@nanobpm/nano-workforce 0.167.0 → 0.167.2

package/operations/acknowledgePr.ts

@@ -15,10 +15,19 @@
 // It rejects (409) a PR that is NOT terminal (still converging/waiting_review/…), so it can never
 // pre-seed the tick-off on a live PR: were `acknowledged_at` set early, the moment the PR later settled
 // the VIEW would drop it straight into History, skipping the operator dismiss this op exists to
-// require. The terminal check reads the base `status` — the reconciler's `onTerminated` edge persists
-// an out-of-band terminate to base `status` = 'abandoned', so a resolved PR is matched here too.
+// require.
+//
+// TERMINALITY IS READ OFF THE READ MODEL, NOT THE BASE COLUMN (issue #652). PRs are the one surface
+// that folds terminal ON READ: since `app/abandon.ts` moved to ADR-0065 derive-only tracking, the
+// reconciler no longer WRITES 'abandoned' onto the base `pull_requests.status` on an out-of-band
+// terminate — the `pull_requests__tracking` VIEW folds it into `derived_status`, and the
+// `pull_requests_read_model` VIEW exposes that as its effective `status` and lights the Dismiss
+// affordance (`ack_open`). This op therefore consults the SAME source of truth as the affordance — the
+// read model's folded/effective `status` — rather than re-deriving terminality against the frozen base
+// column (which for an abandoned PR still reads its last transient, e.g. 'escalated', and would 409 a
+// row the UI shows Dismiss on). Reading the base column here was the drift #652 fixes.
 
-import { PR_TERMINAL_STATUSES } from "../app/pullRequestReadModel.ts";
+import { PR_TERMINAL_STATUSES, PULL_REQUEST_READ_MODEL_NAME } from "../app/pullRequestReadModel.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
 
 const str = (v: unknown): string => (typeof v === "string" ? v.trim() : "");
@@ -32,28 +41,37 @@ export default defineOperation("acknowledgePr", async ({ body }, app) => {
   const prKey = str(body.pr_key);
   if (!prKey) return { status: 400, body: { ok: false, error: "pr_key is required" } };
 
-  const table = app.data.table<{ pr_key: string; status: string; acknowledged_at: string | null; updated_at: string }>(
-    "pull_requests",
+  // Read the FOLDED row from the read model VIEW — its effective `status` is
+  // `COALESCE(derived_status, status)`, so an out-of-band-terminated PR whose base `status` is frozen
+  // at a transient reads its engine-truth terminal (`abandoned`) here, exactly as the Dismiss
+  // affordance (`ack_open`) does.
+  const readModel = app.data.table<{ pr_key: string; status: string }>(
+    PULL_REQUEST_READ_MODEL_NAME,
     "pr_key",
   );
-  const pr = await table.get(prKey);
-  if (!pr) {
+  const view = await readModel.get(prKey);
+  if (!view) {
     app.log.warn("acknowledge-pr: no such pull request", { prKey });
     return { status: 404, body: { ok: false, error: "no such pull request" } };
   }
 
-  // Guard: only a TERMINAL PR (a `PR_TERMINAL_STATUSES` status — the same set the read model's
-  // `list_bucket` folds to History) carries the Dismiss affordance. Acknowledging a live PR would
-  // pre-seed `acknowledged_at`, so the moment it later settled the VIEW would drop it straight into
-  // History, skipping the operator tick-off this op exists to require.
-  if (!PR_TERMINAL_STATUSES.includes(pr.status)) {
-    app.log.warn("acknowledge-pr rejected: PR is not terminal", { prKey, status: pr.status });
+  // Guard: only a TERMINAL PR (a `PR_TERMINAL_STATUSES` effective status — the same terminal-folded
+  // tier the read model's `list_bucket`/`ack_open` fold to History and gate the Dismiss button on)
+  // carries the Dismiss affordance. Acknowledging a live PR would pre-seed `acknowledged_at`, so the
+  // moment it later settled the VIEW would drop it straight into History, skipping the operator
+  // tick-off this op exists to require.
+  if (!PR_TERMINAL_STATUSES.includes(view.status)) {
+    app.log.warn("acknowledge-pr rejected: PR is not terminal", { prKey, status: view.status });
     return { status: 409, body: { ok: false, error: "pull request is not terminal" } };
   }
 
