@overdeck/desktop 0.45.21 → 0.45.23

package/server/{uat-train-BpLnp7Cx.js → uat-train-CuEn0t9M.js}

@@ -1,17 +1,17 @@
-import { En as findProjectByPathSync, Q as resolveModel, d as loadConfigNoMigration, t as init_config_yaml, zn as init_projects } from "./config-yaml-Ciyp2mYe.js";
-import { n as getDashboardIdentity, t as recordDeaconNudge } from "./deacon-nudge-log-C5VCKtyi.js";
-import { D as killSession, E as isPaneDead, V as sessionExists, w as init_tmux } from "./tmux-y1blSxks.js";
-import { L as messageAgent, s as init_agents } from "./queries-B5hl7lMQ.js";
-import { S as setUatGenerationStackStartedAtSync, a as getUatGenerationSync, h as listUatGenerationsWithStacksSync, l as isMergeTrainEnabled, m as listUatGenerationsSync, o as init_merge_sync, p as listUatGenerationNamesSync, s as insertUatGenerationSync, w as updateUatGenerationSync } from "./merge-sync-De1FYva5.js";
-import { A as init_vbrief_index, M as readVBriefDocument, k as findVBriefByIssue } from "./io-BiM-7Zsx.js";
-import { S as getConversationByName, _t as getDiscoveredStats, at as aggregateDiscoveredSessionCost, ct as countDiscoveredSessions, ft as findDiscoveredSessions, k as init_conversations, mt as getDiscoveredSessionById, ot as aggregateDiscoveredSessionCostBy, yt as init_discovered_sessions } from "./conversations-BUgGvqVL.js";
-import { f as isFlywheelGloballyPaused, i as getFlywheelActiveRunId, n as FLYWHEEL_GLOBAL_PAUSE_KEY, o as getSetting, s as init_control_settings, t as FLYWHEEL_ACTIVE_RUN_ID_KEY, w as setSetting } from "./control-settings-D_79A6gp.js";
-import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-BGpO-OVM.js";
-import { a as enrichSessions, c as searchSessions, i as CostThresholdError, n as getSessionsFeedFacets, o as embedSessions, r as listSessionsFeed, t as scan } from "./scanner-C4NeC4FE.js";
-import { t as listSubstrateBugWeights } from "./substrate-bug-weights-service-DXd0ID83.js";
-import { C as writeLatestFlywheelStatus, S as writeFlywheelLaunchMetadata, _ as nextFlywheelRunId, a as loadResumeSessionId, b as resolveLiveFlywheelRunId, c as saveResumeSessionId, d as abortFlywheelRun, g as listFlywheelRuns, l as spawnFlywheelAgent, p as getFlywheelRunDetail, r as isFlywheelDevcontainerRuntime, t as FLYWHEEL_ORCHESTRATOR_AGENT_ID, y as readFlywheelLaunchMetadata } from "./flywheel-1Wd8WDlh.js";
-import { t as extractACFromDocument } from "./acceptance-criteria-CJIFA8Vg.js";
-import { n as ensureDevcontainerSync, r as init_ensure_devcontainer } from "./ensure-devcontainer-CFpQatOc.js";
+import { Tn as init_projects, d as loadConfigNoMigration, fn as findProjectByPathSync, t as init_config_yaml, tt as resolveModel } from "./config-yaml-DvyMuOle.js";
+import { n as getDashboardIdentity, t as recordDeaconNudge } from "./deacon-nudge-log-Bjg8U4Y9.js";
+import { D as killSession, E as isPaneDead, H as sessionExists, w as init_tmux } from "./tmux-ftABRAmc.js";
+import { X as messageAgent, b as init_agents } from "./queries-6d7Cdtm7.js";
+import { S as setUatGenerationStackStartedAtSync, a as getUatGenerationSync, h as listUatGenerationsWithStacksSync, l as isMergeTrainEnabled, m as listUatGenerationsSync, o as init_merge_sync, p as listUatGenerationNamesSync, s as insertUatGenerationSync, w as updateUatGenerationSync } from "./merge-sync-DZ9dojJn.js";
+import { A as init_xbrief_index, M as readXBriefDocument, k as findXBriefByIssue } from "./io-B3_AHDfr.js";
+import { S as getConversationByName, _t as getDiscoveredStats, at as aggregateDiscoveredSessionCost, ct as countDiscoveredSessions, ft as findDiscoveredSessions, k as init_conversations, mt as getDiscoveredSessionById, ot as aggregateDiscoveredSessionCostBy, yt as init_discovered_sessions } from "./conversations-DbOs1e9Q.js";
