@nanobpm/nano-workforce 0.167.1 → 0.167.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.167.2](https://github.com/nanobpm/nano-workforce/compare/v0.167.1...v0.167.2) (2026-08-31)
+
+### Bug Fixes
+
+* gate acknowledgePr on the read model's folded status, not the base column ([#653](https://github.com/nanobpm/nano-workforce/issues/653)) ([80446e2](https://github.com/nanobpm/nano-workforce/commit/80446e24af3c62570c041a109eef85eb34f8bb23)), closes [#652](https://github.com/nanobpm/nano-workforce/issues/652)
+
 ## [0.167.1](https://github.com/nanobpm/nano-workforce/compare/v0.167.0...v0.167.1) (2026-08-31)
 
 ### Bug Fixes

package/app/pullRequestReadModel.ts

@@ -22,6 +22,11 @@
 import { defineReadModel, type Expr, type ReadModel } from "@nanobpm/urban";
 import { deriveAckOpenExpr, deriveListBucketExpr } from "./listBucket.ts";
 
+/** The read model's VIEW name — the single source of truth for the table an operation queries when it
+ * must gate on the folded/effective status (e.g. `acknowledgePr`, issue #652) rather than re-derive
+ * terminality off the frozen base `pull_requests.status` column. */
+export const PULL_REQUEST_READ_MODEL_NAME = "pull_requests_read_model";
+
 /** The base table the read model reads: the auto-provisioned `pull_requests__tracking` derived VIEW
  * (ADR-0065), NOT the raw `pull_requests` table — so the status-classifying derivations read the
  * terminal-folded `derived_status` and a terminated PR drops to History with no worker write. */
@@ -66,7 +71,7 @@ export type PullRequestReadModelDerivedColumn = (typeof PULL_REQUEST_READ_MODEL_
  * generated from THIS single declaration.
  */
 export const pullRequestReadModel: ReadModel = defineReadModel({
-  name: "pull_requests_read_model",
+  name: PULL_REQUEST_READ_MODEL_NAME,
   baseTable: PULL_REQUEST_READ_MODEL_BASE_TABLE,
   selectBaseColumns: false,
   derive: {

package/operations/acknowledgePr.test.ts

@@ -1,25 +1,45 @@
-// Tests for the POST /app/api/actions/acknowledge-pr operation `acknowledgePr` (issue #641).
+// Tests for the POST /app/api/actions/acknowledge-pr operation `acknowledgePr` (issue #641, #652).
 // The nwf UI's "Dismiss" (Done ✓) affordance for a TERMINAL pull request. It stamps `acknowledged_at`,
 // which the `pull_requests_read_model` VIEW (094) derives into `list_bucket` = 'history' and `ack_open`
 // = 0, dropping the finished PR from the Active convergence list into History. Unlike acknowledge-
 // blocked it completes NO user task (a terminal PR is not parked). The PR twin of acknowledge-done /
 // acknowledge-epic.
 //
-// The op's only write is the `acknowledged_at` (+ `updated_at`) stamp, gated on the base `status`
-// belonging to the terminal tier (`PR_TERMINAL_STATUSES`). These tests seed an in-memory `pull_requests`
-// store and assert the 400/404/409/200 gate + the stamp; the bucket derivation itself is proven in
-// app/pullRequestReadModel.test.ts.
+// The op's only write is the `acknowledged_at` (+ `updated_at`) stamp on the base `pull_requests` row,
+// gated on the TERMINAL tier (`PR_TERMINAL_STATUSES`) — but read off the `pull_requests_read_model`
+// VIEW's FOLDED/effective `status` (issue #652), the SAME source of truth the Dismiss affordance
+// (`ack_open`) derives from, NOT the frozen base column. These tests seed an in-memory read model +
+// base store and assert the 400/404/409/200 gate + the stamp; the bucket derivation itself is proven
+// in app/pullRequestReadModel.test.ts.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { noopLog } from "../test/log.ts";
-import { PR_TERMINAL_STATUSES } from "../app/pullRequestReadModel.ts";
+import { PR_TERMINAL_STATUSES, PULL_REQUEST_READ_MODEL_NAME } from "../app/pullRequestReadModel.ts";
 import handler from "./acknowledgePr.ts";
 
