@nanobpm/nano-workforce 0.201.4 → 0.202.0

package/app/mergeLoopBehaviour.test.ts

@@ -89,13 +89,15 @@ const DEFAULT_VARS: Record<string, unknown> = {
   mergeableRepollInterval: "PT2M",
   mergeStallRounds: 0,
   mergeStallMax: 3,
-  abandonBrief: null,
+  abandonBrief: "\n\n---\nAbort if cancelled: curl …",
   failingChecksList: null,
   status: null,
   mergeState: null,
   mergeStatus: null,
   ciBlockedReconciled: null,
   failingChecks: 0,
+  round: 2,
+  abandonUrl: "http://host/app/api/hooks/abandon?token=tok-seeded",
 };
 
 /**
@@ -303,6 +305,86 @@ test("a CONFLICTING PR whose poller never signalled reaches the rebase arm via t
     .hasVariable("rebaseRound", 1);
 });
 
+test("a rebase agent echoing engine-owned timeout state cannot clobber it (#887)", async () => {
+  // Same guard class as fix-ci: the rebase agent must not reshape the seeded timers that later loop
+  // passes re-arm, nor forge `ciBlockedReconciled`. Drive to the rebase arm via the timeout path with
+  // the agent echoing a forged marker and tiny timeouts; the restore must pin the timers.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+      "senior:rebase": {
+        status: "rebased",
+        ciBlockedReconciled: true,
+        agentSlaTimeout: "PT1S",
+        landedWaitTimeout: "PT1S",
+        mergeableWaitTimeout: "PT1S",
+        mergeableRepollInterval: "PT1S",
+      },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("rebase")
+    .hasVariable("agentSlaTimeout", "PT30M")
+    .hasVariable("landedWaitTimeout", "PT30M")
+    .hasVariable("mergeableWaitTimeout", "PT30M")
+    .hasVariable("mergeableRepollInterval", "PT2M");
+  // The forged lifecycle marker was pinned out too (the rebase path never reconciles).
+  assert(instanceVars(engine).ciBlockedReconciled !== true, "a rebase agent must not forge ciBlockedReconciled:true");
+});
+
+test("a rebase agent echoing round/abandonUrl cannot corrupt the converged round or the abandon token (#887)", async () => {
+  // Same guard class as fix-ci: `round`/`abandonUrl` are seeded once and consumed by `pr.merge`
+  // after a successful rebase re-arms the poller. The restore must pin both against an agent echo.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+      "senior:rebase": { status: "rebased", round: 99, abandonUrl: "http://evil.test/abandon?token=forged" },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("rebase")
+    .hasVariable("round", 2)
+    .hasVariable("abandonUrl", "http://host/app/api/hooks/abandon?token=tok-seeded");
+});
+
+test("a rebase agent echoing abandonBrief cannot corrupt the seeded abort brief (#887 round 5)", async () => {
+  // `abandonBrief` feeds the fix-ci/rebase `appendPrompt` input on the NEXT re-arm; a non-string
+  // echo would make that later prompt mapping carry a non-string brief. The restore must pin it.
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "conflict", failingChecks: 0, failingChecksList: "" },
+      "senior:rebase": { status: "rebased", abandonBrief: 42 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("rebase")
+    .hasVariable("abandonBrief", "\n\n---\nAbort if cancelled: curl …");
+});
+
+test("a fix-ci agent echoing abandonBrief cannot corrupt the seeded abort brief (#887 round 5)", async () => {
+  const engine = await boot({
+    responses: {
+      "pr.merge-stall-probe": { mergeState: "blocked", failingChecks: 1, failingChecksList: "build" },
+      "senior:fix-ci": { status: "fixed", abandonBrief: 42 },
+    },
+  });
+  await engine.publishMessage({ name: "deps-cleared", correlationKey: "pr-1" });
+  await engine.advanceTime(MERGEABLE_WAIT_MS + 1);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("merge-stall-probe", "fix-ci")
+    .hasVariable("abandonBrief", "\n\n---\nAbort if cancelled: curl …");
+});
+
 test("a blocked PR probed on timeout reaches the CI-fix arm via the timeout path (#636)", async () => {
   const engine = await boot({
     responses: {
@@ -529,6 +611,67 @@ test("a blocked CI verdict with nothing pushed reconciles once before escalating
   assert(!completedElementIds(engine).has("merge-esc-attempt"), "the first block episode must reconcile, not page a human");
 });
 
+test("a fix-ci agent echoing ciBlockedReconciled:true cannot skip the one-shot ground-truth reconcile (#887)", async () => {
+  // `ciBlockedReconciled` is an engine-owned lifecycle marker (arm-merge seeds it null; ci-reconcile
+  // sets it true). gw-ci-blocked reconciles exactly once per episode while it is != true. If the agent's
+  // completion could echo `ciBlockedReconciled:true`, a `{status:"blocked", pushed:false}` verdict would
+  // skip the mandatory first reconcile and page a human immediately. The snapshot/restore guard pins it,
+  // so the engine still reconciles once.
