@nanobpm/nano-workforce 0.26.0

package/assets/icon.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" role="img" aria-label="Nano Workforce">
+  <title>Nano Workforce</title>
+  <!-- Three coordinated worker nodes converging on a shared task -->
+  <circle cx="12" cy="4.25" r="2.25" />
+  <circle cx="4.75" cy="16.5" r="2.25" />
+  <circle cx="19.25" cy="16.5" r="2.25" />
+  <!-- Links forming the coordination triangle -->
+  <path d="M10.4 6L6.35 14.75" />
+  <path d="M13.6 6L17.65 14.75" />
+  <path d="M7 16.5H17" />
+  <!-- Central convergence mark -->
+  <circle cx="12" cy="16.5" r="0.9" fill="currentColor" stroke="none" />
+</svg>

package/components/review-round.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "https://unpkg.com/@camunda/zeebe-element-templates-json-schema@0.44.0/resources/schema.json",
+  "id": "io.nanobpm.urban.pr-review-round",
+  "name": "PR Review Round (agent)",
+  "description": "One decoupled review round serviced by an external agent (e.g. a Copilot instance via `c8ctl nano work`). The agent reads the latest review, addresses it, pushes, re-requests review, and returns a structured status.",
+  "appliesTo": ["bpmn:Task"],
+  "elementType": { "value": "bpmn:ServiceTask" },
+  "properties": [
+    {
+      "type": "Hidden",
+      "value": "senior:pr-review",
+      "binding": { "type": "zeebe:taskDefinition:type" }
+    },
+    {
+      "label": "Input data-envelope type",
+      "type": "Hidden",
+      "value": "PrReviewRoundIn",
+      "binding": { "type": "zeebe:property", "name": "io.nanobpm.dataEnvelope.in" }
+    },
+    {
+      "label": "Output data-envelope type",
+      "type": "Hidden",
+      "value": "PrReviewRoundOut",
+      "binding": { "type": "zeebe:property", "name": "io.nanobpm.dataEnvelope.out" }
+    },
+    {
+      "label": "PR URL",
+      "type": "String",
+      "feel": "optional",
+      "value": "=prUrl",
+      "binding": { "type": "zeebe:input", "name": "prUrl" }
+    },
+    {
+      "label": "Repo (owner/name)",
+      "type": "String",
+      "feel": "optional",
+      "value": "=repo",
+      "binding": { "type": "zeebe:input", "name": "repo" }
+    },
+    {
+      "label": "PR number",
+      "type": "String",
+      "feel": "optional",
+      "value": "=prNumber",
+      "binding": { "type": "zeebe:input", "name": "prNumber" }
+    },
+    {
+      "label": "Round",
+      "type": "String",
+      "feel": "optional",
+      "value": "=round",
+      "binding": { "type": "zeebe:input", "name": "round" }
+    },
+    {
+      "label": "Prompt (instructions)",
+      "type": "String",
+      "feel": "optional",
+      "value": "=prompt",
+      "binding": { "type": "zeebe:input", "name": "prompt" }
+    },
+    {
+      "label": "Answer (on escalation resume)",
+      "type": "String",
+      "feel": "optional",
+      "value": "=answer",
+      "binding": { "type": "zeebe:input", "name": "answer" }
+    }
+  ]
+}