-  // Stamp the dismissal. `list_bucket` (→ 'history') and `ack_open` (→ 0) are derived by the
-  // `pull_requests_read_model` VIEW from the terminal, now-acknowledged row, so we never hand-set them
-  // here. Idempotent: re-acknowledging re-stamps and stays in History.
+  // Stamp the dismissal on the BASE `pull_requests` row. `list_bucket` (→ 'history') and `ack_open`
+  // (→ 0) are derived by the `pull_requests_read_model` VIEW from the terminal, now-acknowledged row,
+  // so we never hand-set them here. Idempotent: re-acknowledging re-stamps and stays in History.
+  const table = app.data.table<{ pr_key: string; acknowledged_at: string | null; updated_at: string }>(
+    "pull_requests",
+    "pr_key",
+  );
   const now = new Date().toISOString();
   await table.update(prKey, { acknowledged_at: now, updated_at: now });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.167.0",
+  "version": "0.167.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@nanobpm/agentic": "^0.4.0",
-    "@nanobpm/urban": "^0.87.0",
+    "@nanobpm/urban": "^0.88.1",
     "bpmn-auto-layout": "^2.0.0-alpha.2"
   },
   "devDependencies": {

package/pages/delivery-graphs/library.mount.js

@@ -13,7 +13,13 @@
 // standalone — only the host element and injected endpoint config differ. The app has no browser build
 // step, so this consumes the library doors straight off the wire.
 
-import { DG_COMPOSE_FILL_MESSAGE } from "./mount.js";
+import { DG_COMPOSE_FILL_ACK_MESSAGE, DG_COMPOSE_FILL_MESSAGE } from "./mount.js";
+
+// The bounded budget within which the compose App-View must ACK a Reuse fill before we surface an honest
+// "Couldn't reach the composer" error (issue #645). Mirrors the compose mount's own ACK_TIMEOUT_MS: long
+// enough for the App-View relay round-trip (nano-ide #518), short enough that a dropped fill fails fast
+// instead of leaving a misleading "✓ Loaded…" up. Overridable via config for tests.
+const REUSE_ACK_TIMEOUT_MS = 2000;
 
 // The read behind the list: every saved library entry, newest first. Anchored to THIS MODULE's url
 // (import.meta.url), NOT the document base. The library App-View shell (library-embed.html /
@@ -149,6 +155,8 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
 