+  const engine = await boot({
+    responses: { "senior:fix-ci": { status: "blocked", pushed: false, ciBlockedReconciled: true } },
+  });
+  await driveToCiFix(engine);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasCompletedElements("ci-reconcile") // the reconcile STILL runs — the agent's echo was pinned out
+    .hasVariable("ciBlockedReconciled", true);
+  assert(!completedElementIds(engine).has("merge-esc-attempt"), "an agent-forged reconciled flag must not skip the first reconcile");
+});
+
+test("a fix-ci agent echoing seeded timeouts cannot clobber the re-armed merge/SLA timers (#887)", async () => {
+  // The seeded timeout/interval config (agentSlaTimeout, landedWaitTimeout, mergeableWaitTimeout,
+  // mergeableRepollInterval) drives timers re-armed on every loop pass. A `reattempt` re-arms the
+  // merge wait, so a clobbered timeout would silently reshape the next wait. The guard restores them.
+  const engine = await boot({
+    responses: {
+      "senior:fix-ci": {
+        status: "reattempt",
+        agentSlaTimeout: "PT1S",
+        landedWaitTimeout: "PT1S",
+        mergeableWaitTimeout: "PT1S",
+        mergeableRepollInterval: "PT1S",
+      },
+    },
+  });
+  await driveToCiFix(engine);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasVariable("agentSlaTimeout", "PT30M")
+    .hasVariable("landedWaitTimeout", "PT30M")
+    .hasVariable("mergeableWaitTimeout", "PT30M")
+    .hasVariable("mergeableRepollInterval", "PT2M");
+});
+
+test("a fix-ci agent echoing round/abandonUrl cannot corrupt the converged round or the abandon token (#887)", async () => {
+  // `round` (the converged round recorded by ensurePr) and `abandonUrl` (the cooperative-abandon
+  // capability URL) are seeded once and consumed directly by `pr.merge` (attempt-merge). A fix-ci
+  // completion echoing either would corrupt the recorded round or replace the abandon token. The
+  // snapshot/restore guard pins both.
+  const engine = await boot({
+    responses: {
+      "senior:fix-ci": { status: "reattempt", round: 99, abandonUrl: "http://evil.test/abandon?token=forged" },
+    },
+  });
+  await driveToCiFix(engine);
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasActiveElement("wait-mergeable")
+    .hasVariable("round", 2)
+    .hasVariable("abandonUrl", "http://host/app/api/hooks/abandon?token=tok-seeded");
+});
+
 test("a blocked CI verdict that already pushed escalates with a could-not-fix question", async () => {
   const engine = await boot({ responses: { "senior:fix-ci": { status: "blocked", pushed: true } } });
   await driveToCiFix(engine);
@@ -602,6 +745,70 @@ test("a no-verdict rebase result reconciles from ground truth, not escalation (#
   assert(!completedElementIds(engine).has("merge-esc-attempt"), "a missing rebase status must not escalate");
 });
 
+// ---------------------------------------------------------------------------
+// #887 — an external-agent completion must not clobber engine-owned counters
+// ---------------------------------------------------------------------------
+// The engine merges EVERY variable an external agent returns into process scope unfiltered, so a
+// `senior:fix-ci`/`senior:rebase` agent echoing a loop counter (`ciFixRound`, `rebaseRound`, …) with
+// the wrong type/value would corrupt it — and because the counter feeds the task's own `+ 1`
+// increment and the `ciFixRound < ciFixMax` / `rebaseRound < rebaseMax` guards, a string echo wedges
+// the sub-process on a "comparison/arithmetic not defined for string and number" incident. The fix
+// snapshots each engine-owned counter into a task-local input before the agent runs and restores it
+// on the task output (driving the increment from the snapshot), so the agent can never alter it.
