@overdeck/desktop 0.45.16 → 0.45.19

package/server/{verification-runner-CMT5WRMS.js → verification-runner-32y8NRfL.js}

@@ -1,18 +1,187 @@
-import { Fn as init_projects, Sn as findProjectByPathSync } from "./config-yaml-cNOZcEww.js";
-import { c as init_review_status, f as markWorkspaceStuck, s as getReviewStatusSync, y as setReviewStatusSync } from "./review-status-Dc1l4dVz.js";
-import { K as stopAgent, Yn as setAgentPaused, j as messageAgent, t as init_agents } from "./agents-B9GwfCyp.js";
-import { o as init_io, t as VBriefMergeConflictError } from "./io-VEGSAqsd.js";
-import { a as writeFeedbackFile, i as init_feedback_writer } from "./feedback-writer-D20HSXre.js";
-import { n as resolveIssueFeedbackTarget, r as surfaceIssueFeedbackNeedsYou, t as init_feedback_target } from "./feedback-target-CwyWf0Dg.js";
-import { a as getVBriefACStatusSync } from "./beads-BeSMEjGT.js";
-import { n as init_validation, r as runQualityGates, t as DEFAULT_GATES } from "./validation-CsPVsoA0.js";
-import { Effect } from "effect";
+import { Fn as init_projects, Jr as getOverdeckHome, Sn as findProjectByPathSync, Sr as init_errors, Yr as init_paths, Zr as packageRoot, cn as init_state_plane, qn as resolveProjectFromIssueSync, rr as init_issue_id } from "./config-yaml-BQs6GbD_.js";
+import { C as init_review_status_source, c as init_review_status, f as markWorkspaceStuck, s as getReviewStatusSync, w as readReviewStatusMap, y as setReviewStatusSync } from "./review-status-By86XA6Z.js";
+import { L as messageAgent, Q as stopAgent, Xn as setAgentPaused, s as init_agents } from "./queries-srgusoi8.js";
+import { n as init_tracker_utils } from "./tracker-utils-Cl-Eaqrv.js";
+import { m as readWorkspacePlanSync, o as init_io, t as VBriefMergeConflictError, v as init_types, y as subItemsOf } from "./io-Cv9xQTks.js";
+import { n as init_shadow_utils } from "./shadow-utils-DqMLnRgQ.js";
+import { a as writeFeedbackFile, i as init_feedback_writer } from "./feedback-writer-BujzReaQ.js";
+import { n as resolveIssueFeedbackTarget, r as surfaceIssueFeedbackNeedsYou, t as init_feedback_target } from "./feedback-target-Chd5dm-Q.js";
+import { i as runQualityGates, n as init_validation, t as DEFAULT_GATES } from "./validation-xAD7y5vW.js";
+import { r as writeVerificationArtifact, t as readVerificationArtifact } from "./verification-artifact-DK1xb1zG.js";
+import { n as getVBriefACStatusSync } from "./acceptance-criteria-DQqRIuQ-.js";
+import { join } from "node:path";
+import { Data, Effect } from "effect";
 import { existsSync } from "fs";
-import { basename, dirname, join } from "path";
+import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
 import { homedir } from "os";
+import { closeSync as closeSync$1, existsSync as existsSync$1, mkdirSync as mkdirSync$1, openSync as openSync$1, readFileSync as readFileSync$1, renameSync as renameSync$1, writeFileSync as writeFileSync$1 } from "node:fs";
 import { readdir } from "fs/promises";
-import { exec } from "child_process";
-import { promisify } from "util";
+import { exec, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { exec as exec$1 } from "child_process";
+import { promisify as promisify$1 } from "util";
+//#region ../../lib/cloister/verification-feedback.ts
+init_errors();
+init_review_status_source();
+init_review_status();
+init_validation();
+function buildFinalFailureInstructions(issueId) {
+	return `## NEEDS-YOU: Verification stuck
+
+Automatic verification paused after repeated failures so it does not keep spending cycles on the same failing gate.
