@nanobpm/nano-workforce 0.186.1 → 0.186.3

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.186.3](https://github.com/nanobpm/nano-workforce/compare/v0.186.2...v0.186.3) (2026-09-12)
+
+### Bug Fixes
+
+* **app:** redirect standalone /console routes to the engine console ([#780](https://github.com/nanobpm/nano-workforce/issues/780)) ([103e967](https://github.com/nanobpm/nano-workforce/commit/103e967b95191bb04239b5c6a2195913e50b8b9b)), closes [#771](https://github.com/nanobpm/nano-workforce/issues/771)
+
+## [0.186.2](https://github.com/nanobpm/nano-workforce/compare/v0.186.1...v0.186.2) (2026-09-11)
+
+### Bug Fixes
+
+* **merge-loop:** re-poll a 'waiting' mergeability verdict instead of escalating ([#775](https://github.com/nanobpm/nano-workforce/issues/775)) ([4812fe9](https://github.com/nanobpm/nano-workforce/commit/4812fe9689088f21e41ef50ba8f1dbec2093fb23)), closes [#774](https://github.com/nanobpm/nano-workforce/issues/774) [#774](https://github.com/nanobpm/nano-workforce/issues/774) [#774](https://github.com/nanobpm/nano-workforce/issues/774)
+
 ## [0.186.1](https://github.com/nanobpm/nano-workforce/compare/v0.186.0...v0.186.1) (2026-09-11)
 
 ### Bug Fixes

package/SPEC.md

@@ -216,7 +216,7 @@ Consequences the prompt (`resources/prompts/review-round.md`) encodes:
 | `pr-submitted` | — (start) | submit route/webhook | `{repo, prNumber, prUrl, prKey}` |
 | `readiness-ready` | `prKey` | **poller** | `{ready, detail?}` (ADR 0001 §2 wait-gate; the review-ready wait, re-expressed on the ReadinessProbe gate — #259) |
 | `deps-cleared` | `prKey` | **poller** (merge) | — (all `Depends-on` PRs merged) |
-| `merge-ready` | `prKey` | **poller** (merge) | `{mergeState}` (`ready` \| `conflict` \| `blocked`); when `blocked`, also `{failingChecks, failingChecksList}` for the `senior:fix-ci` branch |
+| `merge-ready` | `prKey` | **poller** (merge) | `{mergeState}` (`ready` \| `conflict` \| `blocked` \| `draft`); when `blocked`, also `{failingChecks, failingChecksList}` for the `senior:fix-ci` branch. A transient `UNKNOWN`/`waiting` verdict is NOT published — the poller keeps polling (fast self-heal); the merge loop's `gw-mergeable` sees `waiting` only via the dead-poller stall-probe re-derivation, where it re-polls (bounded, #774) instead of escalating |
 | `merge-landed` | `prKey` | **poller** (merge) | — (queued PR merged, or merged out-of-band) |
 
 The `escalation-answered` message was retired (#256): the merge-loop escalation is
@@ -466,10 +466,21 @@ start ─► wait: deps merged ─► arm merge ─► wait: mergeable ─┬─
   time** by a `fix-ci`/`rebase` agent (`status: "waiting-on-pr"`, above). `merge-loop`
   parks at *wait: deps merged*; the poller checks each dependency (own tracked row
   first, else GitHub `merged` state) and publishes `deps-cleared` once all have landed.
-- **Mergeability** — the poller classifies GitHub's `mergeStateStatus`:
+- **Mergeability** — the poller classifies GitHub's `mergeStateStatus`, but a
+  first-class `isDraft` guard runs *first* (`classifyMergeability`, `app/github.ts`):
+  a draft PR is `draft` regardless of `mergeStateStatus`. Otherwise, by status:
   `CLEAN`/`HAS_HOOKS`/`UNSTABLE`/`BEHIND` → `ready`; `DIRTY` → `conflict`;
   `BLOCKED` → `blocked` if a required check is failing, else keep waiting;
-  `DRAFT`/`UNKNOWN`/empty → keep waiting. It publishes `merge-ready {mergeState}`.
+  `UNKNOWN`/empty (and any other status, including `DRAFT`) → keep polling (GitHub
+  still computing). It
+  publishes `merge-ready {mergeState}` for the settled verdicts. When the live
+  poller is dead the `wait-mergeable-timeout` backstop's stall-probe re-derives
+  mergeability; a still-unsettled `UNKNOWN`/`waiting` verdict then routes to a
+  **bounded re-poll** (`wait-mergeable-repoll`, `NANO_PR_MERGEABLE_REPOLL_INTERVAL`)
+  rather than escalating (bounded by `NANO_PR_MAX_MERGE_STALL_ROUNDS`), and an
+  unclassified/default verdict routes to auto-rebase (`gw-rebase`, bounded by its
+  own `NANO_PR_MAX_REBASE_ROUNDS` budget); once either budget is exhausted the loop
+  escalates to a human (#774).
 - **Merge** — `pr.merge` attempts the merge (`NANO_PR_MERGE_METHOD`, default
   `squash`). GitHub auto-enqueues on merge-queue-required branches → the process
   waits for `merge-landed` (poller detects the landed PR). Every attempt is