+
+test("a fix-ci agent echoing ciFixRound:\"9\" cannot clobber the counter or wedge the increment (#887)", async () => {
+  const engine = await boot({ responses: { "senior:fix-ci": { status: "fixed", ciFixRound: "9", ciFixMax: "1" } } });
+  await driveToCiFix(engine);
+  assertEquals((await engine.searchIncidents()).length, 0, "the agent echo must not raise an incident");
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("fix-ci")
+    .hasVariable("ciFixRound", 1) // the engine increment (0 → 1), NOT the agent's "9"
+    .hasVariable("ciFixMax", 3); // the budget ceiling is engine-owned, unclobbered
+});
+
+test("a rebase agent echoing rebaseRound:\"9\" cannot clobber the counter or wedge the increment (#887)", async () => {
+  const engine = await boot({ responses: { "senior:rebase": { status: "rebased", rebaseRound: "9", rebaseMax: "1" } } });
+  await driveToRebase(engine);
+  assertEquals((await engine.searchIncidents()).length, 0, "the agent echo must not raise an incident");
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("rebase")
+    .hasVariable("rebaseRound", 1) // the engine increment (0 → 1), NOT the agent's "9"
+    .hasVariable("rebaseMax", 3); // the budget ceiling is engine-owned, unclobbered
+});
+
+test("a fix-ci agent echoing PR identity inputs cannot clobber them (#887)", async () => {
+  // `repo`/`prNumber`/`prUrl` are the agent's declared *inputs* (FixCiIn), not its outputs — but the
+  // engine merges a completion UNFILTERED, so an input-echo would replace the process identity that
+  // `pr.merge` reads for GitHub operations after re-arming. The snapshot/restore guard must pin them.
+  const engine = await boot({
+    responses: { "senior:fix-ci": { status: "fixed", repo: "evil/repo", prNumber: 999, prUrl: "https://evil.test/pr/999" } },
+  });
+  await driveToCiFix(engine);
+  assertEquals((await engine.searchIncidents()).length, 0, "the agent echo must not raise an incident");
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("fix-ci")
+    .hasVariable("repo", "acme/app")
+    .hasVariable("prNumber", 1)
+    .hasVariable("prUrl", "https://example.test/pr/1");
+});
+
+test("a rebase agent echoing PR identity inputs cannot clobber them (#887)", async () => {
+  const engine = await boot({
+    responses: { "senior:rebase": { status: "rebased", repo: "evil/repo", prNumber: 999, prUrl: "https://evil.test/pr/999" } },
+  });
+  await driveToRebase(engine);
+  assertEquals((await engine.searchIncidents()).length, 0, "the agent echo must not raise an incident");
+  assertThatInstance(engine, byProcessId("merge-loop"))
+    .isActive()
+    .hasCompletedElements("rebase")
+    .hasVariable("repo", "acme/app")
+    .hasVariable("prNumber", 1)
+    .hasVariable("prUrl", "https://example.test/pr/1");
+});
+
 test("rebase budget exhaustion escalates as not-mergeable without running the agent", async () => {
   const engine = await boot({ responses: { "senior:rebase": { status: "rebased" } }, vars: { rebaseMax: 0 } });
   await driveToRebase(engine);

package/docs/agentic-cockpit.md

@@ -124,6 +124,40 @@ when a worker ages out past the liveness TTL. On (re)mount the presence family
 reconciles the store against live connections, so a worker that vanished while
 the app was down does not linger as a ghost row after a restart.
