@nanobpm/nano-workforce 0.188.0 → 0.189.0

package/e2e/feature-run.e2e.ts

@@ -67,6 +67,7 @@ interface PrRow {
 describe("single-issue feature run (#172 — feature.bpmn)", () => {
   const savedEnv = new Map<string, string | undefined>();
   let restoreGithub: (() => void) | undefined;
+  const githubState = admitGithubState("owner/repo", "main");
 
   before(() => {
     for (const [k, v] of Object.entries(GITHUB_ENV_OVERRIDES)) {
@@ -75,7 +76,7 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
     }
     // ADR 0003: `startFeature` + the `pr.ensure-base-branch` head task pass through base admission,
     // which reads/creates the base ref. Pin the hermetic `token` transport + fetch stub.
-    restoreGithub = installAdmitGithub(admitGithubState("owner/repo", "main"));
+    restoreGithub = installAdmitGithub(githubState);
   });
 
   after(() => {
@@ -331,6 +332,49 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
     }
   });
 
+  test("reconcile before escalate: a no-status result with an open PR on the branch adopts & converges (issue #801)", async () => {
+    // The #796/#801 defect: a harness returns NO machine-readable status but has pushed the branch and
+    // opened a green PR. Instead of dead-ending at a human, the cell's reconcile step observes the open
+    // PR on `feat/<task.id>` (= `feat/issue-7`), adopts it (status=opened, prKey), and converges.
+    githubState.openPrs.set("feat/issue-7", { number: 801, base: "epic/e2e" });
+    try {
+      await withApp(
+        { "senior:feature": () => ({ summary: "opened a PR but reported no status" }) },
+        { baseBranch: "epic/e2e", converge: true },
+        async ({ app, featureKey }) => {
+          const flows = takenFlows(app);
+          assert.ok(
+            flows.includes("ic_reconcile_gw->ic_end"),
+            `the adopted PR routed straight to the cell's done end (flows: ${flows.join(", ")})`,
+          );
+          assert.ok(
+            !flows.includes("ic_reconcile_gw->record-escalation"),
+            "the run did NOT escalate to a human",
+          );
+          assert.ok(
+            flows.includes("gw-converge->converge"),
+            `the adopted PR was handed to the convergence loop (flows: ${flows.join(", ")})`,
+          );
+          const run = await featureRow(app, featureKey);
+          assert.equal(run.status, "converging", "the reconciled run settled at converging");
+          assert.equal(run.pr_key, "owner/repo#801", "the adopted PR key is recorded on the run");
+          const prs = await app.db.table<PrRow>("pull_requests", "pr_key").find({ pr_key: "owner/repo#801" });
+          assert.equal(prs.length, 1, "the adopted PR was enrolled into the convergence loop (submitPr)");
+
+          // A native user-task escalation was never parked — the machine-recoverable outcome was
+          // reconciled without pulling in a person.
+          const tasks = await app.engine.searchUserTasks({ rootProcessInstanceKey: run.process_key! });
+          assert.ok(
+            !tasks.some((t) => t.elementId === "escalation"),
+            "no human-escalation task was created for the adopted run",
+          );
+        },
+      );
+    } finally {
+      githubState.openPrs.delete("feat/issue-7");
+    }
+  });
+
   test("escalate + abandon: abandoning routes to record-feature (default flow)", async () => {
     await withApp(
       {

package/e2e/support/github-admit.ts

@@ -16,6 +16,10 @@ export interface AdmitGithubState {
   branches: Map<string, string>; // branch → head sha
   creates: { ref: string; sha: string }[];
   resets: string[]; // any PATCH/force-update on an existing ref (must stay empty)
+  /** Open PRs keyed by head branch (issue #801): the implement-cell reconcile step lists PRs for a
+   *  head via `listPrsForHead`. Empty by default → the pulls listing returns `[]` (no adoptable PR),
+   *  so suites that don't opt in keep exactly today's escalate behaviour. */
+  openPrs: Map<string, { number: number; base?: string }>;
 }
 
 /** Build a fresh admit-github state with the default branch pre-seeded with a HEAD sha so an
@@ -30,6 +34,7 @@ export function admitGithubState(
     branches: new Map([[defaultBranch, "0".repeat(40)]]),
     creates: [],
     resets: [],
+    openPrs: new Map(),
   };
 }
 
