@nanobpm/nano-workforce 0.195.1 → 0.195.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.195.2](https://github.com/nanobpm/nano-workforce/compare/v0.195.1...v0.195.2) (2026-09-30)
+
+### Bug Fixes
+
+* **converge-gate:** gate Copilot ccr-overview-v2 table findings ([#835](https://github.com/nanobpm/nano-workforce/issues/835)) ([#836](https://github.com/nanobpm/nano-workforce/issues/836)) ([8e3c0b6](https://github.com/nanobpm/nano-workforce/commit/8e3c0b690b7a212b0fcd4904b9e50ab7589e5bda))
+
 ## [0.195.1](https://github.com/nanobpm/nano-workforce/compare/v0.195.0...v0.195.1) (2026-09-30)
 
 ### Bug Fixes

package/app/convergeGate.test.ts

@@ -1123,3 +1123,76 @@ test("the blocked-comments escalation routes through gw-escalated toward an answ
   // The human sees the gate's own reason (the unresolved threads / unacknowledged advisories).
   assertStringIncludes(task[0], "convergeBlockReason");
 });
+
+// ── Copilot ccr-overview-v2 review format (issue #835) ──────────────────────
+// The v2 overview has no "Suppressed comments" block; findings without an inline thread live only in
+// the "What changed" file table as `… (<severity>, N vote[s])` clauses. Paths carry zero-width spaces.
+const V2_REVIEW_BODY = [
+  "<!-- ccr-overview-v2 -->",
+  "",
+  "## Copilot review overview",
+  "",
+  "<details open>",
+  "<summary><strong>Open (1)</strong></summary>",
+  "",
+  "- [Replace HEAD with a valid bootstrap commit SHA](#discussion_r1) · New",
+  "</details>",
+  "",
+  "<details>",
+  "<summary><strong>What changed in this PR</strong></summary>",
+  "",
+  "| File | Summary and final review notes |",
+  "|---|---|",
+  "| `skills/\u200bcamunda-forms/\u200bportability.json` | Adds dependency requirements. |",
+  "| `skills/\u200bcamunda-job-workers/\u200bportability.json` | Adds dependency requirements; Camunda version conflicts with the documented Node fallback (moderate, 1 vote), and Java/TypeScript runtime paths are missing (moderate, 1 vote). |",
+  "| `release-please-config.json` | Configures automated releases; `bootstrap-sha` must be removed or replaced with a full base commit SHA (moderate, 3 votes). |",
+  "</details>",
+].join("\n");
+
+test("parseSuppressedAdvisories: ccr-overview-v2 table findings are gated advisories (#835)", () => {
+  const advisories = parseSuppressedAdvisories(V2_REVIEW_BODY);
+  assertEquals(
+    advisories.map((a) => [a.path, a.text]),
+    [
+      [
+        "skills/camunda-job-workers/portability.json",
+        "Adds dependency requirements; Camunda version conflicts with the documented Node fallback",
+      ],
+      ["skills/camunda-job-workers/portability.json", "Java/TypeScript runtime paths are missing"],
+      [
+        "release-please-config.json",
+        "Configures automated releases; `bootstrap-sha` must be removed or replaced with a full base commit SHA",
+      ],
+    ],
+  );
+  // Keyed on path + prose (vote count excluded, so a re-vote next round keeps the same key).
+  assertEquals(
+    advisories[1].key,
+    advisoryStableKey("skills/camunda-job-workers/portability.json", "Java/TypeScript runtime paths are missing"),
+  );
+});
+
+test("parseSuppressedAdvisories: a v2 table finding is acked by the canonical nano-ack marker and unblocks the gate (#835)", () => {
+  const advisories = parseSuppressedAdvisories(V2_REVIEW_BODY);
+  const threads: ReviewThread[] = advisories.map((a) => ({
+    isResolved: true,
+    path: a.path,
+    bodies: [`Declined. nano-ack: ${a.path} :: ${a.text}`],
+  }));
+  const blocked = evaluateConvergeGate({ unresolvedThreadCount: 0, suppressedAdvisories: advisories, acknowledgedKeys: [] });
+  assertEquals(blocked.convergeBlocked, true);
+  const r = evaluateConvergeGate({
+    unresolvedThreadCount: 0,
+    suppressedAdvisories: advisories,
+    acknowledgedKeys: parseAckedAdvisories(threads),
+  });
+  assertEquals(r.convergeBlocked, false);
+});
+
+test("parseSuppressedAdvisories: v2 table rows without findings yield nothing; non-v2 tables are ignored (#835)", () => {
+  assertEquals(
+    parseSuppressedAdvisories("<!-- ccr-overview-v2 -->\n| `a.ts` | Adds a thing. |"),
+    [],
+  );
+  assertEquals(parseSuppressedAdvisories("| `a.ts` | Broken thing (moderate, 1 vote). |"), []);
+});

