@nanobpm/nano-workforce 0.190.0 → 0.191.1

package/app/deliveryGraphProposals.ts

@@ -62,6 +62,15 @@ export interface DeliveryGraphProposal {
   created_at: string;
   updated_at: string;
   expires_at: string;
+  /** A strictly-monotonic per-write stage revision (migration 114), reassigned to `MAX(stage_seq)+1`
+   * on every stage write (insert AND re-stage). It is the supersede reconcile's same-millisecond
+   * tie-break, AND the version token the dispatch door threads through so `markProposalDispatched`
+   * can guard its terminal flip against a concurrent re-stage that overwrote this same-digest row with
+   * a newer (e.g. credential-differing) graph after this dispatch snapshotted it (issue #778 review —
+   * thread deliveryGraphProposals.ts:243). Persisted rows carry a value ≥ 1; a pre-migration row reads
+   * `0` until its next stage re-sequences it. Assigned atomically in the `stageProposal` SQL, never
+   * from a row object — a freshly-`buildProposalRow`'d row's `0` here is a never-persisted placeholder. */
+  stage_seq: number;
 }
 
 /** The rendered preview a staged proposal carries — the operator-facing view of WHAT the graph does
@@ -150,6 +159,9 @@ export function buildProposalRow(input: {
     created_at: createdAt,
     updated_at: at,
     expires_at: proposalExpiry(createdAt),
+    // Placeholder only: the persisted `stage_seq` is assigned atomically as `MAX(stage_seq)+1` inside
+    // the `stageProposal` INSERT/UPSERT (never bound from this object), so this `0` is never written.
+    stage_seq: 0,
   };
 }
 
