@nanobpm/nano-workforce 0.200.7 → 0.200.9

package/app/implementReconcile.test.ts

@@ -10,6 +10,7 @@ import {
   implementCellBranch,
   pickAdoptablePr,
   reconcileImplement,
+  retryNudgeFor,
   shouldReconcileImplement,
 } from "./implementReconcile.ts";
 
@@ -20,16 +21,34 @@ const openPr = (number: number, base = "main"): HeadPr => ({
   baseRef: base,
 });
 
+// The non-adopt, non-retry tail every escalate/adopt assertion carries (issue #865 widened the result
+// shape with the auto-retry fields; #865 review added `deliveryVerified`). Spread it into each expected
+// object so the tests stay focused on the reconcile/pr decision. `deliveryVerified: false` is the
+// fall-through default (no lookup ran / it threw / transport unavailable); the adopt and
+// verified-absence cases override it to `true`.
+const tail = { retry: false, retryNudge: null, retried: false, deliveryVerified: false } as const;
+// The tail for a SUCCESSFUL lookup: delivery state was confirmed (an adoptable PR, or a verified
+// absence), so `deliveryVerified` is `true`.
+const verified = { ...tail, deliveryVerified: true } as const;
+
 test("implementCellBranch: the deterministic feat/<task.id> branch", () => {
   assertEquals(implementCellBranch("issue-796"), "feat/issue-796");
 });
 
-test("shouldReconcileImplement: only a blank/absent status reconciles", () => {
+test("shouldReconcileImplement: blank or a claimed-completion (off-vocabulary) status reconciles; a recognised status or an answerable question does not", () => {
   assertEquals(shouldReconcileImplement(null), true);
   assertEquals(shouldReconcileImplement(undefined), true);
   assertEquals(shouldReconcileImplement("  "), true);
+  // Off-vocabulary "claimed completion" (issue #865) — look for a delivered PR before escalating.
+  assertEquals(shouldReconcileImplement("completed"), true);
+  assertEquals(shouldReconcileImplement("done"), true);
+  // Recognised statuses are the agent's own clean terminal / escalation — never auto-reconciled.
   assertEquals(shouldReconcileImplement("escalated"), false);
   assertEquals(shouldReconcileImplement("opened"), false);
+  assertEquals(shouldReconcileImplement("blocked"), false);
+  assertEquals(shouldReconcileImplement("skipped"), false);
+  // An off-vocabulary status carrying an answerable question is a GENUINE escalation — honour it.
+  assertEquals(shouldReconcileImplement("completed", "Which API should I use?"), false);
 });
 
 test("pickAdoptablePr: the first OPEN PR wins; merged/closed are not adoptable", () => {
@@ -62,7 +81,7 @@ test("reconcileImplement: blank status + open PR on feat/<task.id> → adopt (st
     lookup,
     "token",
   );
-  assertEquals(res, { reconciled: true, status: "opened", pr: "nanobpm/nano-workforce#800" });
+  assertEquals(res, { reconciled: true, status: "opened", pr: "nanobpm/nano-workforce#800", ...verified });
   assertEquals(calls, [{ repo: "nanobpm/nano-workforce", branch: "feat/issue-796" }]);
 });
 
@@ -72,7 +91,7 @@ test("reconcileImplement: blank status but NO branch/PR → escalate (unchanged
     async () => [],
     "token",
   );
-  assertEquals(res, { reconciled: false, status: null, pr: null });
+  assertEquals(res, { reconciled: false, status: null, pr: null, ...verified });
 });
 
 test("reconcileImplement: a genuine escalation status is honoured, GitHub never consulted", async () => {
@@ -85,7 +104,7 @@ test("reconcileImplement: a genuine escalation status is honoured, GitHub never
     },
     "token",
   );
-  assertEquals(res, { reconciled: false, status: "escalated", pr: null });
+  assertEquals(res, { reconciled: false, status: "escalated", pr: null, ...tail });
   assertEquals(consulted, false);
 });
 
@@ -106,7 +125,7 @@ test("reconcileImplement: a lookup transport failure falls through to escalate (
     },
     "token",
   );
-  assertEquals(res, { reconciled: false, status: null, pr: null });
+  assertEquals(res, { reconciled: false, status: null, pr: null, ...tail });
 });
 
 test("reconcileImplement: an existing pr is carried through unchanged on fall-through (never wiped)", async () => {
@@ -116,7 +135,7 @@ test("reconcileImplement: an existing pr is carried through unchanged on fall-th
     async () => [],
     "token",
   );
-  assertEquals(escalated, { reconciled: false, status: "escalated", pr: "owner/repo#42" });
+  assertEquals(escalated, { reconciled: false, status: "escalated", pr: "owner/repo#42", ...tail });
 
