@nanobpm/nano-workforce 0.200.7 → 0.200.9

package/resources/processes/retro.bpmn

@@ -23,6 +23,8 @@
           <nano:extend name="deviationsRaised" type="integer" optional="true" />
           <nano:extend name="deviationsUnraised" type="integer" optional="true" />
           <nano:extend name="hasDeviations" type="boolean" optional="true" />
+          <nano:extend name="agentSlaElapsed" type="boolean" optional="true" />
+          <nano:extend name="preserveConformance" type="boolean" optional="true" />
           <nano:extend name="summary" type="string" optional="true" />
         </nano:shape>
       </nano:shapes>
@@ -54,16 +56,56 @@
       <bpmn:incoming>f_toConformance</bpmn:incoming>
       <bpmn:outgoing>f_toRecordConformance</bpmn:outgoing>
     </bpmn:serviceTask>
+    <bpmn:boundaryEvent id="be_conformance_sla" name="Agent SLA elapsed" attachedToRef="conformance">
+      <bpmn:outgoing>f_conformanceSla</bpmn:outgoing>
+      <bpmn:timerEventDefinition id="ted_conformance_sla">
+        <bpmn:timeDuration xsi:type="bpmn:tFormalExpression">=agentSlaTimeout</bpmn:timeDuration>
+      </bpmn:timerEventDefinition>
+    </bpmn:boundaryEvent>
     <bpmn:serviceTask id="record-conformance" name="Record conformance">
       <bpmn:extensionElements>
         <zeebe:taskDefinition type="pr.conformance-record" />
         <zeebe:properties>
           <zeebe:property name="io.nanobpm.dataEnvelope.in" value="ConformanceRecordIn" />
         </zeebe:properties>
+        <zeebe:ioMapping>
+          <zeebe:input source="=false" target="agentSlaElapsed" />
+          <zeebe:input source="=false" target="preserveConformance" />
+        </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_toRecordConformance</bpmn:incoming>
       <bpmn:outgoing>f_toDeviationsGw</bpmn:outgoing>
     </bpmn:serviceTask>
+    <bpmn:serviceTask id="record-conformance-sla" name="Record conformance (agent SLA)">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.conformance-record" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="ConformanceRecordIn" />
+        </zeebe:properties>
+        <zeebe:ioMapping>
+          <zeebe:input source="=true" target="agentSlaElapsed" />
+          <zeebe:input source="=false" target="preserveConformance" />
+          <zeebe:input source="=&#34;The spec-conformance agent exceeded its time budget (SLA &#34; + agentSlaTimeout + &#34;) without returning a verdict — it is hung or looping. Acknowledge to record the timeout and continue to the retrospective synthesis.&#34;" target="summary" />
+        </zeebe:ioMapping>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_conformanceSla</bpmn:incoming>
+      <bpmn:outgoing>f_conformanceSlaToEsc</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:serviceTask id="record-synthesize-sla" name="Record synthesize (agent SLA)">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.conformance-record" />
+        <zeebe:properties>
+          <zeebe:property name="io.nanobpm.dataEnvelope.in" value="ConformanceRecordIn" />
+        </zeebe:properties>
+        <zeebe:ioMapping>
+          <zeebe:input source="=true" target="agentSlaElapsed" />
+          <zeebe:input source="=true" target="preserveConformance" />
+          <zeebe:input source="=&#34;The retrospective-synthesis agent exceeded its time budget (SLA &#34; + agentSlaTimeout + &#34;) without completing — it is hung or looping. Acknowledge to record the timeout and continue.&#34;" target="summary" />
+        </zeebe:ioMapping>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_synthesizeSla</bpmn:incoming>
+      <bpmn:outgoing>f_synthesizeSlaToEsc</bpmn:outgoing>
+    </bpmn:serviceTask>
     <bpmn:exclusiveGateway id="gw-deviations" name="deviations?" default="f_noDeviations">
       <bpmn:incoming>f_toDeviationsGw</bpmn:incoming>
       <bpmn:outgoing>f_deviations</bpmn:outgoing>
@@ -104,6 +146,12 @@
       <bpmn:incoming>f_ackToSynthesize</bpmn:incoming>
       <bpmn:outgoing>f_toRecord</bpmn:outgoing>
     </bpmn:serviceTask>
+    <bpmn:boundaryEvent id="be_synthesize_sla" name="Agent SLA elapsed" attachedToRef="synthesize">
+      <bpmn:outgoing>f_synthesizeSla</bpmn:outgoing>
+      <bpmn:timerEventDefinition id="ted_synthesize_sla">
+        <bpmn:timeDuration xsi:type="bpmn:tFormalExpression">=agentSlaTimeout</bpmn:timeDuration>
+      </bpmn:timerEventDefinition>
+    </bpmn:boundaryEvent>
     <bpmn:serviceTask id="record" name="Record retro">
       <bpmn:extensionElements>
         <zeebe:taskDefinition type="pr.retro-record" />