@@ -72,6 +77,24 @@ function admitFetch(state: AdmitGithubState) {
       state.resets.push(decodeURIComponent(path.split("/git/refs/heads/")[1] ?? ""));
       return Promise.resolve(json({ ok: true }));
     }
+    // GET /repos/{repo}/pulls?state=…&head=owner:branch → the open PRs for a head branch, as read by
+    // `listPrsForHead` (the implement-cell reconcile step, issue #801). Default empty state → `[]`.
+    if (method === "GET" && path === `/repos/${state.repo}/pulls`) {
+      const head = u.searchParams.get("head") ?? "";
+      const branch = head.includes(":") ? head.slice(head.indexOf(":") + 1) : head;
+      const hit = state.openPrs.get(branch);
+      if (!hit) return Promise.resolve(json([]));
+      return Promise.resolve(
+        json([
+          {
+            number: hit.number,
+            html_url: `https://github.com/${state.repo}/pull/${hit.number}`,
+            state: "open",
+            base: { ref: hit.base ?? state.defaultBranch },
+          },
+        ]),
+      );
+    }
     // Any other endpoint is a best-effort read the sealed transport used to skip → 404 (null).
     return Promise.resolve(new Response("Not Found", { status: 404 }));
   };

package/nano.app.json

@@ -239,6 +239,10 @@
     {
       "taskType": "pr.record-feature-implementing",
       "handler": "workers/record-feature-implementing/worker.ts"
+    },
+    {
+      "taskType": "pr.reconcile-implement",
+      "handler": "workers/reconcile-implement/worker.ts"
     }
   ],
   "externalTaskTypes": [

package/openapi.yaml

@@ -429,6 +429,7 @@ components:
         - jobKeys
         - live
         - staleMs
+        - harnessStale
       properties:
         instance:
           type: string
@@ -456,6 +457,17 @@ components:
         staleMs:
           type: integer
           description: Milliseconds since the last liveness refresh (0 when fresh).
+        harnessProtocol:
+          type: integer
+          minimum: 0
+          description: The worker-harness protocol version this worker advertised at enrolment (issue #802), when a numeric one is known.
+        harnessStale:
+          type: boolean
+          description: >-
+            Whether this worker's harness is STALE (issue #802) — below the configured minimum protocol
+            or advertising no version at all — so it may silently swallow AgentInstance / transcript /
+            result-envelope artifacts. Surfaced so the operator can drain it. Distinct from the
+            liveness `staleMs` heartbeat grade.
     AgenticSupplyLeaf:
       type: object
       description: The supply for one leaf token — the workers registered under it.
@@ -622,6 +634,16 @@ components:
             sets false) redrives a re-leased round from scratch. Recorded only when `instance` is
             a non-blank string — a missing, empty, or whitespace-only `instance` is echoed back for
             provenance but the flag is not persisted.
+        harnessProtocol:
+          type: integer
+          minimum: 0
+          description: >-
+            The worker-harness protocol version (issue #802) — a non-negative integer declaring which
+            machine-readable artifacts the harness emits (AgentInstance, transcript flush, result
+            envelope). An ENROLMENT attribute, never a routing token. Recorded per instance so the app
+            can flag a stale harness in getAgenticSupply / the registry and — under
+            NANO_AGENTIC_STALE_HARNESS_POLICY=refuse — refuse it agent-job routing. A missing version is
+            treated as stale.
     EnrolledRole:
       type: object
       description: One matched role in an enrolment resolution — provenance for the resolved SERVE set.
@@ -643,6 +665,7 @@ components:
         - roles
         - demandVersion
         - leaseTtl
+        - harnessStale
       properties:
         instance:
           type: string
@@ -655,6 +678,20 @@ components:
             guarantee of durable persistence — recording into the durable-resume registry is
             best-effort (skipped when `instance` is absent/blank, and a registry write hiccup is