package/db/migrations/001_init.sql

@@ -0,0 +1,46 @@
+-- nano-workforce schema (SPEC §7). One row per PR under convergence, its rounds,
+-- and any escalations raised mid-convergence.
+
+CREATE TABLE IF NOT EXISTS pull_requests (
+  pr_key         TEXT PRIMARY KEY,          -- "<owner>/<repo>#<number>"
+  repo           TEXT NOT NULL,             -- "<owner>/<repo>"
+  number         INTEGER NOT NULL,
+  url            TEXT NOT NULL,
+  title          TEXT,                      -- fetched from GitHub (optional)
+  status         TEXT NOT NULL,             -- converging | waiting_review | escalated | converged | abandoned
+  current_round  INTEGER NOT NULL DEFAULT 0,
+  process_key    TEXT,                      -- engine process-instance key
+  waiting_since  TEXT,                      -- ISO ts we began waiting for a review (poller cursor)
+  last_review_id INTEGER,                   -- last GitHub review id we reacted to
+  outcome        TEXT,                      -- final summary
+  created_at     TEXT NOT NULL,
+  updated_at     TEXT NOT NULL,
+  converged_at   TEXT
+);
+
+CREATE TABLE IF NOT EXISTS rounds (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  pr_key     TEXT NOT NULL REFERENCES pull_requests(pr_key),
+  round_no   INTEGER NOT NULL,
+  status     TEXT,                          -- converged | addressed | waiting | needs_input | blocked
+  summary    TEXT,
+  started_at TEXT NOT NULL,
+  ended_at   TEXT
+);
+
+CREATE TABLE IF NOT EXISTS escalations (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  pr_key      TEXT NOT NULL REFERENCES pull_requests(pr_key),
+  round_no    INTEGER NOT NULL,
+  kind        TEXT NOT NULL,                -- question | blocker
+  question    TEXT NOT NULL,
+  answer      TEXT,
+  status      TEXT NOT NULL,                -- open | answered
+  asked_at    TEXT NOT NULL,
+  answered_at TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_pr_status ON pull_requests(status);
+CREATE INDEX IF NOT EXISTS idx_rounds_pr ON rounds(pr_key);
+CREATE INDEX IF NOT EXISTS idx_esc_pr ON escalations(pr_key);
+CREATE INDEX IF NOT EXISTS idx_esc_open ON escalations(pr_key, status);

package/db/migrations/002_transcript.sql

@@ -0,0 +1,7 @@
+-- Auditability: keep the agent's full transcript (the harness's byte-capped
+-- stdout capture, surfaced on the io.nanobpm.agentResult envelope) alongside the
+-- round it produced and any escalation it raised, so a human can see exactly what
+-- the agent did without re-running it.
+
+ALTER TABLE rounds ADD COLUMN transcript TEXT;
+ALTER TABLE escalations ADD COLUMN transcript TEXT;

package/db/migrations/003_open_escalation.sql

@@ -0,0 +1,8 @@
+-- Denormalise the currently-open escalation onto the PR row so the generic page
+-- runtime (ADR 0042) can bind a conditional "answer" form to it without a join:
+-- the form is shown when `open_escalation_id` is set and prints
+-- `open_escalation_question`. The persist-escalation worker sets these when it
+-- opens an escalation, and answering (or finalising) clears them.
+
+ALTER TABLE pull_requests ADD COLUMN open_escalation_id INTEGER;
+ALTER TABLE pull_requests ADD COLUMN open_escalation_question TEXT;

package/db/migrations/004_merge.sql

@@ -0,0 +1,36 @@
+-- Merge stage (SPEC §11). Once a PR converges, a separate `merge-loop` process drives it to
+-- land: it waits for any declared cross-PR dependencies to merge first, then for the PR to
+-- become mergeable (checks green, no conflicts), then merges it — directly or via the repo's
+-- merge queue — escalating to a human when it is blocked. These columns/tables record that
+-- stage alongside the convergence stage already captured by 001_init.sql.
+
+-- Timestamp the app recorded the PR as landed (NULL until merged). Set by `pr.mark-merged` to the
+-- time this app *observed/recorded* the merge, which can lag GitHub's actual `merged_at` (e.g. for
+-- merge-queue or out-of-band merges). `outcome` (001) still holds the convergence summary; a
+-- separate timestamp keeps "converged" and "merged" distinguishable on the row.
+ALTER TABLE pull_requests ADD COLUMN merged_at TEXT;
+
+-- Cross-PR merge dependencies: this PR must not merge until every `depends_on_key` PR has
+-- merged. Declared at submit time (a `dependsOn` field on the submit endpoints and/or a
+-- `Depends-on: owner/repo#N` line in the PR body). Re-submitting a PR replaces its dep set.
+CREATE TABLE IF NOT EXISTS pr_dependencies (
+  pr_key         TEXT NOT NULL,             -- the dependent PR ("<owner>/<repo>#<number>")
+  depends_on_key TEXT NOT NULL,             -- the PR it waits on ("<owner>/<repo>#<number>")
+  created_at     TEXT NOT NULL,
+  PRIMARY KEY (pr_key, depends_on_key)
+);
+
+-- Audit trail of merge attempts, so a human can see how a PR landed (or why it stalled)
+-- without re-running anything — the merge-stage analogue of `rounds`.
+CREATE TABLE IF NOT EXISTS merges (
+  id       INTEGER PRIMARY KEY AUTOINCREMENT,
+  pr_key   TEXT NOT NULL REFERENCES pull_requests(pr_key),
+  outcome  TEXT NOT NULL,                   -- merged | queued | blocked
+  method   TEXT,                            -- squash | merge | rebase | queue
+  detail   TEXT,                            -- gh/API message (success line or error)
+  at       TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_deps_pr ON pr_dependencies(pr_key);
+CREATE INDEX IF NOT EXISTS idx_deps_on ON pr_dependencies(depends_on_key);
+CREATE INDEX IF NOT EXISTS idx_merges_pr ON merges(pr_key);