@@ -119,6 +167,10 @@
     </bpmn:endEvent>
     <bpmn:sequenceFlow id="f_start" sourceRef="Start" targetRef="gather" />
     <bpmn:sequenceFlow id="f_toConformance" sourceRef="gather" targetRef="conformance" />
+    <bpmn:sequenceFlow id="f_conformanceSla" name="conformance agent SLA elapsed" sourceRef="be_conformance_sla" targetRef="record-conformance-sla" />
+    <bpmn:sequenceFlow id="f_synthesizeSla" name="synthesize agent SLA elapsed" sourceRef="be_synthesize_sla" targetRef="record-synthesize-sla" />
+    <bpmn:sequenceFlow id="f_conformanceSlaToEsc" sourceRef="record-conformance-sla" targetRef="conformance-escalation" />
+    <bpmn:sequenceFlow id="f_synthesizeSlaToEsc" sourceRef="record-synthesize-sla" targetRef="conformance-escalation" />
     <bpmn:sequenceFlow id="f_toRecordConformance" sourceRef="conformance" targetRef="record-conformance" />
     <bpmn:sequenceFlow id="f_toDeviationsGw" sourceRef="record-conformance" targetRef="gw-deviations" />
     <bpmn:sequenceFlow id="f_deviations" name="deviations" sourceRef="gw-deviations" targetRef="conformance-escalation">
@@ -147,6 +199,12 @@
       <bpmndi:BPMNShape id="BPMNShape_record-conformance" bpmnElement="record-conformance">
         <dc:Bounds x="616" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_record-conformance-sla" bpmnElement="record-conformance-sla">
+        <dc:Bounds x="616" y="400" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_record-synthesize-sla" bpmnElement="record-synthesize-sla">
+        <dc:Bounds x="1566" y="400" width="100" height="80" />
+      </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_gw-deviations" bpmnElement="gw-deviations" isMarkerVisible="true">
         <dc:Bounds x="816" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
@@ -171,6 +229,18 @@
           <dc:Bounds x="1744" y="143" width="80" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_be_conformance_sla" bpmnElement="be_conformance_sla">
+        <dc:Bounds x="448" y="142" width="36" height="36" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="370" y="183" width="72" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_be_synthesize_sla" bpmnElement="be_synthesize_sla">
+        <dc:Bounds x="1398" y="142" width="36" height="36" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1320" y="183" width="72" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
       <bpmndi:BPMNEdge id="BPMNEdge_f_start" bpmnElement="f_start">
         <di:waypoint x="116" y="120" />
         <di:waypoint x="216" y="120" />
@@ -207,14 +277,41 @@
           <dc:Bounds x="846" y="206" width="74" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_conformanceSlaToEsc" bpmnElement="f_conformanceSlaToEsc">
+        <di:waypoint x="716" y="440" />
+        <di:waypoint x="1016" y="440" />
+        <di:waypoint x="1016" y="320" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_toConformanceAck" bpmnElement="f_toConformanceAck">
         <di:waypoint x="1066" y="280" />
         <di:waypoint x="1166" y="280" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_ackToSynthesize" bpmnElement="f_ackToSynthesize">
-        <di:waypoint x="1266" y="280" />
-        <di:waypoint x="1416" y="280" />
-        <di:waypoint x="1416" y="160" />
+        <di:waypoint x="1216" y="240" />
+        <di:waypoint x="1216" y="120" />
+        <di:waypoint x="1366" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_conformanceSla" bpmnElement="f_conformanceSla">
+        <di:waypoint x="466" y="178" />
+        <di:waypoint x="466" y="440" />
+        <di:waypoint x="616" y="440" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="471" y="288" width="84" height="42" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_synthesizeSla" bpmnElement="f_synthesizeSla">
+        <di:waypoint x="1416" y="178" />
+        <di:waypoint x="1416" y="440" />
+        <di:waypoint x="1566" y="440" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1421" y="288" width="74" height="42" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_synthesizeSlaToEsc" bpmnElement="f_synthesizeSlaToEsc">
+        <di:waypoint x="1616" y="480" />
+        <di:waypoint x="1616" y="500" />
+        <di:waypoint x="1016" y="500" />
+        <di:waypoint x="1016" y="320" />
       </bpmndi:BPMNEdge>
     </bpmndi:BPMNPlane>
   </bpmndi:BPMNDiagram>

package/resources/prompts/feature.md

@@ -18,6 +18,19 @@ The job payload (stdin JSON) carries:
 
 You have `gh` / git authenticated for the target repository.
 
