@nanobpm/nano-workforce 0.95.0 → 0.96.0

package/app/waitGatePoll.test.ts

@@ -0,0 +1,143 @@
+// Integration coverage for the inter-epic gate projection PASS (issue #292, slice S4). `pollWaitGate`
+// is the `pollDelivery` twin for the readiness gate: it joins each `plans` row against its inbound
+// `plan_deps` edges (the S1 read API) and stamps the pure `deriveWaitGate` result onto the row so the
+// declarative epic index/detail can read `wait_gate` / `wait_gate_label` as flat columns. Runs against
+// an in-memory data layer + the real `plans` gateway, mirroring app/promotionPoll.test.ts.
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import type { DataLayer } from "@nanobpm/urban";
+import { plans, recordPlanDep } from "./plan.ts";
+import { pollWaitGate } from "./service.ts";
+
+// In-memory record gateway (all/get/find/insert/update/delete), same shape as promotionPoll.test.ts.
+function memData(): { data: DataLayer; stores: Record<string, any[]> } {
+  const stores: Record<string, any[]> = {};
+  function tbl(name: string, pk = "id") {
+    const rows = (stores[name] ??= [] as any[]);
+    const match = (r: any, where: any) => Object.entries(where).every(([k, v]) => r[k] === v);
+    return {
+      async all() {
+        return rows.slice();
+      },
+      async get(id: any) {
+        return rows.find((r) => r[pk] === id);
+      },
+      async find(where: any = {}) {
+        return rows.filter((r) => match(r, where));
+      },
+      async insert(row: any) {
+        rows.push({ ...row });
+        return row[pk];
+      },
+      async update(id: any, patch: any) {
+        const r = rows.find((row) => row[pk] === id);
+        if (r) Object.assign(r, patch);
+      },
+      async delete(id: any) {
+        for (let i = rows.length - 1; i >= 0; i--) if (rows[i][pk] === id) rows.splice(i, 1);
+      },
+    };
+  }
+  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  return { data, stores };
+}
+
+async function seedPlan(data: DataLayer, over: Record<string, unknown>) {
+  const planKey = over.plan_key as string;
+  const [repo, num] = planKey.split("#");
+  await plans(data).insert({
+    plan_key: planKey,
+    repo,
+    issue_number: Number(num),
+    issue_url: `https://github.com/${repo}/issues/${num}`,
+    title: planKey,
+    status: "planning",
+    task_count: 0,
+    current_wave: null,
+    bound_artifacts: null,
+    wait_gate: null,
+    wait_gate_label: null,
+    created_at: "2026-01-01T00:00:00.000Z",
+    updated_at: "2026-01-01T00:00:00.000Z",
+    ...over,
+  } as any);
+}
+
+test("pollWaitGate: a root epic (no inbound edge) gets no wait-gate", async () => {
+  const { data } = memData();
+  await seedPlan(data, { plan_key: "o/r#1" });
+  await pollWaitGate(data);
+  const row = await plans(data).get("o/r#1");
+  assertEquals(row!.wait_gate, null);
+  assertEquals(row!.wait_gate_label, null);
+});
+
+test("pollWaitGate: a parked dependent is projected 'waiting on <producer>'", async () => {
+  const { data } = memData();
+  await seedPlan(data, { plan_key: "o/r#1" }); // producer
+  // Dependent parked NOW (within the gate's bounded timeout — not yet escalated).
+  await seedPlan(data, { plan_key: "o/r#2", created_at: new Date().toISOString() }); // dependent, parked (no wave)
+  await recordPlanDep(data, {
+    plan_key: "o/r#2",
+    depends_on_plan_key: "o/r#1",
+    package: "@scope/api",
+    capability_ref: "o/r#1",
+  });
+  await pollWaitGate(data);
+  const dep = await plans(data).get("o/r#2");
+  assertEquals(dep!.wait_gate, "waiting");
+  assert(dep!.wait_gate_label.includes("o/r#1 @ @scope/api"), "shows the blocking producer/package");
+  // The producer itself is a root — never gets a gate.
+  assertEquals((await plans(data).get("o/r#1"))!.wait_gate, null);
+});
+
+test("pollWaitGate: a satisfied dependent shows its bound version", async () => {
+  const { data } = memData();
+  await seedPlan(data, { plan_key: "o/r#1" });
+  await seedPlan(data, {
+    plan_key: "o/r#2",
+    current_wave: 0,
+    bound_artifacts: JSON.stringify(["@scope/api@1.4.0"]),
+  });
+  await recordPlanDep(data, {
+    plan_key: "o/r#2",
+    depends_on_plan_key: "o/r#1",
+    package: "@scope/api",
+    capability_ref: "o/r#1",
+  });
+  await pollWaitGate(data);
+  const dep = await plans(data).get("o/r#2");
+  assertEquals(dep!.wait_gate, "ready");
+  assert(dep!.wait_gate_label.includes("@scope/api@1.4.0"), "surfaces the bound pkg@version");
+});
+
+test("pollWaitGate: is idempotent — a steady-state second pass rewrites nothing", async () => {
+  const { data } = memData();
+  await seedPlan(data, { plan_key: "o/r#1" });
+  await seedPlan(data, { plan_key: "o/r#2" });
+  await recordPlanDep(data, {
+    plan_key: "o/r#2",
+    depends_on_plan_key: "o/r#1",
+    package: "@scope/api",
+    capability_ref: "o/r#1",
+  });
+  await pollWaitGate(data);
+  const afterFirst = (await plans(data).get("o/r#2"))!.updated_at;
+  await pollWaitGate(data);
+  const afterSecond = (await plans(data).get("o/r#2"))!.updated_at;
+  assertEquals(afterSecond, afterFirst, "no-op pass must not re-stamp updated_at");
+});
+
+test("pollWaitGate: clears a stale gate when a plan no longer has inbound edges", async () => {
+  const { data } = memData();
+  await seedPlan(data, {
+    plan_key: "o/r#2",
+    wait_gate: "waiting",
+    wait_gate_label: "waiting on o/r#1 @ @scope/api",
+  });
+  // No plan_deps edges exist -> the projection must clear the phantom gate.
+  await pollWaitGate(data);
+  const row = await plans(data).get("o/r#2");
+  assertEquals(row!.wait_gate, null);
+  assertEquals(row!.wait_gate_label, null);
+});

