@nanobpm/nano-workforce 0.56.0 → 0.58.0

package/workers/persist-escalation/worker.ts

@@ -2,8 +2,20 @@
 // row for a human to answer. Handles both the agent-raised path (status = needs_input | blocked)
 // and the MAX_ROUNDS guard (status = blocked, question set by the process). Returns
 // `escalationId` for the UI.
+//
+// A BLANK question is a NON-escalation (nano-workforce ADR 0002 §1): it must never open an
+// answerable escalation. The convergence-loop `gw-status` gateway enforces this upstream — its
+// `f_escalate` arm now requires a non-blank question, so a blank-question round re-enters the
+// durable review wait instead of routing here (see app/roundResultDefault.ts). This worker keeps
+// the same rule as defence-in-depth via the canonical taxonomy: if a blank-question job ever
+// reaches it, it opens NO escalation and reports `escalated:false` rather than FABRICATING a
+// question (the retired failure mode) or throwing an un-remediable incident. The convergence-loop
+// model branches on that `escalated` output (`gw-escalated`): a `false` return re-enters the loop
+// via `gw-guard` instead of flowing into the `wait-answer` catch, so a non-escalation can never
+// wedge a token on a durable wait that has no escalation for a human to answer.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { abandonTokenFromUrl } from "../../app/abandon.ts";
+import { classifyEscalation } from "../../app/escalationTaxonomy.ts";
 import { ensurePr, parsePr } from "../../app/service.ts";
 
 // Extends Record so the declared fields are typed while the job may still carry
@@ -51,42 +63,28 @@ function workerOf(vars: Record<string, unknown>): string | undefined {
   return nonBlank(vars.agent);
 }
 
-// Synthesize a concrete, answerable question when the agent left one blank. A blank question is
-// almost always a *no-result* round: a prompt-less agent that never wrote its result file, so
-// `status` is empty and `gw-status` falls through its default `f_escalate` arm (the empty
-// "(no question provided)" escalations on Magikcraft/nano-bpm #597/#599). Throwing here parked a
-// `JobNoRetries` incident that could NOT be diagnosed or remediated from the UI. Instead we open
-// an escalation a human can actually answer, with the agent's transcript attached below it.
-function fabricateQuestion(rawStatus: string | undefined, hasTranscript: boolean): string {
-  const tail = hasTranscript
-    ? " Review the agent's response shown below, then reply with how it should proceed — or cancel and resubmit."
-    : " No agent response was captured. Reply with how it should proceed, or cancel and resubmit.";
-  if (!rawStatus) {
-    return "The review agent finished without a machine-readable result (no status was reported), " +
-      "so this round could not be classified as converged, addressed, or a specific request." + tail;
-  }
-  return `The review agent reported status "${rawStatus}" without a question, so this round ` +
-    "could not be resolved automatically." + tail;
-}
-
 const handler: AppJobHandler<In> = async (job, app) => {
   const { prKey, round, summary, repo, prNumber, prUrl, abandonUrl } = job.variables;
   // `status` drives the escalation kind (control flow); a blank/absent status is an
-  // unclassified escalation -> a question needing input. `question` is denormalised
-  // onto pull_requests below and bound by the UI answer form, so it must be a
-  // concrete, non-blank value. `summary` is left undefined so the write boundary
-  // omits it and the nullable column stays NULL.
+  // unclassified escalation -> a question needing input. `question` is returned as a
+  // process variable below so the downstream `wait-answer` userTask + `pr-escalation.form`
+  // can display it, so it must be a concrete, non-blank value. `summary` is left undefined
+  // so the write boundary omits it and the nullable column stays NULL.
   const rawStatus = nonBlank(job.variables.status);
   const status = rawStatus ?? "needs_input";
   const transcript = transcriptOf(job.variables);
   const worker = workerOf(job.variables);
-  // A blank question must never open an unanswerable escalation. Every legitimate arm sets a
-  // concrete question — the agent contract requires one for needs_input/blocked, and the
-  // max-rounds + review-timeout arms set a literal via the model. When one is still missing
-  // (a no-result round through the `gw-status` default), fabricate an actionable question that
-  // references the attached transcript rather than throwing (which parked an un-remediable
-  // incident). This keeps the loop recoverable entirely from the UI.
-  const question = nonBlank(job.variables.question) ?? fabricateQuestion(rawStatus, transcript != null);
+  // Classify this job through the single canonical taxonomy (ADR 0002 §1). Only a
+  // decision-required escalation opens an answerable escalation row. A blank question (or any
+  // non-human-blocking status that reached here defensively) is a NON-escalation: open nothing
+  // and report `escalated:false` — never FABRICATE a question and never throw. The `gw-status`
+  // gateway already routes blank-question rounds back into the durable review wait, so this is
+  // defence-in-depth, not the primary guard.
+  const question = nonBlank(job.variables.question);
+  const disposition = classifyEscalation({ kind: "review-round", status: rawStatus, question });
+  if (disposition !== "decision-required" || question === undefined) {
+    return { escalationId: null, escalated: false };
+  }
   const kind = status === "needs_input" ? "question" : "blocker";
   const now = new Date().toISOString();
 
