@nanobpm/nano-workforce 0.35.0 → 0.35.2

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [0.35.2](https://github.com/nanobpm/nano-workforce/compare/v0.35.1...v0.35.2) (2026-08-10)
+
+
+### Bug Fixes
+
+* **pages:** route-driven page actions via @nanobpm/urban@0.33.0 ([#106](https://github.com/nanobpm/nano-workforce/issues/106)) ([0ee4ab2](https://github.com/nanobpm/nano-workforce/commit/0ee4ab29aa8cfca6a04af6eb141a96d7878a6b1a))
+
+## [0.35.1](https://github.com/nanobpm/nano-workforce/compare/v0.35.0...v0.35.1) (2026-08-10)
+
+
+### Bug Fixes
+
+* **api:** move OpenAPI base off the reserved /app page-runtime namespace ([#103](https://github.com/nanobpm/nano-workforce/issues/103)) ([6dfb77f](https://github.com/nanobpm/nano-workforce/commit/6dfb77ff82b532965c4a9823d771d46d4ffa920e)), closes [#102](https://github.com/nanobpm/nano-workforce/issues/102)
+
 # [0.35.0](https://github.com/nanobpm/nano-workforce/compare/v0.34.0...v0.35.0) (2026-08-10)
 
 

package/README.md

@@ -133,15 +133,15 @@ app emits, then put it to work:
 c8ctl nano hire \
   --name fleet \
   --rank senior \
-  --capabilities pr-review plan plan-review feature fix-ci \
+  --capabilities pr-review plan plan-review feature trial-merge fix-ci rebase retro \
   --command 'copilot -p - --allow-all-tools' \
   --model <your-model>
 
 c8ctl nano work fleet         # polls every senior:* agent task below until Ctrl-C
 ```
 
-`--rank senior` × those five capabilities subscribes the worker to exactly the agent
-task types the three workflows emit (one `senior:<capability>` job type per
+`--rank senior` × those eight capabilities subscribes the worker to exactly the agent
+task types the four workflows emit (one `senior:<capability>` job type per
 capability):
 
 | Capability | Job type | Workflow | Task |
@@ -150,7 +150,10 @@ capability):
 | `plan` | `senior:plan` | `plan-fanout` | Plan an issue into levelized tasks |
 | `plan-review` | `senior:plan-review` | `plan-fanout` | Review the plan before fan-out |
 | `feature` | `senior:feature` | `plan-fanout` | Implement one planned task → open a PR |
+| `trial-merge` | `senior:trial-merge` | `plan-fanout` | Integration gate: trial-merge a wave, catch semantic conflicts CI can't see |
 | `fix-ci` | `senior:fix-ci` | `merge-loop` | Green a `blocked` PR's failing checks |
+| `rebase` | `senior:rebase` | `merge-loop` | Rebase a conflicting PR up to date with its base |
+| `retro` | `senior:retro` | `retro` | Synthesize a finished epic's learnings and promote the recurring ones |
 
 - `--command 'copilot -p - --allow-all-tools'` starts the Copilot CLI reading its
   prompt from **stdin** (`-p -`). The harness pipes the whole job JSON (prompt +
@@ -169,9 +172,12 @@ whichever PRs/tasks are ready — that is the idle time you reclaim. Run more th
 job per worker with `--max-parallel 2`. The app-hosted `pr.*` workers (record-plan,
 select-wave, finalize, merge, …) run **inside** the app, not on an agent worker.
 
-Already have a narrower worker? Extend it in place instead of re-hiring — `c8ctl nano
-assign <name> plan plan-review feature fix-ci` unions the roles onto the profile,
-then restart its worker.
+Already have a narrower worker? Extend it in place instead of re-hiring — this unions
+the roles onto the profile, then restart its worker:
+
+```sh
+c8ctl nano assign <name> pr-review plan plan-review feature trial-merge fix-ci rebase retro
+```
 
 ---
 

package/SPEC.md

@@ -261,13 +261,21 @@ child grids, a lazily-loaded transcript, and a conditional **answer** form shown
 when the PR has an open escalation (`open_escalation_id`, denormalised onto the
 row by migration `003`).