package/db/migrations/004_planning.sql

@@ -0,0 +1,37 @@
+-- Planning fan-out (issue #14): a planning agent decomposes an issue into tasks,
+-- a fleet of implementation agents build them in parallel, each opening a PR that
+-- is then enrolled into the review-convergence loop.
+--
+-- `plans` is one row per issue put through the fleet; `plan_tasks` is one row per
+-- slice the planner emitted, tracking the PR it produced and its dispatch state.
+
+CREATE TABLE plans (
+  plan_key      TEXT PRIMARY KEY,          -- "<owner>/<repo>#<issue-number>"
+  repo          TEXT NOT NULL,             -- "<owner>/<repo>"
+  issue_number  INTEGER NOT NULL,
+  issue_url     TEXT NOT NULL,
+  title         TEXT,                       -- issue title (best-effort)
+  status        TEXT NOT NULL,             -- planning | dispatched | done | failed | abandoned
+  task_count    INTEGER NOT NULL DEFAULT 0,
+  process_key   TEXT,                       -- engine process-instance key
+  outcome       TEXT,                       -- final summary / note
+  created_at    TEXT NOT NULL,
+  updated_at    TEXT NOT NULL
+);
+
+CREATE TABLE plan_tasks (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  plan_key    TEXT NOT NULL REFERENCES plans(plan_key),
+  task_index  INTEGER NOT NULL,            -- position in the plan (aligns with the MI output collection)
+  task_id     TEXT NOT NULL,               -- planner-supplied slug (or "t<index>")
+  title       TEXT,
+  prompt      TEXT,
+  status      TEXT NOT NULL,               -- pending | opened | blocked | skipped
+  pr_key      TEXT,                         -- the PR this slice produced ("<owner>/<repo>#<n>")
+  summary     TEXT,
+  created_at  TEXT NOT NULL,
+  updated_at  TEXT NOT NULL
+);
+
+CREATE INDEX idx_plans_status ON plans(status);
+CREATE INDEX idx_plan_tasks_plan ON plan_tasks(plan_key);

package/db/migrations/005_job_activation.sql

@@ -0,0 +1,15 @@
+-- Job-activation visibility. The `converging` status conflates two distinct engine
+-- states of the `senior:pr-review` job the process parks at (the `review-round`
+-- service task): the job may be CREATED but not yet activated (no agent has picked
+-- it up — "waiting for activation"), or activated/leased to a worker (an agent is
+-- actively working the round). The engine tracks this (JobState::Created vs
+-- ::Activated) but the Camunda-8 `/v2/jobs/search` wire API collapses Activated ->
+-- CREATED (Camunda's JobStateEnum has no ACTIVATED value), so activation is read
+-- off the standard `worker` + `deadline` fields: an activated job carries the
+-- leasing worker's name and a lock deadline; a merely-created one carries neither.
+--
+-- The review-ready poller writes these from a `/v2/jobs/search` pass so the pages
+-- surface can show "agent working" vs "queued (awaiting an agent)" — and, via the
+-- lease deadline, a stalled/lost agent whose lock is lapsing.
+ALTER TABLE pull_requests ADD COLUMN active_worker TEXT;  -- leasing worker's name while an agent is working the round; NULL when queued/not at review-round
+ALTER TABLE pull_requests ADD COLUMN lease_until TEXT;    -- ISO ts the current activation lease expires (job deadline); NULL when not activated

