@nathapp/nax 0.77.2 → 0.78.0

package/flows/nax-finish/commit-message.ts

@@ -23,10 +23,74 @@ const SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"] as const;
 /** How much gate output to quote in the body before it stops being a commit message. */
 const MAX_GATE_OUTPUT_LINES = 20;
 
+/**
+ * Markers a test runner uses to introduce a failing case, worst-supported-first.
+ *
+ * A heuristic, deliberately: nax orchestrates polyglot repos, so this cannot be
+ * one runner's format. Each entry is the literal token that precedes the test's
+ * name — bun/jest `(fail)`, go `--- FAIL:`, pytest `FAILED`, and the tick-style
+ * reporters. Nothing downstream depends on a match; a miss just falls back to
+ * the output tail, which is what shipped before.
+ */
+const FAILURE_MARKERS = ["(fail)", "--- FAIL:", "FAILED ", "FAIL ", "✗ ", "× "];
+
+/** How many failing test names to name before the message stops being a commit message. */
+const MAX_NAMED_FAILURES = 10;
+
+/**
+ * Strip machine-local filesystem layout out of text bound for shipped history.
+ *
+ * Two passes, because the two cases differ: a path under the repo is meaningful
+ * once made relative, while a path outside it is noise no reader of the commit
+ * can act on. The home-directory pattern catches what remains — runner output
+ * routinely quotes absolute paths from outside the repo (caches, toolchains).
+ */
+function redactPaths(text: string, workdir?: string): string {
+  const withoutRepo = workdir ? text.split(`${workdir}/`).join("") : text;
+  return withoutRepo.replace(/(?:\/Users\/|\/home\/)[^/\s)]+\//g, "~/");
+}
+
+/**
+ * The names of the tests that actually failed, in output order.
+ *
+ * This is the whole point of the change: the body used to be the last 20 lines
+ * of runner stdout, and a suite whose *passing* tests write to stderr pushes the
+ * real failure out of that window — so the commit named a stack trace from a
+ * test that passed (#1506).
+ */
+function failingTestNames(output: string): string[] {
+  const names: string[] = [];
+  for (const line of output.split("\n")) {
+    const trimmed = line.trim();
+    const marker = FAILURE_MARKERS.find((m) => trimmed.startsWith(m));
+    if (!marker) continue;
+    // Drop bun's trailing `[0.12ms]` timing — it is noise in a commit message
+    // and makes otherwise-identical messages differ between runs.
+    const name = trimmed
+      .slice(marker.length)
+      .replace(/\s*\[[\d.]+m?s\]$/, "")
+      .trim();
+    if (name) names.push(name);
+  }
+  // Say so when the list is cut short. A bare list of ten reads as "ten tests
+  // failed", and a reader who acts on that count is acting on a truncation.
+  if (names.length > MAX_NAMED_FAILURES) {
+    const dropped = names.length - MAX_NAMED_FAILURES;
+    return [...names.slice(0, MAX_NAMED_FAILURES), `...and ${dropped} more failing test(s)`];
+  }
+  return names;
+}
+
 interface MessageCtx {
   outputs: Record<string, unknown>;
 }
 
+/** Options carrying what the message builder cannot read off `ctx.outputs`. */
+interface MessageOptions {
+  /** Absolute repo root, used to rewrite quoted paths as repo-relative. */
+  workdir?: string;
+}
+
 interface PhaseOutputs {
   findings?: Finding[];
   failing?: string[];
@@ -88,20 +152,30 @@ function subjectFor(phase: FinishPhase, ctx: MessageCtx): string {
   return findings.length > 0 ? reviewSubject(phase, findings) : `apply ${phase} review fixes`;
 }
 
