@nanobpm/nano-workforce 0.210.0 → 0.210.1

package/app/readiness.test.ts

@@ -554,6 +554,95 @@ test("#856 parsePrTarget agrees with the canonical parsePr on every PR shape (no
   }
 });
 
+// ── PR #957 review round 3: the readiness `pr` path normalises events too ────────────────────────
+//
+// The `gh pr view` rollup omits `event`, so before this fix the readiness path grouped by name alone
+// and a green `push` run hid a red required `pull_request` run of the same name — `checks-green`
+// reported ready while the PR run was red. `probeOnce` now enriches the rollup through the injected
+// executor (shared transport logic with the merge loop) before parsing.
+
+test("#957 probeOnce pr checks-green: a green push run never hides a red pull_request run of the same name", async () => {
+  const head = "5fbd262a28987d647621da324bf1a7855a8da500";
+  // The `gh pr view` payload: two same-named runs, NO event on either (the CLI exporter omits it).
+  const prView = {
+    state: "OPEN",
+    mergedAt: null,
+    mergeStateStatus: "CLEAN",
+    isDraft: false,
+    headRefOid: head,
+    mergeCommit: null,
+    statusCheckRollup: [
+      { name: "build", conclusion: "FAILURE", status: "COMPLETED", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:41:34Z" },
+      { name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" },
+    ],
+  };
+  // The GraphQL event read, keyed by the SAME head, joining by (name, startedAt).
+  const events = {
+    data: {
+      repository: {
+        pullRequest: {
+          commits: {
+            nodes: [
+              {
+                commit: {
+                  oid: head,
+                  statusCheckRollup: {
+                    contexts: {
+                      nodes: [
+                        { __typename: "CheckRun", databaseId: 1001, name: "build", startedAt: "2026-11-12T00:30:00Z", checkSuite: { workflowRun: { event: "pull_request" } } },
+                        { __typename: "CheckRun", databaseId: 1002, name: "build", startedAt: "2026-11-12T00:41:30Z", checkSuite: { workflowRun: { event: "push" } } },
+                      ],
+                      pageInfo: { hasNextPage: false, endCursor: null },
+                    },
+                  },
+                },
+              },
+            ],
+          },
+        },
+      },
+    },
+  };
+  const exec: ProbeExec = {
+    async httpGet() {
+      return { status: 0, body: "" };
+    },
+    async run(command) {
+      // Route the two reads by shape: the GraphQL call carries `api graphql`, the rollup read `pr view`.
+      if (command.includes("api") && command.includes("graphql")) return { code: 0, stdout: JSON.stringify(events), stderr: "" };
+      return { code: 0, stdout: JSON.stringify(prView), stderr: "" };
+    },
+  };
+  const p = parseProbe({ kind: "pr", target: "o/r#12", match: { prState: "checks-green" } });
+  const res = await probeOnce(p, exec, {});
+  assertEquals(res.ready, false, "the red pull_request run survives event normalisation — checks-green is NOT ready");
+  assertStringIncludes(res.detail, "failing");
+});
+
+test("#957 probeOnce pr checks-green: an event-enrichment failure degrades to name-only, never throws", async () => {
+  const prView = {
+    state: "OPEN",
+    mergedAt: null,
+    mergeStateStatus: "CLEAN",
+    isDraft: false,
+    headRefOid: "abc",
+    mergeCommit: null,
+    statusCheckRollup: [{ name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" }],
+  };
+  const exec: ProbeExec = {
+    async httpGet() {
+      return { status: 0, body: "" };
+    },
+    async run(command) {
+      if (command.includes("api") && command.includes("graphql")) return { code: 1, stdout: "", stderr: "boom" }; // the event read fails
+      return { code: 0, stdout: JSON.stringify(prView), stderr: "" };
+    },
+  };
+  const p = parseProbe({ kind: "pr", target: "o/r#12", match: { prState: "checks-green" } });
+  const res = await probeOnce(p, exec, {});
+  assertEquals(res.ready, true, "a failed event read leaves the rollup event-less — a single green run is still green");
+});
+
 // ── #857: an epic target is a CANONICAL planKey (`owner/repo#N`) — never a URL ────────────────────
 // The epic probe keys off the durable lineage root (`owner/repo#N`, `parseIssue`'s `planKey` shape).
 // Delegating its validation to `parsePr` (whose grammar includes GitHub PR URLs) let a URL pass the
@@ -780,7 +869,7 @@ function prObs(over: Partial<PrObservation> = {}): PrObservation {
     totalChecks: 0,
     presentCheckNames: [],
     pendingCheckNames: [],
-    checkConclusions: {},
+    checkGateConclusions: {},
     isDraft: false,
     headRefOid: "abc123",
     mergedSha: null,

