@nathapp/nax 0.87.0 → 0.88.0-canary.1

package/CHANGELOG.md

@@ -10,6 +10,131 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Fixed
+
+- **Run log, review round 2 (nax#2491).** The repeated-tool-error line releases its per-run ledger of reported
+  rows when the feature workflow ends, and the model preview shares one endpoint resolver with dispatch
+  (`resolveOpEndpoint`) so the two cannot drift.
+- **Run log and Duration, review round 1 (nax#2491, nax#2494).** The repeated-tool-error line now counts a row
+  only inside the step's own time window (each tool-audit row carries its timestamp; a row without one falls
+  back to its file's stamp) and reports each row once per run, so an ACP session that writes its audit file at
+  close is not blamed on the wrong step (an ACP step whose file is not written until later gets no line);
+  `Exec` calls are keyed by their argv and calls that name no target are never grouped. The model named on a
+  step start line follows the story's sticky ladder slot, so a story that already swapped away from a dead
+  primary names the endpoint it will use. `warnOnce` takes an optional discriminator, used for the
+  cross-protocol tier warning (per agent/tier) and the budget warnings, so distinct cases each warn once. A
+  flagged advisor decision that has no way to reach a human is logged at warn. The merged agent-call end line
+  only takes stream counters from a call that was running when the note's call ended, per run, and drops them
+  when the run's subscribers detach. The footer shows `+ end phase` only when the end phase took a second or
+  more. Known and kept: on `run.complete`, `costByStage`, `costByStory` and `errorCostUsd` (and
+  `RunResult.runCompletedAt`) still describe the stories phase, as `run:completed` does; `totalCost` and the
+  durations are the final, whole-run figures.
+- **Run log: advisor rulings, resolved models, quieter gates, tool-error outcomes (nax#2491 P4, P6-P8).**
+  Every advisor decision logs one `advisor` info line, `Advisor ruling [<caller>] <story>: <ruling, about 200
+  characters> (confidence <c>)`, and a flagged decision that has no way to reach a human says so on that same
+  line (`; flagged, no delivery channel`) instead of a separate warning that named nothing. The end-of-feature
+  block lists the decisions under its count, or prints `Advisor decisions this feature: (none)`. The resolved
+  model is named on the story header (`4/7 • medium • fast -> native·<model>`, in pipeline mode too) and on
+  the start line of each workflow implementer, fix, story-review, re-review, branch-review, branch-fix and
+  branch-rereview step (`agentName` / `model`, rendered `native·<model>`), so a fix round that steps up a tier
+  shows the new model. A story's gates log ONE line, `US-004 gates lint ✓ 2.1s · typecheck ✓ 1.3s · scoped
+  tests ✓ 4.7s (12 tests)` (the count is tests passed; the scoped run does not report a file count), expanded
+  per gate with the findings when one is red; the quality runner's own `Running <gate>` / `<gate> completed`
+  pairs are debug inside the workflow gates. Warnings that every story repeated (canonical-rules budget,
+  feature-context budget, dependency-fragment budget, the cross-protocol tier resolution) warn once per run and
+  go to debug afterwards. The two agent-call end lines are one: `middleware Agent call complete` carries the
+  stream's status and activity counters, and `agent-stream Agent call ended` is debug. After a workflow agent
+  step whose session logged three or more identical tool errors (same tool, same Bash exit code, same target;
+  the tool audit does not store the error text) one line says what followed, for example `branch-fix: 4 Edit
+  errors on src/a.ts, then succeeded via Write` or `, then gave up`. That last line reads the tool audit after
+  a workflow step and is workflow-mode only.
+- **Pipeline mode: Duration includes the end phase (nax#2494).** `Duration` (footer, exit summary,
+  `RunResult.durationMs`, `run.complete`, `metrics.json` `totalDurationMs`) used to stop before the end phase
+  (finish, etc.), so pipeline and workflow runs measured different spans. Pipeline `Duration` now runs through
+  the end phase, and the footer shows the split: `stories 139m 53s + end phase 17m 35s`. `run.complete` is held
+  back until the end phase is done in both modes (still exactly once, through the same gate) and carries
+  `storiesDurationMs` and `endPhaseDurationMs` (workflow mode keeps `featureWorkflowDurationMs`); the saved
+  `metrics.json` record is rewritten with the whole-run `totalDurationMs`, the split and the final `totalCost`
+  and `completedAt`. The `run:completed` event (reporters, the on-complete hook) deliberately stays where it
+  is, before the end phase, in both modes: it fires with the stories-only duration and cost, and is not
+  re-fired. If a late completion step throws, the held-back `run.complete` line is still written before the
+  error propagates.