package/app/waitGateVisibility.test.ts

@@ -0,0 +1,55 @@
+// Structural guard for the OPERATOR-VISIBILITY wiring of the inter-epic gate (issue #292, slice S4).
+// S4 makes a parked dependent observable rather than a silent stall: the `select-wave` worker captures
+// the preflight's bound `pkg@version`s off `resolvedArtifacts`, and the epic index/detail pages read
+// the derived `wait_gate` projection + the raw `plan_deps` DAG. These pure text assertions lock the
+// three surfaces that make that projection reachable end-to-end (the BPMN envelope that feeds the
+// capture, and the two page datasources that display it), matching the repo's model-guard style (see
+// planFanoutPreflight.test.ts).
+import { readFileSync } from "node:fs";
+import { test } from "node:test";
+import { assert, assertStringIncludes } from "#test-assert";
+
+test("select-wave's input envelope carries resolvedArtifacts so the worker can capture the bound version", () => {
+  const bpmn = readFileSync("resources/processes/plan-fanout.bpmn", "utf8");
+  const flat = bpmn.replace(/\s+/g, " ");
+  const shape = flat.match(/<nano:shape\b[^>]*\bid="SelectWaveIn"[\s\S]*?<\/nano:shape>/);
+  assert(shape, "SelectWaveIn envelope must exist");
+  assertStringIncludes(
+    shape![0],
+    'name="resolvedArtifacts"',
+    "select-wave must receive the preflight's resolvedArtifacts (the bound pkg@version list)",
+  );
+  // It is a process var the preflight MI produces — optional so a root (no preflight) is well-formed.
+  assertStringIncludes(shape![0], 'name="resolvedArtifacts" type="string" list="true" optional="true"');
+});
+
+test("the epics index projects the wait-gate column", () => {
+  const page = JSON.parse(readFileSync("pages/epic.page.json", "utf8"));
+  const grid = page.nodes.find((n: any) => n.id === "epic-plans");
+  assert(grid, "epics index must have the epic-plans grid");
+  const cols: string[] = grid.props.columns.map((c: any) => c.field);
+  assert(cols.includes("wait_gate_label"), "the index shows the wait-gate at a glance");
+});
+
+test("the epic detail projects both the DAG (plan_deps) and the wait-gate state", () => {
+  const page = JSON.parse(readFileSync("pages/epic-detail.page.json", "utf8"));
+  // 1. The inter-epic DAG: a dataGrid over plan_deps filtered to this epic (who it waits on).
+  const dag = page.nodes.find((n: any) => n.id === "inter-epic-deps");
+  assert(dag, "epic detail must project the inter-epic dependency DAG");
+  assert(dag.props.data.table === "plan_deps", "the DAG grid reads the plan_deps edges");
+  assert(
+    dag.props.data.filter.some((f: any) => f.field === "plan_key" && f.eqParam),
+    "the DAG grid is scoped to this epic's inbound edges",
+  );
+  const dagCols: string[] = dag.props.columns.map((c: any) => c.field);
+  for (const f of ["depends_on_plan_key", "package", "capability_ref"]) {
+    assert(dagCols.includes(f), `the DAG grid shows ${f}`);
+  }
+  // 2. The gate state on the Plan grid: a column + detail fields for the label and bound version.
+  const plan = page.nodes.find((n: any) => n.id === "epic-plan");
+  const planCols: string[] = plan.props.columns.map((c: any) => c.field);
+  assert(planCols.includes("wait_gate_label"), "the Plan grid shows the wait-gate label");
+  const detailFields: string[] = plan.props.detail.fields.map((f: any) => f.field);
+  assert(detailFields.includes("wait_gate_label"), "the detail explains the gate state");
+  assert(detailFields.includes("bound_artifacts"), "the detail shows the bound producer capabilities");
+});

