@nanobpm/nano-workforce 0.198.1 → 0.200.0

package/app/service.ts

@@ -27,6 +27,7 @@ import {
   CONFORMANCE_ESCALATION_ELEMENT,
   conformanceEscalationQuestion,
 } from "./conformance.ts";
+import { envContract, readEnvOr } from "./contracts.ts";
 import { makeDefaultReadHead } from "./currentHead.ts";
 import { isUniqueConstraintFence } from "./dbFence.ts";
 import { deriveDelivery, EPIC_LIVE_STATUSES, TERMINAL_STATUSES } from "./delivery.ts";
@@ -136,6 +137,18 @@ export const MERGE_PROCESS_ID = "merge-loop";
  * in convergence-loop.bpmn). Deliberately NOT hosted here — an external harness services it; the
  * activation poll keys off it to tell "agent working" from "queued". */
 const REVIEW_JOB_TYPE = "senior:pr-review";
+/** Job type of the local adversarial-review agent (the `adversarial-review` service task's
+ * `zeebe:taskDefinition` in convergence-loop.bpmn, issue #844). Like {@link REVIEW_JOB_TYPE} it is
+ * serviced by an external harness while the PR stays `converging`, so the activation poll must
+ * treat it as another live convergence agent — otherwise the grid reports "queued" for the whole
+ * adversarial pass even though an agent has leased the job. */
+const ADVERSARIAL_JOB_TYPE = "senior:adversarial-review";
+/** Every external-agent job type the convergence loop parks on while the PR reads `converging`.
+ * `pollJobActivation` reconciles `active_worker`/`lease_until` against ANY of these so the
+ * review-round ↔ adversarial-review handoff (same `converging` status, different job type) never
+ * flashes a phantom "queued". Typed `readonly string[]` (not `as const`) so `.includes(aString)`
+ * needs no `as` cast at the read site. */
+const CONVERGENCE_AGENT_JOB_TYPES: readonly string[] = [REVIEW_JOB_TYPE, ADVERSARIAL_JOB_TYPE];
 
 /** Default round cap before the loop escalates to a human. A per-submit override (submit form /
  * webhook / start action) takes precedence; this env var sets the fleet-wide default. The cap
@@ -179,6 +192,18 @@ export const MAX_MERGE_RETRIES = clampCiFixBudget(process.env.NANO_PR_MAX_MERGE_
  * (allows 0 = disable, ceiling-capped). */
 export const MAX_ACK_RETRIES = clampCiFixBudget(process.env.NANO_PR_MAX_ACK_RETRIES, 2);
 
+/** Local adversarial-review passes per convergence round (issue #844). An `addressed` round runs the
+ * `senior:adversarial-review` agent over its diff BEFORE the round parks on `waiting_review` (the only
+ * status the poller solicits a Copilot review for); non-blank findings re-dispatch `review-round`, up
+ * to this many passes per round. Default 1; `NANO_PR_MAX_ADVERSARIAL_PASSES=0` disables the stage.
+ * Reuses the CI-fix budget clamp (allows 0 = disable, ceiling-capped). The clamp fallback is
+ * derived from the registered `default` so the schema stays the single source of truth (a
+ * registry edit can't drift from a second literal here). */
+export const MAX_ADVERSARIAL_PASSES = clampCiFixBudget(
+  readEnvOr("NANO_PR_MAX_ADVERSARIAL_PASSES"),
+  Number(envContract("NANO_PR_MAX_ADVERSARIAL_PASSES").default),
+);
+
 /** How many times the mergeable-wait timeout backstop (`merge-stall-probe`) will re-derive
  * mergeability from ground truth and re-arm the merge stage before giving up and escalating to a
  * human. Bounds the timer arm of the `gw-merge-wait` event-based gateway so a dead in-process poller
@@ -740,6 +765,10 @@ async function submitPrCritical(
       // solely on unacked ones, before escalating to a human. `ackRetryRound` counts those passes.
       ackRetryRound: 0,
       ackRetryMax: MAX_ACK_RETRIES,
+      // Local adversarial review (issue #844): `advPass` counts this round's adversarial passes (reset
+      // by `capture-head` each round); `advMax` bounds them. 0 skips the stage.
+      advPass: 0,
+      advMax: MAX_ADVERSARIAL_PASSES,
       // Lineage (issue #245): carry the origin identity onto the convergence instance so every
       // descendant (and any message it correlates) is stitched back to the originating request.
       // A human/webhook PR that is its own root carries its own `pr_key` (never NULL — see above).
@@ -1669,15 +1698,19 @@ interface JobSearchItem {
   worker?: string;
   deadline?: string | null;
   state?: string;
+  /** The job's `zeebe:taskDefinition` type — read to defensively re-filter the wire `$in` type
+   * filter so a non-agent job can never masquerade as a leasing convergence agent. */
+  type?: string;
 }
 