@@ -137,11 +135,9 @@ const handler: AppJobHandler<In> = async (job, app) => {
     status: "escalated",
     current_round: round,
     updated_at: now,
-    open_escalation_id: Number(escalationId),
-    open_escalation_question: question,
   });
 
-  return { escalationId: Number(escalationId) };
+  return { escalationId: Number(escalationId), escalated: true, question };
 };
 
 export default handler;

package/workers/record-feature/worker.ts

@@ -0,0 +1,61 @@
+// pr.record-feature — the single-issue `implement` block has finished (issue #172).
+//
+// The `senior:feature` agent reported one of `opened` / `blocked` / `skipped` (prompts/feature.md);
+// anything else — including a missing status, or an `escalated` status that fell through to abandon
+// (the human abandoned or the SLA fired) — is treated as `blocked`: we must not assume a PR was
+// opened. This worker:
+//   • resolves the run's terminal status from the agent result,
+//   • records the PR key + outcome on the `feature_runs` row,
+//   • emits `featureStatus` + `prKey` so the `converge?` gateway can decide whether to hand the
+//     opened PR off to the convergence loop.
+//
+// Enrollment itself lives in the separate `pr.converge-feature` worker (gated by the `converge?`
+// branch) so the hand-off is legible in the process, not buried in a persistence step.
+import type { AppJobHandler } from "@nanobpm/urban";
+import { type FeatureRunStatus, featureRuns } from "../../app/feature.ts";
+import { parsePr } from "../../app/service.ts";
+
+interface In extends Record<string, unknown> {
+  featureKey: string;
+  status?: unknown;
+  pr?: unknown;
+  summary?: unknown;
+}
+interface Out extends Record<string, unknown> {
+  featureStatus: FeatureRunStatus;
+  prKey: string | null;
+}
+
+const str = (v: unknown): string | undefined =>
+  typeof v === "string" && v.trim().length > 0 ? v.trim() : undefined;
+
+// The implementation agent reports one of these; anything else is `blocked` (we never assume a PR).
+type AgentStatus = "opened" | "blocked" | "skipped";
+const isAgentStatus = (s: string): s is AgentStatus => s === "opened" || s === "blocked" || s === "skipped";
+
+const handler: AppJobHandler<In, Out> = async (job, app) => {
+  const featureKey = job.variables.featureKey;
+  const rawStatus = str(job.variables.status);
+  const status: AgentStatus = rawStatus && isAgentStatus(rawStatus) ? rawStatus : "blocked";
+  const summary = str(job.variables.summary);
+  const prRef = str(job.variables.pr);
+  // Only trust a PR ref when the agent reports it actually opened one.
+  const parsed = status === "opened" && prRef ? parsePr(prRef) : null;
+  // A keyless "opened" cannot be handed off, but a PR was still raised — keep the status `opened`
+  // (the run is complete), just with no `pr_key` to converge.
+  const prKey = parsed?.prKey ?? null;
+  const featureStatus: FeatureRunStatus = status;
+  const ts = new Date().toISOString();
+
+  await featureRuns(app.data).update(featureKey, {
+    status: featureStatus,
+    pr_key: prKey,
+    outcome: summary ?? null,
+    updated_at: ts,
+  });
+  app.log.info("record-feature", { featureKey, featureStatus, prKey });
+
+  return { featureStatus, prKey };
+};
+
+export default handler;