package/app/consoleRedirect.test.ts

@@ -0,0 +1,127 @@
+// Tests for app/consoleRedirect.ts — the standalone `/console` → engine-console redirect (issue
+// #771). Covers the pure match/target derivation, origin resolution from NANOBPMN_BASE_URL, and the
+// live listener-rewiring mount over a real node:http server (redirect fires for `/console/*`,
+// passthrough for everything else, teardown restores the original handler).
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import {
+  consoleRedirectLocation,
+  mountConsoleRedirect,
+  resolveConsoleOrigin,
+} from "./consoleRedirect.ts";
+
+test("redirects a bare /console path to the console origin", () => {
+  assertEquals(consoleRedirectLocation("/console", "http://localhost:8080"), "http://localhost:8080/console");
+});
+
+test("preserves the full path and query under /console/", () => {
+  assertEquals(
+    consoleRedirectLocation("/console/app-view/Foo?tab=bar&x=1", "http://localhost:8080"),
+    "http://localhost:8080/console/app-view/Foo?tab=bar&x=1",
+  );
+});
+
+test("leaves /app/* and root routes unchanged (null)", () => {
+  assertEquals(consoleRedirectLocation("/app/api/agent", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/agentic", "http://localhost:8080"), null);
+});
+
+test("does not match a sibling route that merely starts with 'console'", () => {
+  assertEquals(consoleRedirectLocation("/console-x", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/consolexyz/app", "http://localhost:8080"), null);
+});
+
+test("matches /console immediately followed by a query", () => {
+  assertEquals(consoleRedirectLocation("/console?next=1", "http://localhost:8080"), "http://localhost:8080/console?next=1");
+});
+
+test("normalises a trailing slash on the console origin", () => {
+  assertEquals(consoleRedirectLocation("/console/x", "http://localhost:8080/"), "http://localhost:8080/console/x");
+});
+
+test("handles an absent url", () => {
+  assertEquals(consoleRedirectLocation(undefined, "http://localhost:8080"), null);
+});
+
+test("resolveConsoleOrigin gives CAMUNDA_REST_ADDRESS precedence over NANOBPMN_BASE_URL", () => {
+  const read = (name: string): string | null =>
+    name === "CAMUNDA_REST_ADDRESS"
+      ? "http://engine.example:8080/v2"
+      : name === "NANOBPMN_BASE_URL"
+        ? "http://localhost:9999"
+        : null;
+  assertEquals(resolveConsoleOrigin(read), "http://engine.example:8080");
+});
+
+test("resolveConsoleOrigin uses NANOBPMN_BASE_URL when CAMUNDA_REST_ADDRESS is unset", () => {
+  const read = (name: string): string | null =>
+    name === "NANOBPMN_BASE_URL" ? "https://engine.example.com:9000" : null;
+  assertEquals(resolveConsoleOrigin(read), "https://engine.example.com:9000");
+});
+
+test("resolveConsoleOrigin derives the origin from NANOBPMN_BASE_URL", () => {
+  const read = (name: string): string | null =>
+    name === "NANOBPMN_BASE_URL" ? "https://engine.example.com:9000" : null;
+  assertEquals(resolveConsoleOrigin(read), "https://engine.example.com:9000");
+});
+
+test("resolveConsoleOrigin strips any path from the base", () => {
+  assertEquals(resolveConsoleOrigin(() => "https://engine.example.com/v2/"), "https://engine.example.com");
+});
+
+test("resolveConsoleOrigin defaults to localhost:8080 when unset", () => {
+  assertEquals(resolveConsoleOrigin(() => null), "http://localhost:8080");
+});
+
+test("resolveConsoleOrigin falls back to the default on an unparseable value", () => {
+  assertEquals(resolveConsoleOrigin(() => "not a url"), "http://localhost:8080");
+});
+
+/** Spin up a real server with an app handler, mount the redirect, and return a fetch helper. */
+async function withServer(
+  run: (base: string, teardown: () => void) => Promise<void>,
+): Promise<void> {
+  const server: Server = createServer((_req, res) => {
+    res.statusCode = 200;
+    res.setHeader("content-type", "text/plain");
+    res.end("app-handled");
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const teardown = mountConsoleRedirect(server, "http://console.example:8080");
+  const { port } = server.address() as AddressInfo;
+  try {
+    await run(`http://127.0.0.1:${port}`, teardown);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+}
+
+test("mount: /console/* is answered with a 302 to the console origin, not the app handler", async () => {
+  await withServer(async (base) => {
+    const res = await fetch(`${base}/console/app-view/Workforce?tab=x`, { redirect: "manual" });
+    assertEquals(res.status, 302);
+    assertEquals(res.headers.get("location"), "http://console.example:8080/console/app-view/Workforce?tab=x");
+    // 302 body is empty — the app handler must not have run.
+    assertEquals(await res.text(), "");
+  });
+});
+
+test("mount: a non-console request is delegated to the app handler unchanged", async () => {
+  await withServer(async (base) => {
+    const res = await fetch(`${base}/app/api/agent`, { redirect: "manual" });
+    assertEquals(res.status, 200);
+    assertEquals(await res.text(), "app-handled");
+  });
+});
+
+test("mount: teardown restores the original app handler for /console too", async () => {
+  await withServer(async (base, teardown) => {
+    teardown();
+    const res = await fetch(`${base}/console/x`, { redirect: "manual" });
+    assertEquals(res.status, 200);
+    assert((await res.text()) === "app-handled");
+  });
+});

