@nanobpm/nano-workforce 0.205.1 → 0.206.0

package/workers/merge/worker.ts

@@ -10,12 +10,32 @@
 // waiting for the queue, NOT a direct `gh pr merge` — which that repo refuses. The actual gh/API
 // calls live in app/github.ts; this worker records the attempt in the `merges` audit table and
 // shapes the escalation payload on a block.
+//
+// MERGE-LOOP BACKSTOP (issue #923 §3): the convergence gate's verdict is only as fresh as the head
+// it reviewed — a head that MOVED between convergence and landing, or a review that never existed
+// (the #1443 fail-open), must not slip through at land time. Before running ANY land protocol this
+// worker re-checks that a HEAD-CURRENT Copilot review exists; a missing/stale review blocks the
+// landing (escalating to a human) instead of enqueueing/merging unreviewed code. The check fails
+// OPEN only when the GitHub state is UNREADABLE (no transport / a hiccup) — the merge-stage
+// mergeability polling is the independent backstop there, and a hard block on a transient read
+// would wedge every merge on a network blip.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { matchTags, tag } from "@nanobpm/urban/effect";
 import { abandonTokenFromUrl } from "../../app/abandon.ts";
 import { checkBaseTarget, classifyBaseGuard } from "../../app/baseGuard.ts";
-import { classifyPrLiveness, enqueueViaComment, fetchPrState, mergePr } from "../../app/github.ts";
+import { type HeadReader, makeDefaultReadHead } from "../../app/currentHead.ts";
+import {
+  classifyPrLiveness,
+  enqueueViaComment,
+  fetchBranchHead,
+  fetchLatestCopilotReview,
+  fetchPrHead,
+  fetchPrState,
+  mergePr,
+  parseReviewOpenFindings,
+} from "../../app/github.ts";
 import { classifyMergeLanding, DEFAULT_MERGE_PROTOCOL, loadMergeProtocol } from "../../app/mergeProtocol.ts";
+import { isReviewMissingOrStale } from "../../app/reviewWait.ts";
 import { abandonClosedPr, ensurePr, MERGE_ADMIN, MERGE_METHOD } from "../../app/service.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
 
@@ -28,7 +48,25 @@ interface Out extends Record<string, unknown> {
   question?: string;
 }
 
-const handler: AppJobHandler<In, Out> = async (job, app) => {
+// The backstop's review reader — the SAME shape the converge-gate binds (`{ body, commitId }`,
+// `null` = unverifiable). Injectable so tests drive the missing/stale/head-current matrix without
+// a transport.
+export type MergeReviewReader = (repo: string, prNumber: number) => Promise<{ body: string; commitId: string | null } | null>;
+
+const defaultReadReview: MergeReviewReader = (repo, prNumber) =>
+  fetchLatestCopilotReview(repo, prNumber, process.env.GITHUB_TOKEN ?? "");
+// The SAME branch-ref-over-stale-`head.sha` reader the converge-gate / progress-check / poller
+// bind (#786/#799), so the backstop's staleness comparison sees the exact head the gate did.
+const defaultReadHead: HeadReader = makeDefaultReadHead({ fetchPrHead, fetchBranchHead });
+
+const BLOCK_NO_HEAD_CURRENT_REVIEW =
+  "no head-current Copilot review exists for the PR's current HEAD (the head moved after the last review, or no review was ever submitted). A head-current reviewer verdict is required before landing";
+
+/** Build the handler with injectable GitHub readers. The default export binds the real readers;
+ * tests inject stubs for the backstop matrix. */
+export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha: HeadReader }): AppJobHandler<In, Out> {
+  const { readReview, readHeadSha } = deps;
+  const handler: AppJobHandler<In, Out> = async (job, app) => {
   const { prKey, repo, prNumber, round, abandonUrl } = job.variables;
   const token = process.env.GITHUB_TOKEN ?? "";
   const now = new Date().toISOString();
@@ -88,6 +126,68 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     return { mergeStatus: "abandoned" };
   }
 