+## Workspace confinement — work ONLY inside your run workspace
+
+Your run has a private workspace directory (the git repository you start in — the
+clone/worktree the harness checked out for you). **Do all your work there.** Never
+`cd /tmp/<repo>`, clone into a shared path, or edit files outside your workspace:
+that directory is torn down when your run ends, so edits made elsewhere are
+**silently lost** (and can collide with a sibling run sharing the path). If you
+need the repo, use the one you are already in — do not clone a second copy into
+`/tmp`. A completion that leaves no commit on `feat/<task.id>` and no PR is treated
+as a **failed, undelivered attempt** (see the reconcile/escalation behaviour the
+app applies), so your work must land in a pushed commit on your branch, nowhere
+else.
+
 ## Your branch (deterministic — the same across a resume)
 
 Always use the branch **`feat/<task.id>`**. Because a resumed run gets a fresh
@@ -192,7 +205,9 @@ Write a JSON object of **result variables** to the file named by the
 
 Rules:
 
-- `status` — one of:
+- `status` — one of EXACTLY these four tokens (any other value — e.g.
+  `completed`, `done`, `success` — is **off-vocabulary**: the app cannot route on
+  it and will treat your slice as **not delivered**, so never invent one):
   - `opened` — a PR was created (ready for review). Set `pr`.
   - `escalated` — you need a human decision; set `question`, and set `pr` to the
     **draft** PR you opened to preserve your work (if you managed to open one).

package/test/derivation-parity/derivation-parity.test.ts

@@ -173,33 +173,57 @@ test("loop() inserts a gateway head, so back-edges cannot merge into a task", ()
 // structured topology (clears class 2), but issue #745 added the engine-native
 // AgentTask marker `<zeebe:agentDefinition agentType="external" />` to its two
 // prompt-bearing `senior:*` tasks and the published compiler cannot emit it.
-// Prove the blocker is real AND that it is the ONLY divergence, so the parked
-// entry is a complete, verified port held ready — not an abandoned one.
-test("retro's complete port differs from its golden by ONLY the agent-task marker", () => {
+// Issue #849 then added an interrupting `agentSlaTimeout` timer boundary to each
+// of those tasks (routing to the `conformance-escalation` user task) — the
+// code-first builder cannot express a boundary event on a task either (its
+// `FlowNode` union has no such node; AGENTS.md). Prove the blockers are real AND
+// that they are the ONLY divergence, so the parked entry is a complete, verified
+// port held ready — not an abandoned one.
+test("retro's complete port differs from its golden by ONLY the agent-task marker + SLA boundaries", () => {
   const golden = readFileSync(goldenPath("retro"), "utf8");
   const derived = declarativeToBpmn(retroFlow);
   const markers = (xml: string): number =>
     (xml.match(/<(?:\w+:)?agentDefinition\b[^>]*\bagentType="external"/g) ?? []).length;
+  const boundaries = (xml: string): number =>
+    (xml.match(/<(?:\w+:)?boundaryEvent\b/g) ?? []).length;
 
   // (a) the golden really carries the marker, on BOTH of its agent tasks — and it
   //     cannot simply be dropped: app/agentic/vocab/agent-marker.test.ts is a
   //     defect-class guard requiring it on every deployed prompt-bearing agent task.
   assertEquals(markers(golden), 2, "retro's golden should mark senior:conformance and senior:retro");
+  //     …and each marked task is SLA-bounded (issue #849; the defect-class guard is
+  //     app/agentic/vocab/agent-sla-boundary.test.ts).
+  assertEquals(boundaries(golden), 2, "retro's golden should SLA-bound both agent tasks");
 
-  // (b) the published compiler emits none of it — the blocker is real, not a guess.
-  //     When this starts failing, upstream task() grew marker support: un-park retro
-  //     by threading `retroFlow` back into its PORTS entry in ./flows.ts.
+  // (b) the published compiler emits none of it — the blockers are real, not a guess.
+  //     When the marker assertion starts failing, upstream task() grew marker support;
+  //     when the boundary assertion starts failing, the builder grew boundary events:
+  //     un-park retro by threading `retroFlow` back into its PORTS entry in ./flows.ts.
   assertEquals(markers(derived), 0, "@nanobpm/workflow can now emit <zeebe:agentDefinition/> — un-park retro");
+  assertEquals(boundaries(derived), 0, "@nanobpm/workflow can now emit boundary events — un-park retro");
 