package/db/migrations/005_plan_deps.sql

@@ -0,0 +1,20 @@
+-- Mixed sequential + parallel plan fan-out (issue #20): planner-emitted tasks may
+-- declare dependencies on earlier tasks. A pure levelizer (app/waves.ts) assigns
+-- each task a 0-based `wave` (longest-path level); the plan-fanout process runs the
+-- parallel multi-instance `implement` activity once per wave, in order. Tasks within
+-- a wave still run in parallel; a later wave waits for the whole earlier wave.
+--
+-- `plan_task_deps` records the task DAG (one row per edge), mirroring
+-- `pr_dependencies` for PRs — from which per-PR merge ordering already falls out.
+-- `plan_tasks.wave` is the levelized wave index (NULL until levelized).
+
+ALTER TABLE plan_tasks ADD COLUMN wave INTEGER;
+
+CREATE TABLE plan_task_deps (
+  plan_key            TEXT NOT NULL REFERENCES plans(plan_key),
+  task_id             TEXT NOT NULL,   -- the dependent task's slug
+  depends_on_task_id  TEXT NOT NULL,   -- the task it waits for
+  PRIMARY KEY (plan_key, task_id, depends_on_task_id)
+);
+
+CREATE INDEX idx_plan_task_deps_plan ON plan_task_deps(plan_key);

package/db/migrations/006_plan_review.sql

@@ -0,0 +1,22 @@
+-- Adversarial plan review (issue: gate the plan before fan-out). After the `senior:plan`
+-- agent emits a plan and `record-plan` levelizes it, an INDEPENDENT `senior:plan-review`
+-- agent adversarially critiques the decomposition and sequencing BEFORE any wave dispatches.
+-- On a rejecting verdict the planner revises (bounded rounds); on approval (or once the round
+-- cap is hit) the wave loop proceeds. The plan is the highest-leverage artifact in the fleet —
+-- a wrong decomposition or a mis-placed dependency dooms every downstream PR — so it gets the
+-- same falsification treatment the PRs themselves get.
+--
+-- `plan_reviews` is the append-only audit log: one row per review round, with the verdict and
+-- the reviewer's findings. The current round is derived from the row count, so the loop needs
+-- no counter variable.
+
+CREATE TABLE plan_reviews (
+  plan_key    TEXT NOT NULL REFERENCES plans(plan_key),
+  round       INTEGER NOT NULL,           -- 0-based review round
+  approved    INTEGER NOT NULL,           -- 1 = reviewer approved, 0 = rejected (revise)
+  findings    TEXT,                       -- the reviewer's critique (drives the planner's revision)
+  created_at  TEXT NOT NULL,
+  PRIMARY KEY (plan_key, round)
+);
+
+CREATE INDEX idx_plan_reviews_plan ON plan_reviews(plan_key);