+- **Workflow mode: the run log shows decisions, and Duration covers the feature workflow (nax#2491).**
+  `Duration` and `run.complete` used to stop at the last story and leave out the feature workflow (repo
+  gates, branch review, branch fix, re-review, final gates, publish), undercounting a run by 10-16%. They now
+  run through the end of the feature workflow, and the summary shows the parts: `stories 139m 53s + feature
+  workflow 17m 35s` (`run.complete` also carries `storiesDurationMs` and `featureWorkflowDurationMs`). The
+  `workflow` log tag now says what was decided: every ledger append is mirrored to the log (one helper at
+  all write points); each implementer, story-review, fix and re-review call is labelled with its step and
+  round, with the review verdict and finding count on one line and the per-finding re-review result; the
+  feature workflow logs one line per step (repo gates, branch-review finding counts by severity, branch fix,
+  re-review addressed/not addressed, final gates, publish outcome). The end-of-run summary adds a workflow
+  block built from `result.json`: tokens and cost by role, rounds per story, branch findings found / fixed /
+  left, and the publish outcome. Advisor content on log lines, resolved models, gate-line and warning noise
+  reduction and the repeated-tool-error outcome line (P4, P6-P8 of the issue) followed in the next entry.
+  In workflow mode the saved `metrics.json` record is rewritten after the feature workflow with the
+  whole-run `totalDurationMs` plus `storiesDurationMs` and `featureWorkflowDurationMs`, and the `run.complete`
+  line carries the final cost and a `success` that follows the workflow result. The `run:completed` event
+  (reporters, the on-complete hook) still fires before the feature workflow, so it sees the stories-only
+  duration and cost. Pipeline mode follows the same rule since nax#2494 (see above). Ledger lines the step lines already state are no
+  longer mirrored to the log (`ledger.md` keeps them), and mirrored text is capped at 200 characters.
+- **A hidden `.nax/` index flag no longer outlives the run (#2490).** At run end (completion phase, the runner's finally block, and fatal-signal teardown) nax clears `skip-worktree` / `assume-unchanged` on any `.nax` path (root or nested) and logs a warning, so the PRD an agent hid from git is committed again.
+- **Workflow mode: the run tree moves into the repo (nax#2479).** Briefs, reports, review packages, the
+  ledger and `result.json` now live under `.nax/features/<feature>/workflow/<runId>/` instead of
+  `<outputDir>/<project>/workflow/`, which sat outside the agents' file-tool root: implementers could not
+  write `report.md` and reviewers could not read their brief, report or diff package. The tree is
+  git-ignored (new `NAX_GITIGNORE_ENTRIES` entry, reconciled into `.git/info/exclude` at run start).
+  Agents still may not write `.nax/`: the implementer and branch-fix ops declare their one report as
+  the new `writableOutput`, a path-exact owned-write exemption that, unlike `fileOutput`, leaves the
+  reply untouched. The writing prompts now say evidence belongs in the report, not in new repo files.
+  Workflow records left by an earlier run under the old location are not migrated. Workflow mode now also forces
+  `execution.storyIsolation: "shared"`, since the tree and its git reads sit in the main checkout.
+
+- **Workflow mode: one run writes one run folder (nax#2482).** The pre-flight and the feature workflow keyed the run folder on the runner run id while the story loop used the runtime run id, so each run's ledger and result.json were split across two sibling folders. All phases now use `runtime.runId`.
+
+- **Workflow mode: a red final gate keeps its output (nax#2484).** The final gates recorded only the names of the failing commands, so a red final gate could not be diagnosed after the run. The per-gate output excerpts are now kept in `featureWorkflow.finalGateFindings` in `result.json`, the ledger line points at them, and the PR body shows them under the gates line.