-function bodyFor(phase: FinishPhase, ctx: MessageCtx): string[] {
+/**
+ * What to quote from a runner's output: the failing test names if they can be
+ * identified, otherwise the tail, as before.
+ *
+ * Never both. Naming the failures *and* pasting the tail reproduces the noise
+ * this replaces, and the tail is the weaker signal whenever the names exist.
+ */
+function runnerEvidence(output: string, opts: MessageOptions): string {
+  const clean = redactPaths(output, opts.workdir).trim();
+  const names = failingTestNames(clean);
+  if (names.length > 0) return ["Failed tests:", ...names.map((n) => `- ${n}`)].join("\n");
+  return clean.split("\n").slice(-MAX_GATE_OUTPUT_LINES).join("\n");
+}
+
+function bodyFor(phase: FinishPhase, ctx: MessageCtx, opts: MessageOptions): string[] {
   if (phase === "gate") {
     const gate = outputsFor(ctx, "quality_gates");
     const failing = gate.failing ?? [];
-    const tail = (gate.output ?? "").trim().split("\n").slice(-MAX_GATE_OUTPUT_LINES).join("\n");
-    return [...(failing.length > 0 ? [`Failing: ${failing.join(", ")}`] : []), ...(tail ? [tail] : [])];
+    const evidence = runnerEvidence(gate.output ?? "", opts);
+    return [...(failing.length > 0 ? [`Failing: ${failing.join(", ")}`] : []), ...(evidence ? [evidence] : [])];
   }
   if (phase === "acceptance") {
-    const tail = (outputsFor(ctx, "acceptance").output ?? "")
-      .trim()
-      .split("\n")
-      .slice(-MAX_GATE_OUTPUT_LINES)
-      .join("\n");
-    return tail ? [tail] : [];
+    const evidence = runnerEvidence(outputsFor(ctx, "acceptance").output ?? "", opts);
+    return evidence ? [evidence] : [];
   }
   const findings = findingsFor(ctx, phase);
   if (findings.length === 0) return [];
@@ -129,8 +203,13 @@ function phaseLabel(phase: FinishPhase): string {
  * described is still a commit that must happen — failing here would strand the
  * fix uncommitted and reintroduce the stale-diff bug (#1397).
  */
-export function buildFixCommitMessage(phase: FinishPhase, feature: string, ctx: MessageCtx): string {
+export function buildFixCommitMessage(
+  phase: FinishPhase,
+  feature: string,
+  ctx: MessageCtx,
+  opts: MessageOptions = {},
+): string {
   const subject = truncate(`fix(${feature}): ${subjectFor(phase, ctx)}`);
-  const body = bodyFor(phase, ctx);
+  const body = bodyFor(phase, ctx, opts);
   return [subject, ...body, `nax-finish: ${phaseLabel(phase)} fixes`].join("\n\n");
 }

package/flows/nax-finish/flow-ctx.ts

@@ -17,6 +17,7 @@
  *   *outcome*, so the currently-executing node is never in this list — which is
  *   what lets `incrementalSince` find the *previous* review rather than itself.
  */
+import type { AcceptanceStatus } from "./steps/context";
 import type { AcceptanceGroup, Finding, FinishInput, FinishPhase, ReviewVerdict } from "./types";
 
 /** Minimal shapes so each reader takes only the part of the context it reads. */
@@ -34,11 +35,13 @@ export interface LoadCtxOutput {
   base?: string;
   specPath?: string;
   groups?: AcceptanceGroup[];
-  /** `nax features resolve`'s acceptance status: "ok" | "disabled" | "no-prd". */
-  acceptanceStatus?: string;
+  /** `nax features resolve`'s acceptance status, narrowed at `resolveFeature`. */
+  acceptanceStatus?: AcceptanceStatus;
   /** Test-file regex sources from `nax features resolve`; empty = cannot classify. */
   testFileRegex?: string[];
   route?: string;
+  /** Set only when `route` is `escalate` — see `preflight`. */
+  reason?: string;
 }
 