package/workers/record-plan-review/worker.test.ts

@@ -9,9 +9,8 @@ import { noopLog } from "../../test/log.ts";
 import { MAX_PLAN_REVIEW_ROUNDS, type PlanReview } from "../../app/plan.ts";
 import handler from "./worker.ts";
 
-function fakeApp(existing: PlanReview[] = [], reviewEscalations: any[] = []) {
+function fakeApp(existing: PlanReview[] = []) {
   const reviewRows: PlanReview[] = [...existing];
-  const escalationRows = [...reviewEscalations];
   const match = (r: Record<string, unknown>, q: Record<string, unknown>) =>
     Object.entries(q).every(([f, v]) => r[f] === v);
   const table = (rows: any[]) => ({
@@ -25,14 +24,12 @@ function fakeApp(existing: PlanReview[] = [], reviewEscalations: any[] = []) {
   });
   return {
     data: {
-      table(name: string) {
-        if (name === "plan_review_escalations") return table(escalationRows);
+      table() {
         return table(reviewRows);
       },
     },
     log: noopLog(),
     _rows: reviewRows,
-    _escalations: escalationRows,
   } as any;
 }
 
@@ -85,12 +82,14 @@ test("approved on the FINAL round still proceeds (no escalation)", async () => {
   assertEquals((out as any).planEscalated, false);
 });
 
-test("answered plan-review escalation starts a fresh epoch and round budget", async () => {
-  const app = fakeApp(
-    priorRounds("o/r#5", MAX_PLAN_REVIEW_ROUNDS, 0),
-    [{ id: 1, plan_key: "o/r#5", status: "answered" }],
+test("a bumped plan-review epoch starts a fresh round budget", async () => {
+  // The `plan-review-decision` user task bumped `planReviewEpoch` to 1 after a prior epoch's
+  // rounds; the next planner pass records round 0 of the new epoch, resetting the budget.
+  const app = fakeApp(priorRounds("o/r#5", MAX_PLAN_REVIEW_ROUNDS, 0));
+  const out = await call(
+    app,
+    { planKey: "o/r#5", approved: false, findings: "new epoch finding", planReviewEpoch: 1 },
   );
-  const out = await call(app, { planKey: "o/r#5", approved: false, findings: "new epoch finding" });
   assertEquals((out as any).planApproved, false);
   assertEquals((out as any).planEscalated, false);
   assertEquals((out as any).planReviewEpoch, 1);

package/workers/record-plan-review/worker.ts

@@ -3,9 +3,10 @@
 //
 // The `senior:plan-review` agent critiqued the levelized plan and emitted `{ approved, findings }`.
 // This worker:
-//   • derives the current epoch from answered plan-review escalations and the current round from
-//     the append-only `plan_reviews` log for that epoch (no counter variable), using the engine
-//     jobKey as an idempotency guard so a retried job reuses its row,
+//   • reads the current epoch from the durable `planReviewEpoch` process variable (bumped by the
+//     `plan-review-decision` user task each time a human answers a plan-review escalation) and
+//     derives the current round from the append-only `plan_reviews` log for that epoch (no counter
+//     variable), using the engine jobKey as an idempotency guard so a retried job reuses its row,
 //   • records this round's verdict + findings,
 //   • decides the loop: emits `planApproved` (reviewer said yes → the BPMN gateway proceeds to
 //     `select-wave`) or, when unapproved, re-emits the findings as `planFindings` so a revise
@@ -19,7 +20,6 @@
 