-  // (c) strip exactly the marker lines from the golden and the port derives the
-  //     WHOLE model green, through the shared harness's own normalize/equality —
-  //     so nothing but the marker diverges.
-  const unmarked = golden.replace(/^[ \t]*<(?:\w+:)?agentDefinition\b[^>]*\/>[ \t]*\r?\n/gm, "");
+  // (c) strip exactly the marker lines AND the SLA boundary blocks (plus their
+  //     sequence flows, the two SLA recorder service tasks they feed, and the
+  //     extra incomings on the escalation user task) from the golden and the port
+  //     derives the WHOLE model green, through the shared harness's own
+  //     normalize/equality — so nothing but the marker + SLA-escalation apparatus
+  //     diverges.
+  const unmarked = golden
+    .replace(/^[ \t]*<(?:\w+:)?agentDefinition\b[^>]*\/>[ \t]*\r?\n/gm, "")
+    .replace(/^[ \t]*<(?:\w+:)?boundaryEvent\b[\s\S]*?<\/(?:\w+:)?boundaryEvent>\r?\n/gm, "")
+    // the SLA recorder service tasks (record-conformance-sla / record-synthesize-sla) and the
+    // `<!-- Agent-SLA recorders: … -->` comment block immediately preceding them
+    .replace(/^[ \t]*<!--[\s\S]*?-->[ \t]*\r?\n(?=[ \t]*<(?:\w+:)?serviceTask\b[^>]*\bid="record-(?:conformance|synthesize)-sla")/gm, "")
+    .replace(/^[ \t]*<(?:\w+:)?serviceTask\b[^>]*\bid="record-(?:conformance|synthesize)-sla"[\s\S]*?<\/(?:\w+:)?serviceTask>\r?\n/gm, "")
+    .replace(/^[ \t]*<(?:\w+:)?sequenceFlow\b[^>]*\bsourceRef="be_[^"]*"[^>]*\/>[ \t]*\r?\n/gm, "")
+    .replace(/^[ \t]*<(?:\w+:)?sequenceFlow\b[^>]*\bsourceRef="record-(?:conformance|synthesize)-sla"[^>]*\/>[ \t]*\r?\n/gm, "")
+    .replace(/^[ \t]*<(?:\w+:)?incoming>f_(?:conformanceSla|synthesizeSla)(?:ToEsc)?<\/(?:\w+:)?incoming>[ \t]*\r?\n/gm, "");
   assertEquals(markers(unmarked), 0, "the strip must remove every marker line");
+  assertEquals(boundaries(unmarked), 0, "the strip must remove every SLA boundary");
   const expected = normalize(unmarked);
   const actual = normalize(derived);
   assert(
     modelsEqual(expected, actual),
-    `retro's port must derive its golden once the agent-task marker is stripped — residual drift:\n${diffModels(expected, actual)}`,
+    `retro's port must derive its golden once the agent-task marker and SLA boundaries are stripped — residual drift:\n${diffModels(expected, actual)}`,
   );
 });

package/test/derivation-parity/flows.ts

@@ -133,7 +133,20 @@ export const retroFlow: DeclarativeFlow = defineFlow(
       jobType: "senior:conformance",
       prompt: { resourceId: "prompts/conformance.md", bindingType: "latest", append: "=conformanceDigest" },
     });
-    w.task("record-conformance", { jobType: "pr.conformance-record" });
+    w.task("record-conformance", {
+      jobType: "pr.conformance-record",
+      // The golden pins both SLA-mode control flags to `=false` on this NORMAL-path recorder
+      // (round-7 review, PR #864): the flags share the external conformance agent's result
+      // namespace, so a hoisted agent output must never select the SLA/preserve branch. The port
+      // reproduces those pins so the parity diagnostic's only residual is the class-3 marker +
+      // SLA boundaries.
+      io: {
+        input: [
+          { source: "=false", target: "agentSlaElapsed" },
+          { source: "=false", target: "preserveConformance" },
+        ],
+      },
+    });
     w.branch("hasDeviations = true", {
       then: (b) => {
         b.human("conformance-escalation", {

package/workers/conformance-record/worker.test.ts

@@ -1,5 +1,8 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { test } from "node:test";
-import { assertEquals, assertRejects } from "#test-assert";
+import { fileURLToPath } from "node:url";
+import { assert, assertEquals, assertRejects } from "#test-assert";
 import { noopLog } from "../../test/log.ts";
 import handler from "./worker.ts";
 