             logged without failing enrolment).
+        harnessProtocol:
+          type: integer
+          minimum: 0
+          description: >-
+            Echo of the request's advertised harness protocol version (issue #802). Present only when
+            the request supplied it.
+        harnessStale:
+          type: boolean
+          description: >-
+            Whether this worker's harness is STALE (issue #802) — below the configured minimum protocol
+            (NANO_AGENTIC_MIN_HARNESS_PROTOCOL) or advertising no version at all. Always present. Under
+            NANO_AGENTIC_STALE_HARNESS_POLICY=refuse a stale harness is handed an EMPTY `serve` set so
+            it wins no job leases; under the default `flag` policy `serve` is unchanged and the worker
+            is only flagged for observability/drain.
         serve:
           type: array
           description: The SERVE token set — sorted, de-duplicated leaf tokens the worker may serve.
@@ -812,7 +849,36 @@ components:
         status:
           type: string
           enum: [green, amber, red]
-          description: The overall SLO — worst of the missing-agent signal and the diversity SLO.
+          description: >-
+            The overall SLO — worst of the missing-agent signal and the diversity SLO, and folded to
+            `red` when any enrolled harness is stale (`staleWorkers` non-empty, issue #802), since the
+            board renders only this pill as its overall signal.
+        staleWorkers:
+          type: array
+          description: >-
+            The enrolled workers whose harness is STALE (issue #802) — below the configured minimum
+            protocol or advertising no version at all — so they may silently swallow AgentInstance /
+            transcript / result-envelope artifacts and should be drained. Present (possibly empty) when
+            the app's harness-protocol registry is available.
+          items:
+            $ref: "#/components/schemas/StaleWorker"
+    StaleWorker:
+      type: object
+      description: One enrolled worker flagged as running a stale harness (issue #802).
+      required:
+        - instance
+        - stale
+      properties:
+        instance:
+          type: string
+          description: The worker instance id.
+        harnessProtocol:
+          type: integer
+          minimum: 0
+          description: The advertised harness protocol version, when a numeric one is known (omitted when none was advertised).
+        stale:
+          type: boolean
+          description: Whether the worker's harness is stale (always true for entries in this list).
     AgenticTranscript:
       type: object
       description: One captured agent session's transcript metadata (H3/#146 transcript store). A durable
@@ -3993,6 +4059,10 @@ paths:
                 durableResume:
                   type: boolean
                   description: "Whether this worker's harness advertises durable-resume (issue #325, ADR 0062 Slice 5/5) — an ENROLMENT attribute, never a routing token. Recorded per instance so the app emits the world-restore marker only to a fleet with a participant; a harness that omits it (or sets false) redrives a re-leased round from scratch. Recorded only when `instance` is a non-blank string — a missing, empty, or whitespace-only `instance` is echoed back for provenance but the flag is not persisted."
+                harnessProtocol:
+                  type: integer
+                  minimum: 0
+                  description: 'The worker-harness protocol version (issue #802) — a non-negative integer declaring which machine-readable artifacts the harness emits (AgentInstance, transcript flush, result envelope). An ENROLMENT attribute, never a routing token. Recorded per instance so the app can flag a stale harness in getAgenticSupply / the registry and — under NANO_AGENTIC_STALE_HARNESS_POLICY=refuse — refuse it agent-job routing. A missing version is treated as stale.'
               # END generated:mcp-body
       responses:
         "200":

