the wave/delivery projections it also renders), not the raw `plans` table.
+  // its Active list on a `{field, in:[...]}` predicate. The FEATURE and EPIC surfaces bucket on the
+  // DERIVED `list_bucket` — NOT raw `status` — over their read-model VIEW (features: issue #637 —
+  // fixing a drift where the grid read the vestigial base `feature_runs.status` with an allowlist that
+  // hid every converging feature; epics: issue #298), so a `done`-but-unacknowledged item still
+  // converging does not vanish from its in-flight section the instant `status` reads terminal. Guarding
+  // the field here is the regression guard for that defect class. The feature surface binds the derived
+  // `feature_read_model` VIEW (the single source of truth for the `list_bucket` activeness predicate,
+  // shared byte-for-byte with the Feature tab); the epic surface binds `plan_read_model` (epic #412),
+  // not the raw `plans` table. PRs / delivery graphs still bucket on `status` (see #637 follow-up).
   const expected: Record<string, { field: string; in: string[] }> = {
     pull_requests: {
       field: "status",
       in: ["converging", "waiting_review", "escalated", "waiting_deps", "waiting_merge", "queued", "merging"],
     },
     plan_read_model: { field: "list_bucket", in: ["active"] },
-    feature_runs: { field: "status", in: ["running", "escalated", "awaiting_operator"] },
+    feature_read_model: { field: "list_bucket", in: ["active"] },
     // The 4th dispatch surface (issue #386) — active delivery graphs. Both in-flight statuses
     // (`awaiting-approval` parked at the gate, `running` dispatched) show here. Binds the derived
     // `delivery_graph_read_model` VIEW (S7 / #541 — the single source of truth for the pipeline
@@ -461,3 +464,59 @@ test("issue #521: the Delivery Graphs History tab surfaces dispatch time + the i
     "the Instance cell's processExplorer link must key on `process_key`",
   );
 });
+
+test("issue #637: the Overview 'Active Features' grid buckets on the derived read model, in parity with the Feature tab", async () => {
+  // The bug: Overview's "Active Features" grid read the VESTIGIAL base `feature_runs.status` column
+  // with a hand-maintained allowlist (`running`/`escalated`/`awaiting_operator` — not even a valid
+  // feature-status set: those are delivery-graph statuses cloned from the "Active Delivery Graphs"
+  // grid). A feature only ever surfaced there if it happened to be `escalated`; its whole convergence
+  // life (`converging`/`waiting_review`/`waiting_merge`/…) was invisible on Overview while the SAME
+  // feature showed on the dedicated Feature tab — a state-tear between two surfaces that must agree.
+  //
+  // The fix repoints the grid at the derived `feature_read_model` VIEW filtered on the canonical
+  // `list_bucket IN ('active')` activeness predicate — the single declare-once column (app/
+  // featureReadModel.ts, guarded byte-for-byte by check:derivation-parity) that the Feature tab's
+  // "Feature runs" grid already uses. This test pins that parity so the tear can't silently return.
+  const overview = JSON.parse(readFileSync(`${ROOT}pages/overview.page.json`, "utf8"));
+  const feature = JSON.parse(readFileSync(`${ROOT}pages/feature.page.json`, "utf8"));
+
+  const ovGrid = (overview.nodes ?? []).find(
+    (n: Json) => n.type === "dataGrid" && n.props?.title === "Active Features",
+  );
+  assert(ovGrid, "overview.page.json must have an 'Active Features' grid");
+
+  // It must bind the derived read-model VIEW, never the vestigial base `feature_runs` table.
+  assert(
+    ovGrid.props?.data?.table === "feature_read_model",
+    "the Overview 'Active Features' grid must bind the derived feature_read_model VIEW, not the base feature_runs table",
+  );
+
+  // And it must filter on the canonical `list_bucket IN ('active')` activeness predicate — never a
+  // base-`status` allowlist.
+  const ovFilters: Json[] = ovGrid.props?.data?.filter ?? [];
+  assert(
+    !ovFilters.some((f: Json) => f.field === "status"),
+    "the Overview 'Active Features' grid must NOT re-encode activeness as a base-`status` allowlist",
+  );
+  const ovBucket = ovFilters.find((f: Json) => f.field === "list_bucket");
+  assert(
+    ovBucket && JSON.stringify(ovBucket.in) === JSON.stringify(["active"]),
+    "the Overview 'Active Features' grid must filter `list_bucket IN ['active']`",
+  );
+
+  // Parity: the Feature tab's "Feature runs" grid answers "is this feature active?" identically —
+  // same VIEW, same activeness predicate — so the two surfaces show the same active-feature set.
+  const featGrid = (feature.nodes ?? []).find(
+    (n: Json) => n.type === "dataGrid" && n.props?.title === "Feature runs",
+  );
+  assert(featGrid, "feature.page.json must have a 'Feature runs' grid");
+  assert(
+    featGrid.props?.data?.table === ovGrid.props?.data?.table,
+    "the Overview and Feature-tab feature grids must bind the SAME table (feature_read_model)",
+  );
+  const featBucket = (featGrid.props?.data?.filter ?? []).find((f: Json) => f.field === "list_bucket");
+  assert(
+    featBucket && JSON.stringify(featBucket.in) === JSON.stringify(ovBucket.in),
+    "the Overview and Feature-tab feature grids must apply the IDENTICAL list_bucket activeness predicate",
+  );
+});