+
+Fix every reported failure, commit and push the corrections, then run \`pan done ${issueId} -c "<summary>"\`. That command resets verification and returns the latest commit to the normal review, test, and merge pipeline. If you cannot complete the fixes, report the concrete blocker for operator help.`;
+}
+//#endregion
+//#region ../../lib/cloister/verification-worker-supervisor.ts
+init_paths();
+const POLL_MS = 250;
+const MAX_RUN_MS = 3900 * 1e3;
+function safeIssueId(issueId) {
+	return issueId.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+}
+function workerDir(issueId) {
+	return join(getOverdeckHome(), "verification-workers", safeIssueId(issueId));
+}
+function statePath(issueId) {
+	return join(workerDir(issueId), "state.json");
+}
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function readVerificationWorkerState(issueId) {
+	try {
+		const parsed = JSON.parse(readFileSync$1(statePath(issueId), "utf8"));
+		return parsed.issueId === issueId && Number.isInteger(parsed.pid) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function isVerificationWorkerActive(issueId) {
+	const state = readVerificationWorkerState(issueId);
+	return !!state && isProcessAlive(state.pid) && !existsSync$1(state.resultPath);
+}
+function writeJsonAtomic(path, value) {
+	const temp = `${path}.${process.pid}.tmp`;
+	writeFileSync$1(temp, `${JSON.stringify(value, null, 2)}\n`);
+	renameSync$1(temp, path);
+}
+async function waitForResult(state) {
+	const deadline = Date.now() + MAX_RUN_MS;
+	while (Date.now() < deadline) {
+		if (existsSync$1(state.resultPath)) return JSON.parse(readFileSync$1(state.resultPath, "utf8"));
+		if (!isProcessAlive(state.pid)) return {
+			outcome: "error",
+			message: `Verification worker ${state.pid} exited before writing a result`
+		};
+		await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+	}
+	return {
+		outcome: "error",
+		message: `Verification worker ${state.pid} exceeded ${MAX_RUN_MS}ms`
+	};
+}
+async function runSupervisedVerification(issueId, workspacePath, workspaceInfo, logPrefix, options = {}) {
+	const existing = readVerificationWorkerState(issueId);
+	if (existing && existing.workspacePath === workspacePath && isProcessAlive(existing.pid) && !existsSync$1(existing.resultPath)) {
+		console.log(`[${logPrefix}] Joining live verification worker ${existing.pid} for ${issueId}`);
+		return waitForResult(existing);
+	}
+	const dir = workerDir(issueId);
+	mkdirSync$1(dir, { recursive: true });
+	const runId = `${Date.now()}-${process.pid}`;
+	const resultPath = join(dir, `result-${runId}.json`);
+	const logPath = join(dir, `worker-${runId}.log`);
+	const workerPath = process.env.OVERDECK_VERIFICATION_WORKER_PATH || join(packageRoot, "dist", "verification-worker.js");
+	if (!existsSync$1(workerPath)) return {
+		outcome: "error",
+		message: `Verification worker bundle missing at ${workerPath}; run npm run build`
+	};
+	const logFd = openSync$1(logPath, "a");
+	const child = spawn(process.execPath, [workerPath, JSON.stringify({
+		issueId,
+		workspacePath,
+		workspaceInfo,
+		logPrefix,
+		options,
+		runId,
+		resultPath
+	})], {
+		detached: true,
+		stdio: [
+			"ignore",
+			logFd,
+			logFd
+		],
+		env: {
+			...process.env,
+			OVERDECK_VERIFICATION_WORKER: "1"
+		}
+	});
+	closeSync$1(logFd);
+	if (!child.pid) return {
+		outcome: "error",
+		message: "Failed to spawn verification worker"
+	};
+	const state = {
+		runId,
+		issueId,
+		workspacePath,
+		pid: child.pid,
+		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		resultPath
+	};
+	writeJsonAtomic(statePath(issueId), state);
+	child.unref();
+	console.log(`[${logPrefix}] Verification worker ${child.pid} supervising ${issueId}`);
+	return waitForResult(state);
+}
+//#endregion
+//#region ../../lib/work/test-requirement-gate.ts
+init_projects();
+init_state_plane();
+init_types();
+init_io();
+init_agents();
+init_feedback_writer();
+init_feedback_target();
+/**
+* Pure helpers for the PAN-1501 test-requirement gate.
+*
+* The gate detects when an issue's body asks for tests but the feature branch
+* adds no new lines under test files. This module holds the pure functions only;
+* orchestration lives in done-preflight.ts.
+*/
+init_issue_id();
+init_shadow_utils();
+init_tracker_utils();
+promisify$1(exec$1);
+Data.TaggedError("TrackerFetchError");
+//#endregion
+//#region ../../lib/work/done-preflight.ts
+init_errors();
+promisify(exec);
+const terminal = new Set(["completed", "cancelled"]);
+function checkIncompletePlanItemsSync(workspacePath) {
+	const doc = readWorkspacePlanSync(workspacePath);
+	if (!doc) return ["  The required vBRIEF checklist is missing or unreadable; return the issue to planning before completion."];
+	const incomplete = doc.plan.items.flatMap((item) => {
+		const lines = [];
+		if (!terminal.has(item.status)) lines.push(`    - ${item.id} ${item.title} (${item.status})`);
+		for (const child of subItemsOf(item)) if (!terminal.has(child.status)) lines.push(`    - ${item.id}.${child.id} ${child.title} (${child.status})`);
+		return lines;
+	});
+	return incomplete.length === 0 ? [] : [`  Incomplete plan items (${incomplete.length}):`, ...incomplete];
+}
+async function checkIncompletePlanItemsPromise(workspacePath, _issueId) {
+	return checkIncompletePlanItemsSync(workspacePath);
+}
+//#endregion
 //#region ../../lib/cloister/verification-runner.ts
 /**
 * Verification Runner — orchestrates the full verification gate lifecycle.