+import { f as isFlywheelGloballyPaused, i as getFlywheelActiveRunId, n as FLYWHEEL_GLOBAL_PAUSE_KEY, o as getSetting, s as init_control_settings, t as FLYWHEEL_ACTIVE_RUN_ID_KEY, w as setSetting } from "./control-settings-aP1ANIlI.js";
+import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-qHJBhy3Z.js";
+import { a as enrichSessions, c as searchSessions, i as CostThresholdError, n as getSessionsFeedFacets, o as embedSessions, r as listSessionsFeed, t as scan } from "./scanner-D2743cp8.js";
+import { t as listSubstrateBugWeights } from "./substrate-bug-weights-service-BH66lhm7.js";
+import { C as writeLatestFlywheelStatus, S as writeFlywheelLaunchMetadata, _ as nextFlywheelRunId, a as loadResumeSessionId, b as resolveLiveFlywheelRunId, c as saveResumeSessionId, d as abortFlywheelRun, g as listFlywheelRuns, l as spawnFlywheelAgent, p as getFlywheelRunDetail, r as isFlywheelDevcontainerRuntime, t as FLYWHEEL_ORCHESTRATOR_AGENT_ID, y as readFlywheelLaunchMetadata } from "./flywheel-DSSpWmqF.js";
+import { t as extractACFromDocument } from "./acceptance-criteria-DOA0KgXx.js";
+import { n as ensureDevcontainerSync, r as init_ensure_devcontainer } from "./ensure-devcontainer-DseivYEy.js";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { Effect } from "effect";
 import { existsSync } from "fs";
@@ -31,7 +31,7 @@ init_projects();
 init_config_yaml();
 init_tmux();
 init_merge_sync();
-init_vbrief_index();
+init_xbrief_index();
 init_harness_resolve();
 init_agents();
 init_discovered_sessions();
@@ -176,15 +176,15 @@ async function runInline(operation, payload, onProgress) {
 			});
 		}
 		case "getArtifactBySlug": {
-			const { getArtifactBySlugJob } = await import("./artifact-index-jobs-BOoySTKD.js");
+			const { getArtifactBySlugJob } = await import("./artifact-index-jobs-C-xy7Z5v.js");
 			return getArtifactBySlugJob(payload);
 		}
 		case "listArtifactsForWorkspaceOrIssue": {
-			const { listArtifactsForWorkspaceOrIssueJob } = await import("./artifact-index-jobs-BOoySTKD.js");
+			const { listArtifactsForWorkspaceOrIssueJob } = await import("./artifact-index-jobs-C-xy7Z5v.js");
 			return listArtifactsForWorkspaceOrIssueJob(payload);
 		}
 		case "unshareArtifactBySlug": {
-			const { unshareArtifactBySlugJob } = await import("./artifact-index-jobs-BOoySTKD.js");
+			const { unshareArtifactBySlugJob } = await import("./artifact-index-jobs-C-xy7Z5v.js");
 			return unshareArtifactBySlugJob(payload);
 		}
 	}
@@ -424,12 +424,12 @@ async function pauseFlywheelRunForDashboard() {
 	if (before.activeRunId) try {
 		const { readFile } = await import("node:fs/promises");
 		const { join } = await import("node:path");
-		const { getAgentDir } = await import("./agents-Czz6R57Z.js");
+		const { getAgentDir } = await import("./agents-FlIgQ3ql.js");
 		const sessionId = (await readFile(join(getAgentDir(FLYWHEEL_ORCHESTRATOR_AGENT_ID), "session.id"), "utf-8")).trim();
 		if (sessionId) await saveResumeSessionId(before.activeRunId, sessionId);
 	} catch {}
 	await setPaused(true);
-	await import("./agents-Czz6R57Z.js").then(({ stopAgent }) => Effect.runPromise(stopAgent(FLYWHEEL_ORCHESTRATOR_AGENT_ID)));
+	await import("./agents-FlIgQ3ql.js").then(({ stopAgent }) => Effect.runPromise(stopAgent(FLYWHEEL_ORCHESTRATOR_AGENT_ID)));
 	return {
 		before,
 		after: await readGateSnapshot(),
@@ -439,7 +439,7 @@ async function pauseFlywheelRunForDashboard() {
 async function abortFlywheelRunForDashboard() {