@@ -190,55 +202,77 @@ export interface StageOutcome {
  * retire. */
 export async function stageProposal(data: DataLayer, row: DeliveryGraphProposal): Promise<StageOutcome> {
   const table = deliveryGraphProposals(data);
-  const existing = await table.get(row.digest);
   // Capture the same-logical-key staged siblings that exist BEFORE this stage writes (excluding our own
   // digest) — the supersede reconcile below normally flips them all to `superseded`; we re-read them
   // after to report exactly which digests this stage retired.
   const priorSameKey = (await table.find({ status: "staged" })).filter(
     (r) => r.logical_key === row.logical_key && r.digest !== row.digest && isLiveStaged(r),
   );
-  const toWrite = existing
-    ? buildProposalRow({
-        digest: row.digest,
-        logicalKey: row.logical_key,
-        title: row.title,
-        graphJson: row.graph,
-        preview: JSON.parse(row.preview),
-        nodeCount: row.node_count,
-        humanNodeCount: row.human_node_count,
-        sideEffectCount: row.side_effect_count,
-        sideEffecting: row.side_effecting === 1,
-        // Re-stage: if the existing row is STILL LIVE, preserve its original stage time so the TTL
-        // stays anchored to the first stage. But if it has already aged out of its TTL (or was
-        // dispatched/superseded long ago), reusing the stale `created_at` would yield a past
-        // `expires_at`, leaving the "re-staged" row immediately non-dispatchable (`getStagedProposal`
-        // rejects it as expired) while the preview claims it is staged. In that case re-anchor the TTL
-        // to now (omit `createdAt`) so a re-proposed digest is genuinely live again.
-        createdAt: isProposalExpired(existing.expires_at) ? undefined : existing.created_at,
-      })
-    : row;
-  if (existing) {
-    const { digest, ...patch } = toWrite;
-    await table.update(row.digest, patch);
-  } else {
-    await table.insert(toWrite);
-  }
-  // Reconcile to EXACTLY ONE live proposal per logical graph: supersede every `staged` row for this
-  // `logical_key` that has a strictly-NEWER staged sibling (by `updated_at`, with a deterministic
-  // `digest` tie-breaker), leaving only the globally-newest live. This is ORDER-INDEPENDENT — it never
-  // references the just-written digest, so it converges to a single live row regardless of the
-  // interleaving of concurrent stages. A supersede pass keyed to "only flip rows older than the one *I*
-  // just wrote" leaves TWO live proposals when an OLDER stage's pass runs AFTER a newer stage already
-  // committed (the older pass won't flip the newer row, and the newer pass ran before the older row
-  // existed) — and an unordered supersede-all leaves ZERO. Anchoring on the newest staged sibling avoids
-  // both: the newest row is never superseded (no newer sibling), so it stays staged throughout the
-  // statement and every older row's `EXISTS` is satisfied by it. Idempotent: a no-op once one row remains.
-  await data
-    .open()
-    .exec(
-      `UPDATE "delivery_graph_proposals" SET "status" = 'superseded', "updated_at" = ? WHERE "logical_key" = ? AND "status" = 'staged' AND EXISTS (SELECT 1 FROM "delivery_graph_proposals" AS "newer" WHERE "newer"."logical_key" = "delivery_graph_proposals"."logical_key" AND "newer"."status" = 'staged' AND ("newer"."updated_at" > "delivery_graph_proposals"."updated_at" OR ("newer"."updated_at" = "delivery_graph_proposals"."updated_at" AND "newer"."digest" > "delivery_graph_proposals"."digest")))`,
+  // Persist the write, its strictly-monotonic stage sequence, AND the supersede reconcile as ONE
+  // transaction (issue #778 review — threads deliveryGraphProposals.ts:237/:239). Two properties matter:
+  //   • `stage_seq` is assigned ATOMICALLY inside the write itself — `MAX(stage_seq)+1` in the
+  //     INSERT/UPDATE, NOT a separate stamp statement — so there is never a "written but unstamped
+  //     (seq 0)" window in which a rival same-millisecond stage's reconcile could read the half-written
+  //     sibling at its DEFAULT 0 and supersede it out of order (the inversion the old two-statement
+  //     stamp+reconcile allowed). Assigning inside the serialized transaction keeps `MAX(...)` atomic, so
+  //     `+1` is strictly greater than every committed seq and reflects true write order.
+  //   • wrapping the reconcile in the SAME transaction means no concurrent stage observes an intermediate
+  //     state between the write and the reconcile.
+  // `MAX(stage_seq)` reads the pre-write table via the `stage_seq` index (migration 114), an O(1)
+  // reverse-index seek rather than the full-history scan a bare aggregate over the retained terminal rows
+  // would cost.
+  const at = now();
+  const atExpiry = proposalExpiry(at);
+  const nextSeq = `(SELECT COALESCE(MAX("stage_seq"), 0) + 1 FROM "delivery_graph_proposals")`;
+  await data.open().tx(async (t) => {
+    // Single idempotent UPSERT rather than a read-`existing`-then-branch INSERT/UPDATE: reading the row
+    // BEFORE the transaction meant two concurrent FIRST stages of the same digest both saw `null` and
+    // would both take an INSERT — the second hitting a primary-key conflict that fails the stage and drops
+    // its reconciliation. `ON CONFLICT("digest") DO UPDATE` collapses the raced insert into an in-place
+    // update instead, so a same-digest stage is idempotent regardless of arrival order (issue #778 review —
+    // thread deliveryGraphProposals.ts:245). `stage_seq` is still assigned ATOMICALLY inside the write
+    // (`MAX(stage_seq)+1`, materialised once as `excluded."stage_seq"` so the insert and the on-conflict
+    // update use the exact same value), preserving the strictly-monotonic ordering the supersede reconcile
+    // below tie-breaks on.
+    //
+    // The TTL anchor (`created_at`) and horizon (`expires_at`) are ALSO derived inside this atomic write,
+    // from the row as it exists AT WRITE TIME — NOT from a pre-transaction `table.get` snapshot (issue #778
+    // review — thread deliveryGraphProposals.ts:247). A pre-read snapshot is a TOCTOU: a concurrent re-stage
+    // can commit a fresh TTL between the read and this write, and the stale caller — committing LAST, so it
+    // wins the newest `stage_seq` — would overwrite that fresh horizon with the one it computed from the OLD
+    // `created_at`, restoring an already-expired `expires_at` on the newest row and leaving the proposal
+    // non-dispatchable. On a fresh INSERT the caller's `created_at`/`expires_at` stand (first stage anchors
+    // the TTL). On a CONFLICT the `CASE` re-reads the CURRENT committed row: if it is still LIVE
+    // (`expires_at` in the future) the original anchor and horizon are PRESERVED (an idempotent re-stage
+    // keeps the TTL pinned to the first stage); once it has aged out (past, blank, or NULL `expires_at`,
+    // matching `isProposalExpired`'s fail-closed rule) the TTL is RE-ANCHORED to now so a re-proposed digest
+    // is genuinely live again. All timestamps are ISO-8601 UTC, so the lexical `>` comparison is a valid
+    // chronological test.
+    await t.exec(
+      `INSERT INTO "delivery_graph_proposals" ("digest", "logical_key", "title", "graph", "preview", "node_count", "human_node_count", "side_effect_count", "side_effecting", "status", "created_at", "updated_at", "expires_at", "stage_seq") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ${nextSeq}) ON CONFLICT("digest") DO UPDATE SET "logical_key" = excluded."logical_key", "title" = excluded."title", "graph" = excluded."graph", "preview" = excluded."preview", "node_count" = excluded."node_count", "human_node_count" = excluded."human_node_count", "side_effect_count" = excluded."side_effect_count", "side_effecting" = excluded."side_effecting", "status" = excluded."status", "created_at" = CASE WHEN "delivery_graph_proposals"."expires_at" > ? THEN "delivery_graph_proposals"."created_at" ELSE ? END, "updated_at" = ?, "expires_at" = CASE WHEN "delivery_graph_proposals"."expires_at" > ? THEN "delivery_graph_proposals"."expires_at" ELSE ? END, "stage_seq" = excluded."stage_seq"`,
+      [row.digest, row.logical_key, row.title, row.graph, row.preview, row.node_count, row.human_node_count, row.side_effect_count, row.side_effecting, row.status, row.created_at, at, row.expires_at, at, at, at, at, atExpiry],
+    );
+    // Reconcile to EXACTLY ONE live proposal per logical graph: supersede every `staged` row for this
+    // `logical_key` that has a strictly-NEWER staged sibling (by `updated_at`, with a deterministic
+    // `stage_seq` tie-breaker), leaving only the globally-newest live. This is ORDER-INDEPENDENT
+    // — it never references the just-written digest, so it converges to a single live row regardless of the
+    // interleaving of concurrent stages. A supersede pass keyed to "only flip rows older than the one *I*
+    // just wrote" leaves TWO live proposals when an OLDER stage's pass runs AFTER a newer stage already
+    // committed (the older pass won't flip the newer row, and the newer pass ran before the older row
+    // existed) — and an unordered supersede-all leaves ZERO. Anchoring on the newest staged sibling avoids
+    // both: the newest row is never superseded (no newer sibling), so it stays staged throughout the
+    // statement and every older row's `EXISTS` is satisfied by it. Idempotent: a no-op once one row remains.
+    // The tie-break is the monotonic `stage_seq` (atomically assigned in the write above), NOT the content
+    // `digest` NOR the frozen `rowid`: two stages landing in the SAME millisecond tie on `updated_at`, and a
+    // `digest`-string tie-break is arbitrary w.r.t. submission order while `rowid` does not advance on a
+    // re-stage UPDATE — so either could pick the LATER-submitted graph as the one superseded, inverting
+    // "the latest stage wins". `stage_seq` advances on every stage (insert AND re-stage alike), so the
+    // most-recently-written row deterministically wins the tie.
+    await t.exec(
+      `UPDATE "delivery_graph_proposals" SET "status" = 'superseded', "updated_at" = ? WHERE "logical_key" = ? AND "status" = 'staged' AND EXISTS (SELECT 1 FROM "delivery_graph_proposals" AS "newer" WHERE "newer"."logical_key" = "delivery_graph_proposals"."logical_key" AND "newer"."status" = 'staged' AND ("newer"."updated_at" > "delivery_graph_proposals"."updated_at" OR ("newer"."updated_at" = "delivery_graph_proposals"."updated_at" AND "newer"."stage_seq" > "delivery_graph_proposals"."stage_seq")))`,
       [now(), row.logical_key],
     );
+  });
 