   // Blank status but no adoptable PR → escalate; an existing pr still survives.
   const noAdopt = await reconcileImplement(
@@ -124,7 +143,7 @@ test("reconcileImplement: an existing pr is carried through unchanged on fall-th
     async () => [],
     "token",
   );
-  assertEquals(noAdopt, { reconciled: false, status: null, pr: "owner/repo#42" });
+  assertEquals(noAdopt, { reconciled: false, status: null, pr: "owner/repo#42", ...verified });
 });
 
 test("reconcileImplement: a successful adoption overwrites any existing pr with the adopted key", async () => {
@@ -133,7 +152,7 @@ test("reconcileImplement: a successful adoption overwrites any existing pr with
     async () => [openPr(99)],
     "token",
   );
-  assertEquals(res, { reconciled: true, status: "opened", pr: "owner/repo#99" });
+  assertEquals(res, { reconciled: true, status: "opened", pr: "owner/repo#99", ...verified });
 });
 
 test("reconcileImplement: with a pinned baseBranch, only a PR targeting it is adopted", async () => {
@@ -143,15 +162,16 @@ test("reconcileImplement: with a pinned baseBranch, only a PR targeting it is ad
     async () => [openPr(50, "stale-base"), openPr(51, "epic/feat-x")],
     "token",
   );
-  assertEquals(adopt, { reconciled: true, status: "opened", pr: "owner/repo#51" });
+  assertEquals(adopt, { reconciled: true, status: "opened", pr: "owner/repo#51", ...verified });
 
-  // Only a wrong-base PR exists → escalate rather than converge the wrong branch.
+  // Only a wrong-base PR exists → escalate rather than converge the wrong branch. The lookup SUCCEEDED
+  // and confirmed no PR targets the pinned base — a verified absence.
   const escalate = await reconcileImplement(
     { status: null, subjectKey: "owner/repo#7", taskId: "issue-7", baseBranch: "epic/feat-x", pr: "owner/repo#42" },
     async () => [openPr(52, "stale-base")],
     "token",
   );
-  assertEquals(escalate, { reconciled: false, status: null, pr: "owner/repo#42" });
+  assertEquals(escalate, { reconciled: false, status: null, pr: "owner/repo#42", ...verified });
 });
 