 export function fixAttemptCount(ctx: StepsCtx, fixNodeId: string): number {
@@ -111,15 +114,32 @@ export function findingsOf(ctx: OutputsCtx, phase: FinishPhase): Finding[] {
  * would have discarded the earlier `shaBefore` and silently under-scoped the
  * review.
  *
+ * Only commit steps that actually **committed** anchor the window. A fix node
+ * that edited nothing still records a `commit_*` step, and its `shaBefore` is
+ * the current HEAD — so scoping to it asks the reviewer for `HEAD..HEAD`, an
+ * empty diff, while the prompt tells it the prior findings "have since been
+ * fixed and committed". It returns clean, `route_*` sends the flow onward, and
+ * the findings ship unfixed. That leaves the loop through the green door, so
+ * `MAX_FIX_ATTEMPTS` never catches it. A no-op round therefore either yields
+ * the window to a later real commit, or falls back to a full review.
+ *
+ * Rounds journalled before `committed` existed carry no such field; `!== false`
+ * keeps replaying them on the previous behaviour rather than widening every
+ * resumed review to the whole branch.
+ *
  * Returns null — a full review — when there is no prior review of this phase
- * (round 1), no commit since it (nothing new to look at), or the commit step
- * recorded no `shaBefore`.
+ * (round 1), no commit landed since it (nothing new to look at), or the commit
+ * step recorded no `shaBefore`.
  */
 export function incrementalSince(ctx: OutputsCtx & StepsCtx, phase: "spec" | "quality"): string | null {
   const steps = ctx.state.steps ?? [];
   const lastReview = steps.map((s) => s.nodeId).lastIndexOf(`review_${phase}`);
   if (lastReview < 0) return null;
-  const firstCommit = steps.slice(lastReview + 1).find((s) => s.nodeId.startsWith("commit_"));
+  const firstCommit = steps
+    .slice(lastReview + 1)
+    .find(
+      (s) => s.nodeId.startsWith("commit_") && (s.output as { committed?: boolean } | undefined)?.committed !== false,
+    );
   if (!firstCommit) return null;
   return (firstCommit.output as { shaBefore?: string | null } | undefined)?.shaBefore ?? null;
 }

package/flows/nax-finish/nax-finish.flow.ts

@@ -34,7 +34,14 @@
  * - `commit_gate` re-enters `review_quality` when its fix touched non-test code
  *   — the gate loop was previously the one editing loop whose output only ever
  *   faced mechanical checks. A test-only fix skips the re-review by explicit
- *   cost tradeoff; see `gateCommitRoute` for why that is a known hole.
+ *   cost tradeoff; see `gateCommitRoute` for why that is a known hole. The skip
+ *   records `review-skipped`, so it is visible in the audit.
+ * - `load_ctx` and `open_pr` both route to `escalate` rather than throwing on
+ *   their own failures. acpx has no error edge, so a throw ends the run with no
+ *   result file for the plugin to read or notify from — the one outcome that
+ *   must always be reported is "a human is needed" (#1399). `open_pr` matters
+ *   most: it is reached only after every gate is green, so a failed push or
+ *   forge call there discards a completed, verified run.
  * - Every `commit_*` node appends its round to the finish-audit trail as it
  *   happens, rather than a terminal node reconstructing them from
  *   `ctx.state.steps`. Appending live is what makes the trail survive a flow
@@ -48,8 +55,10 @@ import { narrativePrompt, parseNarrativeNode } from "./narrative";
 import { buildReviewPrompt, fixPrompt } from "./review-prompts";
 import {
   _contextDeps,
+  acceptanceGateNode,
   amendPrBodyNode,
   appendRound,
+  buildCommitRound,
   buildEscalationComment,
   commitAndPush,
   commitFixes,
@@ -57,20 +66,19 @@ import {
   detectForge,
   filesInCommit,
   loadFinishPrContext,
-  loadQualityCommands,
   openOrPromotePr,
   partitionTestFiles,
   postEscalation,
   preflight,
+  qualityGatesNode,
   resolveFeature,
-  runAcceptanceGate,
-  runQualityGates,
+  routeReviewAndRecord,
   writeResult,
 } from "./steps";
 import type { Forge } from "./steps/forge";
 import { _prBodyDeps, buildFinishBody, buildFinishTitle } from "./steps/pr-body";
 import type { FinishInput, FinishPhase, FinishResult, ReviewVerdict } from "./types";
-import { MAX_FIX_ATTEMPTS, parseFixVerdict, parseReviewVerdict, repromptCount, routeReview } from "./verdict";
+import { parseFixVerdict, parseReviewVerdict, repromptCount } from "./verdict";
 
 /**
  * Disabled only on an explicit "0". An unset variable means enabled, so a flow
@@ -90,59 +98,6 @@ export const _openPrDeps = {
   buildFinishBody,
 };
 