package/app/readiness.ts

@@ -18,7 +18,7 @@
 // any credential is read at execution time from the typed env-contract (`credentialEnv` names a
 // declared {@link EnvKey}; ADR 0004 pinned decision 2) and is redacted from every log line.
 import { isEnvKey, readEnv, readEnvOr } from "./contracts.ts";
-import { allCheckNames, checkConclusions, classifyMergeability, failingCheckNames, type PrState, pendingCheckNames } from "./github.ts";
+import { allCheckNames, applyRollupEvents, CHECK_EVENTS_QUERY, checkGateConclusions, classifyMergeability, failingCheckNames, type PrState, pendingCheckNames } from "./github.ts";
 import { parsePr } from "./prParse.ts";
 import { isoDuration, isoDurationToMs } from "./reviewWait.ts";
 
@@ -764,7 +764,7 @@ export function parsePrView(payload: unknown): PrObservation {
     totalChecks: rollup.length,
     presentCheckNames: allCheckNames(rollup),
     pendingCheckNames: pending,
-    checkConclusions: checkConclusions(rollup),
+    checkGateConclusions: checkGateConclusions(rollup),
     isDraft: j.isDraft === true,
     headRefOid: str(j.headRefOid).trim() || null,
     mergeQueueEntry: null, // readiness probe doesn't read native-queue membership (merge-loop-only signal)
@@ -857,6 +857,76 @@ export function prViewCommand(repo: string, number: string): string {
   return `gh pr view ${shellQuote(number)} --repo ${shellQuote(repo)} --json ${shellQuote("state,mergedAt,mergeStateStatus,statusCheckRollup,isDraft,headRefOid,mergeCommit")}`;
 }
 
+/** The GraphQL page query backing {@link enrichPrViewEvents}, as a single-quoted shell argument.
+ * Mirrors the merge loop's enrichment (`enrichRollupEvents` in `app/github.ts`) but runs through the
+ * probe's injected {@link ProbeExec} so the readiness path stays host-agnostic and unit-testable. */
+function prCheckEventsQuery(): string {
+  return CHECK_EVENTS_QUERY;
+}
+
+/** Enrich a `pr`-probe rollup with each run's triggering event, through the probe's injected
+ * executor. The `gh pr view --json statusCheckRollup` read omits `event`, so without this the
+ * readiness path groups by name alone and a green `push` run hides a red required `pull_request` run
+ * of the same name — `checks-green` then reports ready while the PR run is red (PR #957 review).
+ * Pages `statusCheckRollup.contexts` to exhaustion and pins the read to the rollup's head SHA
+ * (aborting the stamp when the head moved between the two reads), exactly like the merge loop's
+ * `enrichRollupEvents`. Never throws: any transport/parse failure leaves the rollup event-less. */
+async function enrichPrViewEvents(
+  exec: ProbeExec,
+  env: Record<string, string | undefined>,
+  repo: string,
+  number: string,
+  payload: Record<string, unknown>,
+): Promise<void> {
+  const j = payload;
+  if (!Array.isArray(j.statusCheckRollup) || j.statusCheckRollup.length === 0) return;
+  const rollup = j.statusCheckRollup;
+  const headSha = typeof j.headRefOid === "string" ? j.headRefOid : "";
+  const [owner, name] = repo.split("/");
+  const nodes: unknown[] = [];
+  let after: string | null = null;
+  for (;;) {
+    const args = [
+      "api",
+      "graphql",
+      "-f",
+      `query=${prCheckEventsQuery()}`,
+      "-f",
+      `o=${owner}`,
+      "-f",
+      `r=${name}`,
+      "-F",
+      `n=${number}`,
+    ];
+    if (after !== null) args.push("-f", `after=${after}`);
+    const command = `gh ${args.map(shellQuote).join(" ")}`;
+    const out = await exec.run(command, env);
+    if (out.code !== 0) return; // a transport hiccup leaves the rollup event-less (name-only gates)
+    const page = parseJson(out.stdout);
+    if (!isRecord(page)) return;
+    const data = isRecord(page.data) ? page.data : undefined;
+    const repository = data && isRecord(data.repository) ? data.repository : undefined;
+    const pullRequest = repository && isRecord(repository.pullRequest) ? repository.pullRequest : undefined;
+    const commits = pullRequest && isRecord(pullRequest.commits) ? pullRequest.commits : undefined;
+    const firstCommit = commits && Array.isArray(commits.nodes) ? commits.nodes[0] : undefined;
+    const commit = isRecord(firstCommit) && isRecord(firstCommit.commit) ? firstCommit.commit : undefined;
+    if (!isRecord(commit)) return;
+    // Head-pin: the rollup came from the earlier `gh pr view`; if the head moved since, these
+    // contexts belong to a different head — stamping them would join events across heads.
+    const oid = typeof commit.oid === "string" ? commit.oid : "";
+    if (headSha !== "" && oid !== "" && oid !== headSha) return;
+    const rollupObj = isRecord(commit.statusCheckRollup) ? commit.statusCheckRollup : undefined;
+    const contexts = rollupObj && isRecord(rollupObj.contexts) ? rollupObj.contexts : undefined;
+    if (contexts === undefined) return;
+    if (Array.isArray(contexts.nodes)) nodes.push(...contexts.nodes);
+    const pageInfo = isRecord(contexts.pageInfo) ? contexts.pageInfo : undefined;
+    const endCursor = pageInfo && typeof pageInfo.endCursor === "string" ? pageInfo.endCursor : "";
+    if (pageInfo?.hasNextPage !== true || endCursor === "") break;
+    after = endCursor;
+  }
+  applyRollupEvents(rollup, nodes);
+}
+
 // ── Epic / plan-fanout probe (issue #568 — gate a graph on an epic reaching "fully merged") ──────
 