 test("reconcileImplement: a missing taskId or unparseable subjectKey → escalate, no lookup", async () => {
@@ -164,3 +184,140 @@ test("reconcileImplement: a missing taskId or unparseable subjectKey → escalat
   assertEquals((await reconcileImplement({ status: null, subjectKey: "not-a-key", taskId: "issue-7" }, lookup, "t")).reconciled, false);
   assertEquals(consulted, false);
 });
+
+// Issue #865 — a claimed-completion status (an off-vocabulary `completed`) is no longer dead-ended at a
+// false "no result" escalation: it reconciles from GitHub (adopting a delivered PR), and when none
+// exists it is auto-retried ONCE before escalating.
+test("reconcileImplement: claimed-completion status + an open PR on the branch → adopt (status=opened)", async () => {
+  const calls: Array<{ repo: string; branch: string }> = [];
+  const res = await reconcileImplement(
+    { status: "completed", subjectKey: "owner/repo#41", taskId: "issue-41" },
+    async (repo, branch) => {
+      calls.push({ repo, branch });
+      return [openPr(900)];
+    },
+    "token",
+  );
+  assertEquals(res, { reconciled: true, status: "opened", pr: "owner/repo#900", retry: false, retryNudge: null, retried: false, deliveryVerified: true });
+  assertEquals(calls, [{ repo: "owner/repo", branch: "feat/issue-41" }]);
+});
+
+test("reconcileImplement: claimed-completion + NO PR + not yet retried → auto-retry once with a nudge", async () => {
+  const res = await reconcileImplement(
+    { status: "completed", subjectKey: "owner/repo#41", taskId: "issue-41" },
+    async () => [],
+    "token",
+  );
+  assertEquals(res.reconciled, false);
+  assertEquals(res.retry, true);
+  assertEquals(res.retried, true);
+  assertEquals(res.status, "completed");
+  assertEquals(typeof res.retryNudge === "string" && res.retryNudge.includes("completed"), true);
+});
+
+// Issue #865 review ("previously missed"): the retry nudge must not over-assert "pushed NO branch, so
+// your work was discarded" — it also fires when an open PR merely targets the WRONG base (a verified
+// absence ON THIS BASE), where the pushed work was NOT discarded. The nudge must describe the missing
+// ADOPTABLE PR and tell the agent to recover pushed work / retarget an existing PR (feature.md resume
+// guidance), not claim the work is gone.
+test("retryNudgeFor: describes the missing ADOPTABLE PR and points at recovery/retarget, never a false 'work was discarded' (#865 review)", () => {
+  const nudge = retryNudgeFor("completed");
+  // It names the reported status.
+  assertEquals(nudge.includes('"completed"'), true);
+  // It does NOT over-assert that no branch was pushed / the work was discarded.
+  assertEquals(nudge.includes("your work was discarded"), false);
+  assertEquals(nudge.includes("pushed NO branch"), false);
+  // It describes the missing adoptable PR (none adoptable on the run's base) and the recovery path:
+  // recover an already-pushed branch / retarget an existing PR (consistent with feature.md resume).
+  assertEquals(nudge.includes("no adoptable pull request"), true);
+  assertEquals(/recover|retarget/i.test(nudge), true);
+});
+
+test("reconcileImplement: claimed-completion + NO PR but ALREADY retried → escalate (retry is bounded once)", async () => {
+  const res = await reconcileImplement(
+    { status: "completed", subjectKey: "owner/repo#41", taskId: "issue-41", retried: true },
+    async () => [],
+    "token",
+  );
+  assertEquals(res, { reconciled: false, status: "completed", pr: null, retry: false, retryNudge: null, retried: true, deliveryVerified: true });
+});
+
+test("reconcileImplement: claimed-completion carrying an answerable question → escalate, no lookup, no retry", async () => {
+  let consulted = false;
+  const res = await reconcileImplement(
+    { status: "completed", subjectKey: "owner/repo#41", taskId: "issue-41", question: "Which design?" },
+    async () => {
+      consulted = true;
+      return [];
+    },
+    "token",
+  );
+  assertEquals(res, { reconciled: false, status: "completed", pr: null, retry: false, retryNudge: null, retried: false, deliveryVerified: false });
+  assertEquals(consulted, false);
+});
+
+test("reconcileImplement: a true no-result (blank status) with no PR escalates — it is NOT auto-retried", async () => {
+  const res = await reconcileImplement(
+    { status: null, subjectKey: "owner/repo#7", taskId: "issue-7" },
+    async () => [],
+    "token",
+  );
+  assertEquals(res.retry, false);
+});
+
+// Issue #865 review — a non-affirmative off-vocabulary status (a reported failure / input-required /
+// unknown) is NOT a claimed completion: it is never reconciled/adopted as success, never auto-retried.
+test("shouldReconcileImplement: a reported non-completion off-vocabulary status does NOT reconcile (#865 review)", () => {
+  assertEquals(shouldReconcileImplement("failed"), false);
+  assertEquals(shouldReconcileImplement("needs_input"), false);
+  assertEquals(shouldReconcileImplement("error"), false);
+});
+
+test("reconcileImplement: a reported 'failed' status + a branch PR → escalate, NOT adopted as success (#865 review)", async () => {
+  let consulted = false;
+  const res = await reconcileImplement(
+    { status: "failed", subjectKey: "owner/repo#7", taskId: "issue-7" },
+    async () => {
+      consulted = true;
+      return [openPr(9)];
+    },
+    "token",
+  );
+  // The open branch PR is never adopted as a success for a reported failure; GitHub is never consulted.
+  assertEquals(res, { reconciled: false, status: "failed", pr: null, ...tail });
+  assertEquals(consulted, false);
+});
+
+// Issue #865 review — a failed/unavailable GitHub lookup does NOT establish that delivery is missing,
+// so it must NEVER consume the one automatic retry. Only a SUCCESSFUL lookup confirming no adoptable PR
+// may retry a claimed completion.
+test("reconcileImplement: claimed-completion + a THROWN lookup → escalate, the retry is NOT consumed (#865 review)", async () => {
+  const res = await reconcileImplement(
+    { status: "completed", subjectKey: "owner/repo#41", taskId: "issue-41" },
+    async () => {
+      throw new Error("github 502");
+    },
+    "token",
+  );
+  // Escalate, retry untouched — the next pass can still retry/adopt once GitHub recovers. The lookup
+  // THREW, so delivery is UNVERIFIED (deliveryVerified: false).
+  assertEquals(res, { reconciled: false, status: "completed", pr: null, retry: false, retryNudge: null, retried: false, deliveryVerified: false });
+});
+
+test("reconcileImplement: claimed-completion + a NULL listing (no transport) → escalate, the retry is NOT consumed (#865 review)", async () => {
+  const res = await reconcileImplement(
+    { status: "completed", subjectKey: "owner/repo#41", taskId: "issue-41" },
+    async () => null,
+    "token",
+  );
+  assertEquals(res, { reconciled: false, status: "completed", pr: null, retry: false, retryNudge: null, retried: false, deliveryVerified: false });
+});
+
+test("reconcileImplement: a blank status + a NULL listing → escalate (unavailable transport, unchanged)", async () => {
+  const res = await reconcileImplement(
+    { status: null, subjectKey: "owner/repo#7", taskId: "issue-7", pr: "owner/repo#42" },
+    async () => null,
+    "token",
+  );
+  assertEquals(res, { reconciled: false, status: null, pr: "owner/repo#42", ...tail });
+});