 import type { AppJobHandler } from "@nanobpm/urban";
 import {
-  currentPlanReviewEpoch,
   MAX_PLAN_REVIEW_ROUNDS,
   type PlanReview,
   planReviews,
@@ -29,6 +29,7 @@ interface In extends Record<string, unknown> {
   planKey: string;
   approved?: unknown;
   findings?: unknown;
+  planReviewEpoch?: unknown;
 }
 interface Out extends Record<string, unknown> {
   planApproved: boolean;
@@ -43,6 +44,15 @@ interface Out extends Record<string, unknown> {
 const isApproved = (v: unknown): boolean =>
   v === true || (typeof v === "string" && v.trim().toLowerCase() === "true");
 
+// The plan-review epoch is a durable process variable. `startPlan` seeds it to 0 when creating the
+// instance, and the `plan-review-decision` user task bumps it on each human answer. The 0-fallback
+// here is backwards compatibility for older instances created before the variable was seeded (where
+// it is null/absent): coerce anything unexpected to 0 so a round is always recorded under a valid epoch.
+const coerceEpoch = (v: unknown): number => {
+  const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : Number.NaN;
+  return Number.isInteger(n) && n >= 0 ? n : 0;
+};
+
 export const str = (v: unknown): string => {
   if (typeof v === "string") return v;
   if (v == null) return "";
@@ -63,7 +73,7 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
   const jobKey = job.jobKey;
 
   const reviews = planReviews(app.data);
-  const epoch = await currentPlanReviewEpoch(app.data, planKey);
+  const epoch = coerceEpoch(job.variables.planReviewEpoch);
 
   // Idempotency guard: deriving the epoch/round from count(plan_reviews) is not retry-safe on its
   // own. A job retried after the insert (crash/timeout post-write) re-runs with the SAME jobKey —

package/workers/resolve-trial-attention/worker.test.ts

@@ -0,0 +1,77 @@
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { noopLog } from "../../test/log.ts";
+import { recordTrialMergeAudit, resolveTrialMergeAttention } from "../../app/trialMerge.ts";
+import handler from "./worker.ts";
+
+// In-memory DataLayer.table shim backing `plan_trial_merges` for the audit helpers.
+function fakeApp() {
+  const rows: any[] = [];
+  let nextId = 1;
+  const table = {
+    async find(q: Record<string, unknown>) {
+      return rows.filter((r) => Object.entries(q).every(([k, v]) => r[k] === v));
+    },
+    async insert(row: Record<string, unknown>) {
+      const id = nextId++;
+      rows.push({ id, ...row });
+      return id;
+    },
+    async update(id: number, patch: Record<string, unknown>) {
+      const r = rows.find((x) => x.id === id);
+      if (r) Object.assign(r, patch);
+    },
+  };
+  const app = {
+    data: { table: (_name: string, _key: string) => table },
+    log: noopLog(),
+  };
+  return { app, rows };
+}
+
+// Red/green regression: a `proceed` override on a trial-merge escalation records NO re-run row, so
+// without this serviceTask the wave's red `plan_trial_merges` audit row stays unresolved forever in
+// the epic page's "Needs attention" tab (the caller was dropped in the userTask refactor). The
+// worker must clear it. (Confirmed red against a no-op handler.)
+test("resolve-trial-attention clears the wave's unresolved audit rows", async () => {
+  const { app, rows } = fakeApp();
+  await recordTrialMergeAudit(app.data as any, {
+    planKey: "o/r#69",
+    wave: 2,
+    result: "suite-failed",
+    summary: "combined suite red",
+  });
+  // A different wave must be left untouched.
+  await recordTrialMergeAudit(app.data as any, { planKey: "o/r#69", wave: 3, result: "suite-failed" });
+
+  assertEquals(rows.filter((r) => r.wave === 2 && r.resolved !== 1).length, 1);
+
+  await handler(
+    { key: 1, variables: { planKey: "o/r#69", currentWave: 2 } } as any,
+    app as any,
+  );
+
+  assertEquals(rows.filter((r) => r.wave === 2 && r.resolved !== 1).length, 0);
+  // Wave 3 is a distinct escalation and must remain unresolved.
+  assertEquals(rows.filter((r) => r.wave === 3 && r.resolved !== 1).length, 1);
+  // Idempotent: a follow-up (e.g. rebase re-entry) clears nothing new.
+  assertEquals(await resolveTrialMergeAttention(app.data as any, "o/r#69", 2), 0);
+});
+
+test("resolve-trial-attention never throws when cleanup fails", async () => {
+  const app = {
+    data: {
+      table: () => ({
+        find: async () => {
+          throw new Error("db down");
+        },
+        insert: async () => 1,
+        update: async () => {},
+      }),
+    },
+    log: noopLog(),
+  };
+  // Best-effort/cosmetic: a transient failure must not wedge the plan.
+  const out = await handler({ key: 2, variables: { planKey: "o/r#1", currentWave: 0 } } as any, app as any);
+  assertEquals(out, {});
+});