   // Report what the stage did to siblings (issue #740). `superseded` = the same-logical-key proposals
   // this stage retired (re-read post-reconcile so a concurrent newer stage that kept ITS row live —
@@ -259,12 +293,13 @@ export async function stageProposal(data: DataLayer, row: DeliveryGraphProposal)
   }
   const siblingsStaged = (await listStagedProposals(data)).filter((r) => r.logical_key !== row.logical_key).length;
 
-  // Re-read the just-written row AFTER the reconcile so `row` reports the ACTUALLY-persisted state, not
-  // the pre-reconcile `toWrite`: a concurrent newer stage of a different digest can flip THIS digest to
-  // `superseded` in the reconcile above, so returning `toWrite` (still `staged`) would report a status
-  // that doesn't match the DB. Fall back to `toWrite` only if the row somehow vanished (it shouldn't —
-  // we just wrote it), keeping the return non-null.
-  const persisted = (await table.get(toWrite.digest)) ?? toWrite;
+  // Re-read the just-written row AFTER the reconcile so the returned row reports the ACTUALLY-persisted
+  // state: a concurrent newer stage of a different digest can flip THIS digest to `superseded` in the
+  // reconcile above, so returning the pre-reconcile input `row` (still `staged`) would report a status
+  // that doesn't match the DB — and the persisted `created_at`/`expires_at`/`stage_seq` are derived inside
+  // the write, not on `row`. Fall back to the input `row` only if the persisted row somehow vanished (it
+  // shouldn't — we just wrote it), keeping the return non-null.
+  const persisted = (await table.get(row.digest)) ?? row;
 
   return { row: persisted, superseded, siblingsStaged };
 }
@@ -321,9 +356,36 @@ export async function listStagedProposals(
 }
 
 /** Mark a staged proposal `dispatched` once the operator launches it — it drops out of the cockpit's
- * staged list (the run then shows in the in-flight grid). */
-export async function markProposalDispatched(data: DataLayer, digest: string): Promise<void> {
-  await deliveryGraphProposals(data).update(digest, { status: "dispatched", updated_at: now() });
+ * staged list (the run then shows in the in-flight grid).
+ *
+ * Like `markProposalExpired`/`markProposalDismissed`/`sweepExpiredProposals`, this is a GUARDED UPDATE
+ * (`... WHERE digest=? AND status='staged'`), not a blind update-by-key. The dispatch door's
+ * `getStagedProposal` liveness read, the launch, and this terminal flip are separate statements, so the
+ * row can leave `staged` in the window between them (a concurrent dispatch consumed it, or a
+ * dismiss/supersede/expiry sweep retired it); a blind `table.update(digest, …)` would clobber that
+ * newer terminal status back to `dispatched`, breaking monotonic lifecycle transitions.
+ *
+ * When `expectedStageSeq` is supplied the guard ALSO pins `stage_seq` to the value the dispatch door
+ * snapshotted when it loaded the proposal (issue #778 review — thread deliveryGraphProposals.ts:243). A
+ * concurrent RE-STAGE of the SAME digest overwrites the row in place with a newer graph (two
+ * credential-differing graphs share a semantic digest) and bumps `stage_seq`; without the seq pin, this
+ * flip would retire that newer, never-launched graph — the dispatch launched the STALE snapshot it read
+ * yet marks the fresh row consumed. Pinning `stage_seq` makes the flip a no-op in that race, leaving the
+ * re-staged graph `staged` for its own dispatch. Omit `expectedStageSeq` (e.g. a pre-migration row whose
+ * seq is `0`) to fall back to the `status='staged'`-only guard.
+ *
+ * Returns whether the guarded UPDATE actually flipped a row (`res.changed > 0`), mirroring
+ * `markProposalDismissed`/`sweepExpiredProposals`. A `false` return means the row was no longer the
+ * `staged` revision this dispatch snapshotted (a concurrent dispatch/re-stage/retire won) — the launched
+ * run still stands, but the mark was intentionally skipped so the newer row is not clobbered. */
+export async function markProposalDispatched(data: DataLayer, digest: string, expectedStageSeq?: number): Promise<boolean> {
+  const db = data.open();
+  const guardSeq = typeof expectedStageSeq === "number";
+  const res = await db.exec(
+    `UPDATE "delivery_graph_proposals" SET "status" = 'dispatched', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'${guardSeq ? ` AND "stage_seq" = ?` : ""}`,
+    guardSeq ? [now(), digest, expectedStageSeq] : [now(), digest],
+  );
+  return res.changed > 0;
 }
 