package/app/implementReconcile.ts

@@ -8,14 +8,19 @@
 // escalation question literally asked a human to go and check (#796's implement-stage twin). Dead-
 // ending that at a person is the defect.
 //
-// This is the CANONICAL, pure decision for the cell's reconcile step: on a blank/absent `status`,
-// look for an OPEN PR opened from the cell's deterministic branch (`feat/<task.id>`, the agent-guide
-// convention every implement-cell caller shares — see resources/prompts/feature.md) and, when one
-// exists, ADOPT it (derive `status = "opened"` + a `pr` key) so the run converges exactly as if the
-// agent had reported it — no human escalation. Only when nothing is observable does the run escalate
-// as today. The GitHub read is injected (the canonical `listPrsForHead`) so this stays a pure,
-// exhaustively testable mirror of the `ic_reconcile_gw` gateway — no second GitHub reconciler.
+// This is the CANONICAL, pure decision for the cell's reconcile step: on a blank/absent `status` — OR
+// an off-vocabulary status such as `completed` that CLAIMED completion without being a recognised
+// terminal (issue #865) — look for an OPEN PR opened from the cell's deterministic branch
+// (`feat/<task.id>`, the agent-guide convention every implement-cell caller shares — see
+// resources/prompts/feature.md) and, when one exists, ADOPT it (derive `status = "opened"` + a `pr`
+// key) so the run converges exactly as if the agent had reported it — no human escalation. When no PR
+// is observable, a claimed-completion-without-delivery is AUTO-RETRIED once with a nudge (#865) before
+// it escalates; a true no-result escalates as today. The GitHub read is injected (the canonical
+// `listPrsForHead`) so this stays a pure, exhaustively testable mirror of the `ic_reconcile_gw`
+// gateway — no second GitHub reconciler.
+import { hasAnswerableQuestion } from "./escalationTaxonomy.ts";
 import type { HeadPr } from "./github.ts";
+import { isClaimedCompletion } from "./implementEscalationReason.ts";
 import { parsePr } from "./prParse.ts";
 
 /** The escalate-arm inputs the reconcile step reads from the implement-cell scope. `subjectKey` is the
@@ -33,15 +38,32 @@ export interface ReconcileImplementInput {
   taskId: unknown;
   pr?: unknown;
   baseBranch?: unknown;
+  /** The agent's own question. An answerable question means a GENUINE escalation even under an
+   *  off-vocabulary status — honour it (escalate), never auto-reconcile/auto-retry over it. */
+  question?: unknown;
+  /** Whether this slice has ALREADY consumed its one automatic retry (the `implementRetried` process
+   *  variable). A claimed-completion-without-delivery is auto-retried ONCE (issue #865) before it
+   *  escalates; this flag bounds that race to a single retry. */
+  retried?: unknown;
 }
 