package/app/consoleRedirect.ts

@@ -0,0 +1,122 @@
+// Standalone `/console` → engine-console redirect (issue #771).
+//
+// When Nano Workforce runs **embedded** behind the nano console, the console origin serves
+// `/console/*` (its app-view host, `/console/app-view/Workforce/…`) and the reverse proxy strips the
+// `/console/app-view/Workforce` prefix before the app's own HTTP server ever sees the request — so
+// the app only ever handles `/app/*`, `/agentic`, and its page routes at the root.
+//
+// Run **standalone** (the default `npm start` on a bare port, no console proxy in front), links the
+// UI emits under `/console` — the engine console's own origin — hit this app's port instead, where
+// nothing serves them: the runtime answers a bare 503 because `/console/*` is not a registered
+// app-view route. This is a narrow Node request redirect that rewrites those `/console/*` requests to
+// the engine console origin, preserving the full path + query, and leaves every other route
+// (`/app/*`, `/agentic`, the Workforce page routes at the root) untouched — it only ever fires for a
+// path that is exactly `/console` or under `/console/`.
+//
+// The redirect is derived, not configured twice: the engine console shares the engine's origin, so
+// the target origin comes from the CANONICAL engine-address resolution (`resolveEngineAddress`,
+// `app/enginePreflight.ts`) — an explicit `CAMUNDA_REST_ADDRESS` wins over `NANOBPMN_BASE_URL`
+// (default `http://localhost:8080`), the same precedence and single source of truth the engine
+// client uses, so the redirect target can never drift from the engine the app actually talks to.
+// Mounting it when embedded is harmless: the proxy owns `/console` there, so the app's server never
+// sees such a path.
+
+import type { IncomingMessage, RequestListener, Server, ServerResponse } from "node:http";
+import { resolveEngineAddress } from "./enginePreflight.ts";
+import { envVar } from "./version.ts";
+
+/** A minimal logging surface (structurally a subset of `Logger`) the mount uses at boot. */
+export interface ConsoleRedirectLog {
+  info(msg: string): void;
+}
+
+/**
+ * The `Location` a `/console`-prefixed request should be redirected to, or `null` when the request
+ * is NOT a console route (and so must be left for the app's own handlers).
+ *
+ * Matches ONLY a path that is exactly `/console` or begins with `/console/` — a sibling route such
+ * as `/console-x` or `/app/console` is deliberately NOT matched, keeping the redirect narrow. The
+ * full original request target (path + query) is preserved by appending it verbatim to the console
+ * origin: because the request path already carries the `/console` prefix, the result is
+ * `<consoleOrigin>/console/<rest>?<query>`.
+ *
+ * @param url          the raw request target (`req.url`), e.g. `/console/app-view/Foo?tab=bar`.
+ * @param consoleOrigin the engine console origin (scheme + authority, no trailing slash), e.g.
+ *                      `http://localhost:8080`.
+ */
+export function consoleRedirectLocation(
+  url: string | undefined,
+  consoleOrigin: string,
+): string | null {
+  if (!url) return null;
+  const queryAt = url.indexOf("?");
+  const path = queryAt === -1 ? url : url.slice(0, queryAt);
+  if (path === "/console" || path.startsWith("/console/")) {
+    return `${consoleOrigin.replace(/\/+$/, "")}${url}`;
+  }
+  return null;
+}
+
+/**
+ * Resolve the engine console origin (scheme + authority) from the CANONICAL engine-address
+ * resolution (`resolveEngineAddress`, `app/enginePreflight.ts`). The engine console is served on the
+ * engine's own origin, so this reuses the single engine-base source of truth — including its
+ * precedence — rather than reading one input directly. That means an explicit `CAMUNDA_REST_ADDRESS`
+ * (already the `/v2` REST address) wins over `NANOBPMN_BASE_URL`, exactly as the engine client
+ * resolves it; the redirect target can never drift from the engine the app actually talks to. Only
+ * the origin is meaningful for the redirect, so any path/query on the resolved address (e.g. the
+ * `/v2` suffix) is discarded. Falls back to the localhost default when the resolved value is
+ * unparseable.
+ *
+ * `read` is injectable so resolution is testable without mutating `process.env`.
+ */
+export function resolveConsoleOrigin(read: (name: string) => string | null = envVar): string {
+  const { restAddress } = resolveEngineAddress(read);
+  try {
+    return new URL(restAddress).origin;
+  } catch {
+    return "http://localhost:8080";
+  }
+}
+
+/**
+ * Prepend a `/console` → engine-console redirect in front of `server`'s existing request handling.
+ *
+ * The runtime has already attached the app's own `request` listener(s) by the time this runs, so we
+ * capture them, remove them, and install a single wrapper that either answers a `/console/*` request
+ * with a `302` (preserving path + query) or delegates to every captured listener unchanged. This
+ * keeps the app's own routing (control API, pages, agentic upgrade) intact for every non-console
+ * request while giving the redirect first refusal on the console prefix.
+ *
+ * Returns a teardown that restores the original listener set.
+ */
+export function mountConsoleRedirect(
+  server: Server,
+  consoleOrigin: string,
+  log?: ConsoleRedirectLog,
+): () => void {
+  // `Server#listeners` is typed `Function[]` by Node; narrow to the request-listener signature so we
+  // can re-invoke and later restore them.
+  // biome-ignore lint/plugin: runtime/framework contract boundary for Node's untyped listeners()
+  const existing = server.listeners("request") as RequestListener[];
+  server.removeAllListeners("request");
+
+  const handler = (req: IncomingMessage, res: ServerResponse): void => {
+    const location = consoleRedirectLocation(req.url, consoleOrigin);
+    if (location !== null) {
+      res.statusCode = 302;
+      res.setHeader("Location", location);
+      res.end();
+      return;
+    }
+    for (const listener of existing) listener.call(server, req, res);
+  };
+
+  server.on("request", handler);
+  log?.info(`console redirect mounted: /console/* → ${consoleOrigin}/console/* (standalone links)`);
+
+  return () => {
+    server.removeListener("request", handler);
+    for (const listener of existing) server.on("request", listener);
+  };
+}