-/** One job-activation poll pass. The `converging` status means the process is parked at the
- * `review-round` service task with a `senior:pr-review` job outstanding — but it does not say
- * whether an external agent has *activated* (leased) that job yet. This pass reads that off the
- * engine's Camunda-8 `/v2/jobs/search`: an activated job carries a leasing `worker` + a lock
- * `deadline`; a merely-created (queued) one carries neither. (The wire `state` can't tell them
- * apart — Camunda's JobStateEnum has no ACTIVATED value, so the engine projects Activated ->
- * CREATED; the `worker`/`deadline` fields are the compatible activation signal.)
+/** One job-activation poll pass. The `converging` status means the process is parked at a
+ * convergence-agent service task (`review-round`'s `senior:pr-review`, or `adversarial-review`'s
+ * `senior:adversarial-review` — issue #844) with a job outstanding — but it does not say whether an
+ * external agent has *activated* (leased) that job yet. This pass reads that off the engine's
+ * Camunda-8 `/v2/jobs/search`: an activated job carries a leasing `worker` + a lock `deadline`; a
+ * merely-created (queued) one carries neither. (The wire `state` can't tell them apart — Camunda's
+ * JobStateEnum has no ACTIVATED value, so the engine projects Activated -> CREATED; the
+ * `worker`/`deadline` fields are the compatible activation signal.)
  *
  * It writes `active_worker` + `lease_until` onto the PR row so the pages surface can show
  * "agent working" vs "queued (awaiting an agent)", updating (and bumping `updated_at`) only on
@@ -1691,10 +1724,21 @@ async function pollJobActivation(
   const base = restAddress.replace(/\/+$/, "");
   const headers: Record<string, string> = { "content-type": "application/json" };
   if (engineToken) headers.authorization = `Bearer ${engineToken}`;
+  await pollJobActivationImpl(data, base, headers);
+}
 
+/** Testable core of {@link pollJobActivation}: given the normalised `base` URL and prepared auth
+ * `headers`, reconcile every `converging` PR row against the engine's open convergence-agent jobs.
+ * Split out so tests can exercise the reconciliation with a stubbed `fetch` without re-deriving
+ * transport wiring. */
+export async function pollJobActivationImpl(
+  data: DataLayer,
+  base: string,
+  headers: Record<string, string>,
+) {
   const all = await prsTracking(data).all();
   for (const pr of all) {
-    // Only a `converging` PR has a live review-round job. Any other status with a stale worker
+    // Only a `converging` PR has a live convergence-agent job. Any other status with a stale worker
     // set (e.g. it just moved to `waiting_review`) gets cleared so the grid can't show a
     // phantom "agent working". ADR-0065: classify on the DERIVED status, not the base transient —
     // a PR whose instance was terminated out-of-band keeps its base `status` frozen at `converging`
@@ -1731,7 +1775,15 @@ async function pollJobActivation(
         method: "POST",
         headers,
         body: JSON.stringify({
-          filter: { type: REVIEW_JOB_TYPE, processInstanceKey: pr.process_key, state: "CREATED" },
+          filter: {
+            // ANY convergence-agent job type: the loop moves between `review-round`
+            // (`senior:pr-review`) and `adversarial-review` (`senior:adversarial-review`) without
+            // leaving `converging`, so filtering on only one would clear the lease mid-handoff and
+            // report "queued" while the other agent is actively working (issue #845 review).
+            type: { $in: [...CONVERGENCE_AGENT_JOB_TYPES] },
+            processInstanceKey: pr.process_key,
+            state: "CREATED",
+          },
           page: { limit: 20 },
         }),
       });
@@ -1739,9 +1791,16 @@ async function pollJobActivation(
       // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
       const body = (await res.json()) as { items?: JobSearchItem[] };
       // An open job with a leasing worker means an agent has activated it. Prefer the one with
-      // the latest deadline if several are open (there is normally at most one).
+      // the latest deadline if several are open (there is normally at most one). Re-filter on the
+      // job type defensively in case the wire `$in` filter is ignored, so a non-agent job (e.g. an
+      // internal `pr.*` worker) can never masquerade as a leasing convergence agent.
       const activated = (body.items ?? [])
-        .filter((j) => typeof j.worker === "string" && j.worker.length > 0)
+        .filter(
+          (j) =>
+            typeof j.worker === "string" &&
+            j.worker.length > 0 &&
+            CONVERGENCE_AGENT_JOB_TYPES.includes(j.type ?? ""),
+        )
         .sort((a, b) => (a.deadline ?? "").localeCompare(b.deadline ?? ""))
         .pop();
       if (activated) {

package/nano.app.json

@@ -255,7 +255,8 @@
     "senior:trial-merge",
     "senior:retro",
     "senior:conformance",
-    "senior:scope-classify"
+    "senior:scope-classify",
+    "senior:adversarial-review"
   ],
   "surfaces": {
     "taskInbox": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.198.1",
+  "version": "0.200.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",