-/**
- * Re-run the acceptance gate, routing on the shared fix-cap rules.
- *
- * "Nothing ran" is not a pass — the same rule `quality_gates` applies to an
- * unconfigured repo. `nax features resolve` reports `groups: []` for BOTH
- * `no-prd` and `disabled`, and reports `exists: false` for a group whose test
- * was expected at its canonical path but never generated. Treating all of those
- * as green let the flow open a ready PR having verified nothing about the
- * feature's own contract (#1398). Only `disabled` — the repo's explicit opt-out
- * — skips cleanly.
- */
-async function acceptanceGateNode(ctx: {
-  input: unknown;
-  outputs: unknown;
-  state: { steps: { nodeId: string }[] };
-}): Promise<{ route: string; reason?: string; output: string }> {
-  const i = inputOf(ctx);
-  const { groups = [], acceptanceStatus } = loadCtxOf(ctx);
-  if (acceptanceStatus === "disabled") {
-    return { route: "proceed", output: "[acceptance] disabled in .nax/config.json — skipping" };
-  }
-  if (acceptanceStatus === "no-prd") {
-    return {
-      route: "escalate",
-      reason: `Acceptance targets could not be computed (status: no-prd) — nothing was verified for "${i.feature}".`,
-      output: "[acceptance] no prd.json resolved — acceptance targets unknown",
-    };
-  }
-
-  const r = await runAcceptanceGate(i.workdir, groups, { timeoutMs: i.timeouts?.acceptanceMs });
-  if (r.passed) {
-    // A real failure below routes to the fix loop, which is more actionable;
-    // the coverage hole is only reported once the runnable groups are green.
-    if (r.missing.length > 0) {
-      return {
-        route: "escalate",
-        reason: `Acceptance test never generated for: ${r.missing.join(", ")} — that package's contract is unverified.`,
-        output: r.output,
-      };
-    }
-    return { route: "proceed", output: r.output };
-  }
-  const attempts = fixAttemptCount(ctx, "fix_acceptance");
-  if (attempts >= MAX_FIX_ATTEMPTS) {
-    return {
-      route: "escalate",
-      reason: `Acceptance tests still failing after ${attempts} fix attempts.`,
-      output: r.output,
-    };
-  }
-  return { route: "fix", output: r.output };
-}
-
 /**
  * Route for `commit_gate`, whose successor depends on what the fix touched.
  *
@@ -153,7 +108,7 @@ async function acceptanceGateNode(ctx: {
  *   The defect that motivated the re-entry (rs-stock `b6fb66dd`) was itself
  *   test-only — 8 copy-pasted stubs across 3 test files — so this route would
  *   not have caught it. Widen it here if test-quality regressions start
- *   shipping.
+ *   shipping — the audit's `review-skipped` rounds are the evidence.
  * - `changed` — production code was touched, or the paths could not be
  *   classified at all. "Cannot classify" reviews rather than skips.
  */
@@ -202,30 +157,32 @@ function commitFixNode(phase: FinishPhase) {
       // PR opens, and a hook failure here would kill the flow mid-loop.
       const { committed, shaBefore, shaAfter } = await commitFixes(
         i.workdir,
-        buildFixCommitMessage(phase, i.feature, messageCtx),
+        buildFixCommitMessage(phase, i.feature, messageCtx, { workdir: i.workdir }),
         { skipHooks: true },
       );
-      await appendRound(i, {
-        ts: new Date().toISOString(),
-        phase,
-        attempt: fixAttemptCount(ctx, `fix_${phase}`),
-        committed,
-        findings: findingsOf(ctx, phase),
-        ...(phase === "gate" ? { failing: gateOutputs(ctx).failing ?? [] } : {}),
-        // Carry `shaAfter` onto committed rounds only: a no-op round has no
-        // commit, so no SHA to record — keeping the field absent (rather than
-        // null/undefined) lets the result-file reader distinguish "no commit"
-        // from "record lost".
-        ...(committed && shaAfter ? { sha: shaAfter } : {}),
-      });
-      // Only `commit_gate` routes on this; the other phases have unconditional
-      // edges and ignore it.
+      // Routed BEFORE the round is recorded: `buildCommitRound` needs the
+      // successor to tell an owed-but-skipped re-review from a phase that never
+      // had a reviewer. Only `commit_gate` routes on this; the other phases have
+      // unconditional edges and ignore it.
       const route =
         phase === "gate"
           ? await gateCommitRoute(i, committed, shaAfter, loadCtxOf(ctx).testFileRegex ?? [])
           : committed
             ? "changed"
             : "unchanged";
+      await appendRound(
+        i,
+        buildCommitRound({
+          phase,
+          attempt: fixAttemptCount(ctx, `fix_${phase}`),
+          committed,
+          route,
+          findings: findingsOf(ctx, phase),
+          failing: phase === "gate" ? (gateOutputs(ctx).failing ?? []) : undefined,
+          shaAfter,
+          now: new Date().toISOString(),
+        }),
+      );
       return { committed, route, shaBefore, shaAfter };
     },
   };
@@ -255,6 +212,7 @@ export default defineFlow({
           testFileRegex: resolution.testFileRegex,
           commitsAhead: pf.commitsAhead,
           route: pf.route,
+          ...(pf.reason ? { reason: pf.reason } : {}),
         };
       },
     },
@@ -286,7 +244,7 @@ export default defineFlow({
     },
     route_spec: {
       nodeType: "compute",