 /** The reconcile decision. `reconciled` is the `ic_reconcile_gw` gate: true → adopt-and-converge (with
- *  `status = "opened"` + `pr` set); false → escalate as today. `status`/`pr` are re-emitted so the
- *  cell (and its caller) route on the adopted values. */
+ *  `status = "opened"` + `pr` set); false → retry-or-escalate. `retry` is the auto-retry arm (issue
+ *  #865): true → re-dispatch the implement agent ONCE with `retryNudge` appended to its prompt; false →
+ *  escalate as today. `retried` is the bounded-once marker re-emitted into `implementRetried` so the
+ *  second pass can never retry again. `status`/`pr` are re-emitted so the cell (and its caller) route on
+ *  the resolved values. `deliveryVerified` is the EVIDENCE the escalation reason needs (issue #865
+ *  review): `true` ONLY when a GitHub lookup actually ran and CONFIRMED the delivery state (an adoptable
+ *  PR, or a verified absence); `false` when no lookup ran, it threw, or the transport was unavailable —
+ *  so the reason never asserts an UNVERIFIED "no pull request / none was found". */
 export interface ReconcileImplementResult {
   reconciled: boolean;
   status: string | null;
   pr: string | null;
+  retry: boolean;
+  retryNudge: string | null;
+  retried: boolean;
+  deliveryVerified: boolean;
 }
 
 /** The injected GitHub read — the canonical `listPrsForHead(repo, headBranch, token)` (so this module
@@ -51,11 +73,30 @@ export type OpenPrLookup = (repo: string, branch: string, token: string) => Prom
 const str = (v: unknown): string | undefined =>
   typeof v === "string" && v.trim().length > 0 ? v.trim() : undefined;
 
-/** Reconcile ONLY when the agent left no machine-readable status (blank/absent) — the #796/#801
- *  no-result condition. A genuine escalation that carries its own status string is honoured (escalate),
- *  never silently overridden by a branch PR that may be unrelated to the agent's question. */
-export function shouldReconcileImplement(status: unknown): boolean {
-  return str(status) === undefined;
+/** Reconcile (look for a delivered PR) when the agent left no CLEAN, intentional result to route on:
+ *  a blank/absent status (#796/#801's no-result), OR an AFFIRMATIVE-completion alias such as `completed`
+ *  that CLAIMED completion without being a recognised terminal (#865) — both may nonetheless have pushed
+ *  the branch and opened a green PR. A genuine escalation (`status = "escalated"`, or ANY status carrying
+ *  an answerable `question`), and a reported non-completion outcome (`failed`/`needs_input`/unknown), are
+ *  honoured as the agent's own decision and escalate accurately — never silently reconciled/adopted as a
+ *  success by a branch PR that may be unrelated (#865 review). */
+export function shouldReconcileImplement(status: unknown, question?: unknown): boolean {
+  if (hasAnswerableQuestion(typeof question === "string" ? question : null)) return false;
+  return str(status) === undefined || isClaimedCompletion(status);
+}
+
+/** The nudge appended to the implement agent's prompt on its one automatic retry (issue #865), naming
+ *  exactly what was missing (an ADOPTABLE PR on the run's base) and the workspace-confinement rule.
+ *  `status` is the off-vocabulary status it reported.
+ *
+ *  It does NOT over-assert "no branch was pushed / your work was discarded" (#865 review): this nudge
+ *  also fires when an open PR merely targets the WRONG base (a verified absence ON the run's base), where
+ *  the pushed work was NOT discarded. So it describes the missing ADOPTABLE PR and points the agent at
+ *  recovering an already-pushed branch or retargeting an existing PR — consistent with the resume
+ *  instructions in `resources/prompts/feature.md` (check `git ls-remote`, continue from an existing
+ *  branch/PR rather than restarting). */
+export function retryNudgeFor(status: string): string {
+  return `\n\n---\n\n**Automatic retry — your previous attempt claimed completion but no adoptable pull request was found.** You reported status "${status}", yet a GitHub lookup confirmed there is no adoptable pull request for this slice on its base branch. Your work may NOT be lost: if you already pushed the \`feat/<task.id>\` branch, recover it — check the remote with \`git ls-remote --heads origin feat/<task.id>\`, and if a pull request exists but targets the WRONG base, retarget it onto this run's base branch with \`gh pr edit --base <base>\`. Otherwise you likely worked OUTSIDE your run workspace (e.g. \`cd /tmp\`), and those edits were discarded on teardown. This is your FINAL automatic retry; the next failure escalates to a human. Work ONLY inside your run workspace, then \`git commit -s\`, push \`feat/<task.id>\`, and open a PR on the correct base with \`gh pr create\`. Report \`status: "opened"\` with the \`pr\` key — not "${status}".`;
 }
 