 
+### Job ownership: authoritative reconnect resync
+
+A worker's **jobs** are tracked by the explicit job-ownership claim registry
+(`app/agentic/claim-registry.ts`): a supervisor sends a `claim` frame when a
+worker picks up a job and a `release` when it finishes. Each frame names its
+owning `instance` explicitly, so one per-host supervisor connection can carry
+many workers' ownership.
+
+On a WS reconnect a supervisor re-`claim`s every active jobKey. Those re-claims
+are **additive** on their own — a claim that is not re-asserted is never dropped
+— so a `release` lost during a hub outage would leave the job shown as *working*
+until the worker exits entirely, forcing the supervisor to buffer every RELEASE
+without limit across the outage.
+
+To close that, a supervisor may end its resync with an **authoritative
+snapshot**: a `claim` frame carrying the full set of jobKeys the instance still
+owns (`{ instance, jobKeys: [...] }` — the empty **array** is allowed, meaning
+"this instance now owns nothing", but every **element** must be a non-empty
+string). The hub validates the frame as the snapshot-or-per-job
+union (a malformed snapshot is dropped before it touches the registry — the
+*presence* of `jobKeys`, not its validity, selects the snapshot variant, so a
+present-but-malformed `jobKeys` — a non-array, a non-string element, or an
+empty-string element — is rejected rather than laundered through the
+per-job path; an empty-string element can't masquerade as an "owns nothing"
+snapshot and clear real claims) and then
+**replaces** that instance's claims with the snapshot — dropping any it did not
+re-assert. The supervisor's
+view wins, because ownership is advisory, short-lived visibility it can always
+restate (it never gates a BPMN flow, ADR 0056). A jobKey that has moved to
+another instance is never blanked by the old instance's resync, and a supervisor
+that sends no snapshot keeps the old additive behaviour. This authoritative
+contract lets a hub client (nano-supervisor#63) **bound** its RELEASE buffer
+during an outage.
+
 ## What you will NOT find here (and where it lives)
 
 - **Demand×supply matrix, missing-agent-type reds, diversity-SLO lights** →

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.201.4",
+  "version": "0.202.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/convergence-loop.bpmn

@@ -147,9 +147,45 @@
         </zeebe:properties>
         <zeebe:ioMapping>
           <zeebe:input source="=(if (abandonBrief = null) then &#34;&#34; else abandonBrief)" target="appendPrompt" />
+          <zeebe:input source="=round" target="guardRound" />
+          <zeebe:input source="=maxRounds" target="guardMaxRounds" />
+          <zeebe:input source="=advPass" target="guardAdvPass" />
+          <zeebe:input source="=advMax" target="guardAdvMax" />
+          <zeebe:input source="=ackRetryRound" target="guardAckRetryRound" />
+          <zeebe:input source="=ackRetryMax" target="guardAckRetryMax" />
+          <zeebe:input source="=huskRetries" target="guardHuskRetries" />
+          <zeebe:input source="=prKey" target="guardPrKey" />
+          <zeebe:input source="=repo" target="guardRepo" />
+          <zeebe:input source="=prNumber" target="guardPrNumber" />
+          <zeebe:input source="=prUrl" target="guardPrUrl" />
+          <zeebe:input source="=reviewWaitTimeout" target="guardReviewWaitTimeout" />
+          <zeebe:input source="=humanApproval" target="guardHumanApproval" />
+          <zeebe:input source="=convergeOnly" target="guardConvergeOnly" />
+          <zeebe:input source="=reviewStale" target="guardReviewStale" />
+          <zeebe:input source="=roundEntryHead" target="guardRoundEntryHead" />
+          <zeebe:input source="=abandonUrl" target="guardAbandonUrl" />
+          <zeebe:input source="=abandonBrief" target="guardAbandonBrief" />