   const libraryUrl = config.libraryUrl ?? DEFAULT_LIBRARY_URL;
   const refreshMs = typeof config.refreshMs === "number" && config.refreshMs > 0 ? config.refreshMs : DEFAULT_REFRESH_MS;
+  const ackTimeoutMs =
+    typeof config.ackTimeoutMs === "number" && config.ackTimeoutMs > 0 ? config.ackTimeoutMs : REUSE_ACK_TIMEOUT_MS;
   const headers = (url) => ({
     "content-type": "application/json",
     ...(config.hookSecret && isSameOrigin(url) ? { "x-hook-secret": config.hookSecret } : {}),
@@ -255,7 +263,22 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
   // the host bridge, posting the shared `deliveryGraph.compose.fill` message UP to the console (the
   // INBOUND twin of the outbound `nano-navigate` DI-preview bridge). Standalone (not embedded) there is
   // no console to route it and no compose view to fill, so we say so instead of failing silently.
+  //
+  // The success toast is ACKNOWLEDGED, never optimistic (issue #645): a "✓ Loaded…" printed synchronously
+  // after the post lied whenever the fill was dropped (no relay, wrong origin, an unmounted compose view).
+  // Now we show a NEUTRAL in-progress status, tag the fill with a correlation `token`, and resolve it only
+  // when the compose mount echoes `DG_COMPOSE_FILL_ACK_MESSAGE` for that token — "✓ Loaded…" on the ack,
+  // "Couldn't reach the composer" on a short timeout. A fresh Reuse supersedes any pending one.
   const isEmbedded = typeof window !== "undefined" && window.parent && window.parent !== window;
+  let pendingReuse = null;
+  function clearPendingReuse() {
+    if (pendingReuse && pendingReuse.timer) clearTimeout(pendingReuse.timer);
+    pendingReuse = null;
+  }
+  function newReuseToken() {
+    if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+    return `reuse-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  }
   function doReuse(id) {
     const entry = entries.find((e) => e && e.id === id);
     if (!entry) {
@@ -270,12 +293,42 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
       setStatus("Open this page inside the console to reuse a saved graph in the composer.", "err");
       return;
     }
+    clearPendingReuse();
+    const token = newReuseToken();
     window.parent.postMessage(
-      { type: DG_COMPOSE_FILL_MESSAGE, graphJson: entry.graph },
+      { type: DG_COMPOSE_FILL_MESSAGE, graphJson: entry.graph, token },
       window.location.origin,
     );
+    // NEUTRAL in-progress status (no "✓") — success is only earned on the compose ack below (#645).
+    setStatus("Loading into the composer above\u2026", "");
+    const timer = setTimeout(() => {
+      if (!pendingReuse || pendingReuse.token !== token) return;
+      pendingReuse = null;
+      setStatus("Couldn't reach the composer \u2014 is the composer open above this list?", "err");
+    }, ackTimeoutMs);
+    pendingReuse = { token, timer };
+  }
+  // The compose App-View's acknowledgment that it filled (#645): a same-origin `DG_COMPOSE_FILL_ACK_MESSAGE`
+  // from the parent (the console, which relays it across from the compose sibling) whose `token` matches the
+  // pending Reuse resolves it to success. A foreign origin, a non-parent source, or a stale/mismatched token
+  // is ignored — an unrelated page (or a prior Reuse's late ack) can't forge or misattribute a success toast.
+  function onReuseAck(ev) {
+    if (!ev || typeof window === "undefined") return;
+    if (ev.origin !== window.location.origin) return;
+    if (ev.source !== window.parent) return;
+    const data = ev.data;
+    if (!data || data.type !== DG_COMPOSE_FILL_ACK_MESSAGE) return;
+    // Require a string `token` that exactly matches the pending Reuse. A null/undefined-token ack
+    // (the compose mount emits `token: null` when a fill arrives without a token) can't be correlated
+    // to this Reuse and must NOT resolve it — otherwise it reintroduces the false-positive "✓ Loaded…"
+    // toast (#645).
+    if (!pendingReuse || typeof data.token !== "string" || data.token !== pendingReuse.token) return;
+    clearPendingReuse();
     setStatus("\u2713 Loaded into the composer above \u2014 edit, Preview or Stage it.", "ok");
   }
+  if (isEmbedded && typeof window !== "undefined" && typeof window.addEventListener === "function") {
+    window.addEventListener("message", onReuseAck);
+  }
 
   // "Export": a purely client-side download of a saved entry's graph JSON as `<name>.deliverygraph.json`
   // (issue #525). No backend door — the list door already carries each entry's `graph` inline (the same
@@ -368,6 +421,10 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
 
   return () => {
     disposed = true;
+    clearPendingReuse();
+    if (typeof window !== "undefined" && typeof window.removeEventListener === "function") {
+      window.removeEventListener("message", onReuseAck);
+    }
     clearInterval(timer);
     root.innerHTML = "";
   };

package/pages/delivery-graphs/mount.js

@@ -50,6 +50,32 @@ const DEFAULT_IMPORT_URL = new URL("../app/api/actions/delivery-graph/library/im
 // routes through the single `fillComposer()` seam below; keep new fill sources going through it.
 export const DG_COMPOSE_FILL_MESSAGE = "nano-delivery-graph-compose-fill";
 