-      run: (ctx) => routeReview(ctx, "spec"),
+      run: (ctx) => routeReviewAndRecord(ctx, "spec"),
     },
     fix_spec: {
       nodeType: "acp",
@@ -312,7 +270,7 @@ export default defineFlow({
     },
     route_quality: {
       nodeType: "compute",
-      run: (ctx) => routeReview(ctx, "quality"),
+      run: (ctx) => routeReviewAndRecord(ctx, "quality"),
     },
     fix_quality: {
       nodeType: "acp",
@@ -328,75 +286,7 @@ export default defineFlow({
     commit_gate: commitFixNode("gate"),
     quality_gates: {
       nodeType: "action",
-      async run(ctx) {
-        const i = inputOf(ctx);
-
-        // Acceptance is gate zero here, not just at the `acceptance` node.
-        // Both fix loops that run after it — quality review and this gate —
-        // edit code, and the repo-root `test` command does not cover the
-        // feature's acceptance tests: they live under `<pkg>/.nax/features/<f>/`
-        // and usually need their own runner config. Re-running them here is what
-        // makes "nothing reaches open_pr without the feature's own contract
-        // passing against the tree as it will ship" true on every path (#1398).
-        //
-        // Unconditional, though the common green path re-runs a gate that
-        // already passed: acceptance is the cheapest gate in the pipeline, and a
-        // conditional skip derived from step history would be a check that can
-        // be *wrong* — a silent false green, the failure mode this exists to
-        // prevent.
-        //
-        // `missing` is deliberately ignored: groups are resolved once at
-        // load_ctx, so a coverage hole was already escalated by the acceptance
-        // node and cannot appear here.
-        const acc = await runAcceptanceGate(i.workdir, loadCtxOf(ctx).groups ?? [], {
-          timeoutMs: i.timeouts?.acceptanceMs,
-        });
-        if (!acc.passed) {
-          // Short-circuit: the repo gates are re-run next round anyway, and
-          // skipping them keeps this out of the "nothing configured" branch
-          // below, which would otherwise misreport configured-but-skipped
-          // commands as absent.
-          const accAttempts = fixAttemptCount(ctx, "fix_gate");
-          const failing = ["acceptance"];
-          if (accAttempts >= MAX_FIX_ATTEMPTS) {
-            return {
-              route: "escalate",
-              reason: `A later fix broke the feature's own contract: acceptance still failing after ${accAttempts} fix attempts.`,
-              ran: [],
-              failing,
-              output: acc.output,
-            };
-          }
-          return { route: "fix", ran: [], failing, output: acc.output };
-        }
-
-        const cmds = await loadQualityCommands(i.workdir);
-        const r = await runQualityGates(i.workdir, cmds, { timeoutMs: i.timeouts?.gateMs });
-        if (r.passed) return { route: "green", ran: r.ran, failing: r.failing, output: r.output };
-        // Nothing configured is not a pass — escalate immediately rather than
-        // open a "ready" PR having verified nothing. An LLM fix node cannot
-        // invent the repo's build/test commands.
-        if (r.ran.length === 0) {
-          return {
-            route: "escalate",
-            reason: "No quality.commands configured in .nax/config.json — nax-finish verified nothing.",
-            ran: r.ran,
-            failing: r.failing,
-            output: r.output,
-          };
-        }
-        const attempts = fixAttemptCount(ctx, "fix_gate");
-        if (attempts >= MAX_FIX_ATTEMPTS) {
-          return {
-            route: "escalate",
-            reason: `Quality gates still failing after ${attempts} fix attempts (${r.failing.join(", ")}).`,
-            ran: r.ran,
-            failing: r.failing,
-            output: r.output,
-          };
-        }
-        return { route: "fix", ran: r.ran, failing: r.failing, output: r.output };
-      },
+      run: qualityGatesNode,
     },
     open_pr: {
       nodeType: "action",
@@ -409,7 +299,24 @@ export default defineFlow({
         }
         // Every fix node edited the working tree; without this the PR would be
         // opened from a remote branch missing all of them.
-        const sync = await commitAndPush(i.workdir, i.branch, `fix(${i.feature}): nax-finish automated fixes`);
+        //
+        // Routed, not thrown. acpx has no error edge, so a throw here kills the
+        // flow — and this is the last node on the happy path, reached only once
+        // every gate is green and every fix has landed. It died before
+        // `writeResult`, so the plugin found no result file and notified
+        // nobody: the #1399 failure mode the `escalate` node was hardened
+        // against and this one was not. A protected branch, an expired token or
+        // a non-fast-forward push is exactly the kind of dead end `escalate`
+        // exists to report.
+        let sync: { committed: boolean };
+        try {
+          sync = await commitAndPush(i.workdir, i.branch, `fix(${i.feature}): nax-finish automated fixes`);
+        } catch (error) {
+          return {
+            route: "escalate",
+            reason: `nax-finish could not push "${i.branch}", so no PR was opened: ${String(error)}`,
+          };
+        }
 