@@ -239,3 +242,86 @@ test("conformance-record: fails (not a silent, untrackable escalation) when ther
   // Nothing was persisted: the throw precedes the write, so no untrackable row is left behind.
   assertEquals(stores.plan_conformance.length, 0);
 });
+
+test("conformance-record: an agent-SLA timeout persists a reviewing row (so the ack finds it) with no deviations", async () => {
+  const { app, stores } = fakeApp();
+  // The retro SLA arm routes here with agentSlaElapsed=true + an SLA summary and NO agent verdict
+  // (the conformance/synthesize agent timed out). The shared conformance-escalation ack task always
+  // runs pr.conformance-ack → acknowledgeConformance, which THROWS when no plan_conformance row
+  // exists — so the SLA path must persist a `reviewing` row even though nothing was scored.
+  const out = await handler(
+    {
+      processInstanceKey: "retro-inst-13",
+      variables: {
+        planKey: "o/r#13",
+        agentSlaElapsed: true,
+        summary: "The spec-conformance agent exceeded its time budget (SLA PT2H) without returning a verdict.",
+      },
+    } as any,
+    app as any,
+  );
+  const row = stores.plan_conformance[0];
+  // A timeout produces no verdict: status coerces to skipped, all counts zeroed, has_deviations 0 …
+  assertEquals(row.status, "skipped");
+  assertEquals(row.has_deviations, 0);
+  // … but the row IS parked at `reviewing` (keyed off the instance) so acknowledgeConformance settles
+  // it instead of throwing, and the Tasks inbox shows the SLA-timeout summary as the reason.
+  assertEquals(row.review_status, "reviewing");
+  assertEquals(row.process_key, "retro-inst-13");
+  assertEquals(row.summary, "The spec-conformance agent exceeded its time budget (SLA PT2H) without returning a verdict.");
+  // The SLA arm routes to the escalation task directly (not via gw-deviations), so the returned flag
+  // stays the ground-truth `hasDeviations` (false) — it is not read on the SLA path.
+  assertEquals(out, { hasDeviations: false });
+});
+
+test("conformance-record: an agent-SLA timeout with no processKey fails loudly (untrackable escalation)", async () => {
+  const { app, stores } = fakeApp();
+  await assertRejects(
+    () =>
+      handler(
+        { variables: { planKey: "o/r#14", agentSlaElapsed: true, summary: "sla" } } as any,
+        app as any,
+      ),
+    Error,
+    "no processInstanceKey",
+  );
+  assertEquals(stores.plan_conformance.length, 0);
+});
+
+// DEFECT-CLASS GUARD (PR #864 review r4181010853): the SLA-control flags `agentSlaElapsed` and
+// `preserveConformance` share the process-variable namespace the external conformance agent's
+// result-JSON is hoisted into. If a `pr.conformance-record` task does NOT pin both flags to a
+// literal via ioMapping, a completed agent that emits `agentSlaElapsed:true` / `preserveConformance:true`
+// could make the NORMAL recorder persist `review_status='reviewing'` (or take the preserve branch)
+// while `gw-deviations` routes away from the ack task — leaving the row permanently stuck. Every
+// recorder task must therefore pin BOTH flags to a constant so agent output can never select this
+// internal control path. This structural guard fails if any recorder (now or a future one) forgets.
+const RETRO_BPMN = join(
+  dirname(fileURLToPath(import.meta.url)),
+  "../../resources/processes/retro.bpmn",
+);
+const SERVICE_TASK = /<bpmn:serviceTask\b[\s\S]*?<\/bpmn:serviceTask>/g;
+
+test("DEFECT-CLASS GUARD: every pr.conformance-record task pins agentSlaElapsed + preserveConformance to a literal (agent output cannot select SLA control path)", () => {
+  const xml = readFileSync(RETRO_BPMN, "utf8");
+  const recorders: string[] = [];
+  for (const [block] of xml.matchAll(SERVICE_TASK)) {
+    if (!/type="pr\.conformance-record"/.test(block)) continue;
+    const id = block.match(/<bpmn:serviceTask\b[^>]*\bid="([^"]*)"/)?.[1] ?? "(unknown)";
+    recorders.push(id);
+    for (const flag of ["agentSlaElapsed", "preserveConformance"]) {
+      // A literal pin is `<zeebe:input source="=true|false" target="<flag>" />` — the source must be
+      // a boolean constant, NOT a process-variable reference (which would read hoisted agent output).
+      const pin = new RegExp(
+        `<zeebe:input\\s+source="=(?:true|false)"\\s+target="${flag}"\\s*/>`,
+      );
+      assert(
+        pin.test(block),
+        `retro.bpmn: record task "${id}" does not pin "${flag}" to a literal — agent output could ` +
+          `select the internal SLA/preserve control path (PR #864 review r4181010853)`,
+      );
+    }
+  }
+  // Sanity: there really are recorder tasks (guard is not vacuously green) — normal + 2 SLA arms.
+  assert(recorders.length >= 3, `expected >=3 pr.conformance-record tasks, found ${recorders.length}`);
+});