@@ -23,14 +192,8 @@ import { promisify } from "util";
 *
 * Extracted from dashboard/server to be independently testable.
 */
-init_review_status();
-init_validation();
-init_feedback_writer();
-init_feedback_target();
-init_agents();
-init_projects();
 init_io();
-const execAsync = promisify(exec);
+const execAsync = promisify$1(exec$1);
 const NO_PROGRESS_REPEAT_THRESHOLD = 2;
 function isFinalVerificationAttempt(cycleCount) {
 	return cycleCount >= 3;
@@ -42,13 +205,6 @@ function shouldEscalateVerificationFailure(status, failedCheck, cycleCount) {
 	if (isFinalVerificationAttempt(cycleCount)) return true;
 	return cycleCount >= NO_PROGRESS_REPEAT_THRESHOLD && isRepeatFailedCheck(status, failedCheck);
 }
-function buildFinalFailureInstructions(issueId) {
-	return `## NEEDS-YOU: Verification stuck
-
-This was the final allowed verification attempt. The work agent is paused so it does not keep spending cycles on the same failing gate.
-
-An operator needs to inspect ${issueId}, decide whether to fix-forward manually, restart the agent with new instructions, or move the issue through the normal pipeline. Do not re-request review automatically.`;
-}
 function setStateDerivedVerificationFailure(issueId, failedCheck, summary, cycleCount, currentStatus) {
 	setReviewStatusSync(issueId, {
 		verificationStatus: "failed",
@@ -81,10 +237,58 @@ async function escalateVerificationStuck(issueId, failedCheck, cycleCount, summa
 		console.error(`[${logPrefix}] Failed to pause ${agentId} after verification stuck:`, err);
 	}
 }
+/**
+* Boot reconciliation for interrupted verifications. Live supervised workers
+* survive dashboard restarts and retain ownership of their running status.
+* A running status without a live worker is orphaned, so reset it to pending
+* and finalize the artifact rather than leaving the issue wedged forever.
+*/
+function reconcileInterruptedVerifications(logPrefix = "boot-reconciliation") {
+	let reset = 0;
+	try {
+		const statuses = readReviewStatusMap() ?? {};
+		for (const [issueId, status] of Object.entries(statuses)) {
+			if (status.verificationStatus !== "running") continue;
+			if (isVerificationWorkerActive(issueId)) {
+				console.log(`[${logPrefix}] preserved live supervised verification for ${issueId}`);
+				continue;
+			}
+			setReviewStatusSync(issueId, {
+				verificationStatus: "pending",
+				verificationNotes: "The supervised verification worker stopped before recording a result; verification re-runs on the next cycle."
+			});
+			reset += 1;
+			try {
+				const resolved = resolveProjectFromIssueSync(issueId);
+				const workspacePath = resolved ? join$1(resolved.projectPath, "workspaces", `feature-${issueId.toLowerCase()}`) : null;
+				const artifact = workspacePath ? readVerificationArtifact(workspacePath) : null;
+				if (workspacePath && artifact?.outcome === "running") writeVerificationArtifact(workspacePath, issueId, [...artifact.gates.map((gate) => ({
+					name: gate.name,
+					passed: gate.passed,
+					required: gate.required,
+					output: gate.output ?? "",
+					durationMs: gate.durationMs,
+					...gate.error ? { error: gate.error } : {}
+				})), {
+					name: artifact.currentGate ?? "interrupted",
+					passed: false,
+					required: true,
+					output: "The supervised verification worker stopped unexpectedly before this gate finished.",
+					durationMs: 0,
+					error: "supervised verification worker stopped unexpectedly"
+				}]);
+			} catch {}
+			console.log(`[${logPrefix}] reset stale running verification for ${issueId} (PAN-2669)`);
+		}
+	} catch (err) {
+		console.warn(`[${logPrefix}] interrupted-verification sweep failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return reset;
+}
 async function deliverVerificationFeedback(issueId, message, details, logPrefix) {
 	const target = await resolveIssueFeedbackTarget(issueId);
 	if ("agentId" in target) {
-		await messageAgent(target.agentId, message);
+		await messageAgent(target.agentId, message, "internal", { owesRework: true });
 		console.log(`[${logPrefix}] Sent verification feedback for ${issueId} to ${target.agentId}`);
 		return;
 	}
@@ -94,20 +298,20 @@ async function deliverVerificationFeedback(issueId, message, details, logPrefix)
 	});
 }
 async function resolveGitDirs(workspacePath, projectConfig) {
-	if (!(projectConfig?.workspace?.type === "polyrepo") && existsSync(join(workspacePath, ".git"))) return {
+	if (!(projectConfig?.workspace?.type === "polyrepo") && existsSync(join$1(workspacePath, ".git"))) return {
 		gitDirs: [workspacePath],
 		isPolyrepo: false
 	};
 	const gitDirs = [];
 	try {
 		const entries = await readdir(workspacePath, { withFileTypes: true });
-		for (const entry of entries) if (entry.isDirectory() && !entry.name.startsWith(".") && existsSync(join(workspacePath, entry.name, ".git"))) gitDirs.push(join(workspacePath, entry.name));