         const fallbackTitle = `nax-finish: ${i.feature}`;
         const fallbackBody = `Automated finish of \`${i.feature}\`.`;
@@ -436,7 +343,18 @@ export default defineFlow({
           body = fallbackBody;
         }
 
-        const r = await openOrPromotePr(i.workdir, i.branch, title, body, forge);
+        // Same reasoning as the push above: a forge that refuses to create or
+        // promote (rate limit, revoked token, unrecognised remote) must reach a
+        // human through `escalate`, not take the flow down silently.
+        let r: { status: "opened" | "promoted" | "already-ready"; url?: string };
+        try {
+          r = await openOrPromotePr(i.workdir, i.branch, title, body, forge);
+        } catch (error) {
+          return {
+            route: "escalate",
+            reason: `nax-finish could not open or promote the PR for "${i.branch}": ${String(error)}`,
+          };
+        }
         await writeResult(i, { feature: i.feature, status: r.status, url: r.url });
         // The PR now exists with the mechanical narrative already in place.
         // Anything the narrative node does from here is an improvement on a
@@ -473,12 +391,14 @@ export default defineFlow({
             : routed.route_quality?.route === "escalate"
               ? routed.route_quality
               : undefined;
-        const loopExhausted =
-          outs.acceptance?.route === "escalate"
-            ? outs.acceptance
-            : outs.quality_gates?.route === "escalate"
-              ? outs.quality_gates
-              : undefined;
+        // Ordered by how far down the graph the node sits, so the *last* thing
+        // that gave up names the reason. `load_ctx` and `open_pr` are here
+        // because both can now route here rather than throw — a base ref that
+        // does not resolve, and a push or forge call that failed after every
+        // gate was green.
+        const loopExhausted = [outs.open_pr, outs.quality_gates, outs.acceptance, outs.load_ctx].find(
+          (o) => o?.route === "escalate",
+        );
         const reason =
           verdict?.escalationReason ?? loopExhausted?.reason ?? "nax-finish could not reach a green, shippable state";
 
@@ -526,7 +446,15 @@ export default defineFlow({
     },
   },
   edges: [
-    { from: "load_ctx", switch: { on: "$.route", cases: { proceed: "acceptance", "nothing-to-finish": "open_pr" } } },
+    {
+      from: "load_ctx",
+      switch: {
+        on: "$.route",
+        // `escalate`: the branch could not be measured against its base at all,
+        // so neither "proceed" nor "nothing-to-finish" would be a true claim.
+        cases: { proceed: "acceptance", "nothing-to-finish": "open_pr", escalate: "escalate" },
+      },
+    },
     {
       from: "acceptance",
       switch: { on: "$.route", cases: { proceed: "review_spec", fix: "fix_acceptance", escalate: "escalate" } },
@@ -586,7 +514,10 @@ export default defineFlow({
     },
     // The narrative runs only once the PR exists. acpx has no error edge, so an
     // acp node before `open_pr` would be able to fail the flow and cost the PR.
-    { from: "open_pr", switch: { on: "$.route", cases: { narrate: "narrative", done: "finish_done" } } },
+    {
+      from: "open_pr",
+      switch: { on: "$.route", cases: { narrate: "narrative", done: "finish_done", escalate: "escalate" } },
+    },
     { from: "narrative", to: "amend_body" },
   ],
 });