package/workers/conformance-record/worker.ts

@@ -9,7 +9,7 @@
 // reads `status`/`pr`/`summary` through), and exposes the raw transcript under the
 // `io.nanobpm.agentResult` envelope's `.output`.
 import type { AppJobHandler } from "@nanobpm/urban";
-import { recordConformance } from "../../app/conformance.ts";
+import { markConformanceSynthesisSla, recordConformance } from "../../app/conformance.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
 
 const AGENT_RESULT_KEY = "io.nanobpm.agentResult";
@@ -81,6 +81,22 @@ const handler: AppJobHandler<In> = async (job, app) => {
   // the same `String(...)` coercion app/service.ts applies when it stamps `process_key`.
   const processKey = job.processInstanceKey != null ? String(job.processInstanceKey) : null;
 
+  // Agent-SLA path (issue #849 review): the conformance/synthesize agent's interrupting timer
+  // boundary fired (retro.bpmn routes the SLA arm here with `agentSlaElapsed=true` + an SLA summary).
+  // The agent produced no verdict, so there is nothing to score — but the shared conformance-escalation
+  // ack task ALWAYS runs `pr.conformance-ack`, whose `acknowledgeConformance` throws when no
+  // `plan_conformance` row exists. Persist a `reviewing` row so the ack settles it and the Tasks inbox
+  // shows the SLA-timeout reason. This escalates exactly like a deviations finding.
+  const agentSlaElapsed = asBool(job.variables.agentSlaElapsed);
+  const escalate = hasDeviations || agentSlaElapsed;
+
+  // Synthesis-SLA preserve path (PR #864 review): the `record-synthesize-sla` arm runs AFTER
+  // `record-conformance` already persisted a real verdict, so it sets `preserveConformance=true` to
+  // flip the row to `reviewing` + append the synthesis-timeout context WITHOUT overwriting the filed
+  // status/counts/report/summary. Only the synthesize arm sets this; the conformance-SLA arm
+  // (`record-conformance-sla`) interrupts BEFORE any verdict exists, so it takes the upsert below.
+  const preserveConformance = asBool(job.variables.preserveConformance);
+
   // Invariant: an escalation must be trackable. If we found deviations to escalate but have no
   // process key to key the `reviewing` row off, the `hasDeviations` return below would still route
   // retro to the `conformance-escalation` user task — yet `pollUserTasks` can never surface that ack
@@ -88,13 +104,23 @@ const handler: AppJobHandler<In> = async (job, app) => {
   // escalation wedges forever, invisible to any human. Rather than record that silent, unreachable
   // state, fail loudly so the run retries/alerts. `job.processInstanceKey` is always present for an
   // activated job, so this only fires on a genuine engine-contract violation.
-  if (hasDeviations && processKey == null) {
+  if (escalate && processKey == null) {
     throw new Error(
-      `conformance-record: ${planKey} has deviations to escalate but no processInstanceKey to track ` +
+      `conformance-record: ${planKey} has an escalation to record but no processInstanceKey to track ` +
         "the escalation — refusing to route to an untrackable conformance-escalation ack task",
     );
   }
 
+  if (preserveConformance) {
+    // Preserve the existing conformance verdict; only mark it reviewing + append the SLA reason.
+    await markConformanceSynthesisSla(app.data, planKey, {
+      summary: summary ?? "The retrospective-synthesis agent exceeded its time budget without completing.",
+      processKey,
+    });
+    app.log.info(`conformance-record: ${planKey} — synthesis SLA, preserved existing verdict (reviewing)`);
+    return { hasDeviations };
+  }
+
   await recordConformance(app.data, planKey, {
     status,
     commentUrl: filed ? commentUrl : null,
@@ -110,17 +136,18 @@ const handler: AppJobHandler<In> = async (job, app) => {
     // Only enter the `reviewing` inbox scan when we actually have a `processKey` to key off — a
     // null key can never be found by `pollUserTasks` (it skips rows without `process_key`) nor
     // cleared by the `instanceTracking` `onTerminated` binding, so a `reviewing` row with no key
-    // would wedge forever. The invariant guard above already rejected `hasDeviations` with a null
+    // would wedge forever. The invariant guard above already rejected any escalation with a null
     // key, so `reviewing` here always carries a non-null `processKey`.
-    reviewStatus: hasDeviations ? "reviewing" : "reviewed",
+    reviewStatus: escalate ? "reviewing" : "reviewed",
   });
 