+  // MERGE-LOOP BACKSTOP (issue #923 §3): refuse to land without a HEAD-CURRENT Copilot review. The
+  // convergence gate's verdict is only as fresh as the head it reviewed — a head that MOVED between
+  // convergence and landing (a fix-ci / rebase push, an out-of-band commit), or a review that never
+  // existed at all (the nano-bpm#1443 fail-open: merged with ZERO reviews), must not slip through
+  // at land time. Runs AFTER the merged/closed short-circuits (an already-terminal PR needs no
+  // verdict) and BEFORE any land protocol (the `@mergifyio queue` comment is itself the landing
+  // for a queue repo). Fails OPEN only when the GitHub state is UNREADABLE (no transport / a
+  // hiccup → `null` review or head): a transient read failure must not wedge every merge — the
+  // merge-stage mergeability polling is the independent backstop there.
+  const [backstopReview, backstopHead] = await Promise.all([
+    readReview(repo, prNumber).catch(() => null),
+    readHeadSha(repo, prNumber).catch(() => null),
+  ]);
+  if (backstopReview !== null && isReviewMissingOrStale(backstopReview.commitId, backstopHead)) {
+    await app.data.table("merges", "id").insert({
+      pr_key: prKey,
+      outcome: "blocked",
+      method: "review-backstop",
+      detail: BLOCK_NO_HEAD_CURRENT_REVIEW,
+      at: now,
+    });
+    return {
+      mergeStatus: "blocked",
+      status: "blocked",
+      question:
+        `Merge refused: ${BLOCK_NO_HEAD_CURRENT_REVIEW}. ` +
+        `Push no further commits, wait for the Copilot review of the current HEAD to land (or request one: ` +
+        `gh api repos/${repo}/pulls/${prNumber}/requested_reviewers -X POST -f "reviewers[]=copilot-pull-request-reviewer[bot]"), ` +
+        `let the convergence loop gate on it, then reply to retry.`,
+    };
+  }
+
+  // A head-current review whose OWN summary still reports open findings (the same canonical
+  // verdict parser the converge-gate uses) must block too: a summary-only "Changes recommended"
+  // review that landed after convergence has no unresolved thread for mergeability polling to see.
+  // Only evaluate the verdict once head-currentness is VERIFIED (review read AND head read succeeded
+  // and match) — an unreadable head fails open here like the stale check above, never blocking on a
+  // possibly-stale review's body.
+  const reviewIsHeadCurrent =
+    backstopReview !== null && backstopHead !== null && backstopHead !== "" && backstopReview.commitId === backstopHead;
+  const openFindings = reviewIsHeadCurrent ? parseReviewOpenFindings(backstopReview.body) : [];
+  if (openFindings.length > 0) {
+    const detail = `the head-current Copilot review reports open findings (${openFindings.join(", ")})`;
+    await app.data.table("merges", "id").insert({
+      pr_key: prKey,
+      outcome: "blocked",
+      method: "review-backstop",
+      detail,
+      at: now,
+    });
+    return {
+      mergeStatus: "blocked",
+      status: "blocked",
+      question:
+        `Merge refused: ${detail}. Address the review's findings on the branch (or reply with ` +
+        `guidance on which to push back on), let the convergence loop gate on a clean review, then reply to retry.`,
+    };
+  }
+  // The head the backstop verified — pinned through the land call so a push between this check
+  // and the merge can never land a later, unreviewed head.
+  const verifiedHead = backstopReview !== null && backstopHead ? backstopHead : undefined;
+
   // Dead-end-base guard (#60): never land a PR into a base branch that has itself already merged
   // to the default branch — the merge would land into a dead branch and never reach `main`.
   // GitHub only auto-retargets a PR when its base is *deleted* on merge; a merged-but-undeleted
@@ -125,9 +225,17 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     // Land via the repo's on-demand queue: post the enqueue comment; the poller's queued→landed
     // watch (service.ts block 3) then advances the process when the queue merges it.
     const comment = protocol?.land.comment ?? "@mergifyio queue";
-    const ok = await enqueueViaComment(repo, prNumber, token, comment);
-    outcome = ok ? "queued" : "blocked";
-    detail = ok ? `enqueued via "${comment}"` : `failed to post enqueue comment "${comment}"`;
+    // A comment can't pin a SHA, so re-read the head right before enqueueing: if it moved past the
+    // verified head, re-enter via the bounded retry (which re-runs the backstop on the new head).
+    const headNow = verifiedHead ? await readHeadSha(repo, prNumber).catch(() => null) : null;
+    if (verifiedHead && headNow !== null && headNow !== verifiedHead) {
+      outcome = "retry";
+      detail = `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
+    } else {
+      const ok = await enqueueViaComment(repo, prNumber, token, comment);
+      outcome = ok ? "queued" : "blocked";
+      detail = ok ? `enqueued via "${comment}"` : `failed to post enqueue comment "${comment}"`;
+    }
     auditMethod = "queue-comment";
   } else if (classifyMergeLanding(protocol ?? DEFAULT_MERGE_PROTOCOL) === "decision-required") {
     // The repo requires a human to click Merge (`land.method=ui`); Merlin can't. This is the
@@ -137,7 +245,7 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     auditMethod = "ui";
   } else {
     const admin = method === "admin" || MERGE_ADMIN;
-    const res = await mergePr(repo, prNumber, token, { method: MERGE_METHOD, admin });
+    const res = await mergePr(repo, prNumber, token, { method: MERGE_METHOD, admin, expectedHeadSha: verifiedHead });
     // No usable transport → treat as a block so a human is asked to configure/merge, rather than
     // silently completing the process without landing the PR.
     outcome = res?.outcome ?? "blocked";
@@ -180,6 +288,9 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
         `Resolve it on GitHub (rebase / fix a required check / grant merge rights), then reply to retry.${docHint}`,
     }),
   });
-};
+  };
+  return handler;
+}
 