package/app/contracts.ts

@@ -137,7 +137,7 @@ export const ENV_CONTRACTS = {
     name: "NANO_PR_MAX_MERGE_STALL_ROUNDS",
     owner: "app/service.ts",
     semantics:
-      "Maximum mergeable-wait-timeout stall-probe re-derivations (dead-poller backstop, #636) before escalating; 0 escalates on the first stall.",
+      "Maximum mergeable-wait-timeout stall-probe re-derivations (dead-poller backstop, #636) AND `waiting`-verdict re-poll probes (#774) before escalating; 0 escalates on the first stall.",
     default: "3",
   },
   NANO_PR_REVIEW_WAIT_TIMEOUT: {
@@ -166,6 +166,13 @@ export const ENV_CONTRACTS = {
     semantics:
       "How long the merge loop waits for the poller's `merge-ready` before the stall-probe timer arm fires (dead-poller backstop, #636; FEEL/ISO-8601 duration).",
   },
+  NANO_PR_MERGEABLE_REPOLL_INTERVAL: {
+    category: "env",
+    name: "NANO_PR_MERGEABLE_REPOLL_INTERVAL",
+    owner: "app/service.ts",
+    semantics:
+      "How long the merge loop waits before re-deriving mergeability when `gw-mergeable` sees an async-`UNKNOWN` `\"waiting\"` verdict, instead of escalating to a human (#774; bounded by `NANO_PR_MAX_MERGE_STALL_ROUNDS`; FEEL/ISO-8601 duration).",
+  },
   NANO_PR_AUTO_MERGE: {
     category: "env",
     name: "NANO_PR_AUTO_MERGE",