   app.log.info(
-    `conformance-record: ${planKey} — status=${status} deviations=${hasDeviations ? "yes" : "no"}`,
+    `conformance-record: ${planKey} — status=${status} deviations=${hasDeviations ? "yes" : "no"} agentSla=${agentSlaElapsed ? "yes" : "no"}`,
   );
   // Return the ground-truth `hasDeviations` as a process variable so the `gw-deviations` gateway
   // routes to the human ack task (retro.bpmn) — overriding the agent's hoisted flag with the value
-  // reconciled against the recorded counts above.
+  // reconciled against the recorded counts above. (The SLA arm routes to the escalation task
+  // directly, not through gw-deviations, so this flag is only read on the normal path.)
   return { hasDeviations };
 };
 

package/workers/reconcile-implement/worker.test.ts

@@ -28,7 +28,7 @@ test("adopts an open PR on the branch: emits reconciled + status=opened + pr", a
       { jobKey: "j1", variables: { subjectKey: "owner/repo#801", task: { id: "issue-801" }, status: null } } as never,
       fakeApp,
     );
-    assertEquals(out, { reconciled: true, status: "opened", pr: "owner/repo#801" });
+    assertEquals(out, { reconciled: true, status: "opened", pr: "owner/repo#801", retry: false, retryNudge: null, retried: false, deliveryVerified: true });
   } finally {
     globalThis.fetch = prevFetch;
     if (prevToken === undefined) delete process.env.GITHUB_TOKEN;
@@ -54,7 +54,7 @@ test("wires baseBranch through: a wrong-base open PR is NOT adopted → escalate
       { jobKey: "j3", variables: { subjectKey: "owner/repo#7", task: { id: "issue-7" }, status: null, baseBranch: "epic/feat-x" } } as never,
       fakeApp,
     );
-    assertEquals(out, { reconciled: false, status: null, pr: null });
+    assertEquals(out, { reconciled: false, status: null, pr: null, retry: false, retryNudge: null, retried: false, deliveryVerified: true });
   } finally {
     globalThis.fetch = prevFetch;
     if (prevToken === undefined) delete process.env.GITHUB_TOKEN;
@@ -76,7 +76,35 @@ test("no open PR on the branch: falls through to escalate (reconciled=false)", a
       { jobKey: "j2", variables: { subjectKey: "owner/repo#7", task: { id: "issue-7" }, status: null } } as never,
       fakeApp,
     );
-    assertEquals(out, { reconciled: false, status: null, pr: null });
+    assertEquals(out, { reconciled: false, status: null, pr: null, retry: false, retryNudge: null, retried: false, deliveryVerified: true });
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevToken === undefined) delete process.env.GITHUB_TOKEN;
+    else process.env.GITHUB_TOKEN = prevToken;
+    if (prevTransport === undefined) delete process.env.NANO_PR_GITHUB_TRANSPORT;
+    else process.env.NANO_PR_GITHUB_TRANSPORT = prevTransport;
+  }
+});
+
+test("claimed-completion (off-vocabulary status) + no PR → auto-retry once with a nudge (issue #865)", async () => {
+  const prevToken = process.env.GITHUB_TOKEN;
+  const prevTransport = process.env.NANO_PR_GITHUB_TRANSPORT;
+  const prevFetch = globalThis.fetch;
+  process.env.GITHUB_TOKEN = "t";
+  process.env.NANO_PR_GITHUB_TRANSPORT = "token";
+  globalThis.fetch = (async () => new Response(JSON.stringify([]), { status: 200 })) as typeof fetch;
+  try {
+    const out = await handler(
+      {
+        jobKey: "j4",
+        variables: { subjectKey: "owner/repo#41", task: { id: "issue-41" }, status: "completed" },
+      } as never,
+      fakeApp,
+    );
+    assertEquals(out.reconciled, false);
+    assertEquals(out.retry, true);
+    assertEquals(out.retried, true);
+    assertEquals(typeof out.retryNudge === "string" && out.retryNudge.length > 0, true);
   } finally {
     globalThis.fetch = prevFetch;
     if (prevToken === undefined) delete process.env.GITHUB_TOKEN;

package/workers/reconcile-implement/worker.ts

@@ -28,6 +28,8 @@ interface In extends Record<string, unknown> {
   status?: unknown;
   pr?: unknown;
   baseBranch?: unknown;
+  question?: unknown;
+  implementRetried?: unknown;
 }
 