+		for (const entry of entries) if (entry.isDirectory() && !entry.name.startsWith(".") && existsSync(join$1(workspacePath, entry.name, ".git"))) gitDirs.push(join$1(workspacePath, entry.name));
 	} catch {}
 	if (gitDirs.length > 0) return {
 		gitDirs,
 		isPolyrepo: true
 	};
-	if (existsSync(join(workspacePath, ".git"))) return {
+	if (existsSync(join$1(workspacePath, ".git"))) return {
 		gitDirs: [workspacePath],
 		isPolyrepo: false
 	};
@@ -117,7 +321,7 @@ async function resolveGitDirs(workspacePath, projectConfig) {
 	};
 }
 async function syncSingleRepo(gitDir, targetBranch) {
-	const repoName = basename(gitDir);
+	const repoName = basename$1(gitDir);
 	try {
 		await execAsync(`git fetch origin ${targetBranch}`, {
 			cwd: gitDir,
@@ -188,8 +392,8 @@ function getSyncTargetBranch(workspacePath, projectConfig, repoName) {
 		const matchingRepo = projectConfig.workspace?.repos?.find((repo) => repo.name === repoName);
 		return matchingRepo?.pr_target || projectConfig.workspace?.pr_target || matchingRepo?.default_branch || projectConfig.workspace?.default_branch || "main";
 	}
-	const wsName = basename(workspacePath);
-	const matchingRepo = projectConfig.workspace?.repos?.find((repo) => repo.name === wsName || basename(repo.path) === wsName);
+	const wsName = basename$1(workspacePath);
+	const matchingRepo = projectConfig.workspace?.repos?.find((repo) => repo.name === wsName || basename$1(repo.path) === wsName);
 	return matchingRepo?.pr_target || projectConfig.workspace?.pr_target || matchingRepo?.default_branch || projectConfig.workspace?.default_branch || "main";
 }
 /**
@@ -201,7 +405,7 @@ function getSyncTargetBranch(workspacePath, projectConfig, repoName) {
 * sync-sources/, config) counts as content and is NOT flagged.
 */
 function changesetHasNoContent(changedFiles) {
-	return changedFiles.map((f) => f.trim()).filter(Boolean).filter((f) => !f.startsWith(".pan/") && !f.startsWith(".beads/") && !f.endsWith(".vbrief.json")).length === 0;
+	return changedFiles.map((f) => f.trim()).filter(Boolean).filter((f) => !f.startsWith(".pan/") && !f.endsWith(".vbrief.json")).length === 0;
 }
 async function runVerificationForIssuePromise(issueId, workspacePath, workspaceInfo, logPrefix, options = {}) {
 	const currentStatus = getReviewStatusSync(issueId);
@@ -224,9 +428,9 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 		else {
 			const syncResults = [];
 			for (const gitDir of gitDirs) {
-				const repoName = isPolyrepo ? basename(gitDir) : void 0;
+				const repoName = isPolyrepo ? basename$1(gitDir) : void 0;
 				const targetBranch = getSyncTargetBranch(workspacePath, projectConfig, repoName);
-				const displayName = repoName || basename(workspacePath);
+				const displayName = repoName || basename$1(workspacePath);
 				console.log(`[${logPrefix}] Syncing ${targetBranch} into ${displayName} for ${issueId}...`);
 				syncResults.push(await syncSingleRepo(gitDir, targetBranch));
 			}
@@ -254,8 +458,8 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 					}));
 					if (fileResult.success) {
 						const hasConflicts = failures.some((f) => f.hasConflicts);
-						const repoList = isPolyrepo ? failures.map((f) => f.repoName).join(", ") : basename(workspacePath);
-						await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck}${hasConflicts ? " — merge conflicts" : ""} in ${repoList} after ${newCycleCount}/3 attempts.\n\nMUST READ: ${fileResult.filePath}\n\nYou are paused for operator intervention. Do not re-request review automatically.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck}${hasConflicts ? " — merge conflicts" : ""} in ${repoList}.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, fix the sync issues, commit and push every change, then request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
+						const repoList = isPolyrepo ? failures.map((f) => f.repoName).join(", ") : basename$1(workspacePath);
+						await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck}${hasConflicts ? " — merge conflicts" : ""} in ${repoList} after repeated attempts.\n\nMUST READ: ${fileResult.filePath}\n\nFix every reported failure, commit and push the corrections, then run pan done ${issueId} -c "<summary>" to reset verification and return the latest commit to the normal pipeline.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck}${hasConflicts ? " — merge conflicts" : ""} in ${repoList}.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, fix the sync issues, commit and push every change, then request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
 							failedCheck,
 							feedbackPath: fileResult.filePath
 						}, logPrefix);
@@ -271,7 +475,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 				};
 			}
 			for (const result of syncResults) {
-				const displayName = isPolyrepo ? result.repoName : basename(workspacePath);