package/operations/enrolAgenticWorker.test.ts

@@ -4,6 +4,7 @@ import { assert, assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { memDataFor } from "../test/worldDb.ts";
 import { DurableResumeRegistry } from "../app/durableResume.ts";
+import { HarnessProtocolRegistry } from "../app/harnessProtocol.ts";
 import { noopLog } from "../test/log.ts";
 import handler from "./enrolAgenticWorker.ts";
 
@@ -151,3 +152,86 @@ test("enforces the shared secret when NANO_PR_WEBHOOK_SECRET is set", async () =
     else process.env["NANO_PR_WEBHOOK_SECRET"] = prev;
   }
 });
+
+// Harness-protocol enrolment gate (issue #802).
+const HARNESS_MIGRATIONS = ["052_worker_durable_resume.sql", "107_worker_harness_protocol.sql"];
+
+test("echoes harnessProtocol and reports harnessStale=false for a healthy protocol (>= minimum)", async () => {
+  const res = (await handler(input({ capability: { cognition: "decide" }, instance: "w1", harnessProtocol: 2 }), app)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.harnessProtocol, 2);
+  assertEquals(res.body.harnessStale, false);
+  // No routing regression under the default `flag` policy: SERVE is unchanged.
+  assert(res.body.serve.includes("decide"));
+});
+
+test("flags harnessStale=true when the harness advertises no version at all (absent = stale)", async () => {
+  const res = (await handler(input({ capability: { cognition: "decide" }, instance: "w1" }), app)) as any;
+  assertEquals(res.status, 200);
+  assertEquals("harnessProtocol" in res.body, false, "no protocol echoed when none advertised");
+  assertEquals(res.body.harnessStale, true);
+  // Default `flag` policy: a stale harness is still routed (only flagged), so no fleet regression.
+  assert(res.body.serve.includes("decide"), "flag policy leaves SERVE intact");
+});
+
+test("flags harnessStale=true for a below-minimum protocol", async () => {
+  const prev = process.env["NANO_AGENTIC_MIN_HARNESS_PROTOCOL"];
+  process.env["NANO_AGENTIC_MIN_HARNESS_PROTOCOL"] = "3";
+  try {
+    const res = (await handler(input({ capability: { cognition: "decide" }, instance: "w1", harnessProtocol: 1 }), app)) as any;
+    assertEquals(res.status, 200);
+    assertEquals(res.body.harnessStale, true);
+  } finally {
+    if (prev === undefined) delete process.env["NANO_AGENTIC_MIN_HARNESS_PROTOCOL"];
+    else process.env["NANO_AGENTIC_MIN_HARNESS_PROTOCOL"] = prev;
+  }
+});
+
+test("rejects a non-integer/negative harnessProtocol as 400", async () => {
+  const nonInt = (await handler(input({ capability: { cognition: "decide" }, harnessProtocol: 1.5 }), app)) as any;
+  assertEquals(nonInt.status, 400);
+  const negative = (await handler(input({ capability: { cognition: "decide" }, harnessProtocol: -1 }), app)) as any;
+  assertEquals(negative.status, 400);
+  const str = (await handler(input({ capability: { cognition: "decide" }, harnessProtocol: "2" }), app)) as any;
+  assertEquals(str.status, 400);
+});
+
+test("records the advertised harness protocol in the registry when a data layer + instance are present", async () => {
+  const { data } = memDataFor(HARNESS_MIGRATIONS);
+  const withData = { log: noopLog(), data } as unknown as AppApi;
+  const res = (await handler(input({ capability: { cognition: "decide" }, instance: "w1", harnessProtocol: 2 }), withData)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(await new HarnessProtocolRegistry(data).protocolFor("w1"), 2);
+});
+
+test("a re-enrol WITHOUT a protocol clears a stale-healthy recorded value (degrade to stale)", async () => {
+  const { data } = memDataFor(HARNESS_MIGRATIONS);
+  const withData = { log: noopLog(), data } as unknown as AppApi;
+  await handler(input({ capability: { cognition: "decide" }, instance: "w1", harnessProtocol: 3 }), withData);
+  assertEquals(await new HarnessProtocolRegistry(data).protocolFor("w1"), 3);
+  const res = (await handler(input({ capability: { cognition: "decide" }, instance: "w1" }), withData)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(await new HarnessProtocolRegistry(data).protocolFor("w1"), undefined, "stale-healthy value cleared");
+});
+
+test("under the `refuse` policy a stale harness is handed an EMPTY SERVE set (no job leases)", async () => {
+  const prev = process.env["NANO_AGENTIC_STALE_HARNESS_POLICY"];
+  process.env["NANO_AGENTIC_STALE_HARNESS_POLICY"] = "refuse";
+  try {
+    const mod = await import(`./enrolAgenticWorker.ts?refuse=${Date.now()}`);
+    const guarded = mod.default as typeof handler;
+    // A stale (version-less) worker: SERVE withheld.
+    const stale = (await guarded(input({ capability: { cognition: "decide" }, instance: "w1" }), app)) as any;
+    assertEquals(stale.status, 200);
+    assertEquals(stale.body.harnessStale, true);
+    assertEquals(stale.body.serve, [], "refuse policy withholds SERVE for a stale harness");
+    assertEquals(stale.body.roles, []);
+    // A healthy worker is routed exactly as today.
+    const healthy = (await guarded(input({ capability: { cognition: "decide" }, instance: "w2", harnessProtocol: 5 }), app)) as any;
+    assertEquals(healthy.body.harnessStale, false);
+    assert(healthy.body.serve.includes("decide"), "healthy harness routed under refuse policy");
+  } finally {
+    if (prev === undefined) delete process.env["NANO_AGENTIC_STALE_HARNESS_POLICY"];
+    else process.env["NANO_AGENTIC_STALE_HARNESS_POLICY"] = prev;
+  }
+});