package/db/migrations/047_plan_wait_gate.sql

@@ -0,0 +1,34 @@
+-- 047_plan_wait_gate.sql — issue #292 slice S4: make the inter-epic schedule OBSERVABLE to an
+-- operator. S1 landed the `plan_deps` edges (which epic waits on which); S3 lowers each dependent
+-- behind a leading `capability` readiness PREFLIGHT (plan-fanout.bpmn) that holds wave 0 until every
+-- producer publishes the awaited `pkg@version`, then escalates (bounded) on timeout. Until now a
+-- parked dependent was a SILENT stall — the epic views showed no wave, no delivery, no reason.
+--
+-- This slice reifies the dependent's gate state as three derived, display-only columns on `plans`,
+-- mirroring the existing `delivery`/`delivery_label` (029) and `wave_label` (022) projections so the
+-- declarative epic index/detail dataGrids read them as flat columns (Urban's datasource can't read a
+-- SQL VIEW or join). All three are DERIVED — never written by the plan lifecycle nor hand-derived in
+-- SQL or the page:
+--   • wait_gate       — the dependent's gate state: 'waiting' (parked at the preflight, blocked on a
+--                       producer's capability) | 'ready' (the preflight went green and the epic has
+--                       fanned out, bound to a concrete version) | 'escalated' (the gate's bounded
+--                       timeout elapsed with no publish). NULL for a ROOT epic (no inbound edge → no
+--                       wait-gate) and for pre-S4 rows. Recomputed idempotently by `pollWaitGate`
+--                       (app/service.ts) from the pure `deriveWaitGate` (app/waitGate.ts), joining
+--                       each plan's inbound `plan_deps` edges against its own lifecycle.
+--   • wait_gate_label — the human at-a-glance rollup the epic index/detail show, e.g.
+--                       "waiting on owner/repo#12 @ @scope/pkg · re-checks every 30s · escalates by …"
+--                       or "ready · bound @scope/pkg@1.4.0". NULL alongside `wait_gate`.
+--   • bound_artifacts — JSON array of the resolved `pkg@version` strings the preflight bound (the
+--                       exact versions FIRST carrying each producer's capability), stamped by the
+--                       `select-wave` worker from the `resolvedArtifacts` process variable the
+--                       preflight produced — the same value that rides the implement task's prompt.
+--                       NULL until the gate goes green (and for roots, whose preflight is skipped).
+--
+-- Forward-only, additive (expand): all nullable with no default, so pre-S4 rows grandfather in as
+-- NULL and never gate control flow (this is read-only projection over S1–S3 state — admission and
+-- scheduling are untouched). Numbered after the current highest prefix on origin/main (046); the
+-- runner wraps each file in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+ALTER TABLE plans ADD COLUMN wait_gate TEXT;
+ALTER TABLE plans ADD COLUMN wait_gate_label TEXT;
+ALTER TABLE plans ADD COLUMN bound_artifacts TEXT;