+				const displayName = isPolyrepo ? result.repoName : basename$1(workspacePath);
 				if (result.alreadyUpToDate) console.log(`[${logPrefix}] ${displayName}: Already up to date with ${result.targetBranch}`);
 				else console.log(`[${logPrefix}] ${displayName}: Merged latest ${result.targetBranch}`);
 			}
@@ -279,20 +483,20 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 		else console.log(`[${logPrefix}] Skipping target-branch sync for ${issueId}; verifying current workspace state`);
 		const gates = projectConfig?.quality_gates && Object.keys(projectConfig.quality_gates).length > 0 ? projectConfig.quality_gates : DEFAULT_GATES;
 		console.log(`[${logPrefix}] Project: ${projectConfig?.name || "NOT FOUND"}, gates: [${Object.keys(gates).join(", ")}], workspace: ${workspacePath}`);
-		const featureFolder = basename(workspacePath);
+		const featureFolder = basename$1(workspacePath);
 		const featureName = featureFolder.replace(/^feature-/, "");
-		const projectPath = projectConfig?.path || dirname(dirname(workspacePath));
+		const projectPath = projectConfig?.path || dirname$1(dirname$1(workspacePath));
 		const domain = projectConfig?.workspace?.dns?.domain || "localhost";
 		const changedBase = `origin/${getSyncTargetBranch(workspacePath, projectConfig, void 0)}`;
 		const placeholders = {
 			FEATURE_NAME: featureName,
 			FEATURE_FOLDER: featureFolder,
 			BRANCH_NAME: `feature/${featureName}`,
-			COMPOSE_PROJECT: `${basename(projectPath)}-${featureFolder}`,
+			COMPOSE_PROJECT: `${basename$1(projectPath)}-${featureFolder}`,
 			DOMAIN: domain,
-			PROJECT_NAME: basename(projectPath),
+			PROJECT_NAME: basename$1(projectPath),
 			PROJECT_PATH: projectPath,
-			PROJECTS_DIR: dirname(projectPath),
+			PROJECTS_DIR: dirname$1(projectPath),
 			WORKSPACE_PATH: workspacePath,
 			HOME: homedir(),
 			CHANGED_BASE: changedBase
@@ -313,7 +517,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 			}
 			const workspacePackages = projectConfig?.workspace_packages;
 			if (workspacePackages) for (const pkg of workspacePackages) {
-				const pkgPath = join(workspacePath, pkg.path);
+				const pkgPath = join$1(workspacePath, pkg.path);
 				try {
 					console.log(`[${logPrefix}] Building workspace package: ${pkg.path}`);
 					await execAsync(pkg.build_command, {
@@ -326,20 +530,56 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 				}
 			}
 		} else console.log(`[${logPrefix}] Polyrepo workspace — per-repo dependencies managed by quality gates`);
-		const failedGate = (await Effect.runPromise(runQualityGates(gates, workspacePath, "pre_push", {
+		const liveGateResults = [];
+		let liveGateName;
+		let liveGateTail = "";
+		let lastTailWriteMs = 0;
+		const writeLiveArtifact = () => {
+			try {
+				writeVerificationArtifact(workspacePath, issueId, liveGateResults, {
+					currentGate: liveGateName,
+					currentGateOutput: liveGateTail || void 0
+				});
+			} catch {}
+		};
+		writeLiveArtifact();
+		const gateResults = await Effect.runPromise(runQualityGates(gates, workspacePath, "pre_push", {
 			isRemote: workspaceInfo.isRemote,
 			vmName: workspaceInfo.vmName,
 			placeholders,
-			...options.onGateLog ? { onLog: options.onGateLog } : {}
-		}))).find((r) => !r.passed && r.required !== false);
+			...options.onGateLog ? { onLog: options.onGateLog } : {},
+			onGateStart: (name) => {
+				liveGateName = name;
+				liveGateTail = "";
+				writeLiveArtifact();
+			},
+			onGateOutput: (_name, chunk) => {
+				liveGateTail = (liveGateTail + chunk.replace(/\u001b\[[0-9;]*[A-Za-z]/g, "")).slice(-4e3);
+				const now = Date.now();
+				if (now - lastTailWriteMs >= 1e3) {
+					lastTailWriteMs = now;
+					writeLiveArtifact();
+				}
+			},
+			onGateResult: (result) => {
+				liveGateResults.push(result);
+				liveGateName = void 0;
+				liveGateTail = "";
+				writeLiveArtifact();
+			}
+		}));
+		const failedGate = gateResults.find((r) => !r.passed && r.required !== false);
 		if (failedGate?.infraUnavailable) {
+			try {
+				writeVerificationArtifact(workspacePath, issueId, gateResults);
+			} catch {}
 			console.warn(`[${logPrefix}] Gate "${failedGate.name}" could not run for ${issueId}: ${failedGate.error} — triggering workspace stack rebuild, attempt NOT counted (${currentCycles}/3 used)`);
 			setReviewStatusSync(issueId, {
 				verificationStatus: "pending",
 				verificationNotes: `Verification deferred: ${failedGate.error}. Workspace stack rebuild triggered; verification re-runs on the next cycle.`
 			});
 			try {
-				const { rebuildWorkspaceStack } = await import("./rebuild-stack-nGD_nPZo.js");
+				const { rebuildWorkspaceStack } = await import("./rebuild-stack-Dsm9WjKv.js");
 				Effect.runPromise(rebuildWorkspaceStack(issueId, { onProgress: (m) => console.log(`[${logPrefix}] ${issueId} stack rebuild: ${m}`) })).then((r) => {