package/operations/enrolAgenticWorker.ts

@@ -13,6 +13,12 @@
 import type { Capability } from "@nanobpm/agentic/protocol";
 import { resolveEnrolment } from "../app/agentic/vocab/enrol.ts";
 import { DurableResumeRegistry } from "../app/durableResume.ts";
+import {
+  HarnessProtocolRegistry,
+  isStaleProtocol,
+  minHarnessProtocol,
+  staleHarnessPolicy,
+} from "../app/harnessProtocol.ts";
 import { envVar } from "../app/version.ts";
 import type { EnrolResult } from "../nano-generated/api-io.d.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
@@ -73,6 +79,22 @@ export default defineOperation("enrolAgenticWorker", async ({ req, body }, app)
     app.log.warn("enrolAgenticWorker rejected: non-boolean durableResume");
     return { status: 400, body: { error: "`durableResume` must be a boolean when provided" } };
   }
+  // The harness-protocol enrolment attribute (issue #802) — a non-negative integer the harness
+  // advertises declaring which machine-readable artifacts it emits (AgentInstance, transcript flush,
+  // result envelope). A directly-invoked delegate bypasses the OpenAPI runtime validation, so guard the
+  // type here: a non-integer / negative value would corrupt the persisted staleness gate.
+  if (
+    body.harnessProtocol !== undefined &&
+    (typeof body.harnessProtocol !== "number" ||
+      !Number.isInteger(body.harnessProtocol) ||
+      body.harnessProtocol < 0)
+  ) {
+    app.log.warn("enrolAgenticWorker rejected: non-integer harnessProtocol");
+    return {
+      status: 400,
+      body: { error: "`harnessProtocol` must be a non-negative integer when provided" },
+    };
+  }
 
   // Fold a top-level `host` into the capability when the capability didn't carry its own — a worker
   // may declare its host either on the capability or beside it (ADR 0059 `{ capability, host }`).
@@ -102,19 +124,57 @@ export default defineOperation("enrolAgenticWorker", async ({ req, body }, app)
     }
   }
 
+  // Harness-protocol enrolment gate (issue #802): record the advertised protocol per instance so the
+  // app can expose it in getAgenticSupply / the registry and gate on it. Recorded even on a downgrade
+  // (a re-enrol WITHOUT a version clears a stale-healthy value to absent → stale). Like durable-resume
+  // it needs a non-blank `instance` and is best-effort — a registry write hiccup must not fail enrol.
+  if (app.data && instanceKey) {
+    try {
+      await new HarnessProtocolRegistry(app.data).recordEnrolment(instanceKey, body.harnessProtocol);
+    } catch (err) {
+      app.log.warn("enrolAgenticWorker: harness-protocol record failed", { instance: instanceKey, err: String(err) });
+    }
+  }
+
+  // Derive staleness from the just-advertised protocol against the configured minimum (absent version =
+  // stale, the #802 signature). Under the `refuse` policy a stale harness is handed an EMPTY SERVE set
+  // so it wins no job leases — a REGISTER→SERVE gate, never an engine/job-protocol change. Under the
+  // default `flag` policy the SERVE set is unchanged (no routing regression); the worker is only
+  // flagged so the cockpit can surface it for drain.
+  const harnessStale = isStaleProtocol(body.harnessProtocol, minHarnessProtocol());
+  const refuseRouting = harnessStale && staleHarnessPolicy() === "refuse";
+  if (refuseRouting) {
+    app.log.warn("enrolAgenticWorker: refusing routing for a stale harness", {
+      instance: body.instance,
+      harnessProtocol: body.harnessProtocol,
+      minHarnessProtocol: minHarnessProtocol(),
+    });
+  }
+
   const result: EnrolResult = {
-    serve: [...resolved.serve],
-    roles: resolved.roles.map((role) => {
-      const out: EnrolResult["roles"][number] = { token: role.token, seatsDistinctFamily: role.seatsDistinctFamily };
-      if (role.weight !== undefined) out.weight = role.weight;
-      return out;
-    }),
+    serve: refuseRouting ? [] : [...resolved.serve],
+    roles: refuseRouting
+      ? []
+      : resolved.roles.map((role) => {
+          const out: EnrolResult["roles"][number] = { token: role.token, seatsDistinctFamily: role.seatsDistinctFamily };
+          if (role.weight !== undefined) out.weight = role.weight;
+          return out;
+        }),
     demandVersion: resolved.demandVersion,
     leaseTtl: resolved.leaseTtl,
+    // Always surface the staleness verdict so the caller (and the cockpit) can see a stale harness even
+    // when it advertised no version at all.
+    harnessStale,
   };
   if (body.instance !== undefined) result.instance = body.instance;
   if (body.durableResume !== undefined) result.durableResume = body.durableResume;
+  if (body.harnessProtocol !== undefined) result.harnessProtocol = body.harnessProtocol;
 