 /** The cell's deterministic implement branch — `feat/<task.id>` (resources/prompts/feature.md). */
@@ -86,6 +127,7 @@ export async function reconcileImplement(
   lookup: OpenPrLookup,
   token: string,
 ): Promise<ReconcileImplementResult> {
+  const alreadyRetried = input.retried === true;
   const escalate: ReconcileImplementResult = {
     reconciled: false,
     status: str(input.status) ?? null,
@@ -93,8 +135,15 @@ export async function reconcileImplement(
     // into the process variable, so returning a bare `null` here would wipe a `pr` the implement
     // harness already set. Only a successful adoption below overwrites it.
     pr: str(input.pr) ?? null,
+    retry: false,
+    retryNudge: null,
+    retried: alreadyRetried,
+    // No lookup has CONFIRMED the delivery state on any fall-through path (no lookup ran, it threw, or
+    // the transport was unavailable) — the escalation reason must not assert an unverified absence
+    // (#865 review). Only the successful-lookup paths below flip this to `true`.
+    deliveryVerified: false,
   };
-  if (!shouldReconcileImplement(input.status)) return escalate;
+  if (!shouldReconcileImplement(input.status, input.question)) return escalate;
   const taskId = str(input.taskId);
   // `subjectKey` shares the `owner/repo#N` shape parsePr validates; we use only its `repo` half.
   const parsed = parsePr(input.subjectKey);
@@ -104,9 +153,54 @@ export async function reconcileImplement(
   try {
     prs = await lookup(parsed.repo, branch, token);
   } catch {
-    return escalate; // transport hiccup → escalate as today
+    // GitHub is unavailable — a failed lookup does NOT establish that delivery is missing, so it must
+    // never consume the one automatic retry (issue #865 review). Escalate (best-effort, unchanged from
+    // the pre-#865 no-result behaviour); the next reconcile pass can retry/adopt once GitHub recovers.
+    return escalate;
   }
+  // A `null` listing is an unavailable transport (no token), not a confirmed "no PR" — same reasoning as
+  // the thrown case: escalate rather than retry on unconfirmed state.
+  if (prs === null) return escalate;
   const adopt = pickAdoptablePr(prs, str(input.baseBranch));
-  if (!adopt) return escalate;
-  return { reconciled: true, status: "opened", pr: `${parsed.repo}#${adopt.number}` };
+  if (adopt) {
+    return {
+      reconciled: true,
+      status: "opened",
+      pr: `${parsed.repo}#${adopt.number}`,
+      retry: false,
+      retryNudge: null,
+      retried: alreadyRetried,
+      // The lookup SUCCEEDED and found the adoptable PR — delivery is verified (present).
+      deliveryVerified: true,
+    };
+  }
+  // The lookup SUCCEEDED and confirmed no adoptable PR — delivery is verified (absent), so the
+  // escalation reason may say "none was found"; only now may a claimed completion auto-retry.
+  return maybeRetry(input, alreadyRetried, { ...escalate, deliveryVerified: true });
+}
+
+/** No adoptable PR was found on a SUCCESSFUL lookup. A claimed-completion-without-delivery (an
+ *  affirmative-completion alias such as `completed`) is auto-retried ONCE with a nudge (issue #865)
+ *  before it escalates; everything else — a true no-result, a reported non-completion status, or a slice
+ *  that has already consumed its retry — escalates as today. */
+function maybeRetry(
+  input: ReconcileImplementInput,
+  alreadyRetried: boolean,
+  escalate: ReconcileImplementResult,
+): ReconcileImplementResult {
+  const status = str(input.status);
+  if (!alreadyRetried && status !== undefined && isClaimedCompletion(status)) {
+    return {
+      // Spread the (successful-lookup) escalate base so `deliveryVerified: true` is preserved — this
+      // arm is only reached after a lookup CONFIRMED no adoptable PR.
+      ...escalate,
+      reconciled: false,
+      status: escalate.status,
+      pr: escalate.pr,
+      retry: true,
+      retryNudge: retryNudgeFor(status),
+      retried: true,
+    };
+  }
+  return escalate;
 }