package/db/migrations/006_task_escalation.sql

@@ -0,0 +1,52 @@
+-- Implementation-phase escalation (issue #25): give a stuck implementation agent
+-- a human-in-the-loop path DURING the fan-out, mirroring the review loop's per-PR
+-- escalation but per-TASK.
+--
+-- The agent opens a DRAFT PR (to preserve its work in git), reports
+-- `status = "escalated"` with a `question`, and completes its job promptly. The
+-- `plan-fanout` process parks that child at a per-task message catch
+-- (`feature-escalation-answered`, correlated on `<plan_key>:<task_id>`); a human
+-- answers, the child re-dispatches the SAME task with the answer merged in, and
+-- the agent continues on the same branch. Context is externalised to git (the
+-- draft PR/branch) + the task row, so a fresh agent on ANY worker machine can
+-- resume (see issue #25 "stateless cold re-dispatch").
+
+-- Per-task escalation state. `corr_key` is "<plan_key>:<task_id>" — the message
+-- correlation key the process opens its wait subscription on. `draft_pr_key` is
+-- the work-preserving draft PR the agent opened before escalating.
+ALTER TABLE plan_tasks ADD COLUMN open_question TEXT;
+ALTER TABLE plan_tasks ADD COLUMN answer TEXT;
+ALTER TABLE plan_tasks ADD COLUMN draft_pr_key TEXT;
+ALTER TABLE plan_tasks ADD COLUMN corr_key TEXT;
+
+-- Denormalise the plan's OLDEST still-open task escalation onto the plan row so
+-- the generic page runtime (ADR 0042) can bind a single conditional "answer" form
+-- to it without a per-child form (which the runtime does not support). The
+-- persist worker sets these when it opens an escalation; answering re-points them
+-- at the next-oldest open escalation (or clears them). `open_task_corr_key` is the
+-- form's correlationKey; `open_task_id` is shown for context.
+ALTER TABLE plans ADD COLUMN open_task_escalation_id INTEGER;
+ALTER TABLE plans ADD COLUMN open_task_question TEXT;
+ALTER TABLE plans ADD COLUMN open_task_corr_key TEXT;
+ALTER TABLE plans ADD COLUMN open_task_id TEXT;
+
+-- One row per implementation-phase escalation (the audit trail, mirroring
+-- `escalations` for the review loop). `status` is open | answered.
+CREATE TABLE plan_escalations (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  plan_key      TEXT NOT NULL REFERENCES plans(plan_key),
+  task_id       TEXT NOT NULL,             -- the escalating task's slug
+  corr_key      TEXT NOT NULL,             -- "<plan_key>:<task_id>"
+  question      TEXT NOT NULL,
+  answer        TEXT,
+  draft_pr_key  TEXT,                        -- draft PR the agent opened to preserve work
+  status        TEXT NOT NULL,             -- open | answered
+  asked_at      TEXT NOT NULL,
+  answered_at   TEXT
+);
+
+CREATE INDEX idx_plan_escalations_plan ON plan_escalations(plan_key);
+CREATE INDEX idx_plan_escalations_open ON plan_escalations(plan_key, status);
+-- The persist worker and `answerTaskEscalation` look up the open row by
+-- (corr_key, status); index it to avoid a scan (mirrors escalations(pr_key, status)).
+CREATE INDEX idx_plan_escalations_corr ON plan_escalations(corr_key, status);

package/db/migrations/007_plan_review_job_key.sql

@@ -0,0 +1,14 @@
+-- Idempotency key for record-plan-review (issue: gate the plan before fan-out).
+--
+-- The review round is derived from `count(plan_reviews)` (no counter variable). That derivation
+-- is NOT idempotent under Zeebe job retries: if the `pr.record-plan-review` job crashes or its
+-- deadline lapses AFTER the row insert but BEFORE the job completes, the engine re-activates the
+-- SAME job (stable `jobKey`). A naive retry would insert a SECOND row for a fresh round index,
+-- inflating the count and tripping `reviewExhausted` early — proceeding to fan-out with fewer
+-- review rounds than intended.
+--
+-- Recording the engine `jobKey` that wrote each row lets the worker detect a retry and reuse the
+-- already-recorded verdict instead of appending a duplicate. Pre-existing rows keep `job_key`
+-- NULL; SQLite treats NULLs as distinct in a UNIQUE index, so they never collide.
+ALTER TABLE plan_reviews ADD COLUMN job_key TEXT;
+CREATE UNIQUE INDEX idx_plan_reviews_job ON plan_reviews(plan_key, job_key);