 /** A live epic (plan-fanout) observation, reduced to the fields {@link matchEpic} reads. An nwf epic
@@ -974,7 +1044,15 @@ export async function probeOnce(
       if (!ref) return { ready: false, detail: "pr: unparseable target (not ready)" };
       const out = await exec.run(prViewCommand(ref.repo, ref.number), env);
       if (out.code !== 0) return { ready: false, detail: "pr: gh pr view failed (not ready)" };
-      return matchPr(probe.match, parsePrView(parseJson(out.stdout)));
+      const payload = parseJson(out.stdout);
+      if (!isRecord(payload)) return matchPr(probe.match, parsePrView(payload));
+      // Normalise each run's triggering event BEFORE parsing (PR #957 review): the `gh pr view`
+      // rollup omits `event`, so an un-enriched read groups by name alone and a green `push` run
+      // hides a red required `pull_request` run of the same name — `checks-green` would report
+      // ready while the PR run is red. Shared transport logic with the merge loop, over the
+      // injected executor.
+      await enrichPrViewEvents(exec, env, ref.repo, ref.number, payload);
+      return matchPr(probe.match, parsePrView(payload));
     }
     case "epic": {
       // "Fully merged" is the app's AGGREGATE, not a GitHub read — observe it over the app's own

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.210.0",
-  "gitSha": "c1a72ce90744ccd23aa8160d20f0add2779db837",
-  "gitTag": "v0.210.0",
-  "builtAt": "2026-11-12T10:53:21.705Z"
+  "version": "0.210.1",
+  "gitSha": "e2c4e966b566ce8b4bdc19e84bceb130909a981c",
+  "gitTag": "v0.210.1",
+  "builtAt": "2026-11-12T12:00:58.232Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.210.0",
+  "version": "0.210.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/workers/landed-probe/worker.test.ts

@@ -12,7 +12,7 @@ const base: PrState = {
   totalChecks: 0,
   presentCheckNames: [],
   pendingCheckNames: [],
-  checkConclusions: {},
+  checkGateConclusions: {},
   isDraft: false,
   headRefOid: null,
   mergeQueueEntry: null,

package/workers/merge-stall-probe/worker.test.ts

@@ -18,7 +18,7 @@ function state(over: Partial<PrState>): PrState {
     failingCheckNames: [],
     presentCheckNames: ["build", "Mergify Merge Queue"],
     pendingCheckNames: [],
-    checkConclusions: { build: "SUCCESS", "Mergify Merge Queue": "NEUTRAL" },
+    checkGateConclusions: { build: ["SUCCESS"], "Mergify Merge Queue": ["NEUTRAL"] },
     totalChecks: 2,
     isDraft: false,
     headRefOid: "abc",
@@ -80,7 +80,7 @@ test("merge-stall-probe: BLOCKED gh-merge PR with green checks still waits (#951
 // must NOT classify that head's stale check failures as `blocked` (which starts fix-ci / escalates).
 // It defers to `waiting` (bounded re-poll) until the head moves or the remedy's window lapses.
 test("merge-stall-probe: a blocked verdict on a pending-update old head defers to waiting (#951)", async () => {
-  const blocked = state({ failingChecks: 1, failingCheckNames: ["build"], checkConclusions: { build: "FAILURE" } });
+  const blocked = state({ failingChecks: 1, failingCheckNames: ["build"], checkGateConclusions: { build: ["FAILURE"] } });
   // Sanity: without a pending update this IS blocked (would route to fix-ci).
   assertEquals((await run(blocked, MERGIFY, false)).mergeState, "blocked");
   // With the update still pending on this head, the probe holds remediation.