           <zeebe:output source="=null" target="answer" />
           <zeebe:output source="=false" target="scopePending" />
           <zeebe:output source="=null" target="adversarialFindings" />
+          <zeebe:output source="=guardRound" target="round" />
+          <zeebe:output source="=guardMaxRounds" target="maxRounds" />
+          <zeebe:output source="=guardAdvPass" target="advPass" />
+          <zeebe:output source="=guardAdvMax" target="advMax" />
+          <zeebe:output source="=guardAckRetryRound" target="ackRetryRound" />
+          <zeebe:output source="=guardAckRetryMax" target="ackRetryMax" />
+          <zeebe:output source="=guardHuskRetries" target="huskRetries" />
+          <zeebe:output source="=guardPrKey" target="prKey" />
+          <zeebe:output source="=guardRepo" target="repo" />
+          <zeebe:output source="=guardPrNumber" target="prNumber" />
+          <zeebe:output source="=guardPrUrl" target="prUrl" />
+          <zeebe:output source="=guardReviewWaitTimeout" target="reviewWaitTimeout" />
+          <zeebe:output source="=(guardHumanApproval = true) or (humanApproval = true)" target="humanApproval" />
+          <zeebe:output source="=guardConvergeOnly" target="convergeOnly" />
+          <zeebe:output source="=guardReviewStale" target="reviewStale" />
+          <zeebe:output source="=guardRoundEntryHead" target="roundEntryHead" />
+          <zeebe:output source="=guardAbandonUrl" target="abandonUrl" />
+          <zeebe:output source="=guardAbandonBrief" target="abandonBrief" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_capture</bpmn:incoming>
@@ -205,11 +241,46 @@
         </zeebe:properties>
         <zeebe:ioMapping>
           <zeebe:input source="=(if (abandonBrief = null) then &#34;&#34; else abandonBrief)" target="appendPrompt" />
+          <zeebe:input source="=round" target="guardRound" />
+          <zeebe:input source="=maxRounds" target="guardMaxRounds" />
+          <zeebe:input source="=advPass" target="guardAdvPass" />
+          <zeebe:input source="=advMax" target="guardAdvMax" />
+          <zeebe:input source="=ackRetryRound" target="guardAckRetryRound" />
+          <zeebe:input source="=ackRetryMax" target="guardAckRetryMax" />
+          <zeebe:input source="=huskRetries" target="guardHuskRetries" />
+          <zeebe:input source="=prKey" target="guardPrKey" />
+          <zeebe:input source="=repo" target="guardRepo" />
+          <zeebe:input source="=prNumber" target="guardPrNumber" />
+          <zeebe:input source="=prUrl" target="guardPrUrl" />
+          <zeebe:input source="=reviewWaitTimeout" target="guardReviewWaitTimeout" />
+          <zeebe:input source="=humanApproval" target="guardHumanApproval" />
+          <zeebe:input source="=convergeOnly" target="guardConvergeOnly" />
+          <zeebe:input source="=reviewStale" target="guardReviewStale" />
+          <zeebe:input source="=roundEntryHead" target="guardRoundEntryHead" />
+          <zeebe:input source="=abandonUrl" target="guardAbandonUrl" />
+          <zeebe:input source="=abandonBrief" target="guardAbandonBrief" />
           <zeebe:output source="=adversarialFindings" target="adversarialFindings" />
-          <zeebe:output source="=(if advPass = null then 0 else advPass) + 1" target="advPass" />
+          <zeebe:output source="=(if guardAdvPass = null then 0 else guardAdvPass) + 1" target="advPass" />
           <zeebe:output source="=(if adversarialFindings != null and trim(adversarialFindings) != &#34;&#34; then null else status)" target="status" />
           <zeebe:output source="=(if adversarialFindings != null and trim(adversarialFindings) != &#34;&#34; then null else summary)" target="summary" />
           <zeebe:output source="=(if adversarialFindings != null and trim(adversarialFindings) != &#34;&#34; then null else question)" target="question" />