 
-`main.ts` delegates to the runtime and intercepts only the three actions that
-carry app-specific business logic:
+The app-specific business-logic endpoints are **OpenAPI operations** mounted
+under `api.base` (`/app/api`), each implemented by a delegate module in
+`operations/`, plus a `/hooks/*` webhook. The runtime serves them all; `main.ts`
+only starts the runtime and the review-ready poller. The full, authoritative
+contract is `openapi.json` (Swagger UI at `/app/api-docs`); the OpenAPI rows
+below are the complete set of operations, `/hooks/submit` is one of the `/hooks/*`
+webhooks:
 
 | method | route | purpose |
 |---|---|---|
-| `POST` | `/app/actions/start/convergence-loop` | parse the PR ref → create the aggregate + start the process |
-| `POST` | `/app/actions/message` (`escalation-answered`) | answer an open escalation → publish `escalation-answered` |
+| `GET` | `/app/api/status` | list tracked PRs + count |
+| `GET` | `/app/api/version` | app + engine version |
+| `POST` | `/app/api/actions/start/convergence-loop` | parse the PR ref → create the aggregate + start the process |
+| `POST` | `/app/api/actions/start/plan-fanout` | start a plan fan-out run |
+| `POST` | `/app/api/actions/message` (`escalation-answered`) | answer an open escalation → publish `escalation-answered` |
 | `POST` | `/hooks/submit` | webhook submit (shared-secret auth) → start the process |
 
 Everything else (`GET /`, `GET /app/pages/*`, `GET /app/data/*`, the renderer) is

package/app/version.ts

@@ -9,7 +9,7 @@
 // debugging a stuck instance can confirm the process is on the code they think it is.
 //
 // Every probe is best-effort: a missing file or unavailable `.git` yields `null` for that field
-// rather than throwing, so `/app/version` never fails just because one source is absent.
+// rather than throwing, so `/app/api/version` never fails just because one source is absent.
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join, resolve, isAbsolute } from "node:path";

package/deno.json

@@ -6,7 +6,7 @@
     ]
   },
   "imports": {
-    "@nanobpm/urban": "npm:@nanobpm/urban@^0.31.1"
+    "@nanobpm/urban": "npm:@nanobpm/urban@^0.33.0"
   },
   "tasks": {
     "start": "deno run --allow-net --allow-read --allow-write --allow-run=gh --allow-env main.ts",

package/deno.lock

@@ -1756,11 +1756,11 @@
   },
   "workspace": {
     "dependencies": [
-      "npm:@nanobpm/urban@~0.31.1"
+      "npm:@nanobpm/urban@0.33"
     ],
     "packageJson": {
       "dependencies": [
-        "npm:@nanobpm/urban@~0.31.1",
+        "npm:@nanobpm/urban@0.33",
         "npm:@semantic-release/changelog@^6.0.3",
         "npm:@semantic-release/git@^10.0.1",
         "npm:@semantic-release/npm@^13.1.5",

package/nano.app.json

@@ -141,7 +141,6 @@
   },
   "api": {
     "spec": "openapi.json",
-    "base": "/app",
     "dir": "operations",
     "validateResponses": "dev"
   },

package/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "Nano Workforce control API",
     "version": "1.0.0",
-    "description": "The externally-facing control surface an operator, an automation harness, or an LLM uses to observe and steer PR-convergence and planning runs. Contract-first (ADR 0058): the toolkit derives typed request/response contracts + runtime validators from this document and each `operationId` is implemented by a delegate module in `operations/`. Mounted under base `/app` so the existing endpoint paths are preserved. The `/hooks/*` webhook endpoints stay on `actions[]` because they live outside the `/app` namespace."