 					if (!r.success) console.warn(`[${logPrefix}] Stack rebuild for ${issueId} failed: ${r.error}`);
 				});
@@ -353,6 +593,11 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 				maxCycles: 3
 			};
 		}
+		try {
+			writeVerificationArtifact(workspacePath, issueId, gateResults);
+		} catch (artifactErr) {
+			console.warn(`[${logPrefix}] Could not write verification artifact for ${issueId}: ${artifactErr.message}`);
+		}
 		if (failedGate) {
 			const newCycleCount = currentCycles + 1;
 			const failedCheck = failedGate.name;
@@ -378,7 +623,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 					summary: `Verification FAILED at ${failedCheck} (attempt ${newCycleCount}/3)`,
 					markdownBody: feedbackBody
 				}));
-				if (fileResult.success) await deliverVerificationFeedback(issueId, shouldEscalate ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after ${newCycleCount}/3 attempts.\n\nMUST READ: ${fileResult.filePath}\n\nYou are paused for operator intervention. Do not re-request review automatically.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck}.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, fix the failing check, commit every change, and invoke /rebase-and-submit. The skill will push and request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
+				if (fileResult.success) await deliverVerificationFeedback(issueId, shouldEscalate ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after repeated attempts.\n\nMUST READ: ${fileResult.filePath}\n\nFix every reported failure, commit and push the corrections, then run pan done ${issueId} -c "<summary>" to reset verification and return the latest commit to the normal pipeline.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck}.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, fix the failing check, commit every change, and invoke /rebase-and-submit. The skill will push and request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
 					failedCheck,
 					feedbackPath: fileResult.filePath
 				}, logPrefix);
@@ -412,7 +657,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 						summary: `vBRIEF plan has merge conflicts (attempt ${newCycleCount}/3)`,
 						markdownBody: feedbackBody
 					}));
-					if (fileResult.success) await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after ${newCycleCount}/3 attempts.\n\nMUST READ: ${fileResult.filePath}\n\nYou are paused for operator intervention. Do not re-request review automatically.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck} — plan.vbrief.json has merge conflict markers.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, resolve the merge conflict markers, commit and push the fix, then request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
+					if (fileResult.success) await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after repeated attempts.\n\nMUST READ: ${fileResult.filePath}\n\nFix every reported failure, commit and push the corrections, then run pan done ${issueId} -c "<summary>" to reset verification and return the latest commit to the normal pipeline.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck} — plan.vbrief.json has merge conflict markers.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, resolve the merge conflict markers, commit and push the fix, then request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
 						failedCheck,
 						feedbackPath: fileResult.filePath
 					}, logPrefix);
@@ -438,7 +683,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 			const summary = `Acceptance criteria check FAILED — ${acStatus.totalPending}/${acStatus.totalCount} AC incomplete:\n\n${incompleteList}`;
 			setStateDerivedVerificationFailure(issueId, failedCheck, summary, newCycleCount, currentStatus);
 			if (shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount)) await escalateVerificationStuck(issueId, failedCheck, newCycleCount, summary, logPrefix);
-			const feedbackBody = shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId} (attempt ${newCycleCount}/3):\n\nFailed check: ${failedCheck}\n\n${summary}\n\n${buildFinalFailureInstructions(issueId)}` : `VERIFICATION FAILED for ${issueId} (attempt ${newCycleCount}/3):\n\nFailed check: ${failedCheck}\n\n${summary}\n\n## REQUIRED: Complete all acceptance criteria BEFORE resubmitting\n\n1. Review the incomplete AC above\n2. Implement the missing requirements and write tests\n3. Close every completed bead with \`pan beads close\` — the canonical writer publishes the close and AC statuses sync automatically; never hand-edit spec files\n4. Commit and push ALL changes\n5. ONLY THEN resubmit: pan review request ${issueId} -m "Completed acceptance criteria"\n\nDo NOT resubmit until all AC are completed.`;