 	const candidate = await getActiveRunId();
 	if (!candidate) return { aborted: await resolveLiveFlywheelRunId() ?? null };
-	const { stopAgent } = await import("./agents-Czz6R57Z.js");
+	const { stopAgent } = await import("./agents-FlIgQ3ql.js");
 	await Effect.runPromise(stopAgent(FLYWHEEL_ORCHESTRATOR_AGENT_ID));
 	await abortFlywheelRun(candidate);
 	return { aborted: candidate };
@@ -1870,7 +1870,7 @@ function canStartUatTrainReconciler() {
 async function getReadySet() {
 	const status = await readCurrentFlywheelStatusForDashboard();
 	if (!status) return null;
-	const { computeMergeQueue, resolveMergeQueuePrUrl } = await import("./flywheel-merge-order-CeBuX0EJ.js");
+	const { computeMergeQueue, resolveMergeQueuePrUrl } = await import("./flywheel-merge-order-C-6zRLvM.js");
 	const fromVerbs = (await Effect.runPromise(computeMergeQueue(status.activePipeline, projectRoot(), {
 		getPrUrl: resolveMergeQueuePrUrl,
 		onIneligible: (issueId, reason) => console.log(`[uat-train] ${issueId} has a merge verb but is not merge-eligible (${reason}) — excluded from the ready set`)
@@ -1896,8 +1896,8 @@ async function getReadySet() {
 */
 async function sweepEligibleFeatures(alreadyIncluded) {
 	try {
-		const { loadReviewStatuses, mergeGateEligibility } = await import("./review-status-DXeqFpk5.js");
-		const { resolveProjectFromIssueSync } = await import("./projects-IRHJIPYC.js");
+		const { loadReviewStatuses, mergeGateEligibility } = await import("./review-status-C6n6-9f_.js");
+		const { resolveProjectFromIssueSync } = await import("./projects-9SkRpES9.js");
 		const { execFile } = await import("node:child_process");
 		const { promisify } = await import("node:util");
 		const execFileAsync = promisify(execFile);
@@ -2029,14 +2029,14 @@ async function loadAcceptanceCriteriaCache(issueIds) {
 			acceptanceCriteriaByIssue.delete(upperIssueId);
 		}
 		try {
-			const found = await Effect.runPromise(findVBriefByIssue(root, upperIssueId));
+			const found = await Effect.runPromise(findXBriefByIssue(root, upperIssueId));
 			if (!found) {
 				acceptanceCriteriaByIssue.delete(upperIssueId);
 				cache.set(upperIssueId, []);
 				return;
 			}
 			const { mtimeMs } = await stat(found.path);
-			const criteria = extractACFromDocument(await Effect.runPromise(readVBriefDocument(found.path))).map((ac) => ({
+			const criteria = extractACFromDocument(await Effect.runPromise(readXBriefDocument(found.path))).map((ac) => ({
 				title: ac.title,
 				status: ac.status
 			}));
@@ -2131,7 +2131,7 @@ async function postUatGenerationStackPayload(name) {
 }
 async function postUatGenerationPromotePayload(name, firePostMerge) {
 	const root = projectRoot();
-	const { reviewRecordEligibility } = await import("./flywheel-merge-order-CeBuX0EJ.js");
+	const { reviewRecordEligibility } = await import("./flywheel-merge-order-C-6zRLvM.js");
 	const result = await promoteUatGeneration(name, root, {
 		git: buildUatPromoteGitDeps(root),
 		store: {
@@ -2149,4 +2149,4 @@ async function postUatGenerationPromotePayload(name, firePostMerge) {
 //#endregion
 export { postUatGenerationStackPayload as a, startUatTrainReconciler as c, openFlywheelRunReportForDashboard as d, pauseFlywheelRunForDashboard as f, runDashboardDbJob as g, startFlywheelRunForDashboard as h, postUatGenerationPromotePayload as i, stopUatTrainReconciler as l, resumeFlywheelRunForDashboard as m, getUatCandidatePayload as n, resolveUatProjectRoot as o, readCurrentFlywheelStatusForDashboard as p, getUatGenerationsPayload as r, runUatTrainReconcile as s, canStartUatTrainReconciler as t, abortFlywheelRunForDashboard as u };
 