+          <zeebe:output source="=guardRound" target="round" />
+          <zeebe:output source="=guardMaxRounds" target="maxRounds" />
+          <zeebe:output source="=guardAdvMax" target="advMax" />
+          <zeebe:output source="=guardAckRetryRound" target="ackRetryRound" />
+          <zeebe:output source="=guardAckRetryMax" target="ackRetryMax" />
+          <zeebe:output source="=guardHuskRetries" target="huskRetries" />
+          <zeebe:output source="=guardPrKey" target="prKey" />
+          <zeebe:output source="=guardRepo" target="repo" />
+          <zeebe:output source="=guardPrNumber" target="prNumber" />
+          <zeebe:output source="=guardPrUrl" target="prUrl" />
+          <zeebe:output source="=guardReviewWaitTimeout" target="reviewWaitTimeout" />
+          <zeebe:output source="=(guardHumanApproval = true) or (humanApproval = true)" target="humanApproval" />
+          <zeebe:output source="=guardConvergeOnly" target="convergeOnly" />
+          <zeebe:output source="=guardReviewStale" target="reviewStale" />
+          <zeebe:output source="=guardRoundEntryHead" target="roundEntryHead" />
+          <zeebe:output source="=guardAbandonUrl" target="abandonUrl" />
+          <zeebe:output source="=guardAbandonBrief" target="abandonBrief" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_advDue</bpmn:incoming>
@@ -478,7 +549,43 @@
           <zeebe:property name="io.nanobpm.dataEnvelope.out" value="PrScopeClassifyOut" />
         </zeebe:properties>
         <zeebe:ioMapping>
+          <zeebe:input source="=round" target="guardRound" />
+          <zeebe:input source="=maxRounds" target="guardMaxRounds" />
+          <zeebe:input source="=advPass" target="guardAdvPass" />
+          <zeebe:input source="=advMax" target="guardAdvMax" />
+          <zeebe:input source="=ackRetryRound" target="guardAckRetryRound" />
+          <zeebe:input source="=ackRetryMax" target="guardAckRetryMax" />
+          <zeebe:input source="=huskRetries" target="guardHuskRetries" />
+          <zeebe:input source="=prKey" target="guardPrKey" />
+          <zeebe:input source="=repo" target="guardRepo" />
+          <zeebe:input source="=prNumber" target="guardPrNumber" />
+          <zeebe:input source="=prUrl" target="guardPrUrl" />
+          <zeebe:input source="=reviewWaitTimeout" target="guardReviewWaitTimeout" />
+          <zeebe:input source="=humanApproval" target="guardHumanApproval" />
+          <zeebe:input source="=convergeOnly" target="guardConvergeOnly" />
+          <zeebe:input source="=reviewStale" target="guardReviewStale" />
+          <zeebe:input source="=roundEntryHead" target="guardRoundEntryHead" />
+          <zeebe:input source="=abandonUrl" target="guardAbandonUrl" />
+          <zeebe:input source="=abandonBrief" target="guardAbandonBrief" />
           <zeebe:output source="=null" target="scopeAnswer" />
+          <zeebe:output source="=guardRound" target="round" />
+          <zeebe:output source="=guardMaxRounds" target="maxRounds" />
+          <zeebe:output source="=guardAdvPass" target="advPass" />
+          <zeebe:output source="=guardAdvMax" target="advMax" />
+          <zeebe:output source="=guardAckRetryRound" target="ackRetryRound" />
+          <zeebe:output source="=guardAckRetryMax" target="ackRetryMax" />
+          <zeebe:output source="=guardHuskRetries" target="huskRetries" />
+          <zeebe:output source="=guardPrKey" target="prKey" />
+          <zeebe:output source="=guardRepo" target="repo" />
+          <zeebe:output source="=guardPrNumber" target="prNumber" />
+          <zeebe:output source="=guardPrUrl" target="prUrl" />
+          <zeebe:output source="=guardReviewWaitTimeout" target="reviewWaitTimeout" />
+          <zeebe:output source="=(guardHumanApproval = true) or (humanApproval = true)" target="humanApproval" />
+          <zeebe:output source="=guardConvergeOnly" target="convergeOnly" />