+// A read model row (folded/effective `status` the op gates on) and its base `pull_requests` row (the
+// stamp target). `derivedStatus` folds over `status` exactly as `COALESCE(pr.derived_status, pr.status)`
+// does in the 094 VIEW, so a seed can model an out-of-band-terminated PR (base `escalated`, folded
+// `abandoned`) — the #652 drift case.
+type Seed = { prKey: string; status: string; derivedStatus?: string; acknowledgedAt?: string | null };
+
 // biome-ignore lint/suspicious/noExplicitAny: test-only fake data layer over dynamic row shapes.
-function memApp(seed: any[]): { app: AppApi; rows: any[] } {
+function memApp(seeds: Seed[]): { app: AppApi; base: any[] } {
+  // biome-ignore lint/suspicious/noExplicitAny: test-only store.
+  const base: any[] = seeds.map((s) => ({
+    pr_key: s.prKey,
+    status: s.status,
+    acknowledged_at: s.acknowledgedAt ?? null,
+  }));
+  // The read model VIEW exposes the folded effective status as `status` (COALESCE(derived_status, status)).
+  // biome-ignore lint/suspicious/noExplicitAny: test-only store.
+  const readModel: any[] = seeds.map((s) => ({
+    pr_key: s.prKey,
+    status: s.derivedStatus ?? s.status,
+  }));
   // biome-ignore lint/suspicious/noExplicitAny: test-only store.
-  const stores: Record<string, any[]> = { pull_requests: seed };
+  const stores: Record<string, any[]> = { pull_requests: base, [PULL_REQUEST_READ_MODEL_NAME]: readModel };
   function tbl(name: string, pk = "id") {
     // biome-ignore lint/suspicious/noExplicitAny: test-only.
     const rows = (stores[name] ??= [] as any[]);
@@ -40,7 +60,7 @@ function memApp(seed: any[]): { app: AppApi; rows: any[] } {
     data: { table: (n: string, pk?: string) => tbl(n, pk) },
     log: noopLog(),
   } as unknown as AppApi;
-  return { app, rows: stores.pull_requests };
+  return { app, base };
 }
 
 async function call(app: AppApi, body: unknown) {
@@ -49,29 +69,54 @@ async function call(app: AppApi, body: unknown) {
 }
 
 test("acknowledge-pr: stamps acknowledged_at on a terminal PR and returns 200", async () => {
-  const { app, rows } = memApp([{ pr_key: "o/r#1", status: "merged", acknowledged_at: null }]);
+  const { app, base } = memApp([{ prKey: "o/r#1", status: "merged" }]);
   const res = await call(app, { pr_key: "o/r#1" });
   assertEquals(res.status, 200);
   assertEquals(res.body.ok, true);
-  assertEquals(typeof rows[0].acknowledged_at, "string");
-  assertEquals(typeof rows[0].updated_at, "string");
+  assertEquals(typeof base[0].acknowledged_at, "string");
+  assertEquals(typeof base[0].updated_at, "string");
 });
 
 test("acknowledge-pr: every terminal status is dismissable", async () => {
   for (const status of PR_TERMINAL_STATUSES) {
-    const { app, rows } = memApp([{ pr_key: "o/r#1", status, acknowledged_at: null }]);
+    const { app, base } = memApp([{ prKey: "o/r#1", status }]);
     const res = await call(app, { pr_key: "o/r#1" });
     assertEquals(res.status, 200, `status ${status} must be dismissable`);
-    assertEquals(typeof rows[0].acknowledged_at, "string");
+    assertEquals(typeof base[0].acknowledged_at, "string");
   }
 });
 