package/db/migrations/048_feature_escalations.sql

@@ -0,0 +1,51 @@
+-- 048_feature_escalations.sql — issue #305: canonical, append-only source for a feature run's
+-- escalation QUESTION, so the denormalised `feature_runs.escalation_question` column can be dropped
+-- in the later CONTRACT phase without losing the text the Tasks inbox shows.
+--
+-- Today the `feature-escalation` question is denormalised onto `feature_runs.escalation_question`
+-- (written by `record-feature-escalation`, read by `pollUserTasks`). #305 consolidates escalation
+-- state onto the native `user_tasks` projection and removes the duplicate `feature_runs.escalation_*`
+-- surface. The question text still has to come from SOMEWHERE the poller can read while a run is
+-- parked — so, exactly like the surviving `plan_reviews` (adversarial plan-review log), `escalations`
+-- (PR review-loop log) and `plan_trial_merges` (D3 trial-merge gate log) audit tables that already
+-- enrich the plan/PR kinds' questions in `pollUserTasks`, the FEATURE kind gets its own append-only
+-- audit log. `record-feature-escalation` appends one row per escalation entry (with the agent's
+-- `question`), and the poller reads the newest row per feature as the live question.
+--
+-- Append-only (never updated/deleted): the newest `id` for a `feature_key` is the current question,
+-- mirroring `escalations`/`latestOpenEscalationQuestion`. No "answered" flag is needed for display —
+-- `pollUserTasks` already gates the row's existence on the run being parked at an observable task, so
+-- the enrichment only supplies the text.
+--
+-- EXPAND (additive) phase: this only ADDS a table and BACKFILLS the currently-open escalations'
+-- questions from `feature_runs`; nothing is dropped and the poller reads it with a fallback to the
+-- legacy column, so it is safe to land before the contract phase. Numbered after the current highest
+-- prefix on origin/main (047). The runner wraps each file in its own transaction, so this file must
+-- NOT contain BEGIN/COMMIT.
+CREATE TABLE feature_escalations (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  feature_key TEXT NOT NULL,
+  question    TEXT,
+  created_at  TEXT NOT NULL,
+  -- Idempotency guard: the engine `jobKey` that wrote the row, exactly like `plan_reviews`
+  -- (migration 007) and `plan_trial_merges`. `record-feature-escalation` is at-least-once — a job
+  -- retried after the insert (crash/timeout before job completion) re-runs with the SAME `jobKey`, so
+  -- the writer reuses its existing row instead of appending a duplicate, which would otherwise bloat
+  -- this append-only log. NULL only for backfill rows (below), which have no originating job.
+  job_key     TEXT
+);
+
+CREATE INDEX idx_feature_escalations_feature ON feature_escalations(feature_key, id);
+-- Unique per (feature_key, job_key) enforces the retry guard. SQLite treats NULLs as distinct in a
+-- UNIQUE index, so the backfill's NULL-job_key rows never collide with each other or a live insert.
+CREATE UNIQUE INDEX idx_feature_escalations_job ON feature_escalations(feature_key, job_key);
+
+-- Backfill: seed one audit row for every run currently parked at an answerable escalation with a
+-- captured question, so a run parked WHEN THIS LANDS keeps showing its question after the poller
+-- switches to reading the audit log (the poller's legacy-column fallback covers this too, but the
+-- backfill makes the new log authoritative from boot). `escalation_open = 1` is the fail-closed
+-- signal (migration 040) that all three legacy columns agree the run is answerable.
+INSERT INTO feature_escalations (feature_key, question, created_at)
+SELECT feature_key, escalation_question, COALESCE(updated_at, created_at)
+FROM feature_runs
+WHERE escalation_open = 1 AND escalation_question IS NOT NULL;