package/db/migrations/007_wave_gate.sql

@@ -0,0 +1,16 @@
+-- Wave-merge barrier (release-notes-concierge epic): a later wave must not be
+-- IMPLEMENTED until the prior wave's PRs have MERGED — not merely opened.
+--
+-- Before this, `record-wave` handed off a wave's PRs to convergence/merge and the
+-- plan-fanout loop went straight back to `select-wave`, dispatching the next wave's
+-- agents off an UNMERGED base. The `pr_dependencies` DAG only ordered the eventual
+-- *merges*; it never held back a dependent wave's *implementation*. For a blocking
+-- prerequisite (e.g. app scaffolding that every later task builds on) the next wave
+-- must see the merged prerequisite on `main`.
+--
+-- `plans.gate_wave` is the durable marker for the barrier: when `record-wave` hands
+-- off a wave that has a successor, it records that wave's index here and the process
+-- parks at the `wait-wave-merged` catch event. The poller (`pollWaveGates`) clears it
+-- and publishes `wave-merged` once every opened PR in that wave has merged. NULL means
+-- the plan is not currently parked at the wave barrier.
+ALTER TABLE plans ADD COLUMN gate_wave INTEGER;

package/db/migrations/008_review_nudge.sql

@@ -0,0 +1,9 @@
+-- Review-wait liveness. A PR parked in `waiting_review` blocks on a *fresh* Copilot review
+-- arriving. Copilot does not spontaneously re-review a round with no new commit, and it
+-- routinely dismisses a re-request (`review_request_removed`) — so without an active nudge the
+-- loop can hang indefinitely at the `wait-review` catch (observed: three merlin convergence
+-- processes stalled ~22h). The poller now re-requests Copilot on a waiting PR that has no
+-- pending Copilot reviewer; `last_nudge_at` records when it last did so, so the nudge is
+-- throttled to one attempt per cooldown window (NANO_PR_REVIEW_NUDGE_MINUTES) rather than
+-- hammering the reviewers API on every poll tick. NULL = never nudged.
+ALTER TABLE pull_requests ADD COLUMN last_nudge_at TEXT;  -- ISO ts of the last Copilot re-request nudge; NULL when never nudged

package/db/migrations/009_plan_blackboard.sql

@@ -0,0 +1,46 @@
+-- Epic coordination blackboard — Tier 1 (issues #51 / #49 D4).
+--
+-- A per-plan advisory shared store that implementer agents READ on dispatch and WRITE to
+-- (file-claims, constraint/scope changes), so parallel siblings in a wave can coordinate
+-- without a human relay. Before this, the only structured channel was task->human escalation;
+-- all sibling coordination ("task U now also touches state.rs") lived in PR/issue prose the
+-- planner and other agents could not act on (retro: Magikcraft/nano-bpm#614).
+--
+-- Deliberately kept OUT of process/engine state: it is *advisory knowledge*, never gates a
+-- sequence flow, and is read fresh (so it need not be replay-deterministic). Control-flow stays
+-- in the BPMN; this is a shared scratchpad.
+--
+-- Delivery vs use: the plan process seeds a rendered coordination brief (including THIS plan's
+-- capability URL) into `appendPrompt`; the c8ctl-nano harness forwards that prompt verbatim, so
+-- it needs no change. The agent then talks to the endpoint DIRECTLY as a side-channel — a
+-- different endpoint from the activation/completion channel.
+
+-- Per-plan capability token: the unguessable credential baked into the blackboard URL handed to
+-- agents (the URL *is* the credential). Minted at plan start; `/hooks/blackboard` maps it back to
+-- this plan and scopes reads/writes to it. NULL for plans created before this migration.
+ALTER TABLE plans ADD COLUMN blackboard_token TEXT;
+
+CREATE TABLE plan_blackboard (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  plan_key    TEXT NOT NULL REFERENCES plans(plan_key),
+  author_task TEXT NOT NULL DEFAULT 'system', -- the writing task's slug (or 'system' for host writes)
+  kind        TEXT NOT NULL DEFAULT 'note',    -- file-claim | constraint-change | scope-change | note
+  files       TEXT,                            -- JSON array of repo-relative paths (nullable; feeds D2)
+  body        TEXT NOT NULL,                   -- the human/agent-readable note
+  wave        INTEGER,                         -- optional wave index the writer was dispatched in
+  dedupe_key  TEXT,                            -- idempotency key (see the unique index below)
+  created_at  TEXT NOT NULL
+);
+
+-- Idempotent write-back: the engine may re-activate a job on retry, so re-POSTing the same entry
+-- (same author + stable dedupe_key) must collapse to one row. Partial index so the common
+-- dedupe-less note (NULL dedupe_key) is unconstrained and always appends.
+CREATE UNIQUE INDEX ux_plan_blackboard_dedupe
+  ON plan_blackboard (plan_key, dedupe_key) WHERE dedupe_key IS NOT NULL;
+
+-- List a plan's entries in write order (id asc), and map a capability token back to its plan.
+CREATE INDEX ix_plan_blackboard_plan ON plan_blackboard (plan_key, id);
+-- The token is a capability credential, so it must map back to exactly ONE plan. A partial UNIQUE
+-- index (NULLs excluded, so pre-migration plans without a token are unconstrained) enforces the
+-- one-token→one-plan invariant at the DB boundary, and doubles as the token→plan lookup index.
+CREATE UNIQUE INDEX ux_plans_blackboard_token ON plans (blackboard_token) WHERE blackboard_token IS NOT NULL;