+const handler = makeHandler({ readReview: defaultReadReview, readHeadSha: defaultReadHead });
 export default handler;

package/workers/progress-check/worker.ts

@@ -296,7 +296,7 @@ export function makeHandler(deps: {
   readRounds?: RoundsReader;
 }): AppJobHandler<In, Out> {
   return async (job, app) => {
-    const { prKey, status, repo, prNumber, round, huskRetries, roundEntryHead } = job.variables;
+    const { prKey, status, repo, prNumber, round, huskRetries, roundEntryHead, reviewWaitCutoff } = job.variables;
     const jobKey = job.jobKey;
 
     const prs = app.data.table<{
@@ -356,6 +356,13 @@ export function makeHandler(deps: {
         status?: "waiting_review" | "converging";
         agentWatermark?: string | null;
         churnEscalatedRound?: number;
+        /** The review-wait start to stamp instead of "now" (issue #923 review): the converge-gate
+         * emits `reviewWaitCutoff` (the time of ITS review read) when it signals `reviewStale`, so
+         * a head-current review that lands in the window between that read and this park still
+         * satisfies `pollReviews`' `submitted_at >= waiting_since` filter instead of being
+         * discarded — closing the arrival-window race that otherwise re-solicits and times out
+         * despite a valid verdict already sitting unconsumed on the PR. */
+        waitingSince?: string;
       },
     ): Promise<Out> => {
       const ts = new Date().toISOString();
@@ -368,7 +375,9 @@ export function makeHandler(deps: {
         // Only overwrite the baseline when we actually read a head, so a null (unreadable) head
         // never clobbers a good `last_round_head`.
         ...(opts.head ? { last_round_head: opts.head } : {}),
-        ...(opts.status === "waiting_review" ? { status: "waiting_review", waiting_since: ts } : {}),
+        ...(opts.status === "waiting_review"
+          ? { status: "waiting_review", waiting_since: opts.waitingSince ?? ts }
+          : {}),
         ...(opts.status === "converging" ? { status: "converging" } : {}),
         // Advance the attempt watermark ONLY when an agent-work read consumed a `review-round`
         // instance (Copilot #789); `undefined` leaves the persisted watermark untouched (an
@@ -392,8 +401,18 @@ export function makeHandler(deps: {
     const parsed = parsePr(prKey);
     const ghRepo = repo ?? parsed?.repo;
     const ghNumber = typeof prNumber === "number" ? prNumber : parsed?.number;
+    // The review-wait start to stamp on a park. When the converge-gate signalled `reviewStale` it
+    // emitted `reviewWaitCutoff` (the time of ITS review read); parking with `waiting_since` at that
+    // cutoff — rather than "now" — lets a head-current review that landed in the read→park window
+    // satisfy the wait (issue #923 review). Only a non-empty string is honoured; anything else
+    // (absent on a normal round, or a malformed value) falls back to the park time.
+    const waitCutoff =
+      typeof reviewWaitCutoff === "string" && reviewWaitCutoff !== "" ? reviewWaitCutoff : undefined;
     if (!ghRepo || typeof ghNumber !== "number") {
-      return commit({ progressed: true, huskRetries: 0 }, { status: "waiting_review" });
+      return commit(
+        { progressed: true, huskRetries: 0 },
+        { status: "waiting_review", ...(waitCutoff ? { waitingSince: waitCutoff } : {}) },
+      );
     }
 
     // Read the head and record the baseline on EVERY round — including a non-addressed `waiting`
@@ -457,7 +476,12 @@ export function makeHandler(deps: {
     if (!isAddressedStatus(status)) {
       return commit(
         { progressed: true, huskRetries: 0 },
-        { head: currentHead, status: "waiting_review", agentWatermark },
+        {
+          head: currentHead,
+          status: "waiting_review",
+          agentWatermark,
+          ...(waitCutoff ? { waitingSince: waitCutoff } : {}),
+        },
       );
     }
 
@@ -528,7 +552,12 @@ export function makeHandler(deps: {
       }
       // Genuine progress → the loop parks at wait-review. THIS is the review-wait park, written only
       // once the husk retry has been ruled out, so a husk-retry round never transits `waiting_review`.
-      return commit(out, { head: currentHead, status: "waiting_review", agentWatermark });
+      return commit(out, {
+        head: currentHead,
+        status: "waiting_review",
+        agentWatermark,
+        ...(waitCutoff ? { waitingSince: waitCutoff } : {}),
+      });
     }
 
     // NO-ADVANCE SELF-HEAL (#818, Layer 2). Before escalating to a human, reconcile the round's work
@@ -576,7 +605,12 @@ export function makeHandler(deps: {
           // (husk counter reset), so the poller solicits the next Copilot review against the healed head.
           return commit(
             { progressed: true, huskRetries: 0 },
-            { head: heal.sha, status: "waiting_review", agentWatermark },
+            {
+              head: heal.sha,
+              status: "waiting_review",
+              agentWatermark,
+              ...(waitCutoff ? { waitingSince: waitCutoff } : {}),
+            },
           );
         }
       }