package/workers/resolve-trial-attention/worker.ts

@@ -0,0 +1,43 @@
+// pr.resolve-trial-attention — clear the wave's trial-merge "Needs attention" audit rows once a
+// human has made a decision on the trial-merge escalation (issue #69 / #131 follow-up).
+//
+// Before the escalations were converted to native userTasks, the app-side answer path called
+// `resolveTrialMergeAttention` so that a `proceed` override (which records no re-run row and so
+// would otherwise pin the red `plan_trial_merges` row in the epic page's "Needs attention" tab
+// forever) cleared the wave. The userTask refactor retired that app-side path, leaving this
+// cleanup uncalled. This serviceTask restores it in the process: it runs on EVERY answer variant
+// (proceed / rebase / abandon) between the `trial-merge-decision` userTask and the answer gateway,
+// so the human's decision always clears the wave. It is idempotent w.r.t. a `rebase` re-run, which
+// records a fresh unresolved row that supersedes any prior (so re-resolving here changes nothing).
+//
+// Cleanup is best-effort/cosmetic: a transient failure must never wedge the plan, so it is caught
+// and logged rather than thrown.
+import type { AppJobHandler } from "@nanobpm/urban";
+import { resolveTrialMergeAttention } from "../../app/trialMerge.ts";
+
+interface In extends Record<string, unknown> {
+  planKey: string;
+  currentWave?: unknown;
+  trialMergeWave?: unknown;
+}
+
+const waveNo = (v: unknown): number => {
+  const n = Math.trunc(Number(v));
+  return Number.isFinite(n) && n >= 0 ? n : 0;
+};
+
+const handler: AppJobHandler<In> = async (job, app) => {
+  const planKey = job.variables.planKey;
+  const wave = waveNo(job.variables.trialMergeWave ?? job.variables.currentWave);
+  try {
+    const cleared = await resolveTrialMergeAttention(app.data, planKey, wave);
+    if (cleared > 0) {
+      app.log.info(`resolve-trial-attention: cleared ${cleared} row(s) for ${planKey} wave ${wave}`);
+    }
+  } catch (err) {
+    app.log.error(`resolve-trial-attention: cleanup failed for ${planKey} wave ${wave}`, { err: String(err) });
+  }
+  return {};
+};
+
+export default handler;