-  app.log.info("agentic enrol resolved", { instance: body.instance, serve: result.serve, family: capability.family });
+  app.log.info("agentic enrol resolved", {
+    instance: body.instance,
+    serve: result.serve,
+    family: capability.family,
+    harnessStale,
+  });
   return { status: 200, body: result };
 });

package/operations/getAgenticRegistry.ts

@@ -20,6 +20,6 @@ export default defineOperation("getAgenticRegistry", async ({ req }, app) => {
     app.log.warn("getAgenticRegistry rejected: missing/invalid shared secret");
     return { status: 401, body: { error: "unauthorized" } };
   }
-  const report = await computeRegistryReport(app.log);
+  const report = await computeRegistryReport(app.log, app.data);
   return { status: 200, body: toWireReport(report) };
 });

package/operations/getAgenticSupply.test.ts

@@ -5,6 +5,7 @@
 // by instance, family/host/jobKeys/liveness) — driven through a REAL AgenticHub + in-memory transport
 // exactly as the presence family is exercised, so the singleton the operation reads is the live one.
 import { DatabaseSync } from "node:sqlite";
+import { readFileSync } from "node:fs";
 import { test } from "node:test";
 import { AgenticHub } from "@nanobpm/agentic/channel";
 import type { Authenticator, ChannelConnection, ChannelTransport } from "@nanobpm/agentic/channel";
@@ -39,6 +40,19 @@ function memData(db: SqliteDb): DataLayer {
   return { source: () => ({ db }) } as unknown as DataLayer;
 }
 
+/** Wrap an existing DatabaseSync as a SqliteDb (so the presence store and a raw insert share one db). */
+function memSqliteOver(db: DatabaseSync): SqliteDb {
+  return {
+    exec: (sql) => db.exec(sql),
+    run: (sql, params = []) => {
+      const r = db.prepare(sql).run(...(params as never[]));
+      return { changes: Number(r.changes), lastInsertRowid: Number(r.lastInsertRowid) };
+    },
+    all: <T = Record<string, unknown>>(sql: string, params: unknown[] = []) =>
+      db.prepare(sql).all(...(params as never[])) as T[],
+  };
+}
+
 function memTransport(): { transport: ChannelTransport; connect(conn: ChannelConnection): void } {
   let onConnection: ((conn: ChannelConnection) => void) | undefined;
   const transport: ChannelTransport = {
@@ -259,3 +273,69 @@ test("#738 drift: the supply advertises the producer's instance-scoped stream id
     await hub.close();
   }
 });
+
+// Harness staleness (issue #802): the supply report flags a worker whose harness protocol is below the
+// minimum / absent, joined by instance from the app's harness-protocol registry.
+test("#802: flags harnessStale per worker, joining the harness-protocol registry by instance", async () => {
+  const raw = new DatabaseSync(":memory:");
+  raw.exec("PRAGMA foreign_keys = ON;");
+  raw.exec(readFileSync(new URL("../db/migrations/107_worker_harness_protocol.sql", import.meta.url), "utf8"));
+  const now = new Date().toISOString();
+  // wk-a advertised a healthy protocol (>= min 1); wk-a's presence row is minted below.
+  raw.prepare("INSERT INTO worker_harness_protocol (instance, harness_protocol, updated_at) VALUES (?, ?, ?)").run("wk-a", 2, now);
+
+  // A data layer providing BOTH the presence `source().db` handle and the RAD `table()` surface over
+  // the SAME db, so the presence family and the harness registry read one store.
+  const sqlite = memSqliteOver(raw);
+  const quote = (id: string) => `"${id.replace(/"/g, '""')}"`;
+  const table = (name: string, pk = "id") => ({
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway.
+    async find(where: any = {}): Promise<any[]> {
+      const keys = Object.keys(where);
+      const clause = keys.length ? `WHERE ${keys.map((k) => `${quote(k)} = ?`).join(" AND ")}` : "";
+      return raw.prepare(`SELECT * FROM ${quote(name)} ${clause}`).all(...keys.map((k) => where[k])) as any[];
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway.
+    async findOne(where: any = {}): Promise<any> {
+      return (await this.find(where))[0];
+    },
+    _pk: pk,
+  });
+  const data = {
+    source: () => ({ db: sqlite }),
+    table,
+    // The raw-SQL surface the harness registry's bounded `WHERE instance IN (…)` read binds to, over
+    // the SAME db as `table`/presence.
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway.
+    open: () => ({ query: async (sql: string, params: any[] = []) => raw.prepare(sql).all(...params) as any[] }),
+  } as unknown as DataLayer;
+
+  const transport = memTransport();
+  const hub = new AgenticHub({ transport: transport.transport, authenticator, sweepIntervalMs: 0 });
+  await family.mount({ hub, registry: hub.registry, transport: transport.transport as never, data, log: noopLog() });
+  const healthyConn = fakeConn("c1", "leafA");
+  transport.connect(healthyConn.conn);
+  await flush();
+  healthyConn.feed({ lane: "control", family: "register", seq: 1, payload: { instance: "wk-a", capability: {} } });
+  const staleConn = fakeConn("c2", "leafA");
+  transport.connect(staleConn.conn);
+  await flush();
+  // wk-b registers but has NO harness-protocol row → absent = stale.
+  staleConn.feed({ lane: "control", family: "register", seq: 1, payload: { instance: "wk-b", capability: {} } });
+  await flush();
+
+  const withData = { log: noopLog(), data } as unknown as AppApi;
+  try {
+    const res = (await handler(input(), withData)) as { status: number; body: { workers: Array<Record<string, unknown>> } };
+    assertEquals(res.status, 200);
+    const byInstance = new Map(res.body.workers.map((w) => [w.instance, w]));
+    assertEquals(byInstance.get("wk-a")?.harnessStale, false, "healthy protocol is not stale");
+    assertEquals(byInstance.get("wk-a")?.harnessProtocol, 2);
+    assertEquals(byInstance.get("wk-b")?.harnessStale, true, "no recorded protocol = stale");
+    assertEquals("harnessProtocol" in (byInstance.get("wk-b") ?? {}), false, "no protocol echoed for a stale worker");
+  } finally {
+    family.teardown?.();
+    await hub.close();
+    raw.close();
+  }
+});