-//# sourceMappingURL=uat-train-BpLnp7Cx.js.map
+//# sourceMappingURL=uat-train-CuEn0t9M.js.map

package/server/{uat-train-Wismge7h.js → uat-train-cKfM-_WW.js}

@@ -1,2 +1,2 @@
-import { a as postUatGenerationStackPayload, c as startUatTrainReconciler, i as postUatGenerationPromotePayload, l as stopUatTrainReconciler, n as getUatCandidatePayload, o as resolveUatProjectRoot, r as getUatGenerationsPayload, s as runUatTrainReconcile, t as canStartUatTrainReconciler } from "./uat-train-BpLnp7Cx.js";
+import { a as postUatGenerationStackPayload, c as startUatTrainReconciler, i as postUatGenerationPromotePayload, l as stopUatTrainReconciler, n as getUatCandidatePayload, o as resolveUatProjectRoot, r as getUatGenerationsPayload, s as runUatTrainReconcile, t as canStartUatTrainReconciler } from "./uat-train-CuEn0t9M.js";
 export { canStartUatTrainReconciler, getUatCandidatePayload, getUatGenerationsPayload, postUatGenerationPromotePayload, postUatGenerationStackPayload, resolveUatProjectRoot, runUatTrainReconcile, startUatTrainReconciler, stopUatTrainReconciler };