package/operations/answerFeatureEscalation.test.ts

@@ -1,112 +0,0 @@
-import { test } from "node:test";
-import { assertEquals } from "#test-assert";
-import type { AppApi } from "@nanobpm/urban";
-import { noopLog } from "../test/log.ts";
-
-const hadSecret = Object.prototype.hasOwnProperty.call(process.env, "NANO_PR_WEBHOOK_SECRET");
-const previousSecret = process.env.NANO_PR_WEBHOOK_SECRET;
-let answerFeatureEscalation: typeof import("./answerFeatureEscalation.ts").default;
-try {
-  process.env.NANO_PR_WEBHOOK_SECRET = " test-secret ";
-  answerFeatureEscalation = (await import("./answerFeatureEscalation.ts")).default;
-} finally {
-  if (hadSecret && previousSecret !== undefined) process.env.NANO_PR_WEBHOOK_SECRET = previousSecret;
-  else delete process.env.NANO_PR_WEBHOOK_SECRET;
-}
-
-function memTable(rows: any[], key: string) {
-  return {
-    find: (where: Record<string, unknown>) =>
-      Promise.resolve(rows.filter((row) => Object.entries(where).every(([field, value]) => row[field] === value))),
-    update: (value: unknown, patch: Record<string, unknown>) => {
-      const row = rows.find((candidate) => candidate[key] === value);
-      if (row) Object.assign(row, patch);
-      return Promise.resolve(row);
-    },
-  };
-}
-
-function memApp(escalations: any[] = []) {
-  const stores: Record<string, { rows: any[]; key: string }> = {
-    plans: { rows: [{ plan_key: "owner/repo#9" }], key: "plan_key" },
-    plan_escalations: { rows: escalations, key: "id" },
-    plan_tasks: { rows: [{ id: 1, plan_key: "owner/repo#9", task_id: "task-1" }], key: "id" },
-  };
-  const published: Record<string, unknown>[] = [];
-  const app = {
-    data: {
-      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
-    },
-    engine: {
-      publishMessage: (message: Record<string, unknown>) => {
-        published.push(message);
-        return Promise.resolve();
-      },
-    },
-    log: noopLog(),
-  } as any as AppApi;
-  return { app, published };
-}
-
-function input(body: Record<string, unknown>, secret?: string) {
-  const headers = new Headers();
-  if (secret !== undefined) headers.set("x-hook-secret", secret);
-  return {
-    req: {
-      method: "POST",
-      path: "/app/api/hooks/feature-answer",
-      query: new URLSearchParams(),
-      headers,
-      text: async () => "",
-    } as any,
-    params: {},
-    query: {},
-    body,
-  };
-}
-
-test("rejects a request without the configured hook secret", async () => {
-  const { app } = memApp();
-  const result = await answerFeatureEscalation(input({ corrKey: "owner/repo#9:task-1", answer: "yes" }), app) as any;
-  assertEquals(result.status, 401);
-  assertEquals(result.body, { ok: false, error: "unauthorized" });
-});
-
-test("derives corrKey from plan + task and maps an answered escalation to 200", async () => {
-  const { app, published } = memApp([{
-    id: 1,
-    plan_key: "owner/repo#9",
-    task_id: "task-1",
-    corr_key: "owner/repo#9:task-1",
-    question: "Proceed?",
-    status: "open",
-  }]);
-  const result = await answerFeatureEscalation(
-    input({ plan: "owner/repo#9", task: "task-1", answer: " yes " }, "test-secret"),
-    app,
-  ) as any;
-  assertEquals(result.status, 200);
-  assertEquals(result.body.ok, true);
-  assertEquals(published[0]?.correlationKey, "owner/repo#9:task-1");
-  assertEquals((published[0]?.variables as Record<string, unknown>).answer, "yes");
-});
-
-test("maps an unmatched corrKey to 404", async () => {
-  const { app } = memApp();
-  const result = await answerFeatureEscalation(
-    input({ corrKey: "owner/repo#9:missing", answer: "yes" }, "test-secret"),
-    app,
-  ) as any;
-  assertEquals(result.status, 404);
-  assertEquals(result.body.ok, false);
-});
-
-test("rejects a missing request body with 400 (not 500)", async () => {
-  const { app } = memApp();
-  const result = await answerFeatureEscalation(
-    { ...input({}, "test-secret"), body: undefined },
-    app,
-  ) as any;
-  assertEquals(result.status, 400);
-  assertEquals(result.body.ok, false);
-});