 /** Retire a proposal by flipping it to `expired` — its `graph` payload is unusable (e.g. corrupt JSON
@@ -342,12 +404,18 @@ export async function markProposalDispatched(data: DataLayer, digest: string): P
  * Returns whether the guarded UPDATE actually flipped a row (`res.changed > 0`), mirroring
  * `markProposalDismissed`/`sweepExpiredProposals`. A `false` return means the row was no longer `staged`
  * at write time (a dismiss/supersede/dispatch race won), so the caller must not treat the retirement as
- * having happened. */
-export async function markProposalExpired(data: DataLayer, digest: string): Promise<boolean> {
+ * having happened.
+ *
+ * When an `expectedStageSeq` is supplied (the dispatch door's corrupt-graph retirement), the flip is
+ * ADDITIONALLY guarded on `stage_seq = ?`, exactly like `markProposalDispatched`: a concurrent re-stage
+ * of the same digest bumps `stage_seq`, so guarding on the revision we inspected keeps the expiry from
+ * retiring a newer graph that landed in the read→write window (issue #778 review). */
+export async function markProposalExpired(data: DataLayer, digest: string, expectedStageSeq?: number): Promise<boolean> {
   const db = data.open();
+  const guardSeq = typeof expectedStageSeq === "number";
   const res = await db.exec(
-    `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'`,
-    [now(), digest],
+    `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'${guardSeq ? ` AND "stage_seq" = ?` : ""}`,
+    guardSeq ? [now(), digest, expectedStageSeq] : [now(), digest],
   );
   return res.changed > 0;
 }
@@ -404,9 +472,15 @@ export async function sweepExpiredProposals(data: DataLayer, at: Date = new Date
   let swept = 0;
   for (const row of staged) {
     if (isProposalExpired(row.expires_at, at)) {
+      // Pin `stage_seq` (like `markProposalDispatched`/`markProposalExpired`): the `find` liveness read and
+      // this flip are separate statements, so a concurrent RE-STAGE can overwrite the row in place with a
+      // newer graph — bumping `stage_seq` and REFRESHING `expires_at` — in the window between them. A blind
+      // `digest + status='staged'` update would then expire that fresh, un-expired revision. Guarding on the
+      // `stage_seq` we inspected makes the flip a no-op in that race, leaving the re-staged graph `staged`
+      // (issue #778 review — thread deliveryGraphProposals.ts:417).
       const res = await db.exec(
-        `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged'`,
-        [ts, row.digest],
+        `UPDATE "delivery_graph_proposals" SET "status" = 'expired', "updated_at" = ? WHERE "digest" = ? AND "status" = 'staged' AND "stage_seq" = ?`,
+        [ts, row.digest, row.stage_seq],
       );
       swept += res.changed;
     }

package/app/deliveryGraphRun.test.ts

@@ -8,7 +8,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { test } from "node:test";
-import { assertEquals } from "#test-assert";
+import { assert, assertEquals, assertStringIncludes } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
 import { bootTestApp } from "@nanobpm/urban-testkit";
 import { compileDeliveryGraph } from "./deliveryGraphCompiler.ts";
@@ -19,6 +19,7 @@ import {
   computeRunKey,
   deriveDeliveryPhase,
   DELIVERY_PHASE,
+  deliveryGraphRunIdentities,
   deliveryGraphRuns,
   humanTaskElementId,
   parseHumanLabels,
@@ -107,6 +108,25 @@ test("claimRunForLaunch: re-running a terminal row clears the PRIOR instance key
   });
 });
 
+test("claimRunForLaunch: winning a re-run claim ATOMICALLY invalidates the prior run's identity side-row — a concurrent loser's short-circuit read sees a MISSING (unprovable) fingerprint, not the stale prior one (issue #778 review — thread deliveryGraphDispatch.ts:180)", async () => {
+  await withData(async (data) => {
+    const runs = deliveryGraphRuns(data);
+    const identities = deliveryGraphRunIdentities(data);
+    // A terminal prior run still carrying its stamped lossless identity fingerprint.
+    await runs.insert({ ...claimRow("running"), status: "failed" });
+    await identities.insert({ run_key: "rk", graph_fingerprint: "PRIOR-FP", created_at: "2020-01-01T00:00:00.000Z" });
+    // The winner re-runs (conceptually a DIFFERENT graph that shares the digest-derived run_key but not
+    // the credential-sensitive fingerprint). The CAS flips the row to running…
+    assertEquals(await claimRunForLaunch(data, true, claimRow("running")), true);
+    // …and the stale identity row must be GONE the instant the row is `running`. Otherwise a racing loser
+    // reading between this flip and the winner's post-launch `upsertRunIdentity` re-stamp would read
+    // "PRIOR-FP" and, if that matched ITS graph, wrongly confirm identity for a credential-different run.
+    // Missing → dispatch's identityConfirmed is false (the safe 409) throughout the window.
+    const after = await identities.get("rk");
+    assert(after == null, `the stale identity row must be gone, got: ${JSON.stringify(after)}`);
+  });
+});
+
 // ── pollDeliveryGraphPhase: engine-key coercion ───────────────────────────────
 test("pollDeliveryGraphPhase: a numeric engine processInstanceKey still matches the string process_key, so a COMPLETED instance reconciles to done", async () => {
   await withData(async (data) => {
@@ -181,7 +201,7 @@ test("computeRunKey: a non-blank caller key wins; a blank/absent key falls back
 });
 