package/e2e/inter-epic-dependency.e2e.ts

@@ -0,0 +1,227 @@
+// Adversarial end-to-end proof for the inter-epic capability gate on the REAL `plan-fanout.bpmn`
+// (issue #292, slice S5). The sibling e2e (plan-fanout-preflight.e2e.ts) proves the GREEN and ROOT
+// paths; this suite proves the RED, adversarial ones the whole feature hinges on — driven on the
+// engine + virtual clock via `bootTestApp`, hermetic (a deterministic shell-builtin probe, no
+// network, no GitHub):
+//
+//   • S5 P1 — HOLDS WAVE 0: a dependent whose producer never publishes parks at the preflight and
+//     NEVER reaches `ensure-base-branch` (the head of the fan-out). The gate is a true barrier.
+//   • S5 P3 — ESCALATES, then DOESN'T WEDGE: the never-green probe opens exactly one
+//     `readiness-escalation-pf` user task; an operator who acknowledges it releases the gate onward
+//     to the fan-out head — the stall is surfaced and recoverable, not a silent dead end.
+//   • S5 P7 — NEVER HANGS FOREVER: with NO human acting, the escalation's bounded SLA timer
+//     (`be_pf_sla`) fires and auto-abandons the gate onward — a removed/never-finishing producer can
+//     never strand the dependent indefinitely.
+//
+// We assert on the cumulative taken sequence flows (the WASM engine folds completed variables away),
+// exactly like the sibling plan-fanout e2es.
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { after, before, describe, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
+import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
+
+const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+const GITHUB_ENV_OVERRIDES: Record<string, string> = {
+  NANO_PR_GITHUB_TRANSPORT: "token",
+  GITHUB_TOKEN: "",
+};
+const savedEnv = new Map<string, string | undefined>();
+
+interface TakenFlow {
+  from: string;
+  to: string;
+}
+
+function takenFlows(app: TestApp): string[] {
+  const snapshot = app.snapshot();
+  const flows = Array.isArray(snapshot.takenSequenceFlows) ? snapshot.takenSequenceFlows : [];
+  return flows
+    .filter((f): f is TakenFlow => typeof f === "object" && f !== null && "from" in f && "to" in f)
+    .map((f) => `${f.from}->${f.to}`);
+}
+
+// The full variable set `startPlan` seeds onto a plan-fanout instance (mirrors
+// plan-fanout-preflight.e2e.ts). We inject `readinessProbes` directly — the shape S3's set lowering
+// seeds for a DEPENDENT — so we can drive the gate without standing up a whole two-epic set.
+function planVars(overrides: Record<string, unknown>): Record<string, unknown> {
+  return {
+    planKey: "owner/repo#2",
+    repo: "owner/repo",
+    issue: "owner/repo#2",
+    issueNumber: 2,
+    issueUrl: "https://github.com/owner/repo/issues/2",
+    planFindings: null,
+    planReviewEpoch: 0,
+    escalationSlaTimeout: "PT24H",
+    escalationAssignee: null,
+    blackboardUrl: "http://blackboard.local/x",
+    blackboardBrief: "",
+    baseBranch: "epic/e2e",
+    baseBranchBrief: "",
+    waveCount: 1,
+    readinessProbes: null,
+    probeTimeout: null,
+    gateKey: null,
+    resolvedArtifacts: null,
+    ...overrides,
+  };
+}
+
+// A never-green probe: `false` is never ready. The worker's local poll budget is the seeded
+// `probeTimeout` (in real time), so a SHORT `probeTimeout` (PT2S below) makes the worker exhaust its
+// budget quickly and settle NOT-ready — the gateway's default `pf_escalate` arm then fires, parking
+// the gate on the escalation user task (P1/P3) until either a human or the SLA timer (P7) resolves it.
+function redProbe(): Record<string, unknown> {
+  return { kind: "command", target: "false", poll: { everyMs: 5, backoff: "fixed" } };
+}
+
+async function boot(): Promise<{ app: TestApp; dbDir: string }> {
+  const dbDir = mkdtempSync(join(tmpdir(), "nwf-s5-interepic-"));
+  const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(dbDir, "app.db")}` } });
+  return { app, dbDir };
+}
+
+describe("inter-epic capability gate — adversarial (plan-fanout.bpmn, issue #292 S5)", () => {
+  let restoreGithub: (() => void) | undefined;
+
+  before(() => {
+    for (const [k, v] of Object.entries(GITHUB_ENV_OVERRIDES)) {
+      savedEnv.set(k, process.env[k]);
+      process.env[k] = v;
+    }
+    // The fan-out head (`pr.ensure-base-branch`) reads/creates the base ref via the token transport;
+    // pin the shared hermetic admit-github stub so a released gate reaches it offline.
+    restoreGithub = installAdmitGithub(admitGithubState("owner/repo", "main"));
+  });
+  after(() => {
+    restoreGithub?.();
+    for (const [k, v] of savedEnv) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+  });
+
+  // ── S5 P1 — the gate HOLDS wave 0 ───────────────────────────────────────────────────────────────
+  test("S5 P1: a dependent whose producer never publishes parks at the preflight and never reaches the fan-out head", async () => {
+    const { app, dbDir } = await boot();
+    try {
+      const { processInstanceKey } = await app.engine.createInstance({
+        processDefinitionId: "plan-fanout",