package/operations/answerFeatureEscalation.ts

@@ -1,58 +0,0 @@
-// POST /app/api/hooks/feature-answer → operationId `answerFeatureEscalation` (ADR 0059 webhook
-// operation; was the `/hooks/feature-answer` action). Answers an implementation-phase task
-// escalation out of band (optional shared-secret guard via X-Hook-Secret, enforced only when
-// NANO_PR_WEBHOOK_SECRET is set — mirrors the operator control surface), issue #25. Lets an
-// external system (a chat relay, a CI job, a human via curl) resume a parked implementation agent
-// without the page. Same idempotent `answerTaskEscalation` path the page's answer form uses.
-//
-// The runtime validates the body shape against openapi.yaml — a `oneOf` of EXACTLY ONE addressing
-// form (`{ corrKey, answer }` OR `{ plan, task, answer }`), so a body that supplies neither form (or
-// mixes them) is rejected at the edge with a 400 that names the allowed shapes. This delegate narrows
-// the validated variant and keeps the semantic normalization the schema can't express (an answer /
-// correlation key that is present but blank-after-trim) plus the shared-secret guard.
-//   { "corrKey": "owner/repo#12:task-3", "answer": "…" }
-//   { "plan": "owner/repo#12", "task": "task-3", "answer": "…" }
-
-import { answerTaskEscalation, featureCorrKey } from "../app/plan.ts";
-import { envVar } from "../app/version.ts";
-import { defineOperation } from "../nano-generated/operations.ts";
-
-const WEBHOOK_SECRET = envVar("NANO_PR_WEBHOOK_SECRET") ?? "";
-
-const str = (v: unknown): string => (typeof v === "string" ? v.trim() : "");
-
-export default defineOperation("answerFeatureEscalation", async ({ req, body }, app) => {
-  if (WEBHOOK_SECRET && req.headers.get("x-hook-secret") !== WEBHOOK_SECRET) {
-    app.log.warn("feature-answer rejected: missing/invalid shared secret");
-    return { status: 401, body: { ok: false, error: "unauthorized" } };
-  }
-  // The runtime validates a well-formed body against openapi.yaml, but a directly-invoked delegate
-  // (or a missing body) leaves `body` undefined — guard so that becomes a 400, not a 500.
-  if (!body || typeof body !== "object") {
-    app.log.warn("feature-answer rejected: missing request body");
-    return { status: 400, body: { ok: false, error: "answer is required" } };
-  }
-  const answer = str(body.answer);
-  if (!answer) {
-    app.log.warn("feature-answer rejected: blank answer");
-    return { status: 400, body: { ok: false, error: "answer is required" } };
-  }
-
-  const corrKey = "corrKey" in body
-    ? str(body.corrKey)
-    : str(body.plan) && str(body.task)
-      ? featureCorrKey(str(body.plan), str(body.task))
-      : "";
-  if (!corrKey) {
-    app.log.warn("feature-answer rejected: unresolvable correlation key");
-    return {
-      status: 400,
-      body: { ok: false, error: "provide corrKey, or both plan (owner/repo#N) and task" },
-    };
-  }
-
-  const r = await answerTaskEscalation(app.data, app.engine, corrKey, answer);
-  if (r.ok) app.log.info("feature escalation answered", { corrKey });
-  else app.log.warn("feature-answer: no open escalation to answer", { corrKey });
-  return { status: r.ok ? 200 : 404, body: r };
-});