+    "description": "The externally-facing control surface an operator, an automation harness, or an LLM uses to observe and steer PR-convergence and planning runs. Contract-first (ADR 0058): the toolkit derives typed request/response contracts + runtime validators from this document and each `operationId` is implemented by a delegate module in `operations/`. Mounted under base `/app/api`, kept off the framework-reserved `/app` page-runtime namespace (which owns `/app/runtime.js`, `/app/pages/*`, `/app/data/*`). The `/hooks/*` webhook endpoints stay on `actions[]` because they live outside the `/app` namespace."
   },
   "components": {
     "securitySchemes": {

package/operations/getVersion.test.ts

@@ -1,4 +1,4 @@
-// Tests for GET /app/version → operation `getVersion` (ADR 0058 OpenAPI surface).
+// Tests for GET /app/api/version → operation `getVersion` (ADR 0058 OpenAPI surface).
 // Ported from the previous actions/version.test.ts. Method handling now belongs to the router
 // (only GET is routed here), so there is no 405 case to test at the delegate level.
 import { assert, assertEquals } from "jsr:@std/assert@1";
@@ -12,7 +12,7 @@ function input(headers: Record<string, string> = {}) {
   return {
     req: {
       method: "GET",
-      path: "/app/version",
+      path: "/app/api/version",
       query: new URLSearchParams(),
       headers: new Headers(headers),
       text: async () => "",

package/operations/getVersion.ts

@@ -1,4 +1,4 @@
-// GET /app/version → operationId `getVersion` (ADR 0058 OpenAPI surface, mounted under base /app).
+// GET /app/api/version → operationId `getVersion` (ADR 0058 OpenAPI surface, mounted under base /app/api).
 // The running app's identity (app + resolved @nanobpm/urban versions, git commit/branch, JS runtime,
 // pid, uptime). Because the app runs its `.ts` sources directly from a checkout with no build step,
 // restarts alone don't tell you whether a fix is live; this endpoint does.

package/operations/listActivePrs.test.ts

@@ -1,4 +1,4 @@
-// Tests for GET /app/status → operation `listActivePrs` (ADR 0058 OpenAPI surface).
+// Tests for GET /app/api/status → operation `listActivePrs` (ADR 0058 OpenAPI surface).
 // Covers the happy path (count/prs projection) and the optional shared-secret guard. A minimal
 // in-memory DataLayer backs `activePrs` (it reads the `pull_requests` table via `.all()`).
 import { assert, assertEquals } from "jsr:@std/assert@1";
@@ -21,7 +21,7 @@ function input(headers: Record<string, string> = {}) {
   return {
     req: {
       method: "GET",
-      path: "/app/status",
+      path: "/app/api/status",
       query: new URLSearchParams(),
       headers: new Headers(headers),
       text: async () => "",

package/operations/listActivePrs.ts

@@ -1,4 +1,4 @@
-// GET /app/status → operationId `listActivePrs` (ADR 0058 OpenAPI surface, mounted under base /app).
+// GET /app/api/status → operationId `listActivePrs` (ADR 0058 OpenAPI surface, mounted under base /app/api).
 // List the PRs currently in flight (every tracked PR not converged/abandoned) so an operator or an
 // external automation harness can see active work — and grab a `processKey` to cancel — without
 // opening the DB or the UI. Read-only projection over the datasource.

package/operations/postMessage.ts

@@ -1,4 +1,4 @@
-// POST /app/actions/message → operationId `postMessage` (ADR 0058, base /app).
+// POST /app/api/actions/message → operationId `postMessage` (ADR 0058, base /app/api).
 // Replaces the hand-rolled action that overrode the generic publishMessage action. For the
 // `escalation-answered` message we run the review answer flow, and for `feature-escalation-answered`
 // (issue #25) the implementation-phase (per-task) answer flow: record the answer, resume the parked

package/operations/startConvergenceLoop.ts

@@ -1,4 +1,4 @@
-// POST /app/actions/start/convergence-loop → operationId `startConvergenceLoop` (ADR 0058, base /app).