package/operations/getAgenticSupply.ts

@@ -23,6 +23,7 @@
 import { type ClaimRegistry, currentClaimRegistry } from "../app/agentic/claim-registry.ts";
 import { currentCorrelation, type JobCorrelation } from "../app/agentic/correlation.ts";
 import { currentPresenceRegistry, type SupplyWorker } from "../app/agentic/families/presence.family.ts";
+import { assessWorkers, type HarnessAssessment } from "../app/harnessProtocol.ts";
 import { envVar } from "../app/version.ts";
 import type { AgenticJobCorrelation, AgenticSupplyReport, AgenticSupplyWorker } from "../nano-generated/api-io.d.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
@@ -36,7 +37,7 @@ const SECRET = envVar("NANO_PR_WEBHOOK_SECRET") ?? "";
 // (`composeStreamId(instance, jobKey)`, issue #738) when the claim registry knows a current claim for
 // it (#713) — keyed by the CLAIM, not by the connection — so drilling in opens the LIVE job's terminal
 // (the exact stream the producer writes) even before any transcript lands.
-function toWorker(w: SupplyWorker, claims: ClaimRegistry | undefined): AgenticSupplyWorker {
+function toWorker(w: SupplyWorker, claims: ClaimRegistry | undefined, harness: HarnessAssessment | undefined): AgenticSupplyWorker {
   const out: AgenticSupplyWorker = {
     instance: w.instance,
     identity: w.identity,
@@ -44,9 +45,13 @@ function toWorker(w: SupplyWorker, claims: ClaimRegistry | undefined): AgenticSu
     jobKeys: [...w.jobKeys],
     live: w.live,
     staleMs: w.staleMs,
+    // Harness staleness (issue #802) — an absent registry entry / unmounted data layer reads as stale
+    // (fail loud). Distinct from the liveness `staleMs` heartbeat grade above.
+    harnessStale: harness?.stale ?? true,
   };
   if (w.family !== undefined) out.family = w.family;
   if (w.host !== undefined) out.host = w.host;
+  if (harness?.harnessProtocol !== undefined) out.harnessProtocol = harness.harnessProtocol;
   return out;
 }
 