+// Issue #652 — the drift case. A PR terminated OUT OF BAND leaves base `status` frozen at its last
+// transient (`escalated`) while the tracking VIEW folds `derived_status` to `abandoned`, so the read
+// model reports the effective `status = abandoned` and lights `ack_open`. Gating on the base column
+// (the old bug) 409'd "pull request is not terminal" on exactly the row the UI shows Dismiss on;
+// gating on the folded read-model status accepts it.
+test("acknowledge-pr: an out-of-band-terminated PR (base escalated, folded abandoned) is dismissable (200)", async () => {
+  const { app, base } = memApp([{ prKey: "o/r#1716", status: "escalated", derivedStatus: "abandoned" }]);
+  const res = await call(app, { pr_key: "o/r#1716" });
+  assertEquals(res.status, 200);
+  assertEquals(res.body.ok, true);
+  assertEquals(typeof base[0].acknowledged_at, "string");
+  // The base row's frozen transient is NOT rewritten — only the acknowledgement is stamped; the VIEW
+  // folds it to History (list_bucket = 'history', ack_open = 0) off derived_status + acknowledged_at.
+  assertEquals(base[0].status, "escalated");
+});
+
 test("acknowledge-pr: a live (still-converging) PR is rejected (409) and stays unstamped", async () => {
-  const { app, rows } = memApp([{ pr_key: "o/r#2", status: "converging", acknowledged_at: null }]);
+  const { app, base } = memApp([{ prKey: "o/r#2", status: "converging" }]);
   const res = await call(app, { pr_key: "o/r#2" });
   assertEquals(res.status, 409);
   assertEquals(res.body.ok, false);
-  assertEquals(rows[0].acknowledged_at, null);
+  assertEquals(base[0].acknowledged_at, null);
+});
+
+// A genuinely live PR whose engine instance is still ACTIVE has `derived_status === status` (a live PR
+// has no terminal fold), so the read model reports the live transient — still not terminal → 409.
+test("acknowledge-pr: a live PR awaiting review (instance active, folded == base) is rejected (409)", async () => {
+  const { app, base } = memApp([{ prKey: "o/r#3", status: "waiting_review", derivedStatus: "waiting_review" }]);
+  const res = await call(app, { pr_key: "o/r#3" });
+  assertEquals(res.status, 409);
+  assertEquals(base[0].acknowledged_at, null);
 });
 
 test("acknowledge-pr: a missing pr_key → 400", async () => {
@@ -86,9 +131,9 @@ test("acknowledge-pr: no matching PR → 404", async () => {
 });
 
 test("acknowledge-pr: idempotent — re-acknowledging a terminal PR re-stamps and returns 200", async () => {
-  const { app, rows } = memApp([{ pr_key: "o/r#5", status: "converged", acknowledged_at: null }]);
+  const { app, base } = memApp([{ prKey: "o/r#5", status: "converged" }]);
   assertEquals((await call(app, { pr_key: "o/r#5" })).status, 200);
-  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals(typeof base[0].acknowledged_at, "string");
   assertEquals((await call(app, { pr_key: "o/r#5" })).status, 200);
-  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals(typeof base[0].acknowledged_at, "string");
 });

package/operations/acknowledgePr.ts

@@ -15,10 +15,19 @@
 // It rejects (409) a PR that is NOT terminal (still converging/waiting_review/…), so it can never
 // pre-seed the tick-off on a live PR: were `acknowledged_at` set early, the moment the PR later settled
 // the VIEW would drop it straight into History, skipping the operator dismiss this op exists to
-// require. The terminal check reads the base `status` — the reconciler's `onTerminated` edge persists
-// an out-of-band terminate to base `status` = 'abandoned', so a resolved PR is matched here too.
+// require.
+//
+// TERMINALITY IS READ OFF THE READ MODEL, NOT THE BASE COLUMN (issue #652). PRs are the one surface
+// that folds terminal ON READ: since `app/abandon.ts` moved to ADR-0065 derive-only tracking, the
+// reconciler no longer WRITES 'abandoned' onto the base `pull_requests.status` on an out-of-band
+// terminate — the `pull_requests__tracking` VIEW folds it into `derived_status`, and the
+// `pull_requests_read_model` VIEW exposes that as its effective `status` and lights the Dismiss
+// affordance (`ack_open`). This op therefore consults the SAME source of truth as the affordance — the
+// read model's folded/effective `status` — rather than re-deriving terminality against the frozen base
+// column (which for an abandoned PR still reads its last transient, e.g. 'escalated', and would 409 a
+// row the UI shows Dismiss on). Reading the base column here was the drift #652 fixes.
 