+// POST /app/api/actions/start/convergence-loop → operationId `startConvergenceLoop` (ADR 0058, base /app/api).
 // Replaces the hand-rolled action that overrode the generic "start process" palette action: parse the
 // PR reference and register/refresh the PR aggregate (idempotent on prKey) before starting the loop.
 //

package/operations/startPlanFanout.ts

@@ -1,4 +1,4 @@
-// POST /app/actions/start/plan-fanout → operationId `startPlanFanout` (ADR 0058, base /app).
+// POST /app/api/actions/start/plan-fanout → operationId `startPlanFanout` (ADR 0058, base /app/api).
 // Replaces the hand-rolled action that overrode the generic "start process" palette action: parse the
 // issue reference and register/refresh the plan aggregate (idempotent on planKey) before starting the
 // planning fan-out. An unparseable reference is a 400; an already-running plan short-circuits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -40,7 +40,7 @@
     "test": "deno test -A"
   },
   "dependencies": {
-    "@nanobpm/urban": "^0.31.1"
+    "@nanobpm/urban": "^0.33.0"
   },
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",

package/pages/epic.page.json

@@ -33,7 +33,7 @@
       "props": {
         "title": "Hand an issue to the fleet",
         "submitLabel": "Plan & implement",
-        "action": { "kind": "startProcess", "process": "plan-fanout" },
+        "action": { "path": "/app/api/actions/start/plan-fanout" },
         "fields": [
           { "key": "issue", "label": "owner/repo#123 or a GitHub issue URL", "type": "text" }
         ]

package/pages/home.page.json

@@ -33,7 +33,7 @@
       "props": {
         "title": "Submit a pull request",
         "submitLabel": "Start review",
-        "action": { "kind": "startProcess", "process": "convergence-loop" },
+        "action": { "path": "/app/api/actions/start/convergence-loop" },
         "fields": [
           { "key": "pr", "label": "owner/repo#123 or a GitHub PR URL", "type": "text" },
           { "key": "maxRounds", "label": "Max review rounds (blank = fleet default)", "type": "number" }
@@ -82,7 +82,7 @@
             "label": "Cancel",
             "confirm": "Cancel this PR's review run?",
             "showWhenField": "process_key",
-            "action": { "kind": "cancelProcess", "keyField": "process_key" }
+            "action": { "path": "/app/actions/cancel", "body": { "processInstanceKey": "{{row.process_key}}" } }
           }
         ],
         "detail": {
@@ -149,9 +149,8 @@
             "inputLabel": "Your answer",
             "submitLabel": "Send answer",
             "action": {
-              "kind": "publishMessage",
-              "message": "escalation-answered",
-              "correlationKeyField": "pr_key"
+              "path": "/app/api/actions/message",
+              "body": { "name": "escalation-answered", "correlationKey": "{{row.pr_key}}", "variables": "{{form}}" }
             }
           }
         }
@@ -192,7 +191,7 @@
             "label": "Cancel",
             "confirm": "Cancel this plan's fan-out run?",
             "showWhenField": "process_key",
-            "action": { "kind": "cancelProcess", "keyField": "process_key" }
+            "action": { "path": "/app/actions/cancel", "body": { "processInstanceKey": "{{row.process_key}}" } }
           }
         ],
         "detail": {
@@ -301,9 +300,8 @@
             "inputLabel": "Your answer",
             "submitLabel": "Send answer",
             "action": {
-              "kind": "publishMessage",
-              "message": "feature-escalation-answered",
-              "correlationKeyField": "open_task_corr_key"
+              "path": "/app/api/actions/message",
+              "body": { "name": "feature-escalation-answered", "correlationKey": "{{row.open_task_corr_key}}", "variables": "{{form}}" }
             }
           }
         }