+        variables: planVars({
+          readinessProbes: [redProbe()],
+          probeTimeout: "PT2S",
+          gateKey: "preflight:owner/repo#2",
+        }),
+      });
+      await app.settle();
+
+      const flows = takenFlows(app);
+      // It entered the gate (it is a dependent, not a root skip)…
+      assert.ok(
+        flows.includes("gw-readiness->readiness-preflight"),
+        `the dependent enters the preflight (flows: ${flows.join(", ")})`,
+      );
+      // …the probe went NOT-ready, so the gate never released as ready…
+      assert.ok(!flows.includes("pf_gw->pf_end"), "a never-green probe never releases the gate as ready");
+      // …and CRUCIALLY it never fanned out: the head of the fan-out was never reached.
+      assert.ok(
+        !flows.includes("readiness-preflight->ensure-base-branch"),
+        "the gate HOLDS wave 0 — a parked dependent never reaches the fan-out head",
+      );
+      // The token is parked on the escalation user task, not lost.
+      const tasks = (await app.engine.searchUserTasks({ processInstanceKey })).filter(
+        (t) => t.elementId === "readiness-escalation-pf",
+      );
+      assert.equal(tasks.length, 1, "the held gate surfaces as exactly one escalation task, not a silent stall");
+    } finally {
+      await app.stop();
+      rmSync(dbDir, { recursive: true, force: true });
+    }
+  });
+
+  // ── S5 P3 — it ESCALATES, and an operator ack un-wedges it ───────────────────────────────────────
+  test("S5 P3: the never-green gate escalates exactly once, and acknowledging it releases the fan-out (no wedge)", async () => {
+    const { app, dbDir } = await boot();
+    try {
+      const { processInstanceKey } = await app.engine.createInstance({
+        processDefinitionId: "plan-fanout",
+        variables: planVars({
+          readinessProbes: [redProbe()],
+          probeTimeout: "PT2S",
+          gateKey: "preflight:owner/repo#2",
+        }),
+      });
+      await app.settle();
+
+      const escalations = (await app.engine.searchUserTasks({ processInstanceKey })).filter(
+        (t) => t.elementId === "readiness-escalation-pf",
+      );
+      assert.equal(escalations.length, 1, "a never-publishing producer escalates exactly once (bounded, not a storm)");
+
+      // An operator acknowledges the stall — the gate must NOT wedge: it proceeds onward to the fan-out.
+      await app.engine.completeUserTask(escalations[0].userTaskKey, { resolution: "acknowledge" });
+      await app.settle();
+
+      const flows = takenFlows(app);
+      assert.ok(
+        flows.includes("readiness-escalation-pf->pf_gw_res") && flows.includes("pf_gw_res->pf_end"),
+        `acknowledging routes through the resolution gateway to settle the gate (flows: ${flows.join(", ")})`,
+      );
+      assert.ok(
+        flows.includes("readiness-preflight->ensure-base-branch"),
+        "an acknowledged gate is NOT wedged — it releases onward to the fan-out head",
+      );
+    } finally {
+      await app.stop();
+      rmSync(dbDir, { recursive: true, force: true });
+    }
+  });
+
+  // ── S5 P7 — the SLA timer means it NEVER hangs forever, even with no human ────────────────────────
+  test("S5 P7: with no operator acting, the escalation's bounded SLA auto-abandons onward — the gate never hangs forever", async () => {
+    const { app, dbDir } = await boot();
+    try {
+      const { processInstanceKey } = await app.engine.createInstance({
+        processDefinitionId: "plan-fanout",
+        variables: planVars({
+          readinessProbes: [redProbe()],
+          probeTimeout: "PT2S",
+          escalationSlaTimeout: "PT1H",
+          gateKey: "preflight:owner/repo#2",
+        }),
+      });
+      await app.settle();
+
+      // Parked on the escalation, no human acts. Before the SLA it has NOT proceeded.
+      const before = takenFlows(app);
+      assert.ok(!before.includes("be_pf_sla->pf_end"), "the SLA has not yet fired");
+      assert.ok(
+        !before.includes("readiness-preflight->ensure-base-branch"),
+        "the gate is still held before the SLA elapses",
+      );
+
+      // Advancing past the escalation SLA is the ONLY thing that ends the unattended wait — proving the
+      // bound is engine-owned. It auto-abandons the gate ONWARD (never strands the dependent forever).
+      await app.advanceTime(61 * 60 * 1000);
+      await app.settle();
+
+      const after = takenFlows(app);
+      assert.ok(
+        after.includes("be_pf_sla->pf_end"),
+        `the bounded SLA timer fires and settles the held gate (flows: ${after.join(", ")})`,
+      );
+      assert.ok(
+        after.includes("readiness-preflight->ensure-base-branch"),
+        "the auto-abandoned gate releases onward — the dependent is never stranded indefinitely",
+      );
+    } finally {
+      await app.stop();
+      rmSync(dbDir, { recursive: true, force: true });
+    }
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.95.0",
+  "version": "0.96.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/epic-detail.page.json