package/db/migrations/010_plan_task_deltas.sql

@@ -0,0 +1,27 @@
+-- Structured scope/impl-change report from implementer agents (D5, issue #55 / #49).
+--
+-- The implementer result contract (prompts/feature.md) gains an optional `delta`: the machine-
+-- readable "I changed the contract / discovered a constraint / this now touches files X / affects
+-- tasks A,B" that previously had nowhere to land but PR prose. One row per (plan, task) — upserted,
+-- so a worker retry or a post-escalation resume overwrites rather than duplicates. `newly_touches`
+-- and `affects_tasks` are JSON-encoded string arrays (feeds D2 conflict-scan + the D4 blackboard).
+CREATE TABLE IF NOT EXISTS plan_task_deltas (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  plan_key        TEXT NOT NULL,
+  task_id         TEXT NOT NULL,
+  wave            INTEGER,
+  contract_change TEXT,
+  newly_touches   TEXT,               -- JSON array of paths, or NULL
+  affects_tasks   TEXT,               -- JSON array of task ids, or NULL
+  constraint_note TEXT,
+  created_at      TEXT NOT NULL,
+  updated_at      TEXT NOT NULL
+);
+
+-- One delta per (plan, task): the upsert key. A resume/retry replaces the prior report in place.
+CREATE UNIQUE INDEX IF NOT EXISTS ux_plan_task_deltas_task
+  ON plan_task_deltas (plan_key, task_id);
+
+-- Read a plan's whole report in write order.
+CREATE INDEX IF NOT EXISTS ix_plan_task_deltas_plan
+  ON plan_task_deltas (plan_key, id);

package/db/migrations/011_plan_merge_exclusions.sql

@@ -0,0 +1,26 @@
+-- The merge-exclusion graph (D1, issue #57 / #49).
+--
+-- A SECOND relationship, distinct from the dispatch-DAG (`plan_task_deps` → waves). Those edges
+-- gate *starting* a task; these gate *landing* it: two tasks can run in parallel but touch the same
+-- surface, so they can't merge independently (nano-bpm#614: nine slices all appending to
+-- engine/tests.rs). Undirected `(task_a, task_b)` pairs, `task_a < task_b` normalised so a pair has
+-- exactly one row. `files` is the JSON-encoded overlapping path set; `source` records how the edge
+-- was derived (e.g. `file-overlap`). These MUST NEVER enter computeWaves — they order landings only.
+CREATE TABLE IF NOT EXISTS plan_merge_exclusions (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  plan_key   TEXT NOT NULL,
+  task_a     TEXT NOT NULL,
+  task_b     TEXT NOT NULL,
+  files      TEXT,               -- JSON array of the overlapping paths
+  source     TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+-- One row per unordered pair on a plan: the upsert key (a refreshed scan updates files in place).
+CREATE UNIQUE INDEX IF NOT EXISTS ux_plan_merge_exclusions_pair
+  ON plan_merge_exclusions (plan_key, task_a, task_b);
+
+-- Read a plan's whole exclusion graph.
+CREATE INDEX IF NOT EXISTS ix_plan_merge_exclusions_plan
+  ON plan_merge_exclusions (plan_key, id);