+// The ACK half of the reuse-fill bridge (issue #645). An optimistic "✓ Loaded…" toast printed
+// synchronously after the Library posts the fill can never reflect the cross-frame OUTCOME — the fill
+// message is relayed across App-Views (nano-ide #518) and could still be dropped (no relay, wrong
+// origin, a compose view that isn't mounted), yet the toast claimed success regardless (the #645
+// defect). So the delivery is now ACKNOWLEDGED: when THIS compose mount actually fills from a fill
+// message, it posts this ack back UP to the host (relayed across to the Library sibling), echoing the
+// producer's correlation `token`. The Library shows "✓ Loaded…" ONLY on that ack and a clear error on a
+// short timeout — the success is earned, not assumed. The `type` is exported ONCE here as the single
+// source of truth; the Library consumer imports it rather than re-declaring a synonym.
+export const DG_COMPOSE_FILL_ACK_MESSAGE = "nano-delivery-graph-compose-fill-ack";
+
+// The host acknowledgment of a `nano-navigate` (issue #645). "Preview generated DI" posts nano-navigate
+// UP to the console; nano-ide #518 forwards it to the host explorer, but the host does not synchronously
+// confirm, so an optimistic "✓ Opening…" toast printed right after the post claimed success even when the
+// message was dropped (standalone, no relay, a console that never navigated). The compose view now treats
+// Preview as fire-to-host with a bounded budget: it shows a NEUTRAL in-progress status, and only earns a
+// "✓" when the host echoes this ack for the same `target`; if no host ack is observed within the budget it
+// surfaces "Couldn't reach the console explorer" instead. Same-origin, from the parent (the console).
+export const NANO_NAVIGATE_ACK_MESSAGE = "nano-navigate-ack";
+
+// The bounded budget within which a cross-frame delivery (compose-fill relay, or a nano-navigate to the
+// host) must be acknowledged before the producer surfaces an honest "couldn't reach …" error (#645). A
+// couple of seconds is long enough for the App-View relay round-trip yet short enough that a dropped
+// message fails fast instead of leaving a misleading toast up. Overridable via config for tests.
+const ACK_TIMEOUT_MS = 2000;
+
 // A bounded timeout for every door request. Without it a hung endpoint leaves the fetch promise pending
 // forever, so the busy() lock never clears and the UI is stranded (buttons disabled, status stuck) with
 // no way to retry. On timeout the AbortController rejects the fetch, which surfaces as an error banner
@@ -230,6 +256,8 @@ export function mountDeliveryGraphs(host, config = {}) {
   const previewUrl = config.previewUrl ?? DEFAULT_PREVIEW_URL;
   const stageUrl = config.stageUrl ?? DEFAULT_STAGE_URL;
   const importUrl = config.importUrl ?? DEFAULT_IMPORT_URL;
+  const ackTimeoutMs =
+    typeof config.ackTimeoutMs === "number" && config.ackTimeoutMs > 0 ? config.ackTimeoutMs : ACK_TIMEOUT_MS;
   const headers = (url) => ({
     "content-type": "application/json",
     ...(config.hookSecret && isSameOrigin(url) ? { "x-hook-secret": config.hookSecret } : {}),
@@ -324,7 +352,23 @@ export function mountDeliveryGraphs(host, config = {}) {
     if (embedded && ev.source !== window.parent) return;
     const data = ev.data;
     if (!data || data.type !== DG_COMPOSE_FILL_MESSAGE || typeof data.graphJson !== "string") return;
-    fillComposer(data.graphJson, { status: "Reused a saved graph \u2014 Preview or Stage it." });
+    const filled = fillComposer(data.graphJson, { status: "Reused a saved graph \u2014 Preview or Stage it." });
+    // ACK the fill back to the producer (issue #645): the Library shows "✓ Loaded…" ONLY on this ack,
+    // never optimistically. Post UP to the host, which nano-ide #518 relays across to the Library
+    // sibling App-View; echo the correlation `token` so a stale ack from a prior Reuse can't complete a
+    // newer one. Only when actually embedded (there is a parent to relay through) and only when the fill
+    // truly happened — a blank/bad payload earns no ack.
+    if (
+      filled &&
+      embedded &&
+      window.parent &&
+      typeof window.parent.postMessage === "function"
+    ) {
+      window.parent.postMessage(