package/app/mergeLoopBehaviour.test.ts

@@ -43,6 +43,7 @@ const MODEL = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
 const AGENT_SLA_MS = 30 * 60 * 1000; // matches the PT30M we start instances with
 const LANDED_WAIT_MS = 30 * 60 * 1000; // matches the PT30M landedWaitTimeout we start instances with
 const MERGEABLE_WAIT_MS = 30 * 60 * 1000; // matches the PT30M mergeableWaitTimeout we start instances with
+const MERGEABLE_REPOLL_MS = 2 * 60 * 1000; // matches the PT2M mergeableRepollInterval we start instances with
 
 type Output = Record<string, unknown>;
 type Responder = Output | Output[] | ((job: { variables: Record<string, unknown> }) => Output);
@@ -85,6 +86,7 @@ const DEFAULT_VARS: Record<string, unknown> = {
   agentSlaTimeout: "PT30M",
   landedWaitTimeout: "PT30M",
   mergeableWaitTimeout: "PT30M",
+  mergeableRepollInterval: "PT2M",
   mergeStallRounds: 0,
   mergeStallMax: 3,
   abandonBrief: null,
@@ -349,6 +351,94 @@ test("the stall-round cap escalates to a human instead of looping forever (#636)
   assert(!completedElementIds(engine).has("mark-merged"), "an exhausted stall must not mark-merged");
 });
 
+// ---------------------------------------------------------------------------
+// Async-UNKNOWN "waiting" verdict → bounded re-poll, NOT a human (issue #774)
+// ---------------------------------------------------------------------------
+// GitHub returns `mergeable=UNKNOWN` transiently while it computes mergeability in the background,
+// which `classifyMergeability` maps to `"waiting"`. Before the fix, a `"waiting"` verdict at
+// `gw-mergeable` hit the DEFAULT arm and escalated straight to the `wait-merge-answer` human task —
+// so a PR whose real state was still settling (e.g. to `"conflict"`, which would auto-fire
+// `senior:rebase`) paged a human instead of self-healing. The fix routes `"waiting"` to a bounded
+// re-poll (`wait-mergeable-repoll` timer → `merge-stall-probe` → the existing `gw-mergeable` arms),
+// bounded by the shared `mergeStallMax` budget, and routes the true DEFAULT to auto-rebase.
+
+test("a 'waiting' (async UNKNOWN) verdict re-polls instead of escalating to a human (#774)", async () => {
+  // RED (before the fix): `waiting` → DEFAULT → `merge-esc-conflict` → `wait-merge-answer`. GREEN:
+  // `waiting` parks on the re-poll timer; when it fires, `merge-stall-probe` re-derives `ready` and
+  // the PR merges — no human ever touched.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "ready", failingChecks: 0, failingChecksList: "" },
+      "pr.merge": { mergeStatus: "merged" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "waiting" } });
+  // Parks on the bounded re-poll timer — NOT on a human task, NOT escalated.
+  assertThatInstance(engine, byProcessId("merge-loop")).isActive().hasActiveElement("wait-mergeable-repoll");
+  assert(!completedElementIds(engine).has("merge-esc-conflict"), "a waiting verdict must NOT escalate to a human");
+  const openTasks = await engine.searchUserTasks({});
+  assert(!openTasks.some((t) => t.elementId === "wait-merge-answer"), "a waiting verdict must not park a user task");
+  // The timer fires → the probe re-derives ground truth (`ready`) → the PR merges.
+  await engine.advanceTime(MERGEABLE_REPOLL_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .hasCompleted()
+    .hasNoIncident()
+    .hasCompletedElements("wait-mergeable-repoll", "merge-stall-probe", "attempt-merge", "mark-merged");
+});
+
+test("a 'waiting' verdict that settles to conflict on re-poll reaches the rebase arm (#774)", async () => {
+  // The incident (Magikcraft/nano-bpm#1166): the PR was really CONFLICTING, but GitHub reported
+  // UNKNOWN transiently. The re-poll must let it settle to `conflict` → `senior:rebase`, the arm that
+  // would have fixed it, rather than paging a human on the transient UNKNOWN.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+      "senior:rebase": { status: "rebased" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "waiting" } });
+  await engine.advanceTime(MERGEABLE_REPOLL_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("wait-mergeable-repoll", "merge-stall-probe", "rebase")
+    .hasVariable("rebaseRound", 1);
+  assert(!completedElementIds(engine).has("merge-esc-conflict"), "settling to conflict must rebase, not escalate");
+});
+
+test("the 'waiting' re-poll is bounded — exhausting mergeStallMax escalates to a human (#774)", async () => {
+  // A permanently-UNKNOWN PR cannot re-poll forever: the re-poll shares the `mergeStallMax` budget.
+  // `mergeStallMax: 0` — escalate on the first re-poll. The probe runs once, `gw-merge-stall` finds
+  // the budget exhausted, and routes to the human `wait-merge-answer` (last resort, not first).
+  const engine = await boot({
+    vars: { mergeStallMax: 0 },
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "waiting", failingChecks: 0, failingChecksList: "" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "waiting" } });
+  assert(!completedElementIds(engine).has("merge-esc-conflict"), "must re-poll before ever escalating");
+  await engine.advanceTime(MERGEABLE_REPOLL_MS + 1);
+  await assertThatUserTask(engine, { instance: byProcessId("merge-loop"), elementId: "wait-merge-answer" }).isCreated();
+  assertThatInstance(engine, byProcessId("merge-loop")).hasCompletedElements("wait-mergeable-repoll", "merge-stall-probe", "merge-esc-conflict");
+});
+
+test("an unclassified verdict routes to auto-rebase (DEFAULT), not to a human (#774)", async () => {
+  // The DEFAULT arm is a last-resort self-heal, not a page: an unexpected/garbage `mergeState` routes
+  // to the bounded rebase agent (which reconciles from ground truth), never straight to a human.
+  const engine = await boot({ responses: { "senior:rebase": { status: "rebased" } } });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.publishMessage({ name: "merge-ready", correlationKey: "pr-1", variables: { mergeState: "bogus" } });
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("rebase")
+    .hasVariable("rebaseRound", 1);
+  const openTasks = await engine.searchUserTasks({});
+  assert(!openTasks.some((t) => t.elementId === "wait-merge-answer"), "the default arm must not page a human");
+});
+
 test("an evicted queued merge re-arms the poller rather than completing", async () => {
   const engine = await boot({ responses: { "pr.merge": { mergeStatus: "queued" } } });
   await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });

package/app/mergeableWait.test.ts

@@ -6,7 +6,8 @@
 
 import assert from "node:assert/strict";
 import { test } from "node:test";
-import { DEFAULT_MERGEABLE_WAIT_TIMEOUT, mergeableWaitTimeout } from "./mergeableWait.ts";
+import { DEFAULT_MERGEABLE_REPOLL_INTERVAL, DEFAULT_MERGEABLE_WAIT_TIMEOUT, mergeableRepollInterval, mergeableWaitTimeout } from "./mergeableWait.ts";
+import { isoDurationToMs } from "./reviewWait.ts";
 
 test("mergeableWaitTimeout: blank / absent / malformed → default", () => {
   assert.equal(mergeableWaitTimeout(undefined), DEFAULT_MERGEABLE_WAIT_TIMEOUT);
@@ -37,3 +38,43 @@ test("the default is itself a well-formed ISO-8601 duration (never an uninterpre
   assert.notEqual(DEFAULT_MERGEABLE_WAIT_TIMEOUT, sentinel);
   assert.equal(mergeableWaitTimeout(DEFAULT_MERGEABLE_WAIT_TIMEOUT, sentinel), DEFAULT_MERGEABLE_WAIT_TIMEOUT);
 });
+
+// --- Mergeability re-poll interval (issue #774) -----------------------------------------------
+// Baked into every merge-loop instance's `mergeableRepollInterval` process variable and evaluated by
+// the `wait-mergeable-repoll` timer catch, which bounds the `"waiting"` (async UNKNOWN) verdict's
+// re-poll before it re-derives mergeability from ground truth — so a malformed operator env must
+// never deploy an uninterpretable `<bpmn:timeDuration>`.
+
+test("mergeableRepollInterval: blank / absent / malformed → default", () => {
+  assert.equal(mergeableRepollInterval(undefined), DEFAULT_MERGEABLE_REPOLL_INTERVAL);
+  assert.equal(mergeableRepollInterval(""), DEFAULT_MERGEABLE_REPOLL_INTERVAL);
+  assert.equal(mergeableRepollInterval("   "), DEFAULT_MERGEABLE_REPOLL_INTERVAL);
+  assert.equal(mergeableRepollInterval("2m"), DEFAULT_MERGEABLE_REPOLL_INTERVAL); // missing leading P/T
+  assert.equal(mergeableRepollInterval("garbage"), DEFAULT_MERGEABLE_REPOLL_INTERVAL);
+});
+
+test("mergeableRepollInterval: a valid ISO-8601 duration is honoured and upper-cased", () => {
+  assert.equal(mergeableRepollInterval("PT2M"), "PT2M");
+  assert.equal(mergeableRepollInterval("pt90s"), "PT90S");
+  assert.equal(mergeableRepollInterval("  pt5m  "), "PT5M");
+});
+
+test("mergeableRepollInterval: the re-poll interval is shorter than the poller-death backstop", () => {
+  // The re-poll (GitHub settling UNKNOWN, ~seconds) must fire far sooner than the 30-minute
+  // dead-poller backstop, so a transient UNKNOWN self-heals briskly rather than parking for tens of
+  // minutes per round.
+  assert.equal(DEFAULT_MERGEABLE_REPOLL_INTERVAL, "PT2M");
+  // `notEqual` only proves the values differ — a future `PT1H` would pass despite being LONGER than
+  // the backstop. Assert the actual ordering invariant on parsed durations via the canonical helper.
+  assert.ok(
+    isoDurationToMs(DEFAULT_MERGEABLE_REPOLL_INTERVAL, "PT0S") <
+      isoDurationToMs(DEFAULT_MERGEABLE_WAIT_TIMEOUT, "PT0S"),
+    "the re-poll interval must be strictly shorter than the poller-death backstop",
+  );
+});
+
+test("mergeableRepollInterval: the default is itself a well-formed ISO-8601 duration", () => {
+  const sentinel = "PT1S";
+  assert.notEqual(DEFAULT_MERGEABLE_REPOLL_INTERVAL, sentinel);
+  assert.equal(mergeableRepollInterval(DEFAULT_MERGEABLE_REPOLL_INTERVAL, sentinel), DEFAULT_MERGEABLE_REPOLL_INTERVAL);
+});