-import { PR_TERMINAL_STATUSES } from "../app/pullRequestReadModel.ts";
+import { PR_TERMINAL_STATUSES, PULL_REQUEST_READ_MODEL_NAME } from "../app/pullRequestReadModel.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
 
 const str = (v: unknown): string => (typeof v === "string" ? v.trim() : "");
@@ -32,28 +41,37 @@ export default defineOperation("acknowledgePr", async ({ body }, app) => {
   const prKey = str(body.pr_key);
   if (!prKey) return { status: 400, body: { ok: false, error: "pr_key is required" } };
 
-  const table = app.data.table<{ pr_key: string; status: string; acknowledged_at: string | null; updated_at: string }>(
-    "pull_requests",
+  // Read the FOLDED row from the read model VIEW — its effective `status` is
+  // `COALESCE(derived_status, status)`, so an out-of-band-terminated PR whose base `status` is frozen
+  // at a transient reads its engine-truth terminal (`abandoned`) here, exactly as the Dismiss
+  // affordance (`ack_open`) does.
+  const readModel = app.data.table<{ pr_key: string; status: string }>(
+    PULL_REQUEST_READ_MODEL_NAME,
     "pr_key",
   );
-  const pr = await table.get(prKey);
-  if (!pr) {
+  const view = await readModel.get(prKey);
+  if (!view) {
     app.log.warn("acknowledge-pr: no such pull request", { prKey });
     return { status: 404, body: { ok: false, error: "no such pull request" } };
   }
 
-  // Guard: only a TERMINAL PR (a `PR_TERMINAL_STATUSES` status — the same set the read model's
-  // `list_bucket` folds to History) carries the Dismiss affordance. Acknowledging a live PR would
-  // pre-seed `acknowledged_at`, so the moment it later settled the VIEW would drop it straight into
-  // History, skipping the operator tick-off this op exists to require.
-  if (!PR_TERMINAL_STATUSES.includes(pr.status)) {
-    app.log.warn("acknowledge-pr rejected: PR is not terminal", { prKey, status: pr.status });
+  // Guard: only a TERMINAL PR (a `PR_TERMINAL_STATUSES` effective status — the same terminal-folded
+  // tier the read model's `list_bucket`/`ack_open` fold to History and gate the Dismiss button on)
+  // carries the Dismiss affordance. Acknowledging a live PR would pre-seed `acknowledged_at`, so the
+  // moment it later settled the VIEW would drop it straight into History, skipping the operator
+  // tick-off this op exists to require.
+  if (!PR_TERMINAL_STATUSES.includes(view.status)) {
+    app.log.warn("acknowledge-pr rejected: PR is not terminal", { prKey, status: view.status });
     return { status: 409, body: { ok: false, error: "pull request is not terminal" } };
   }
 
-  // Stamp the dismissal. `list_bucket` (→ 'history') and `ack_open` (→ 0) are derived by the
-  // `pull_requests_read_model` VIEW from the terminal, now-acknowledged row, so we never hand-set them
-  // here. Idempotent: re-acknowledging re-stamps and stays in History.
+  // Stamp the dismissal on the BASE `pull_requests` row. `list_bucket` (→ 'history') and `ack_open`
+  // (→ 0) are derived by the `pull_requests_read_model` VIEW from the terminal, now-acknowledged row,
+  // so we never hand-set them here. Idempotent: re-acknowledging re-stamps and stays in History.
+  const table = app.data.table<{ pr_key: string; acknowledged_at: string | null; updated_at: string }>(
+    "pull_requests",
+    "pr_key",
+  );
   const now = new Date().toISOString();
   await table.update(prKey, { acknowledged_at: now, updated_at: now });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.167.1",
+  "version": "0.167.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",