package/server/{validation-BA4e5EGm.js → validation-B5JxoPUS.js}

@@ -1,12 +1,221 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Or as init_errors } from "./config-yaml-Ciyp2mYe.js";
-import { f as init_config, m as loadConfigSync } from "./config-CrduXs4a.js";
-import { n as init_workspace_config, r as replacePlaceholdersSync } from "./workspace-config-BAAsAv-o.js";
+import { Br as getOverdeckHome, Vr as init_paths, mr as init_errors } from "./config-yaml-DvyMuOle.js";
+import { f as init_config, m as loadConfigSync } from "./config-CCvjQf27.js";
+import { n as init_workspace_config, r as replacePlaceholdersSync } from "./workspace-config-cEGcO6UT.js";
+import { join } from "node:path";
 import { Effect } from "effect";
 import "fs";
-import { join } from "path";
+import { join as join$1 } from "path";
+import { cpus, loadavg } from "node:os";
+import { mkdir, open, readFile, readdir, unlink } from "node:fs/promises";
 import { exec } from "child_process";
 import { promisify } from "util";
+//#region ../../lib/cloister/quality-gate-admission.ts
+function isErrnoException(error) {
+	return error instanceof Error && "code" in error;
+}
+function processIsAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return isErrnoException(error) && error.code === "EPERM";
+	}
+}
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function cpuTotals() {
+	const records = cpus();
+	let idle = 0;
+	let total = 0;
+	for (const cpu of records) {
+		idle += cpu.times.idle;
+		total += Object.values(cpu.times).reduce((sum, value) => sum + value, 0);
+	}
+	return {
+		idle,
+		total,
+		cores: Math.max(1, records.length)
+	};
+}
+async function sampleQualityGatePressure(sleep = delay) {
+	const before = cpuTotals();
+	await sleep(250);
+	const after = cpuTotals();
+	const totalDelta = after.total - before.total;
+	const idleDelta = after.idle - before.idle;
+	const cpuUtilization = totalDelta > 0 ? (totalDelta - idleDelta) / totalDelta : 0;
+	const loadPerCore = loadavg()[0] / after.cores;
+	return {
+		cpuUtilization,
+		loadPerCore,
+		pressured: cpuUtilization >= .75 || loadPerCore >= 1
+	};
+}
+function admissionRoot(rootDir) {
+	return rootDir ?? join(getOverdeckHome(), "verification-workers", "admission");
+}
+function ownerPath(root) {
+	return join(root, "owner.json");
+}
+function breakerPath(root) {
+	return join(root, "owner.break");
+}
+function ticketPath(root, ticketId) {
+	return join(root, `waiter-${ticketId}.json`);
+}
+async function writeExclusive(path, value) {
+	const file = await open(path, "wx", 384);
+	try {
+		await file.writeFile(`${JSON.stringify(value)}\n`, "utf8");
+	} finally {
+		await file.close();
+	}
+}
+async function readJson(path) {
+	try {
+		return JSON.parse(await readFile(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function unlinkIfExists(path) {
+	try {
+		await unlink(path);
+	} catch (error) {
+		if (!isErrnoException(error) || error.code !== "ENOENT") throw error;
+	}
+}
+function sameOwner(left, right) {
+	return left?.ticketId === right.ticketId && left.pid === right.pid && left.acquiredAt === right.acquiredAt;
+}
+function ownerIsStale(owner, now, staleMs, isProcessAlive) {
+	return now - owner.acquiredAt > staleMs || !isProcessAlive(owner.pid);
+}
+async function acquireBreaker(root, now, staleMs, isProcessAlive) {
+	const path = breakerPath(root);
+	for (let attempt = 0; attempt < 2; attempt++) try {
+		await writeExclusive(path, {
+			pid: process.pid,
+			acquiredAt: now()
+		});
+		return true;
+	} catch (error) {
+		if (!isErrnoException(error) || error.code !== "EEXIST") throw error;
+		const existing = await readJson(path);
+		if (existing && now() - existing.acquiredAt <= staleMs && isProcessAlive(existing.pid)) return false;
+		await unlinkIfExists(path);
+	}
+	return false;
+}
+async function clearStaleOwner(root, observed, now, staleMs, isProcessAlive) {
+	if (!await acquireBreaker(root, now, staleMs, isProcessAlive)) return;
+	try {
+		const current = await readJson(ownerPath(root));
+		if (!observed && !current || observed && sameOwner(current, observed) && ownerIsStale(observed, now(), staleMs, isProcessAlive)) await unlinkIfExists(ownerPath(root));
+	} finally {
+		await unlinkIfExists(breakerPath(root));
+	}
+}
+async function listLiveTickets(root, isProcessAlive) {
+	const entries = await readdir(root);
+	const tickets = [];
+	for (const entry of entries) {
+		if (!entry.startsWith("waiter-") || !entry.endsWith(".json")) continue;
+		const path = join(root, entry);
+		const ticket = await readJson(path);
+		if (!ticket || typeof ticket.ticketId !== "string" || !Number.isFinite(ticket.createdAt)) {
+			await unlinkIfExists(path);
+			continue;
+		}
+		if (!isProcessAlive(ticket.pid)) {
+			await unlinkIfExists(path);
+			continue;
+		}
+		tickets.push(ticket);
+	}
+	return tickets.sort((left, right) => left.createdAt - right.createdAt || left.ticketId.localeCompare(right.ticketId));
+}
+async function acquireQualityGateAdmission(request, deps = {}) {
+	const root = admissionRoot(deps.rootDir);
+	const now = deps.now ?? Date.now;
+	const sleep = deps.sleep ?? delay;
+	const pid = deps.pid ?? process.pid;
+	const isProcessAlive = deps.isProcessAlive ?? processIsAlive;
+	const samplePressure = deps.samplePressure ?? (() => sampleQualityGatePressure(sleep));
+	const pollMs = deps.pollMs ?? 1e3;
+	const settleMs = deps.settleMs ?? 1500;
+	const staleMs = deps.staleMs ?? 15e5;
+	await mkdir(root, { recursive: true });
+	const createdAt = now();
+	const ticketId = `${String(createdAt).padStart(16, "0")}-${String(pid).padStart(10, "0")}-${String(ticketSequence++).padStart(6, "0")}`;
+	const ticket = {
+		...request,
+		ticketId,
+		pid,
+		createdAt
+	};