@@ -82,11 +87,18 @@ export default defineOperation("getAgenticSupply", async ({ req }, app) => {
   // process-instance / plan context surfaced in `correlations`, but no longer feeds visibility.
   const correlation = currentCorrelation();
   const snapshot = registry.snapshot(claims ? { jobKeysFor: (instance) => claims.jobKeysFor(instance) } : {});
+  // Harness-staleness (issue #802): assess every visible worker's advertised protocol against the
+  // configured minimum — the ONE canonical staleness derivation (no second heuristic). Best-effort:
+  // an unmounted data layer / read failure reads as stale (fail loud).
+  const harness = await assessWorkers(app.data, snapshot.workers.map((w) => w.instance));
   const report: AgenticSupplyReport = {
     count: snapshot.count,
     generatedAt: new Date().toISOString(),
-    workers: snapshot.workers.map((w) => toWorker(w, claims)),
-    leaves: snapshot.leaves.map((leaf) => ({ token: leaf.token, workers: leaf.workers.map((w) => toWorker(w, claims)) })),
+    workers: snapshot.workers.map((w) => toWorker(w, claims, harness.get(w.instance))),
+    leaves: snapshot.leaves.map((leaf) => ({
+      token: leaf.token,
+      workers: leaf.workers.map((w) => toWorker(w, claims, harness.get(w.instance))),
+    })),
     correlations: correlation ? correlation.snapshot().correlations.map(toCorrelation) : [],
   };
   return { status: 200, body: report };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.188.0",
+  "version": "0.189.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/cockpit/mount.js

@@ -84,6 +84,10 @@ function workerView(worker, staleAfterMs, byJobKey) {
     correlations,
     liveness: liveness(worker, staleAfterMs),
     staleMs: worker.staleMs,
+    // Fail loud: default a missing harness verdict to STALE (mirrors the typed cockpit view and the
+    // server's fail-loud assessment) so an older/cached response can't hide a stale/unknown worker.
+    harnessStale: worker.harnessStale ?? true,
+    ...(worker.harnessProtocol !== undefined ? { harnessProtocol: worker.harnessProtocol } : {}),
   };
 }
 
@@ -141,6 +145,7 @@ function workerRow(doc, worker, onDrill, onOpenWorker) {
   row.setAttribute("data-worker", worker.instance);
   row.setAttribute("data-liveness", worker.liveness);
   row.setAttribute("data-stream", worker.stream);
+  row.setAttribute("data-harness-stale", String(worker.harnessStale));
 
   const nameCell = el(doc, "td", "cockpit-td cockpit-supply-name");
   nameCell.appendChild(dot(doc, worker.liveness));
@@ -162,6 +167,19 @@ function workerRow(doc, worker, onDrill, onOpenWorker) {
     if (onDrill) drill.addEventListener("click", () => onDrill(worker.stream));
     nameCell.appendChild(drill);
   }
+  // A stale harness silently swallows machine-readable artifacts (issue #802) — surface it as a
+  // distinct badge (mirrors app/agentic/cockpit/supply-render.ts).
+  if (worker.harnessStale) {
+    const badge = el(
+      doc,
+      "span",
+      "cockpit-supply-harness-stale",
+      worker.harnessProtocol === undefined ? "stale harness" : `stale harness (v${worker.harnessProtocol})`,
+    );
+    badge.setAttribute("data-harness-stale", "true");
+    badge.setAttribute("title", "Harness protocol below the configured minimum (or none advertised); jobs may dead-end.");
+    nameCell.appendChild(badge);
+  }
   row.appendChild(nameCell);
 
   row.appendChild(el(doc, "td", "cockpit-td cockpit-supply-family", worker.family));

package/resources/processes/feature.bpmn

@@ -174,6 +174,7 @@
         <zeebe:calledElement processId="implement-cell" />
         <zeebe:ioMapping>
           <zeebe:input source="=task" target="task" />
+          <zeebe:input source="=baseBranch" target="baseBranch" />
           <zeebe:input source="=if (is defined(baseBranchBrief)) then baseBranchBrief else null" target="baseBranchBrief" />
           <zeebe:input source="=if (is defined(resolvedArtifacts)) then resolvedArtifacts else null" target="resolvedArtifacts" />
           <zeebe:input source="=if (is defined(customInstructions)) then customInstructions else null" target="customInstructions" />