package/app/github.ts

@@ -153,16 +153,31 @@ export interface ReviewThread {
 }
 
 /** A suppressed / low-confidence Copilot advisory parsed out of a review body. Its `key` is the
- * line-stable identity (survives a line drift); `label` is the human-facing `path:line` shown in
- * block reasons. */
+ * line-stable identity (survives a line drift); `label` is the human-facing locator shown in block
+ * reasons.
+ *
+ * Two source formats populate this shape, so the per-field shapes below vary by variant:
+ * - LEGACY "Suppressed comments" block (`parseLegacySuppressedBlock`): a `**path:line**` header
+ *   with real `line` (> 0), `text` is the first non-empty prose line after the header, and `label`
+ *   is `path:line`.
+ * - `ccr-overview-v2` file-table findings (`parseOverviewV2TableFindings`, issue #835): `text` is a
+ *   finding clause from the table's notes column (no header, no source line), so `line` is the
+ *   sentinel `0` and `label` is `<path> (review overview)` rather than `path:line`.
+ *
+ * Consumers must therefore treat `line === 0` as "not line-addressable" (an overview finding), NOT
+ * as a real line, and must not assume `label` is always `path:line`. */
 export interface SuppressedAdvisory {
   path: string;
+  /** Source line of the advisory. Real (> 0) for a legacy `**path:line**` header; the sentinel `0`
+   * for a `ccr-overview-v2` table finding, which carries no source line and is not line-addressable. */
   line: number;
-  /** The advisory prose (first non-empty line after the header), used for the stable fingerprint. */
+  /** The advisory prose: the first non-empty line after the header (legacy block) or a finding
+   * clause from the overview table's notes column (`ccr-overview-v2`). Used for the stable fingerprint. */
   text: string;
   /** Line-stable identity: `<path>#<fingerprint>` of the normalized prose. Survives line drift. */
   key: string;
-  /** Human-facing `path:line` label for block-reason messages. */
+  /** Human-facing label for block-reason messages: `path:line` for a legacy advisory, or
+   * `<path> (review overview)` for a line-less `ccr-overview-v2` table finding. */
   label: string;
 }
 
@@ -250,11 +265,67 @@ export function questionFingerprint(text: string): string {
   return fingerprint(normalizeAdvisoryText(text));
 }
 