package/app/plan.ts

@@ -10,6 +10,7 @@
 // the process. Data access goes through the record gateway (`data.table`), never
 // hand-written SQL — matching app/service.ts.
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
+import { AGENT_SLA_TIMEOUT } from "./agentSla.ts";
 import {
   InvalidBaseBranchError,
   isPlausibleBranchName,
@@ -1021,6 +1022,17 @@ export async function startPlan(
       // `operators` candidate group); an operator/agent can claim/reassign via the task inbox.
       escalationSlaTimeout: ESCALATION_SLA_TIMEOUT,
       escalationAssignee: null,
+      // Agent-task liveness SLA (issue #849): PRE-SEED the canonical bound for the fan-out's
+      // external agent tasks. Each slice's implementation agent (via the implement-cell
+      // callActivity's explicit `agentSlaTimeout` input mapping) is bounded today; the wave's own
+      // inline `trial-merge` agent (`plan-fanout.bpmn:524-542`) is NOT — it is a separate external
+      // task from the standalone `merge-cell` process (which has no callActivity caller), sits on a
+      // rerun back-edge, and its SLA boundary is deferred to #868 alongside the planner (`plan`) and
+      // plan reviewer (`review-plan`), whose back-edge loop the layouter cannot yet route (layouter
+      // bug #867). For those three this seed is preparation, not yet an armed bound. Each bounded
+      // task's interrupting timer boundary evaluates `=agentSlaTimeout` at timer creation, so a hung
+      // or looping agent escalates to a human instead of parking forever.
+      agentSlaTimeout: AGENT_SLA_TIMEOUT,
       // Capability-barrier bound (#289): the validated ISO-8601 duration read by the
       // `wait-caps-timeout` timer arm of the `wait-caps-resolved` event-based gateway. A task whose
       // declared cross-repo capabilities never resolve (most acutely an unresolvable capabilityRef the

package/app/retro.test.ts

@@ -4,6 +4,7 @@ import { assert, assertEquals, assertStringIncludes } from "#test-assert";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { memBlackboardSource } from "../test/blackboardDb.ts";
 import { withTrackingViews } from "../test/trackingViews.ts";
+import { AGENT_SLA_TIMEOUT } from "./agentSla.ts";
 import { appendEntry } from "./blackboard.ts";
 import { recordTaskDelta } from "./taskDelta.ts";
 import {
@@ -308,6 +309,10 @@ test("maybeStartRetro: starts the retro exactly once when the last PR lands with
   assertEquals(started.length, 1);
   assertEquals(started[0].processDefinitionId, "retro");
   assertEquals(started[0].variables.planKey, PLAN);
+  // The retro seed must carry the canonical agent-SLA bound through its PRODUCTION start path
+  // (not just the e2e, which supplies agentSlaTimeout manually) — else the two external agent
+  // tasks (`conformance` / `synthesize`) would run unbounded (Previously-missed advisory, PR #864).
+  assertEquals(started[0].variables.agentSlaTimeout, AGENT_SLA_TIMEOUT);
   assert(stores["plans"][0].retro_started_at, "retro_started_at must be stamped");
   assertEquals(stores["plan_retro_starts"].length, 1);
 

package/app/retro.ts

@@ -14,6 +14,7 @@
 // Data access goes through the record gateway (`data.table`), never hand-written SQL — matching
 // app/plan.ts, app/blackboard.ts, and app/taskDelta.ts.
 import type { DataLayer, EngineClient, Logger } from "@nanobpm/urban";
+import { AGENT_SLA_TIMEOUT } from "./agentSla.ts";
 import { type BlackboardEntry, isUniqueViolation, readBlackboard } from "./blackboard.ts";
 import { hasDeliveredImplementationForPlan } from "./conformance.ts";
 import { TERMINAL_STATUSES } from "./delivery.ts";
@@ -355,6 +356,9 @@ export async function maybeStartRetro(
           planKey,
           repo: digest.repo,
           issueUrl: digest.issueUrl,
+          // Agent-task liveness SLA (issue #849): bounds the retro's two external agent tasks
+          // (`conformance`, `synthesize`) — a hung agent escalates to a human instead of parking.
+          agentSlaTimeout: AGENT_SLA_TIMEOUT,
         },
       }));
     } catch (err) {

package/app/service.ts

@@ -11,7 +11,7 @@ import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { ABANDONED_STATUS, abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
 import { matchAdjudication, prAdjudications, resetAdjudications } from "./adjudications.ts";
 import { completeEscalationAutoApplied, escalationFormId } from "./agentCompletion.ts";
-import { agentSlaTimeout } from "./agentSla.ts";
+import { AGENT_SLA_TIMEOUT } from "./agentSla.ts";
 import {
   CAPS_RESOLVED_MESSAGE,
   type CapabilityNeed,
@@ -214,13 +214,25 @@ export const MAX_ADVERSARIAL_PASSES = clampCiFixBudget(
  * (allows 0 = escalate immediately, ceiling-capped). */
 export const MAX_MERGE_STALL_ROUNDS = clampCiFixBudget(process.env.NANO_PR_MAX_MERGE_STALL_ROUNDS, 3);
 