+          <zeebe:output source="=guardReviewStale" target="reviewStale" />
+          <zeebe:output source="=guardRoundEntryHead" target="roundEntryHead" />
+          <zeebe:output source="=guardAbandonUrl" target="abandonUrl" />
+          <zeebe:output source="=guardAbandonBrief" target="abandonBrief" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_convergeOk</bpmn:incoming>

package/resources/processes/merge-loop.bpmn

@@ -362,7 +362,46 @@
           </zeebe:properties>
           <zeebe:ioMapping>
             <zeebe:input source="=(if (failingChecksList = null or failingChecksList = &#34;&#34;) then &#34;&#34; else &#34;&#10;&#10;Failing checks to make green:&#10;&#34; + failingChecksList) + (if (abandonBrief = null) then &#34;&#34; else abandonBrief)" target="appendPrompt" />
-            <zeebe:output source="=ciFixRound + 1" target="ciFixRound" />
+            <zeebe:input source="=ciFixRound" target="guardCiFixRound" />
+            <zeebe:input source="=ciFixMax" target="guardCiFixMax" />
+            <zeebe:input source="=rebaseRound" target="guardRebaseRound" />
+            <zeebe:input source="=rebaseMax" target="guardRebaseMax" />
+            <zeebe:input source="=mergeRetryRound" target="guardMergeRetryRound" />
+            <zeebe:input source="=mergeRetryMax" target="guardMergeRetryMax" />
+            <zeebe:input source="=mergeStallRounds" target="guardMergeStallRounds" />
+            <zeebe:input source="=mergeStallMax" target="guardMergeStallMax" />
+            <zeebe:input source="=prKey" target="guardPrKey" />
+            <zeebe:input source="=repo" target="guardRepo" />
+            <zeebe:input source="=prNumber" target="guardPrNumber" />
+            <zeebe:input source="=prUrl" target="guardPrUrl" />
+            <zeebe:input source="=ciBlockedReconciled" target="guardCiBlockedReconciled" />
+            <zeebe:input source="=agentSlaTimeout" target="guardAgentSlaTimeout" />
+            <zeebe:input source="=landedWaitTimeout" target="guardLandedWaitTimeout" />
+            <zeebe:input source="=mergeableWaitTimeout" target="guardMergeableWaitTimeout" />
+            <zeebe:input source="=mergeableRepollInterval" target="guardMergeableRepollInterval" />
+            <zeebe:input source="=round" target="guardRound" />
+            <zeebe:input source="=abandonUrl" target="guardAbandonUrl" />
+            <zeebe:input source="=abandonBrief" target="guardAbandonBrief" />
+            <zeebe:output source="=guardCiFixRound + 1" target="ciFixRound" />
+            <zeebe:output source="=guardCiFixMax" target="ciFixMax" />
+            <zeebe:output source="=guardRebaseRound" target="rebaseRound" />
+            <zeebe:output source="=guardRebaseMax" target="rebaseMax" />
+            <zeebe:output source="=guardMergeRetryRound" target="mergeRetryRound" />
+            <zeebe:output source="=guardMergeRetryMax" target="mergeRetryMax" />
+            <zeebe:output source="=guardMergeStallRounds" target="mergeStallRounds" />
+            <zeebe:output source="=guardMergeStallMax" target="mergeStallMax" />
+            <zeebe:output source="=guardPrKey" target="prKey" />
+            <zeebe:output source="=guardRepo" target="repo" />
+            <zeebe:output source="=guardPrNumber" target="prNumber" />
+            <zeebe:output source="=guardPrUrl" target="prUrl" />
+            <zeebe:output source="=guardCiBlockedReconciled" target="ciBlockedReconciled" />
+            <zeebe:output source="=guardAgentSlaTimeout" target="agentSlaTimeout" />
+            <zeebe:output source="=guardLandedWaitTimeout" target="landedWaitTimeout" />
+            <zeebe:output source="=guardMergeableWaitTimeout" target="mergeableWaitTimeout" />
+            <zeebe:output source="=guardMergeableRepollInterval" target="mergeableRepollInterval" />