 // ── buildHumanLabels / parseHumanLabels ───────────────────────────────────────
-test("buildHumanLabels: maps each human node's compiled user-task element id → its instruction label", async () => {
+test("buildHumanLabels: maps each human node's compiled user-task element id → its FULL instruction", async () => {
   const graph = {
     nodes: [
       { id: "open-b", kind: "agent", agent: { jobType: "j" } },
@@ -196,16 +216,38 @@ test("buildHumanLabels: maps each human node's compiled user-task element id →
   const labels = buildHumanLabels(compiled);
   const publishEl = compiled.resolved.nodes.find((n) => n.id === "publish")?.element ?? "";
   const ackEl = compiled.resolved.nodes.find((n) => n.id === "ack")?.element ?? "";
-  assertEquals(labels[humanTaskElementId(publishEl)], "run the manual OTP publish"); // first line only
+  // The FULL prompt is stored (issue #813) — not a clamped first line — so the Tasks "Decision
+  // context" can show the whole instruction. The phase pill clamps this at display (deriveDeliveryPhase).
+  assertEquals(labels[humanTaskElementId(publishEl)], "run the manual OTP publish\nsecond line");
   assertEquals(labels[humanTaskElementId(ackEl)], "ack"); // fallback to node id
 });
 
+test("buildHumanLabels: redacts a credential-bearing human prompt before it lands in human_labels (issue #778 review)", async () => {
+  const graph = {
+    nodes: [
+      { id: "publish", kind: "human", human: { prompt: "deploy via https://user:s3cr3t@registry.example.com then confirm" } },
+    ],
+    edges: [],
+  };
+  const compiled = await compileDeliveryGraph(graph);
+  assertEquals(compiled.ok, true);
+  if (!compiled.ok) return;
+  const labels = buildHumanLabels(compiled);
+  const publishEl = compiled.resolved.nodes.find((n) => n.id === "publish")?.element ?? "";
+  const label = labels[humanTaskElementId(publishEl)];
+  assert(!label.includes("s3cr3t") && !label.includes("user:s3cr3t"), "the credential must not survive into the denormalised inbox label");
+  assertStringIncludes(label, "//***@");
+});
+
 test("parseHumanLabels: round-trips a stored map and tolerates null/blank/corrupt", () => {
-  assertEquals(parseHumanLabels(JSON.stringify({ a: "x" })), { a: "x" });
   assertEquals(parseHumanLabels(null), {});
   assertEquals(parseHumanLabels(""), {});
   assertEquals(parseHumanLabels("  "), {});
   assertEquals(parseHumanLabels("{not json"), {});
+  assertEquals(parseHumanLabels(JSON.stringify({ n1: "manual OTP publish", n2: "confirm deploy" })), {
+    n1: "manual OTP publish",
+    n2: "confirm deploy",
+  }); // round-trips a valid string→string map
   assertEquals(parseHumanLabels(JSON.stringify(["a"])), {}); // non-object
   assertEquals(parseHumanLabels(JSON.stringify({ a: 1, b: "y" })), { b: "y" }); // drops non-string values
 });
@@ -224,6 +266,16 @@ test("deriveDeliveryPhase: ACTIVE with an open human task → parked on that nod
   assertEquals(p.phase_node_id, el);
 });
 
+test("deriveDeliveryPhase: clamps a long/multi-line stored instruction to a first-line phase pill (#813)", () => {
+  const el = humanTaskElementId("n2");
+  const full = `Review the console dependency-adopt PR opened by adopt-console (bumps the ranges).\nSecond line.`;
+  const p = deriveDeliveryPhase("ACTIVE", [{ elementId: el }], { [el]: full });
+  // Full instruction is stored for the Decision context, but the phase pill shows only the clamped
+  // first line (77 chars + …), never the second line.
+  assertEquals(p.phase, "Parked on human node: Review the console dependency-adopt PR opened by adopt-console (bumps the ran…");
+  assert(!p.phase.includes("Second line"));
+});
+
 test("deriveDeliveryPhase: a parked node with no stored label falls back to the element id", () => {
   const el = humanTaskElementId("n5");
   const p = deriveDeliveryPhase("ACTIVE", [{ elementId: el }], {});
@@ -231,6 +283,17 @@ test("deriveDeliveryPhase: a parked node with no stored label falls back to the
   assertEquals(p.phase_node_id, el);
 });
 