package/db/migrations/012_merge_protocol_attempt.sql

@@ -0,0 +1,4 @@
+-- Merge-protocol liveness (D9). The frugal-CI fresh-head-run remedy is one-shot per landing
+-- attempt, not per PR lifetime: a rebase creates a new head commit and may need a new synthetic
+-- `pull_request` run even if an earlier head was already nudged.
+ALTER TABLE pull_requests ADD COLUMN fresh_head_run_head TEXT;

package/db/migrations/013_merge_train_waiting_lane.sql

@@ -0,0 +1,6 @@
+-- D6 merge-train lane serialization.
+--
+-- Adds the durable meaning of pull_requests.status = 'waiting_lane': a converged PR that is green
+-- but parked behind the current head of its D2 merge-exclusion lane. SQLite has no status enum in
+-- this schema, so no column shape changes are required; the existing idx_pr_status covers polling.
+SELECT 1;

package/db/migrations/014_plan_trial_merges.sql

@@ -0,0 +1,21 @@
+-- D3 trial-merge integration gate audit (issue #69).
+CREATE TABLE IF NOT EXISTS plan_trial_merges (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  plan_key TEXT NOT NULL,
+  wave INTEGER NOT NULL DEFAULT 0,
+  result TEXT NOT NULL CHECK (result IN ('clean', 'merge-conflict', 'suite-failed')),
+  heads TEXT,
+  conflicts TEXT,
+  failing TEXT,
+  summary TEXT,
+  job_key TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_plan_trial_merges_plan_wave
+  ON plan_trial_merges(plan_key, wave, id);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_plan_trial_merges_plan_job
+  ON plan_trial_merges(plan_key, job_key)
+  WHERE job_key IS NOT NULL;

package/db/migrations/015_pr_abandon_token.sql

@@ -0,0 +1,9 @@
+-- Cooperative abandon check (issue #76): a per-PR capability token the running agent curls to learn
+-- whether its run was cancelled before it performs a side effect. The abandon state itself is
+-- derived from pull_requests.status (set to 'abandoned' by cancelRun); this only adds the token the
+-- /hooks/abandon endpoint resolves back to the PR.
+ALTER TABLE pull_requests ADD COLUMN abandon_token TEXT;
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_pull_requests_abandon_token
+  ON pull_requests(abandon_token)
+  WHERE abandon_token IS NOT NULL;

package/deno.json

@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "lib": [
+      "deno.window",
+      "deno.ns"
+    ]
+  },
+  "imports": {
+    "@nanobpm/urban": "npm:@nanobpm/urban@^0.24.0"
+  },
+  "tasks": {
+    "start": "deno run --allow-net --allow-read --allow-write --allow-run=gh --allow-env main.ts",
+    "purge": "deno run --allow-read --allow-write --allow-env scripts/purge-db.ts",
+    "check": "deno run -A @nanobpm/urban check",
+    "check:prompts": "deno run -A scripts/check-agent-prompts.ts",
+    "gen": "deno run -A @nanobpm/urban gen",
+    "gen:check": "deno run -A @nanobpm/urban gen --check",
+    "layout": "deno run -A scripts/layout-bpmn.ts",
+    "layout:check": "deno run -A scripts/layout-bpmn.ts --check",
+    "dev": "deno run -A @nanobpm/urban dev",
+    "compile": "deno compile --allow-net --allow-read --allow-write --allow-run=gh --allow-env -o dist/nano-workforce main.ts",
+    "test": "deno test -A"
+  }
+}