+            <zeebe:output source="=guardRound" target="round" />
+            <zeebe:output source="=guardAbandonUrl" target="abandonUrl" />
+            <zeebe:output source="=guardAbandonBrief" target="abandonBrief" />
           </zeebe:ioMapping>
         </bpmn:extensionElements>
         <bpmn:incoming>f_ci_s0</bpmn:incoming>
@@ -524,7 +563,46 @@
           </zeebe:properties>
           <zeebe:ioMapping>
             <zeebe:input source="=(if (abandonBrief = null) then &#34;&#34; else abandonBrief)" target="appendPrompt" />
-            <zeebe:output source="=rebaseRound + 1" target="rebaseRound" />
+            <zeebe:input source="=ciFixRound" target="guardCiFixRound" />
+            <zeebe:input source="=ciFixMax" target="guardCiFixMax" />
+            <zeebe:input source="=rebaseRound" target="guardRebaseRound" />
+            <zeebe:input source="=rebaseMax" target="guardRebaseMax" />
+            <zeebe:input source="=mergeRetryRound" target="guardMergeRetryRound" />
+            <zeebe:input source="=mergeRetryMax" target="guardMergeRetryMax" />
+            <zeebe:input source="=mergeStallRounds" target="guardMergeStallRounds" />
+            <zeebe:input source="=mergeStallMax" target="guardMergeStallMax" />
+            <zeebe:input source="=prKey" target="guardPrKey" />
+            <zeebe:input source="=repo" target="guardRepo" />
+            <zeebe:input source="=prNumber" target="guardPrNumber" />
+            <zeebe:input source="=prUrl" target="guardPrUrl" />
+            <zeebe:input source="=ciBlockedReconciled" target="guardCiBlockedReconciled" />
+            <zeebe:input source="=agentSlaTimeout" target="guardAgentSlaTimeout" />
+            <zeebe:input source="=landedWaitTimeout" target="guardLandedWaitTimeout" />
+            <zeebe:input source="=mergeableWaitTimeout" target="guardMergeableWaitTimeout" />
+            <zeebe:input source="=mergeableRepollInterval" target="guardMergeableRepollInterval" />
+            <zeebe:input source="=round" target="guardRound" />
+            <zeebe:input source="=abandonUrl" target="guardAbandonUrl" />
+            <zeebe:input source="=abandonBrief" target="guardAbandonBrief" />
+            <zeebe:output source="=guardRebaseRound + 1" target="rebaseRound" />
+            <zeebe:output source="=guardCiFixRound" target="ciFixRound" />
+            <zeebe:output source="=guardCiFixMax" target="ciFixMax" />
+            <zeebe:output source="=guardRebaseMax" target="rebaseMax" />
+            <zeebe:output source="=guardMergeRetryRound" target="mergeRetryRound" />
+            <zeebe:output source="=guardMergeRetryMax" target="mergeRetryMax" />
+            <zeebe:output source="=guardMergeStallRounds" target="mergeStallRounds" />
+            <zeebe:output source="=guardMergeStallMax" target="mergeStallMax" />
+            <zeebe:output source="=guardPrKey" target="prKey" />
+            <zeebe:output source="=guardRepo" target="repo" />
+            <zeebe:output source="=guardPrNumber" target="prNumber" />
+            <zeebe:output source="=guardPrUrl" target="prUrl" />
+            <zeebe:output source="=guardCiBlockedReconciled" target="ciBlockedReconciled" />
+            <zeebe:output source="=guardAgentSlaTimeout" target="agentSlaTimeout" />
+            <zeebe:output source="=guardLandedWaitTimeout" target="landedWaitTimeout" />
+            <zeebe:output source="=guardMergeableWaitTimeout" target="mergeableWaitTimeout" />
+            <zeebe:output source="=guardMergeableRepollInterval" target="mergeableRepollInterval" />
+            <zeebe:output source="=guardRound" target="round" />
+            <zeebe:output source="=guardAbandonUrl" target="abandonUrl" />
+            <zeebe:output source="=guardAbandonBrief" target="abandonBrief" />
           </zeebe:ioMapping>
         </bpmn:extensionElements>
         <bpmn:incoming>f_reb_s0</bpmn:incoming>