+- **Workflow mode: story and branch reviews check contracts that span stories (nax#2486).** The story review read only its own diff and the test evidence, so a limit one story accepts was never checked against storage an earlier story created. It now walks each acceptance criterion against the current code (the diff finds the changed paths, it is not the only source of truth), follows the data to its schema, migrations, DTOs and shared types, lists the files it opened in `inspectedFiles`, and quotes an `observed` excerpt for every critical or important finding about code behaviour (a missing-test finding names the AC and the test file instead); the excerpt is carried to the fix prompt. The branch review gains a storage-against-contracts remit. When a review package is truncated it now ends with every omitted file by its verbatim path (which `--stat` shortens), plus the file the cut went through, marked partially shown.
+- **Workflow mode: the story review keeps `inspectedFiles` in `review.json` (#2488).** The reviewer's list of files it opened was dropped when the reply was parsed, so `review.json` never carried it.
+
+### Added
+
+- **Workflow mode feature workflow (A5 PR4).** With `execution.mode: "workflow"`, the advisor pre-flight
+  runs once before the first story, and after the last story one feature workflow runs: repo gates, one
+  whole-branch review (cross-story integration, reachability, consistency, triage of every deferred minor),
+  exactly one branch fix, one scoped re-review, an advisor ruling on whatever is still open, gates again,
+  then push, a draft PR, a CI wait (a timeout is `pending`, never `failed`), advisor approval, and the PR
+  promoted to ready only when every gate is green, CI did not fail, no story is gate-open or not run, no
+  ruling is flagged and the branch review ran. nax never merges. The run's success includes the feature
+  workflow; `status.json` gains a `workflow` block; `result.json` gains the resumable feature record and
+  per-role token totals. Finish and the deferred regression gate do not run in workflow mode.
+  A crash during the branch fix re-runs the fix on resume; a re-run at the same HEAD skips a finished (ready or
+  draft) feature but retries a local-only one.
+- Workflow mode advisor kinds (A5 PR3): the implementer's NEEDS_CONTEXT / BLOCKED question is answered
+  by the advisor into the same session (at most twice per story); at the fix-round cap the open items
+  get one batched advisor ruling each (park as reviewer-wrong, defer to the branch review, carry an
+  instruction into dependent stories, or flag for a human), with a diagnosis per red gate; and a
+  pre-flight batch (run by PR4 at run start) rules on spec/AC conflicts and writes `preflight.json`.
+  Every ruling is a standard decision in `decisions.jsonl`; pre-flight rulings and carried
+  instructions appear in the briefs of the stories they apply to. New advisor actions `answer` and
+  `carry`, and `adviseBatch` for one-call batches over the model ladder.
+- **Workflow mode story loop (A5 PR2).** With `execution.mode: "workflow"`, each story runs one implementer
+  (TDD with evidence), lint/typecheck/scoped gates, a story review, and up to `workflow.maxFixRounds`
+  fix rounds (warm for the first three, then fresh one tier up) with scoped re-reviews, then the full
+  suite. Stories always close as `complete`, `complete-with-rulings` or `complete-gate-open`. Writes
+  `workflow/<feature>/<runId>/ledger.md`, `result.json` and per-story briefs, reports, reviews and diff
+  packages, and resumes a story mid-loop after a crash. Advisor calls use their deterministic defaults
+  until PR3.
+- **Workflow mode config (`execution.mode: "workflow"`), inert until the workflow runner lands.** The key is accepted
+  and normalised on every merged config (root chain and per-package overlays): acceptance is forced off, the advisor
+  forced on, one warning names what was overridden, and `--parallel` is clamped to sequential. The default
+  `"pipeline"` mode is untouched and returns the config unchanged.
+- **Provider-scoped quota cooldown.** A `fail-quota` failure now parks only the exhausted provider (every model id of
+  that provider) for the rest of the run, instead of cooling down the whole native agent.
+- **Token-plan 429 classification.** Usage-limit and token-plan 429 responses are classified as `fail-quota` rather
+  than a transient rate limit, so they fall back instead of retrying against a dead plan.
+- **Advisor `fallbackModels` ladder.** `advisor.fallbackModels` lists models tried in order when the primary advisor
+  model fails or is cooling down; each attempt is recorded in the advisor audit entry.
+
 ### Breaking
 
 - **nax now requires explicit folder trust before it runs repository-controlled code.** A gated command