 /** The cell's deterministic branch is `feat/<task.id>`; `task` is the implement-cell's slice object.
@@ -45,6 +47,8 @@ const handler: AppJobHandler<In, ReconcileImplementResult> = async (job, app) =>
       taskId: taskId(job.variables.task),
       pr: job.variables.pr,
       baseBranch: job.variables.baseBranch,
+      question: job.variables.question,
+      retried: job.variables.implementRetried,
     },
     listPrsForHead,
     process.env.GITHUB_TOKEN ?? "",
@@ -52,6 +56,7 @@ const handler: AppJobHandler<In, ReconcileImplementResult> = async (job, app) =>
   app.log.info("reconcile-implement", {
     subjectKey: job.variables.subjectKey ?? null,
     reconciled: res.reconciled,
+    retry: res.retry,
     pr: res.pr,
   });
   return res;

package/workers/record-feature-escalation/worker.test.ts

@@ -97,14 +97,43 @@ test("no-result: a missing status/question synthesises the #360 answerable quest
   assertEquals(app.stores.feature_escalations[0].question, NO_RESULT_QUESTION);
 });
 
-test("blank-question escalated: still synthesises the #360 question (never a dead-end task)", async () => {
+test("blank-question escalated: synthesises an ACCURATE reported-status reason, not the false no-result text (#865 review)", async () => {
+  // A reported `escalated` with a blank question reaches the builder. It must name the reported status
+  // accurately — never the false "no status was reported" (no-result) diagnosis — and never dead-end.
   const app = fakeApp([]);
   const out = await handler(
     { jobKey: "job-b", variables: { subjectKey: "owner/repo#2", status: "escalated", question: "   " } } as never,
     app,
   );
-  assertEquals(out, { question: NO_RESULT_QUESTION });
-  assertEquals(app.stores.feature_escalations[0].question, NO_RESULT_QUESTION);
+  assertEquals(out.question.includes('reported status "escalated"'), true);
+  assertEquals(out.question.includes("gave no answerable question"), true);
+  assertEquals(out.question.includes("without a machine-readable result"), false);
+  assertEquals(app.stores.feature_escalations[0].question, out.question);
+});
+
+test("escalated with a question + summary + transcript: preserves ALL context, not just the question (#865 review)", async () => {
+  // The #865-review defect: an `escalated` result carrying a question, summary, and transcript persisted
+  // ONLY the question, leaving pollUserTasks without the supporting decision context.
+  const rows = [{ feature_key: "owner/repo#9", status: "running" }];
+  const app = fakeApp(rows);
+  const out = await handler(
+    {
+      jobKey: "job-9",
+      variables: {
+        subjectKey: "owner/repo#9",
+        status: "escalated",
+        question: "Should I target the epic base or main?",
+        summary: "drafted the migration but the base is ambiguous",
+        transcriptUrl: "http://merlin.local:3000/t?stream=job%3A777",
+      },
+    } as never,
+    app,
+  );
+  assertEquals(out.question.startsWith("Should I target the epic base or main?"), true);
+  assertEquals(out.question.includes('The agent\'s own summary: "drafted the migration but the base is ambiguous".'), true);
+  assertEquals(out.question.includes("Transcript: http://merlin.local:3000/t?stream=job%3A777"), true);
+  assertEquals(rows[0].status, "escalated");
+  assertEquals(app.stores.feature_escalations[0].question, out.question);
 });
 
 test("fails fast (incident) when subjectKey is absent — never appends a corrupt undefined-keyed audit row", async () => {
@@ -132,3 +161,29 @@ test("a retried job (same jobKey) reuses its audit row, never duplicating", asyn
   assertEquals(app.stores.feature_escalations.length, 1, "the retry reuses the row, no duplicate append");
   assertEquals(app.stores.feature_escalations[0].job_key, "job-retry");
 });
+
+test("claimed-completion (off-vocabulary status) with no question: accurate reason, not the false no-result text (issue #865)", async () => {
+  // The #865 defect reproduction: the agent reported `status: "completed"` with a summary but no PR.
+  // The synthesised reason must name the reported status + fold in the summary and transcript link —
+  // never the false "no status was reported" diagnosis.
+  const rows = [{ feature_key: "owner/repo#41", status: "running" }];
+  const app = fakeApp(rows);
+  const out = await handler(
+    {
+      jobKey: "job-41",
+      variables: {
+        subjectKey: "owner/repo#41",
+        status: "completed",
+        summary: "implemented src/pin.rs and supporting changes",
+        transcriptUrl: "http://merlin.local:3000/t?stream=job%3A215572",
+      },
+    } as never,
+    app,
+  );
+  assertEquals(out.question.includes('reported status "completed"'), true);
+  assertEquals(out.question.includes("without a machine-readable result"), false);
+  assertEquals(out.question.includes('The agent\'s own summary: "implemented src/pin.rs and supporting changes".'), true);
+  assertEquals(out.question.includes("Transcript: http://merlin.local:3000/t?stream=job%3A215572"), true);
+  assertEquals(rows[0].status, "escalated");
+  assertEquals(app.stores.feature_escalations[0].question, out.question);
+});