+			const feedbackBody = shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId} (attempt ${newCycleCount}/3):\n\nFailed check: ${failedCheck}\n\n${summary}\n\n${buildFinalFailureInstructions(issueId)}` : `VERIFICATION FAILED for ${issueId} (attempt ${newCycleCount}/3):\n\nFailed check: ${failedCheck}\n\n${summary}\n\n## REQUIRED: Complete all acceptance criteria BEFORE resubmitting\n\n1. Review the incomplete AC above\n2. Implement the missing requirements and write tests\n3. Close every completed task with \`pan task close\` — the canonical writer publishes the close and AC statuses sync automatically; never hand-edit spec files\n4. Commit and push ALL changes\n5. ONLY THEN resubmit: pan review request ${issueId} -m "Completed acceptance criteria"\n\nDo NOT resubmit until all AC are completed.`;
 			try {
 				const fileResult = await Effect.runPromise(writeFeedbackFile({
 					issueId,
@@ -448,7 +693,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 					summary: `AC check FAILED — ${acStatus.totalPending}/${acStatus.totalCount} incomplete (attempt ${newCycleCount}/3)`,
 					markdownBody: feedbackBody
 				}));
-				if (fileResult.success) await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after ${newCycleCount}/3 attempts.\n\nMUST READ: ${fileResult.filePath}\n\nYou are paused for operator intervention. Do not re-request review automatically.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck} — ${acStatus.totalPending} AC incomplete.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, complete all pending acceptance criteria, commit and push every change, then request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
+				if (fileResult.success) await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after repeated attempts.\n\nMUST READ: ${fileResult.filePath}\n\nFix every reported failure, commit and push the corrections, then run pan done ${issueId} -c "<summary>" to reset verification and return the latest commit to the normal pipeline.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck} — ${acStatus.totalPending} AC incomplete.\n\nMUST READ: ${fileResult.filePath}\n\nUse your Read tool to open this file, read every line, complete all pending acceptance criteria, commit and push every change, then request a new review with pan review request. Do NOT stop at the prompt — keep working until pan review request completes successfully.`, {
 					failedCheck,
 					feedbackPath: fileResult.filePath
 				}, logPrefix);
@@ -462,6 +707,38 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 				maxCycles: 3
 			};
 		}
+		const taskBlockers = await checkIncompletePlanItemsPromise(workspacePath, issueId);
+		if (taskBlockers.length > 0) {
+			const newCycleCount = currentCycles + 1;
+			const failedCheck = "incomplete-plan-items";
+			const itemIds = taskBlockers.map((line) => line.match(/^\s+-\s+(\S+)/)?.[1]).filter((id) => Boolean(id));
+			const summary = `Checklist completion check FAILED — ${itemIds.length} incomplete item(s) remain:\n\n${taskBlockers.join("\n")}`;
+			setStateDerivedVerificationFailure(issueId, failedCheck, summary, newCycleCount, currentStatus);
+			if (shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount)) await escalateVerificationStuck(issueId, failedCheck, newCycleCount, summary, logPrefix);
+			const feedbackBody = shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId} (attempt ${newCycleCount}/3):\n\nFailed check: ${failedCheck}\n\n${summary}\n\n${buildFinalFailureInstructions(issueId)}` : `VERIFICATION FAILED for ${issueId} (attempt ${newCycleCount}/3):\n\nFailed check: ${failedCheck}\n\n${summary}\n\nComplete each listed item with \`pan task done ${issueId} <item>\` after committing and pushing its implementation, then resubmit the review request.`;
+			try {
+				const fileResult = await Effect.runPromise(writeFeedbackFile({
+					issueId,
+					workspacePath,
+					specialist: "verification-gate",
+					outcome: "failed",
+					summary: `Checklist completion check FAILED — ${itemIds.length} incomplete item(s) remain (attempt ${newCycleCount}/3)`,
+					markdownBody: feedbackBody
+				}));
+				if (fileResult.success) await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after repeated attempts.\n\nMUST READ: ${fileResult.filePath}\n\nFix every reported failure, commit and push the corrections, then run pan done ${issueId} -c "<summary>" to reset verification and return the latest commit to the normal pipeline.` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck} — ${itemIds.length} incomplete item(s) remain.\n\nMUST READ: ${fileResult.filePath}\n\nRead the file, complete every listed item with pan task after committing and pushing, then request a new review with pan review request.`, {
+					failedCheck,
+					feedbackPath: fileResult.filePath
+				}, logPrefix);
+			} catch (feedbackErr) {
+				console.error(`[${logPrefix}] Failed to write open-task verification feedback for ${issueId}:`, feedbackErr);