@@ -61,6 +61,7 @@
           { "field": "epic_phase", "header": "Phase" },
           { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "delivery", "header": "Delivery" },
+          { "field": "wait_gate_label", "header": "Wait gate" },
           { "field": "promotion_state", "header": "Promotion" },
           { "field": "wave_label", "header": "Wave" },
           { "field": "task_count", "header": "Tasks" },
@@ -73,12 +74,39 @@
             { "field": "issue_number", "label": "Issue number" },
             { "field": "base_branch", "label": "Base branch (blank = repo default)" },
             { "field": "delivery_label", "label": "Delivery rollup (slices merged / converging)" },
+            { "field": "wait_gate_label", "label": "Inter-epic gate (waiting on / bound version / escalated)" },
+            { "field": "bound_artifacts", "label": "Bound producer capabilities (pkg@version)" },
             { "field": "promotion_pr", "label": "Promotion PR (epic/* → default branch)" },
             { "field": "outcome", "label": "Outcome" }
           ]
         }
       }
     },
+    {
+      "type": "dataGrid",
+      "id": "inter-epic-deps",
+      "props": {
+        "title": "Inter-epic dependencies (waiting on)",
+        "rowKey": "depends_on_plan_key",
+        "refreshMs": 5000,
+        "collapsible": true,
+        "defaultCollapsed": true,
+        "empty": "No inter-epic dependencies — this is a root epic (it starts immediately, no capability wait-gate).",
+        "data": {
+          "kind": "datasource",
+          "source": "app",
+          "table": "plan_deps",
+          "orderBy": { "field": "created_at", "dir": "asc" },
+          "filter": [{ "field": "plan_key", "eqParam": true }]
+        },
+        "columns": [
+          { "field": "depends_on_plan_key", "header": "Waits on (producer epic)" },
+          { "field": "package", "header": "Package" },
+          { "field": "capability_ref", "header": "Capability ref" },
+          { "field": "created_at", "header": "Recorded", "width": "9rem" }
+        ]
+      }
+    },
     {
       "type": "dataGrid",
       "id": "wave-state",

package/pages/epic.page.json

@@ -79,6 +79,7 @@
           { "field": "epic_phase", "header": "Phase" },
           { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "delivery", "header": "Delivery" },
+          { "field": "wait_gate_label", "header": "Wait gate" },
           { "field": "promotion_state", "header": "Promotion" },
           { "field": "delivery_label", "header": "Landing" },
           { "field": "base_branch", "header": "Base branch" },