package/operations/answerPlanEscalation.test.ts

@@ -1,115 +0,0 @@
-import { test } from "node:test";
-import { assertEquals } from "#test-assert";
-import type { AppApi } from "@nanobpm/urban";
-import { noopLog } from "../test/log.ts";
-
-const hadSecret = Object.prototype.hasOwnProperty.call(process.env, "NANO_PR_WEBHOOK_SECRET");
-const previousSecret = process.env.NANO_PR_WEBHOOK_SECRET;
-let answerPlanEscalation: typeof import("./answerPlanEscalation.ts").default;
-try {
-  process.env.NANO_PR_WEBHOOK_SECRET = " test-secret ";
-  answerPlanEscalation = (await import("./answerPlanEscalation.ts")).default;
-} finally {
-  if (hadSecret && previousSecret !== undefined) process.env.NANO_PR_WEBHOOK_SECRET = previousSecret;
-  else delete process.env.NANO_PR_WEBHOOK_SECRET;
-}
-
-function memTable(rows: any[], key: string) {
-  return {
-    find: (where: Record<string, unknown>) =>
-      Promise.resolve(rows.filter((row) => Object.entries(where).every(([field, value]) => row[field] === value))),
-    update: (value: unknown, patch: Record<string, unknown>) => {
-      const row = rows.find((candidate) => candidate[key] === value);
-      if (row) Object.assign(row, patch);
-      return Promise.resolve(row);
-    },
-  };
-}
-
-function memApp(escalations: any[] = []) {
-  const stores: Record<string, { rows: any[]; key: string }> = {
-    plans: { rows: [{ plan_key: "owner/repo#9", open_plan_escalation_id: 1 }], key: "plan_key" },
-    plan_review_escalations: { rows: escalations, key: "id" },
-  };
-  const published: Record<string, unknown>[] = [];
-  const app = {
-    data: {
-      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
-    },
-    engine: {
-      publishMessage: (message: Record<string, unknown>) => {
-        published.push(message);
-        return Promise.resolve();
-      },
-    },
-    log: noopLog(),
-  } as any as AppApi;
-  return { app, published, stores };
-}
-
-function input(body: Record<string, unknown>, secret?: string) {
-  const headers = new Headers();
-  if (secret !== undefined) headers.set("x-hook-secret", secret);
-  return {
-    req: {
-      method: "POST",
-      path: "/app/api/hooks/plan-answer",
-      query: new URLSearchParams(),
-      headers,
-      text: async () => "",
-    } as any,
-    params: {},
-    query: {},
-    body,
-  };
-}
-
-test("rejects a request without the configured hook secret", async () => {
-  const { app } = memApp();
-  const result = await answerPlanEscalation(input({ plan: "owner/repo#9", directive: "revise" }), app) as any;
-  assertEquals(result.status, 401);
-  assertEquals(result.body, { ok: false, error: "unauthorized" });
-});
-
-test("answers an open plan escalation and publishes the plan correlation message", async () => {
-  const { app, published, stores } = memApp([{
-    id: 1,
-    plan_key: "owner/repo#9",
-    epoch: 0,
-    round: 2,
-    findings: "needs wave 0",
-    status: "open",
-  }]);
-  const result = await answerPlanEscalation(
-    input({ plan: "owner/repo#9", directive: "revise", note: " use issue-1 first " }, "test-secret"),
-    app,
-  ) as any;
-  assertEquals(result.status, 200);
-  assertEquals(result.body.ok, true);
-  assertEquals(stores.plan_review_escalations.rows[0].status, "answered");
-  assertEquals(stores.plan_review_escalations.rows[0].directive, "revise");
-  assertEquals(stores.plan_review_escalations.rows[0].note, "use issue-1 first");
-  assertEquals(published[0]?.name, "plan-escalation-answered");
-  assertEquals(published[0]?.correlationKey, "owner/repo#9");
-  assertEquals((published[0]?.variables as Record<string, unknown>).planEscalationDirective, "revise");
-});
-
-test("maps an unmatched plan to 404", async () => {
-  const { app } = memApp();
-  const result = await answerPlanEscalation(
-    input({ plan: "owner/repo#missing", directive: "revise" }, "test-secret"),
-    app,
-  ) as any;
-  assertEquals(result.status, 404);
-  assertEquals(result.body.ok, false);
-});
-
-test("rejects an invalid directive with 400", async () => {
-  const { app } = memApp();
-  const result = await answerPlanEscalation(
-    input({ plan: "owner/repo#9", directive: "ship-it" }, "test-secret"),
-    app,
-  ) as any;
-  assertEquals(result.status, 400);
-  assertEquals(result.body.ok, false);
-});