package/app/mergeableWait.ts

@@ -36,3 +36,26 @@ export function mergeableWaitTimeout(
 ): string {
   return isoDuration(raw, def);
 }
+
+/** Default mergeability re-poll interval (ISO-8601 duration): how long the merge loop waits before
+ * re-deriving mergeability from ground truth when `gw-mergeable` sees an async-`UNKNOWN` `"waiting"`
+ * verdict (issue #774). GitHub returns `mergeable=UNKNOWN` transiently while it computes mergeability
+ * in the background; a `"waiting"` verdict must therefore route to a *bounded re-poll* — not straight
+ * to a human — so the loop self-heals once GitHub settles (to `"conflict"` → `senior:rebase`, etc.).
+ * Deliberately SHORT (unlike the 30-minute {@link DEFAULT_MERGEABLE_WAIT_TIMEOUT} poller-death
+ * backstop): GitHub usually settles UNKNOWN within seconds, so re-poll briskly rather than parking
+ * the PR for tens of minutes per round. The re-poll is bounded by the shared `mergeStallMax` budget
+ * (`NANO_PR_MAX_MERGE_STALL_ROUNDS`): once exhausted, `gw-merge-stall` escalates to a human. */
+export const DEFAULT_MERGEABLE_REPOLL_INTERVAL = "PT2M";
+
+/** Validate the operator-supplied mergeability re-poll interval (env
+ * `NANO_PR_MERGEABLE_REPOLL_INTERVAL`, ISO-8601 duration), falling back to
+ * {@link DEFAULT_MERGEABLE_REPOLL_INTERVAL} when absent, blank, or malformed — a bad env value must
+ * never deploy an uninterpretable timer expression. Derives its validation from the single canonical
+ * {@link isoDuration}. */
+export function mergeableRepollInterval(
+  raw: string | undefined,
+  def: string = DEFAULT_MERGEABLE_REPOLL_INTERVAL,
+): string {
+  return isoDuration(raw, def);
+}

package/app/service.ts

@@ -53,7 +53,7 @@ import {
 } from "./github.ts";
 import { activeStatusesFor, derivedTrackingTable } from "./instanceTracking.ts";
 import { pollLineage } from "./lineage.ts";
-import { mergeableWaitTimeout } from "./mergeableWait.ts";
+import { mergeableRepollInterval, mergeableWaitTimeout } from "./mergeableWait.ts";
 import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import { mergeLandedWaitTimeout } from "./mergeLandedWait.ts";
 import {
@@ -206,6 +206,19 @@ export const MERGEABLE_WAIT_TIMEOUT = mergeableWaitTimeout(
   process.env.NANO_PR_MERGEABLE_WAIT_TIMEOUT,
 );
 