+	const ownTicketPath = ticketPath(root, ticketId);
+	await writeExclusive(ownTicketPath, ticket);
+	try {
+		for (;;) {
+			if ((await listLiveTickets(root, isProcessAlive))[0]?.ticketId !== ticketId) {
+				await sleep(pollMs);
+				continue;
+			}
+			const observedOwner = await readJson(ownerPath(root));
+			if (observedOwner) {
+				if (ownerIsStale(observedOwner, now(), staleMs, isProcessAlive)) await clearStaleOwner(root, observedOwner, now, staleMs, isProcessAlive);
+				await sleep(pollMs);
+				continue;
+			}
+			if ((await samplePressure()).pressured) {
+				await sleep(pollMs);
+				continue;
+			}
+			const owner = {
+				...ticket,
+				acquiredAt: now()
+			};
+			try {
+				await writeExclusive(ownerPath(root), owner);
+			} catch (error) {
+				if (isErrnoException(error) && error.code === "EEXIST") {
+					if (!await readJson(ownerPath(root))) await clearStaleOwner(root, null, now, staleMs, isProcessAlive);
+					await sleep(pollMs);
+					continue;
+				}
+				throw error;
+			}
+			await sleep(settleMs);
+			if ((await samplePressure()).pressured) {
+				if (sameOwner(await readJson(ownerPath(root)), owner)) await unlinkIfExists(ownerPath(root));
+				await sleep(pollMs);
+				continue;
+			}
+			await unlinkIfExists(ownTicketPath);
+			let released = false;
+			return {
+				admittedAt: new Date(owner.acquiredAt).toISOString(),
+				async release() {
+					if (released) return;
+					released = true;
+					if (sameOwner(await readJson(ownerPath(root)), owner)) await unlinkIfExists(ownerPath(root));
+				}
+			};
+		}
+	} catch (error) {
+		await unlinkIfExists(ownTicketPath);
+		throw error;
+	}
+}
+var ticketSequence;
+var init_quality_gate_admission = __esmMin((() => {
+	init_paths();
+	ticketSequence = 0;
+}));
+//#endregion
 //#region ../../lib/cloister/validation.ts
 /**
 * Merge Validation - Validation utilities for merge completeness
@@ -71,12 +280,18 @@ async function runQualityGatesPromise(gates, projectPath, phase = "pre_push", op
 	for (const [name, gate] of Object.entries(gates)) {
 		if ((gate.phase || "pre_push") !== phase) continue;
 		const required = gate.required !== false;
-		const cwd = gate.path ? join(projectPath, gate.path) : projectPath;
+		const cwd = gate.path ? join$1(projectPath, gate.path) : projectPath;
 		console.log(`[quality-gate] Running "${name}" (${required ? "required" : "optional"}) in ${cwd}`);
 		opts.onLog?.(`Running gate "${name}"${required ? "" : " (optional)"}…`);
 		opts.onGateStart?.(name);
 		const startTime = Date.now();
 		if (gate.type === "http_health") {
+			opts.onAdmissionPhase?.({
+				phase: "running",
+				gateName: name,
+				attempt: 1,
+				admittedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
 			const result = await runHttpHealthGate(name, gate, required);
 			results.push(result);
 			opts.onGateResult?.(result);
@@ -138,7 +353,36 @@ async function runQualityGatesPromise(gates, projectPath, phase = "pre_push", op
 		let passOutput = "";
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			let gatePgid;
+			let admission = null;
 			try {
+				if (!isRemote) {
+					const identity = `${opts.issueId ?? "unscoped"} gate="${name}" attempt=${attempt}/${maxAttempts} workspace=${cwd}`;
+					console.log(`[quality-gate] Queued for CPU admission: ${identity}`);
+					opts.onLog?.(`Queued ${name} for CPU admission…`);
+					opts.onAdmissionPhase?.({
+						phase: "queued",
+						gateName: name,
+						attempt
+					});
+					admission = await acquireQualityGateAdmission({
+						issueId: opts.issueId,
+						workspacePath: cwd,
+						gateName: name,
+						attempt
+					});
+					console.log(`[quality-gate] Admitted: ${identity}`);
+					opts.onAdmissionPhase?.({
+						phase: "running",
+						gateName: name,
+						attempt,
+						admittedAt: admission.admittedAt
+					});
+				} else opts.onAdmissionPhase?.({
+					phase: "running",
+					gateName: name,
+					attempt,
+					admittedAt: (/* @__PURE__ */ new Date()).toISOString()
+				});
 				const useHostCwd = !isRemote && !(gate.container && gate.container_name);
 				const env = buildQualityGateEnv(gate.env);
 				const execPromise = execAsync(resolvedCommand, {
@@ -154,18 +398,23 @@ async function runQualityGatesPromise(gates, projectPath, phase = "pre_push", op
 					execPromise.child.stderr?.on("data", (chunk) => opts.onGateOutput(name, String(chunk)));
 				}
 				const { stdout, stderr } = await execPromise;
-				killGateProcessGroup(gatePgid);
 				passedGate = true;
 				passOutput = formatGateOutput(stdout, stderr);
-				break;
 			} catch (error) {
-				killGateProcessGroup(gatePgid);
 				lastError = error;
 				if (attempt < maxAttempts) {
 					console.log(`[quality-gate] ✗ "${name}" failed attempt ${attempt}/${maxAttempts} — retrying (gate declares retry: ${gate.retry})`);
 					opts.onLog?.(`↻ ${name} failed attempt ${attempt}/${maxAttempts} — retrying`);
 				}
+			} finally {
+				killGateProcessGroup(gatePgid);
+				try {
+					await admission?.release();
+				} catch (error) {
+					console.warn(`[quality-gate] Failed to release CPU admission for ${opts.issueId ?? "unscoped"} gate="${name}": ${error instanceof Error ? error.message : String(error)}`);
+				}
 			}
+			if (passedGate) break;
 		}
 		if (passedGate) {
 			const durationMs = Date.now() - startTime;
@@ -253,6 +502,7 @@ var init_validation = __esmMin((() => {
 	init_workspace_config();
 	init_config();
 	init_errors();
+	init_quality_gate_admission();
 	execAsync = promisify(exec);
 	DASHBOARD_RUNTIME_ENV_KEYS = [
 		"API_PORT",
@@ -272,4 +522,4 @@ var init_validation = __esmMin((() => {
 //#endregion
 export { runQualityGates as i, init_validation as n, killAllGateProcessGroups as r, DEFAULT_GATES as t };
 