+test("deliveryHuman: a parked bounded-timeout twin (`…__esc`) resolves the base node's stored label in the phase pill (#813)", () => {
+  // The twin's exact `…__esc` id is never stamped into `human_labels` (only the base id is), so the
+  // phase-pill lookup must strip `__esc` — the same fallback the Tasks Decision-context helpers use —
+  // else a parked timeout twin shows the raw element id instead of the instruction's first line.
+  const base = humanTaskElementId("n2");
+  const twin = `${base}__esc`;
+  const p = deriveDeliveryPhase("ACTIVE", [{ elementId: twin }], { [base]: "manual OTP publish" });
+  assertEquals(p.phase, "Parked on human node: manual OTP publish");
+  assertEquals(p.phase_node_id, twin);
+});
+
 test("deriveDeliveryPhase: ACTIVE with only a non-human open task (or none) → a bare Running", () => {
   assertEquals(deriveDeliveryPhase("ACTIVE", [], {}), { status: "running", phase: DELIVERY_PHASE.RUNNING, phase_node_id: null });
   assertEquals(deriveDeliveryPhase("ACTIVE", [{ elementId: "some-service-task" }], {}), {

package/app/deliveryGraphRun.ts

@@ -26,6 +26,7 @@
 import type { DataLayer, ProcessInstanceState } from "@nanobpm/urban";
 import type { CompileDeliveryGraphResult } from "../nano-generated/api-io.d.ts";
 import { isUniqueConstraintFence } from "./dbFence.ts";
+import { redactFreeText } from "./deliveryGraphCompiler.ts";
 import { DELIVERY_HUMAN_ELEMENT, isDeliveryHumanElement } from "./deliveryHuman.ts";
 
 const now = () => new Date().toISOString();
@@ -97,6 +98,24 @@ export const DELIVERY_PHASE = {
 export const deliveryGraphRuns = (data: DataLayer) =>
   data.table<DeliveryGraphRun>("delivery_graph_runs", "run_key");
 
+/** One row of the `delivery_graph_run_identity` SIDE table (migration 113) — the run's LOSSLESS
+ * content-identity fingerprint, kept OFF the heavily-projected `delivery_graph_runs` base row so no
+ * drift-guarded read-model/compat view has to carry it. Keyed by `run_key`. */
+export interface DeliveryGraphRunIdentity {
+  run_key: string;
+  /** `sha256(digest \0 canonicalJson(digestInvisibleRawValues(graph)))`, captured at launch — the same
+   *  lossless identity `stableProposalRunKey` folds into the keyless run key. An explicit-`idempotencyKey`
+   *  short-circuit compares this to prove the running run is THIS exact graph (a same-payload retry) vs. a
+   *  credential-different graph re-staged under the same key. */
+  graph_fingerprint: string;
+  created_at: string;
+}
+
+/** The `delivery_graph_run_identity` side-table accessor — the run's lossless identity fingerprint,
+ * keyed by `run_key` (issue #778 review — thread dispatchDeliveryGraph.ts:332). */
+export const deliveryGraphRunIdentities = (data: DataLayer) =>
+  data.table<DeliveryGraphRunIdentity>("delivery_graph_run_identity", "run_key");
+
 /** Atomically claim a run for LAUNCH — the at-most-once dispatch fence. Returns `true` iff THIS caller
  * won the claim and must proceed to `runDeliveryGraph`; `false` iff a concurrent submit already claimed
  * it (the caller must short-circuit as `alreadyRunning` instead of double-launching). Two fences, one
@@ -119,7 +138,9 @@ export const deliveryGraphRuns = (data: DataLayer) =>
  * the row briefly visible as `running` while still pointing at the OLD instance key, so the
  * `process_key`-keyed instance-tracking reconciler / poller could act on (and mis-reconcile against)
  * the stale instance before the winner's follow-up metadata write lands. Clearing them atomically with
- * the flip means a claimed `running` row can never be observed with a stale instance key. */
+ * the flip means a claimed `running` row can never be observed with a stale instance key. A winning
+ * relaunch also DELETES the run's prior `delivery_graph_run_identity` side-row in the same transaction,
+ * for the same reason — see the inline note (issue #778 review). */
 export async function claimRunForLaunch(
   data: DataLayer,
   existing: boolean,
@@ -134,9 +155,8 @@ export async function claimRunForLaunch(
       return false;
     }
   }
-  const res = await data
-    .open()
-    .exec(
+  const res = await data.open().tx(async (t) => {
+    const flip = await t.exec(
       `UPDATE "delivery_graph_runs" SET "status" = ?, "process_key" = ?, "process_definition_id" = ?, "phase" = ?, "phase_node_id" = ?, "updated_at" = ? WHERE "run_key" = ? AND "status" <> 'running'`,
       [
         claim.status,
@@ -148,7 +168,21 @@ export async function claimRunForLaunch(
         claim.run_key,
       ],
     );
-  return res.changed === 1;
+    if (flip.changed !== 1) return false;
+    // Invalidate the PRIOR run's lossless identity fingerprint IN THE SAME transaction as the flip, so a
+    // claimed `running` row can never be observed alongside the previous run's stale `graph_fingerprint`.
+    // dispatch's `identityConfirmed` short-circuit reads this side-row to prove an already-running run is
+    // THIS exact graph (a same-payload retry) vs. a credential-different graph re-staged under the same
+    // key; between this flip and the winner's post-launch re-stamp (`upsertRunIdentity`) the prior row
+    // would otherwise still match a relaunch that shares only the digest, WRONGLY confirming identity for
+    // a different-credential run. Deleting it here makes the fingerprint UNPROVABLE (missing →
+    // identityConfirmed:false, the safe pre-existing 409) throughout that window, atomically with the
+    // status flip — the same "no stale side-state observable on a claimed row" invariant the instance-key
+    // clear above enforces (issue #778 review — thread deliveryGraphDispatch.ts:180).
+    await t.exec(`DELETE FROM "delivery_graph_run_identity" WHERE "run_key" = ?`, [claim.run_key]);
+    return true;
+  });
+  return res;
 }
 