-/** Parse Copilot's suppressed / low-confidence advisories out of a review body. Copilot renders them
- * under a `<summary>Suppressed comments (N)</summary>` block, each as a bold `**path:line**` header
- * followed by the advisory prose. Returns de-duplicated advisories (empty when there is no block). */
+/** Parse Copilot's suppressed / low-confidence advisories out of a review body, supporting BOTH
+ * formats Copilot emits:
+ *
+ * 1. The legacy `<summary>Suppressed comments (N)</summary>` block — each advisory is a bold
+ *    `**path:line**` header followed by the advisory prose (`parseLegacySuppressedBlock`).
+ * 2. The newer `ccr-overview-v2` review body (issue #835), which has NO "Suppressed comments"
+ *    block — findings appear only as clauses in the "What changed" file table's notes column,
+ *    each ending `(<severity>, N vote[s])` (`parseOverviewV2TableFindings`).
+ *
+ * Returns de-duplicated advisories from both formats (empty when neither is present). */
 export function parseSuppressedAdvisories(reviewBody: string | null | undefined): SuppressedAdvisory[] {
   const body = reviewBody ?? "";
+  const out: SuppressedAdvisory[] = [];
+  const seen = new Set<string>();
+  for (const a of [...parseLegacySuppressedBlock(body), ...parseOverviewV2TableFindings(body)]) {
+    if (seen.has(a.key)) continue;
+    seen.add(a.key);
+    out.push(a);
+  }
+  return out;
+}
+
+/** A finding clause's trailing `(<severity>, N vote[s])` tag in the ccr-overview-v2 file table. */
+const V2_FINDING_TAG = /\s*\(\s*[a-z]+\s*,\s*\d+\s+votes?\s*\)/gi;
+
+/** Copilot's `ccr-overview-v2` review body (issue #835) has NO "Suppressed comments" block. Findings
+ * that got an inline comment are threads (gated via `isResolved`), but others appear ONLY as clauses
+ * in the "What changed" file table's notes column, each ending `(<severity>, N vote[s])`, e.g.
+ * `Adds X; A is wrong (moderate, 1 vote), and B is missing (nit, 3 votes).` Each such clause is an
+ * advisory keyed on `<path> :: <clause>` — the vote tag is EXCLUDED so a re-vote next round keeps the
+ * key stable. The first clause keeps any leading row summary (`Adds X; A is wrong`): Copilot does not
+ * always emit a summary (`Maven is declared…; requirements should model…` is ONE finding), so cutting
+ * at `; ` would silently truncate a finding — keeping it is fail-CLOSED. Table findings carry
+ * no line, so `line` is 0. Findings that duplicate an inline thread are still returned: fail-CLOSED
+ * (an extra ack is cheap; a finding silently dropped is the false-OPEN this gate prevents). */
+function parseOverviewV2TableFindings(body: string): SuppressedAdvisory[] {
+  if (!/<!--\s*ccr-overview-v\d+\s*-->/i.test(body)) return [];
+  const out: SuppressedAdvisory[] = [];
+  const rowRe = /^\|\s*`([^`]+)`\s*\|(.*)\|\s*$/;
+  for (const raw of body.split(/\r?\n/)) {
+    const row = rowRe.exec(raw);
+    if (!row) continue;
+    const path = row[1].replace(/\u200b|\u200c|\u200d|\ufeff/g, "").trim();
+    const notes = row[2].trim();
+    let prev = 0;
+    V2_FINDING_TAG.lastIndex = 0;
+    let m: RegExpExecArray | null;
+    // biome-ignore lint/suspicious/noAssignInExpressions: canonical regex-exec accumulation loop
+    while ((m = V2_FINDING_TAG.exec(notes)) !== null) {
+      const seg = notes.slice(prev, m.index);
+      prev = m.index + m[0].length;
+      const text = seg.replace(/^[\s,;.]*(?:and\s+)?/i, "").trim();
+      if (!text) continue;
+      out.push({ path, line: 0, text, key: advisoryStableKey(path, text), label: `${path} (review overview)` });
+    }
+  }
+  return out;
+}
+
+/** The legacy "Suppressed comments (N)" block: `**path:line**` headers followed by advisory prose. */
+function parseLegacySuppressedBlock(body: string): SuppressedAdvisory[] {
   const idx = body.search(/Suppressed comments\s*\(/i);
   if (idx < 0) return [];
   // Scan only from the "Suppressed comments" marker onward so a `**path:line**` elsewhere in the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.195.1",
+  "version": "0.195.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/prompts/review-round.md

@@ -71,6 +71,11 @@ Because several agents may run on the same host at once:
    "low confidence" list Copilot folds into the **review body** (`.../reviews`
    `body`). These are NOT in the default inline-comment API set, so a plain
    `.../comments` read misses them; scan the review body for them explicitly.
+   Newer Copilot reviews use an **overview format** (body starts `<!-- ccr-overview-v2 -->`)
+   with no "Suppressed comments" block. There, findings without an inline thread appear
+   **only** in the "What changed in this PR" file table, as clauses in the notes column
+   ending `(<severity>, N vote[s])`. The gate treats **each such clause** as an advisory
+   (even if it duplicates an inline thread), so triage and ack every one (step 5a).
    If `answer` is present, it is a human's instruction: either the decision on the
    escalation you raised last round, or change requests from merge approval of this
    converged PR. Act on it first, on this same PR branch (never open a new PR).
@@ -130,7 +135,11 @@ Because several agents may run on the same host at once:
    new line — a line-based ack would go stale and the gate would escalate to a human
    every round (issue #787). Because the ack is keyed on the prose, a decline you
    made in an earlier round stays acknowledged across the drift and you need **not**
-   re-ack it. The ack thread may sit on any valid diff line. Example:
+   re-ack it. The ack thread may sit on any valid diff line. For an **overview-format
+   table finding**, `<path>` is the file column (backticks and any invisible zero-width
+   characters removed) and `<advisory text>` is the finding clause **verbatim, without**
+   its trailing `(<severity>, N vote[s])` tag — for the row's first finding, include any
+   leading row summary before it (e.g. `nano-ack: a.json :: Adds X; A is wrong`). Example:
 
    ```sh
    # Post the ack thread (pick any changed line in the diff for path/line). Use the PR's real HEAD