+			}
+			return {
+				outcome: "failed",
+				failedCheck,
+				cycleCount: newCycleCount,
+				maxCycles: 3
+			};
+		}
 		try {
 			const { stdout: changedOut } = await execAsync(`git diff --name-only ${changedBase}...HEAD`, {
 				cwd: workspacePath,
@@ -471,7 +748,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 			if (changesetHasNoContent(changedOut.split("\n"))) {
 				const newCycleCount = currentCycles + 1;
 				const failedCheck = "empty-changeset";
-				const summary = `Branch has no implementation — only pipeline artifacts (.pan/vbrief/beads) changed vs ${changedBase}. The work agent produced no code (likely a kickoff-delivery zombie — PAN-2179).`;
+				const summary = `Branch has no implementation — only pipeline artifacts (.pan/vBRIEF task state) changed vs ${changedBase}. The work agent produced no code (likely a kickoff-delivery zombie — PAN-2179).`;
 				setReviewStatusSync(issueId, {
 					reviewStatus: "pending",
 					verificationStatus: "failed",
@@ -481,7 +758,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 				});
 				if (shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount)) await escalateVerificationStuck(issueId, failedCheck, newCycleCount, summary, logPrefix);
 				try {
-					await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after ${newCycleCount}/3 attempts — branch still has no implementation.\n\n${buildFinalFailureInstructions(issueId)}` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck} — your branch contains NO code (only .pan/vbrief/beads changed vs ${changedBase}).\n\nYou must actually implement the issue: read the plan (.pan/spec.vbrief.json + the issue body), write and commit the code, push, then run pan review request. Do NOT stop at the prompt — keep working until pan review request completes.`, {
+					await deliverVerificationFeedback(issueId, shouldEscalateVerificationFailure(currentStatus, failedCheck, newCycleCount) ? `VERIFICATION STUCK for ${issueId}.\nFailed check: ${failedCheck} after ${newCycleCount}/3 attempts — branch still has no implementation.\n\n${buildFinalFailureInstructions(issueId)}` : `VERIFICATION FAILED for ${issueId}.\nFailed check: ${failedCheck} — your branch contains NO code (only .pan/vBRIEF task state changed vs ${changedBase}).\n\nYou must actually implement the issue: read the plan (.pan/spec.vbrief.json + the issue body), write and commit the code, push, then run pan review request. Do NOT stop at the prompt — keep working until pan review request completes.`, {
 						failedCheck,
 						changedBase
 					}, logPrefix);
@@ -519,7 +796,7 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 				const repo = findProjectByPathSync(workspacePath)?.github_repo;
 				if (!repo || !repo.includes("/")) return;
 				const [owner, name] = repo.split("/");
-				const { postOverdeckTestsStatus } = await import("./github-app-Bwt9lK4A.js");
+				const { postOverdeckTestsStatus } = await import("./github-app-Dtn4ib6M.js");
 				await postOverdeckTestsStatus(workspacePath, owner, name, "success", "Verification gate passed");
 			} catch (err) {
 				console.warn(`[${logPrefix}] Failed to post overdeck/tests status: ${err.message}`);
@@ -547,9 +824,12 @@ async function runVerificationForIssuePromise(issueId, workspacePath, workspaceI
 * so the Effect error channel stays empty.
 */
 function runVerificationForIssue(issueId, workspacePath, workspaceInfo, logPrefix, options = {}) {
+	return process.env.OVERDECK_VERIFICATION_WORKER === "1" ? runVerificationForIssueInProcess(issueId, workspacePath, workspaceInfo, logPrefix, options) : Effect.promise(() => runSupervisedVerification(issueId, workspacePath, workspaceInfo, logPrefix, options));
+}
+function runVerificationForIssueInProcess(issueId, workspacePath, workspaceInfo, logPrefix, options = {}) {
 	return Effect.promise(() => runVerificationForIssuePromise(issueId, workspacePath, workspaceInfo, logPrefix, options));
 }
 //#endregion
-export { runVerificationForIssue as n, changesetHasNoContent as t };
+export { runVerificationForIssueInProcess as i, reconcileInterruptedVerifications as n, runVerificationForIssue as r, changesetHasNoContent as t };
 
-//# sourceMappingURL=verification-runner-CMT5WRMS.js.map
+//# sourceMappingURL=verification-runner-32y8NRfL.js.map

package/server/verification-runner-DAat1p1u.js

@@ -0,0 +1,2 @@
+import { n as reconcileInterruptedVerifications, r as runVerificationForIssue } from "./verification-runner-32y8NRfL.js";
+export { reconcileInterruptedVerifications, runVerificationForIssue };

package/server/{vtt-parser-C_XPlifj.js → vtt-parser-QnRfcjiU.js}

@@ -107,4 +107,4 @@ function consolidateSpeakerCues(cues) {
 //#endregion
 export { vttToMarkdown };
 
-//# sourceMappingURL=vtt-parser-C_XPlifj.js.map
+//# sourceMappingURL=vtt-parser-QnRfcjiU.js.map