-/** How long a merge-loop AGENT service task (rebase / fix-ci) may sit without completing before its
- * interrupting timer boundary fires and the PR escalates for human attention. Seeded as the
- * `agentSlaTimeout` process variable at merge start and evaluated by those tasks' boundary timers.
- * Unlike a human-decision escalation (PT24H), an agent task has no human in the loop — if its
- * capability is unstaffed or the agent hangs/crashes without failing the job, the token would
- * otherwise park forever. Override with `NANO_PR_AGENT_SLA_TIMEOUT` (ISO-8601 duration). */
-export const AGENT_SLA_TIMEOUT = agentSlaTimeout(process.env.NANO_PR_AGENT_SLA_TIMEOUT);
+/** How long an external AGENT service task may sit without completing before its interrupting
+ * timer boundary fires and the process escalates for human attention. Seeded as the
+ * `agentSlaTimeout` process variable at every process start that hosts an external agent task
+ * (issue #849), and evaluated by the BOUNDED subset's boundary timers
+ * (`<bpmn:timeDuration>=agentSlaTimeout`, FEEL at timer creation): the implement-cell, the
+ * merge-cell's trial-merge, the merge-loop's rebase / fix-ci, and retro's conformance / synthesize.
+ * The convergence-loop (review-round / adversarial-review / classify-scope) and plan-fanout (plan /
+ * review-plan) tasks are only PRE-SEEDED here — their boundaries are intentionally deferred to #868
+ * (a bpmn-auto-layout back-edge routing limitation, #867). Plan-fanout's inline wave `trial-merge`
+ * (`plan-fanout.bpmn:524-542`) is likewise deferred: it is a separate external agent task from the
+ * standalone `merge-cell` (which has no callActivity caller) on a rerun back-edge with no boundary
+ * yet. For all of these this seed is preparation, not yet an armed bound. Unlike a human-decision
+ * escalation (PT24H), an agent task has no human in
+ * the loop — if its capability is unstaffed or the agent hangs/crashes without failing the job, the
+ * token would otherwise park forever. Override with `NANO_PR_AGENT_SLA_TIMEOUT` (ISO-8601 duration).
+ * The canonical validated constant lives in the leaf module `app/agentSla.ts` (re-exported here) so
+ * `app/feature.ts`, `app/plan.ts`, `app/retro.ts`, and `app/deliveryRunner.ts` seed it without an
+ * import cycle. */
+export { AGENT_SLA_TIMEOUT } from "./agentSla.ts";
 
 /** How long the convergence loop waits for a fresh review before escalating to a human. Seeded as
  * the `reviewWaitTimeout` process variable at submit and evaluated by the process's
@@ -761,6 +773,13 @@ async function submitPrCritical(
       round: 1,
       maxRounds: clampRounds(maxRounds, MAX_ROUNDS),
       reviewWaitTimeout: REVIEW_WAIT_TIMEOUT,
+      // Agent-task liveness SLA (issue #849): PRE-SEED the bound for the loop's external agent
+      // tasks (review-round / adversarial-review / classify-scope). Those tasks sit on a
+      // back-edge loop whose boundary the layouter cannot yet route, so their SLA boundaries are
+      // intentionally deferred to #868 (layouter bug #867) — this seed is preparation for that
+      // follow-up, not yet an armed bound on this loop. (The merge-loop's rebase / fix-ci, seeded
+      // from the same constant, ARE bounded today.)
+      agentSlaTimeout: AGENT_SLA_TIMEOUT,
       // Bounded agent auto-ack (issue #796): the convergence loop re-dispatches the review-round
       // agent up to `ackRetryMax` times to ack suppressed advisories when the converge-gate blocks
       // solely on unacked ones, before escalating to a human. `ackRetryRound` counts those passes.