-//# sourceMappingURL=validation-BA4e5EGm.js.map
+//# sourceMappingURL=validation-B5JxoPUS.js.map

package/server/{validation-CUWamZ4X.js → validation-CIi6pnI2.js}

@@ -1,3 +1,3 @@
-import { i as runQualityGates, n as init_validation, r as killAllGateProcessGroups } from "./validation-BA4e5EGm.js";
+import { i as runQualityGates, n as init_validation, r as killAllGateProcessGroups } from "./validation-B5JxoPUS.js";
 init_validation();
 export { killAllGateProcessGroups, runQualityGates };

package/server/{verification-artifact-Dr_0g9nb.js → verification-artifact-BcnIbigL.js}

@@ -53,4 +53,4 @@ function readVerificationArtifact(workspacePath) {
 //#endregion
 export { verificationArtifactPath as n, writeVerificationArtifact as r, readVerificationArtifact as t };
 
-//# sourceMappingURL=verification-artifact-Dr_0g9nb.js.map
+//# sourceMappingURL=verification-artifact-BcnIbigL.js.map

package/server/{verification-artifact-CrbI4tJE.js → verification-artifact-C-lIHfUa.js}

@@ -1,2 +1,2 @@
-import { t as readVerificationArtifact } from "./verification-artifact-Dr_0g9nb.js";
+import { t as readVerificationArtifact } from "./verification-artifact-BcnIbigL.js";
 export { readVerificationArtifact };