+        { type: DG_COMPOSE_FILL_ACK_MESSAGE, token: typeof data.token === "string" ? data.token : null },
+        window.location.origin,
+      );
+    }
   }
   if (typeof window !== "undefined" && typeof window.addEventListener === "function") {
     window.addEventListener("message", onFillMessage);
@@ -446,6 +490,17 @@ export function mountDeliveryGraphs(host, config = {}) {
   // the path. Standalone (not embedded) there is no host explorer to drive, so we say so instead of
   // failing silently.
   const isEmbedded = typeof window !== "undefined" && window.parent && window.parent !== window;
+  // A single in-flight Preview→host handshake (issue #645). Posting nano-navigate is fire-to-host: the
+  // console does not synchronously confirm it navigated, so we must not claim success up front. We hold
+  // the pending target + its timeout timer here; a host ack for that target resolves it to "✓ Opened…",
+  // and the timeout resolves it to an honest "Couldn't reach the console explorer". A fresh Preview
+  // supersedes any pending one (its timer is cleared) so only the latest attempt is ever resolved.
+  const DEFINITION_PREVIEW_TARGET = "definitionPreview";
+  let pendingPreview = null;
+  function clearPendingPreview() {
+    if (pendingPreview && pendingPreview.timer) clearTimeout(pendingPreview.timer);
+    pendingPreview = null;
+  }
   function doPreviewDi() {
     if (lastBpmn.trim() === "") {
       setStatus("Preview a graph first — the laid-out BPMN comes from the preview.", "err");
@@ -455,11 +510,40 @@ export function mountDeliveryGraphs(host, config = {}) {
       setStatus("Open this page inside the console cockpit to preview the generated DI.", "err");
       return;
     }
+    clearPendingPreview();
     window.parent.postMessage(
       { type: "nano-navigate", target: "definitionPreview", params: { xml: lastBpmn } },
       window.location.origin,
     );
-    setStatus("\u2713 Opening the generated DI in the process explorer…", "ok");
+    // NEUTRAL in-progress status (no "✓") — the success is only earned on the host ack below (#645).
+    setStatus("Opening the generated DI in the process explorer…", "");
+    const timer = setTimeout(() => {
+      if (!pendingPreview || pendingPreview.target !== DEFINITION_PREVIEW_TARGET) return;
+      pendingPreview = null;
+      setStatus("Couldn't reach the console explorer — is this page open inside the console?", "err");
+    }, ackTimeoutMs);
+    pendingPreview = { target: DEFINITION_PREVIEW_TARGET, timer };
+  }
+  // The host's acknowledgment of a Preview nano-navigate (#645): a same-origin `nano-navigate-ack` from
+  // the parent (the console) for the target we're awaiting resolves the pending Preview to success. A
+  // foreign origin, a non-parent source, or an ack for a different/absent target is ignored — an
+  // unrelated page can't forge a success toast.
+  function onNavAck(ev) {
+    if (!ev || typeof window === "undefined") return;
+    if (ev.origin !== window.location.origin) return;
+    if (ev.source !== window.parent) return;
+    const data = ev.data;
+    if (!data || data.type !== NANO_NAVIGATE_ACK_MESSAGE) return;
+    // Require a string `target` that exactly matches the pending preview. A target-less (or
+    // mismatched) ack must NOT resolve the Preview — otherwise any same-origin parent ack could
+    // forge a "✓ Opened…" toast the target never actually rendered (#645).
+    if (!pendingPreview || typeof data.target !== "string" || data.target !== pendingPreview.target)
+      return;
+    clearPendingPreview();
+    setStatus("\u2713 Opened the generated DI in the process explorer.", "ok");
+  }
+  if (isEmbedded && typeof window !== "undefined" && typeof window.addEventListener === "function") {
+    window.addEventListener("message", onNavAck);
   }
   outputEl.addEventListener("click", (ev) => {
     const btn = ev.target && ev.target.closest ? ev.target.closest("[data-preview-di]") : null;
@@ -469,8 +553,10 @@ export function mountDeliveryGraphs(host, config = {}) {
   });
 
   return () => {
+    clearPendingPreview();
     if (typeof window !== "undefined" && typeof window.removeEventListener === "function") {
       window.removeEventListener("message", onFillMessage);
+      window.removeEventListener("message", onNavAck);
     }
     root.innerHTML = "";
   };