 /** The idempotency key for a submitted graph: a caller-supplied `idempotencyKey` (trimmed) when
@@ -172,16 +206,28 @@ function firstLine(text: string | undefined | null): string {
   return line.length > 80 ? `${line.slice(0, 77)}…` : line;
 }
 
-/** Map each human node's compiled user-task element id → a display label (its instruction's first
- * line, else its author node id), from the S1 compile result. Stamped on the run row at dispatch so
- * the poller renders the parked-node phase without recompiling the graph. */
+/** Map each human node's compiled user-task element id → its FULL instruction, from the S1 compile
+ * result. Stamped on the run row at dispatch so the poller can (a) render the parked-node phase label
+ * — clamped at display by {@link deriveDeliveryPhase} — and (b) surface the WHOLE instruction as the
+ * Tasks-inbox "Decision context" (issue #813). Storing the full prompt (not a clamped first line) is
+ * what lets the operator read the entire instruction, and lets a URL embedded in the prompt reach the
+ * task's clickable link. Falls back to the node id when a human node declares no prompt. */
 export function buildHumanLabels(compiled: CompileDeliveryGraphResult): Record<string, string> {
   const elementByNodeId = new Map(compiled.resolved.nodes.map((n) => [n.id, n.element]));
   const labels: Record<string, string> = {};
   for (const stop of compiled.humanNodes) {
     const element = elementByNodeId.get(stop.nodeId);
     if (element === undefined) continue;
-    labels[humanTaskElementId(element)] = firstLine(stop.prompt) || stop.nodeId;
+    // Redact the prompt with the SAME display-safe helper `nodeDisplay` uses BEFORE stamping it: this
+    // label is denormalised into the run row's `human_labels` and surfaced to the operator as the parked
+    // task's Decision context in the Tasks inbox, so a URL credential in a human prompt (`//user:pass@…`)
+    // must be stripped here too — else it is persisted and shown unredacted even though the BPMN display
+    // path redacts it. The RAW prompt still reaches the runtime user task unmodified (issue #778 review).
+    // The FULL redacted prompt is stored (not a clamped first line) so the Tasks "Decision context" can
+    // show the whole instruction and surface an embedded link; the phase pill clamps it at display via
+    // `firstLine` in `deriveDeliveryPhase` below (issue #813).
+    const safePrompt = typeof stop.prompt === "string" ? redactFreeText(stop.prompt).trim() : "";
+    labels[humanTaskElementId(element)] = safePrompt || stop.nodeId;
   }
   return labels;
 }
@@ -227,7 +273,13 @@ export function deriveDeliveryPhase(
     .filter((id): id is string => typeof id === "string" && isDeliveryHumanElement(id))
     .sort()[0];
   if (parkedOn !== undefined) {
-    const label = humanLabels[parkedOn] ?? parkedOn;
+    // Clamp the compact phase label to the instruction's first line (the full prompt is stored in
+    // `human_labels` for the Tasks "Decision context" — issue #813 — but the phase pill wants a short
+    // one-liner). Use the SAME exact-then-`__esc`-stripped lookup as `deliveryHumanContext*` so a
+    // parked bounded-timeout twin (`…__esc`, whose exact id is never stamped) resolves to its base
+    // node's label instead of showing the raw element id. A missing label falls back to the raw id.
+    const stored = humanLabels[parkedOn] ?? humanLabels[parkedOn.replace(/__esc$/, "")];
+    const label = firstLine(stored) || parkedOn;
     return { status: "running", phase: `Parked on human node: ${label}`, phase_node_id: parkedOn };
   }
   return { status: "running", phase: DELIVERY_PHASE.RUNNING, phase_node_id: null };

package/app/deliveryHuman.test.ts

@@ -11,7 +11,9 @@ import {
   bindHumanEmits,
   DELIVERY_HUMAN_ELEMENT,
   deliveryHumanContextQuestion,
+  deliveryHumanContextUrl,
   deriveHumanCategory,
+  firstHttpUrl,
   GENERIC_HUMAN_FORM,
   HUMAN_ACK_FORM,
   HUMAN_PUBLISH_FORM,
@@ -21,6 +23,7 @@ import {
   renderHumanEmitBrief,
   resolveHumanForm,
 } from "./deliveryHuman.ts";
+import { redactFreeText } from "./deliveryGraphCompiler.ts";
 import { ESCALATION_TASK_ELEMENTS } from "./agentCompletion.ts";
 import { USER_TASK_KIND_LABELS } from "./userTasks.ts";
 
@@ -322,8 +325,82 @@ test("deliveryHumanContextQuestion: derives the node instruction from human_labe
   );
 });
 