+/** How long the merge loop waits before re-deriving mergeability from ground truth when
+ * `gw-mergeable` sees an async-`UNKNOWN` `"waiting"` verdict (issue #774). Seeded as the
+ * `mergeableRepollInterval` process variable at merge start and evaluated by the merge-loop's
+ * `wait-mergeable-repoll` timer catch. A `"waiting"` verdict means GitHub is still computing
+ * mergeability in the background — so route it to a *bounded re-poll* (this timer → `merge-stall-probe`
+ * → the existing `gw-mergeable` arms), not to a human. The re-poll shares the `mergeStallMax` budget
+ * (`NANO_PR_MAX_MERGE_STALL_ROUNDS`) with the dead-poller stall backstop; once exhausted,
+ * `gw-merge-stall` escalates. ISO-8601 duration; a malformed `NANO_PR_MERGEABLE_REPOLL_INTERVAL`
+ * falls back to the default so an uninterpretable timer is never deployed. */
+export const MERGEABLE_REPOLL_INTERVAL = mergeableRepollInterval(
+  process.env.NANO_PR_MERGEABLE_REPOLL_INTERVAL,
+);
+
 /** Cooldown (ms) between the poller's automatic Copilot re-request nudges for a single waiting PR.
  * Copilot dismisses re-requests, so the poller retries — but not on every tick; this throttles it
  * to one attempt per window. Set via `NANO_PR_REVIEW_NUDGE_MINUTES` (minutes). */
@@ -678,6 +691,7 @@ export async function startMerge(
       agentSlaTimeout: AGENT_SLA_TIMEOUT,
       landedWaitTimeout: MERGE_LANDED_WAIT_TIMEOUT,
       mergeableWaitTimeout: MERGEABLE_WAIT_TIMEOUT,
+      mergeableRepollInterval: MERGEABLE_REPOLL_INTERVAL,
       mergeStallRounds: 0,
       mergeStallMax: MAX_MERGE_STALL_ROUNDS,
       // Lineage (issue #245): thread the origin identity onto the merge instance (see startMerge).

package/main.ts

@@ -21,6 +21,7 @@ import { Server } from "node:http";
 import { createNanoSdkEngineClient, runFromEnv, selectHost } from "@nanobpm/urban";
 import { type AgenticChannelHandle, mountAgenticChannel } from "./app/agentic/channel.ts";
 import { makeElementInstanceResolver } from "./app/agentic/element-instance.ts";
+import { mountConsoleRedirect, resolveConsoleOrigin } from "./app/consoleRedirect.ts";
 import { announceEngine, resolveEngineAddress } from "./app/enginePreflight.ts";
 import { runEngineReconcile } from "./app/reconcile.ts";
 import { MAX_ROUNDS, pollOnce } from "./app/service.ts";
@@ -103,6 +104,20 @@ if (httpServer instanceof Server) {
   app.log.warn("agentic channel not mounted: app.httpServer is not a node:http Server on this host");
 }
 
+// Standalone `/console` redirect (issue #771). Running behind the nano console, the console origin
+// serves `/console/*` and the reverse proxy strips its app-view prefix before the app ever sees a
+// request — but STANDALONE, the UI's `/console` links land on this app's own port, where nothing
+// serves them, so the runtime answers a bare 503. Mount a narrow request redirect that rewrites
+// `/console/*` to the engine console origin (derived from the CANONICAL engine-address resolution,
+// `resolveEngineAddress`, so an explicit `CAMUNDA_REST_ADDRESS` wins over `NANOBPMN_BASE_URL`),
+// preserving path + query, and leaves `/app/*`, `/agentic`, and the Workforce page routes untouched.
+// Mounted last so it captures every request listener the runtime + agentic channel attached, and
+// delegates each non-console request to them unchanged.
+let consoleRedirectTeardown: (() => void) | undefined;
+if (httpServer instanceof Server) {
+  consoleRedirectTeardown = mountConsoleRedirect(httpServer, resolveConsoleOrigin(), app.log);
+}
+
 // Engine-reset reconciliation (issues #622, #630). On boot, compare the engine's incarnation epoch
 // against the last-seen value; on a REGRESSION (the engine was reset/restored/rewound and re-minted
 // its keys, Magikcraft/nano-bpm#1065) drive every dangling engine-backed inflight row to the defined
@@ -153,6 +168,12 @@ async function drainAndExit(): Promise<void> {
   if (shuttingDown) return;
   shuttingDown = true;
   if (pollTimer) clearTimeout(pollTimer);
+  // Restore the original request listener set (drops the /console redirect wrapper).
+  if (consoleRedirectTeardown) {
+    try {
+      consoleRedirectTeardown();
+    } catch { /* best-effort redirect teardown */ }
+  }
   // Tear the agentic families + hub down (releases the WS clients) before the app stops its HTTP
   // server, which the channel shares.
   if (agentic) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.186.1",
+  "version": "0.186.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",