-test("deliveryHumanContextQuestion: falls back to a static message when no label is stored", () => {
-  // A parked human step must never render a blank Decision context — an untracked/absent label still
+test("firstHttpUrl: extracts the first http(s) URL and trims trailing prose punctuation (#813)", () => {
+  assertEquals(firstHttpUrl("see https://github.com/o/r/pull/5 for details"), "https://github.com/o/r/pull/5");
+  // Trailing sentence punctuation / closing bracket is stripped so the link resolves.
+  assertEquals(firstHttpUrl("Review the PR (https://github.com/o/r/pull/5)."), "https://github.com/o/r/pull/5");
+  assertEquals(firstHttpUrl("http://example.test/a,"), "http://example.test/a");
+  // A balanced closing bracket is part of the URL and preserved (not truncated into a broken link).
+  assertEquals(
+    firstHttpUrl("see https://en.wikipedia.org/wiki/Nano_(technology) here"),
+    "https://en.wikipedia.org/wiki/Nano_(technology)",
+  );
+  // A balanced bracket followed by prose punctuation: strip only the punctuation, keep the pair.
+  assertEquals(
+    firstHttpUrl("ref https://en.wikipedia.org/wiki/Nano_(technology)."),
+    "https://en.wikipedia.org/wiki/Nano_(technology)",
+  );
+  // An UNBALANCED wrapping bracket is prose and still stripped.
+  assertEquals(firstHttpUrl("(https://github.com/o/r/pull/9)"), "https://github.com/o/r/pull/9");
+  // Multiple/nested UNBALANCED trailing closers + prose punctuation are all peeled off in one linear
+  // pass (guards the O(n) trim refactor — #813 review), while an inner balanced pair is preserved.
+  assertEquals(
+    firstHttpUrl("(see [https://en.wikipedia.org/wiki/Nano_(technology)])."),
+    "https://en.wikipedia.org/wiki/Nano_(technology)",
+  );
+  assertEquals(firstHttpUrl("look: {[(https://example.test/a)]}"), "https://example.test/a");
+  // An apostrophe is a valid URL sub-delimiter and preserved WITHIN the URL (not truncated at it)…
+  assertEquals(
+    firstHttpUrl("see https://en.wikipedia.org/wiki/It's_a_Wonderful_Life here"),
+    "https://en.wikipedia.org/wiki/It's_a_Wonderful_Life",
+  );
+  // …while a TRAILING apostrophe (a prose quote closer) is still trimmed.
+  assertEquals(firstHttpUrl("the link 'https://example.test/a' works"), "https://example.test/a");
+  // Scheme match is case-insensitive (RFC 3986 schemes are case-insensitive).
+  assertEquals(firstHttpUrl("see HTTPS://github.com/o/r/pull/5 now"), "HTTPS://github.com/o/r/pull/5");
+  assertEquals(firstHttpUrl("Http://example.test/b"), "Http://example.test/b");
+  // First wins when several are present.
+  assertEquals(firstHttpUrl("a https://one.test b https://two.test"), "https://one.test");
+  // No URL / non-string → null (preserves today's linkless behaviour).
+  assertEquals(firstHttpUrl("merge the PR opened by adopt-console"), null);
+  assertEquals(firstHttpUrl(undefined), null);
+});
+
+test("deliveryHumanContextUrl: lifts a prompt-embedded URL onto the task link (base + __esc twin), else null (#813)", () => {
+  const labels = {
+    "delivery-human-task__n7": "Review the adopt PR at https://github.com/nanobpm/nano-ide/pull/42 and merge it.",
+    "delivery-human-task__n8": "Confirm CI is green, then merge — no link here.",
+  };
+  assertEquals(deliveryHumanContextUrl(labels, "delivery-human-task__n7"), "https://github.com/nanobpm/nano-ide/pull/42");
+  // The bounded-timeout twin resolves the same node instruction.
+  assertEquals(deliveryHumanContextUrl(labels, "delivery-human-task__n7__esc"), "https://github.com/nanobpm/nano-ide/pull/42");
+  // A node whose instruction names no URL yields null (the linkless default).
+  assertEquals(deliveryHumanContextUrl(labels, "delivery-human-task__n8"), null);
+  assertEquals(deliveryHumanContextUrl(undefined, "delivery-human-task__n1"), null);
+});
+
+test("deliveryHumanContextUrl: declines to link a redaction-altered URL, links a credential-free one (#814)", () => {
+  // The stored `human_labels` are display-REDACTED via the SAME `redactFreeText` `buildHumanLabels` uses,
+  // so build the labels through it to mirror production exactly.
+  const withQuery = redactFreeText("Review the checks tab at https://example.test/o/r/pull/5?tab=checks now");
+  const withCred = redactFreeText("Open https://user:pass@example.test/o/r/pull/5 to review");
+  const withFragment = redactFreeText("Jump to https://example.test/o/r/pull/5#files section");
+  const clean = redactFreeText("Review the PR at https://example.test/o/r/pull/5 and merge it");
+  const labels = {
+    "delivery-human-task__q": withQuery,
+    "delivery-human-task__c": withCred,
+    "delivery-human-task__f": withFragment,
+    "delivery-human-task__ok": clean,
+  };
+  // A redacted query/userinfo/fragment would publish a DIFFERENT, broken link → decline (null).
+  assertEquals(deliveryHumanContextUrl(labels, "delivery-human-task__q"), null);
+  assertEquals(deliveryHumanContextUrl(labels, "delivery-human-task__c"), null);
+  assertEquals(deliveryHumanContextUrl(labels, "delivery-human-task__f"), null);
+  // A credential-free URL is untouched by redaction and links faithfully.
+  assertEquals(deliveryHumanContextUrl(labels, "delivery-human-task__ok"), "https://example.test/o/r/pull/5");
+});
+
+test("deliveryHumanContextQuestion: falls back to a static message when no label is stored", () => {  // A parked human step must never render a blank Decision context — an untracked/absent label still
   // yields actionable guidance rather than null (which would leave the panel empty, issue #772).
   assertEquals(
     deliveryHumanContextQuestion({}, "delivery-human-task__n1"),