@papi-ai/server 0.7.36 → 0.7.38

package/dist/backfill-cycle-metrics.js

@@ -50,6 +50,7 @@ __export(git_exports, {
   hasRemote: () => hasRemote,
   hasUncommittedChanges: () => hasUncommittedChanges,
   hasUnpushedCommits: () => hasUnpushedCommits,
+  isBranchContentAlreadyInBase: () => isBranchContentAlreadyInBase,
   isBranchMergedInto: () => isBranchMergedInto,
   isGhAvailable: () => isGhAvailable,
   isGitAvailable: () => isGitAvailable,
@@ -807,6 +808,32 @@ function isBranchMergedInto(cwd, branch, baseBranch) {
     return false;
   }
 }
+function isBranchContentAlreadyInBase(cwd, branch, baseBranch) {
+  const resolveCommit = (ref) => {
+    try {
+      return execFileSync("git", ["rev-parse", "--verify", `${ref}^{commit}`], { cwd, encoding: "utf-8" }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const branchRef = resolveCommit(branch) ? branch : resolveCommit(`origin/${branch}`) ? `origin/${branch}` : null;
+  if (!branchRef) return false;
+  try {
+    const out = execFileSync("git", ["merge-tree", "--write-tree", baseBranch, branchRef], {
+      cwd,
+      encoding: "utf-8"
+    }).trim();
+    const mergedTree = out.split("\n")[0]?.trim();
+    if (!mergedTree) return false;
+    const baseTree = execFileSync("git", ["rev-parse", `${baseBranch}^{tree}`], {
+      cwd,
+      encoding: "utf-8"
+    }).trim();
+    return mergedTree === baseTree;
+  } catch {
+    return false;
+  }
+}
 function pickModuleCycleBranch(candidates, cycleNumber, module) {
   if (candidates.length === 0) return void 0;
   const expected = cycleBranchName(cycleNumber, module);

package/dist/index.js

@@ -51,6 +51,7 @@ __export(git_exports, {
   hasRemote: () => hasRemote,
   hasUncommittedChanges: () => hasUncommittedChanges,
   hasUnpushedCommits: () => hasUnpushedCommits,
+  isBranchContentAlreadyInBase: () => isBranchContentAlreadyInBase,
   isBranchMergedInto: () => isBranchMergedInto,
   isGhAvailable: () => isGhAvailable,
   isGitAvailable: () => isGitAvailable,
@@ -808,6 +809,32 @@ function isBranchMergedInto(cwd, branch, baseBranch) {
     return false;
   }
 }
+function isBranchContentAlreadyInBase(cwd, branch, baseBranch) {
+  const resolveCommit = (ref) => {
+    try {
+      return execFileSync("git", ["rev-parse", "--verify", `${ref}^{commit}`], { cwd, encoding: "utf-8" }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const branchRef = resolveCommit(branch) ? branch : resolveCommit(`origin/${branch}`) ? `origin/${branch}` : null;
+  if (!branchRef) return false;
+  try {
+    const out = execFileSync("git", ["merge-tree", "--write-tree", baseBranch, branchRef], {
+      cwd,
+      encoding: "utf-8"
+    }).trim();
+    const mergedTree = out.split("\n")[0]?.trim();
+    if (!mergedTree) return false;
+    const baseTree = execFileSync("git", ["rev-parse", `${baseBranch}^{tree}`], {
+      cwd,
+      encoding: "utf-8"
+    }).trim();
+    return mergedTree === baseTree;
+  } catch {
+    return false;
+  }
+}
 function pickModuleCycleBranch(candidates, cycleNumber, module) {
   if (candidates.length === 0) return void 0;
   const expected = cycleBranchName(cycleNumber, module);
@@ -7087,6 +7114,9 @@ ${footer}`);
     await this.write("PLANNING_LOG.md", updated);
   }
 };
+function newTaskJoinKey(task, index) {
+  return task.tempId ?? `new-${index + 1}`;
+}
 var NONE_PATTERN2 = /^none\b/i;
 function normalizeText2(text) {
   return text.trim().toLowerCase().replace(/[.,;:!]+$/, "").replace(/\s+/g, " ");
@@ -7981,6 +8011,39 @@ function formatDerivedMetrics(snapshots, backlogTasks) {
   }
   return lines.join("\n");
 }
+function formatLearningPatterns(patterns) {
+  if (!patterns || patterns.length === 0) return void 0;
+  const ranked = [...patterns].sort(
+    (a, b2) => b2.cycles.length - a.cycles.length || b2.frequency - a.frequency
+  );
+  const strong = ranked.filter((p) => p.cycles.length >= 3);
+  const shown = (strong.length > 0 ? strong : ranked).slice(0, 12);
+  if (shown.length === 0) return void 0;
+  const lines = shown.map(
+    (p) => `- \`${p.tag}\` \u2014 recurred in ${p.cycles.length} cycles (${p.frequency}\xD7), most recent C${Math.max(...p.cycles)}`
+  );
+  return lines.join("\n");
+}
+function formatDecisionScorePatterns(patterns) {
+  if (!patterns || patterns.length === 0) return void 0;
+  const HIGH_RISK = 15;
+  const moved = (p) => p.previousScore != null && p.previousScore !== p.totalScore;
+  const relevant = patterns.filter((p) => p.totalScore > HIGH_RISK || moved(p));
+  if (relevant.length === 0) return void 0;
+  const ranked = [...relevant].sort(
+    (a, b2) => b2.totalScore - a.totalScore || Math.abs((b2.previousScore ?? b2.totalScore) - b2.totalScore) - Math.abs((a.previousScore ?? a.totalScore) - a.totalScore)
+  );
+  const lines = ranked.slice(0, 10).map((p) => {
+    let line = `- ${p.decisionId}: ${p.title} [${p.confidence}] \u2014 score ${p.totalScore}/25`;
+    if (p.previousScore != null && p.previousScore !== p.totalScore) {
+      const arrow = p.totalScore > p.previousScore ? "\u2191 riskier" : "\u2193 safer";
+      line += ` (${arrow} from ${p.previousScore}/25${p.previousCycle != null ? ` at C${p.previousCycle}` : ""})`;
+    }
+    if (p.totalScore > HIGH_RISK) line += " \u26A0 high-risk";
+    return line;
+  });
+  return lines.join("\n");
+}
 function formatBuildPatterns(patterns) {
   const sections = [];
   if (patterns.recurringSurprises.length > 0) {
@@ -8253,7 +8316,7 @@ After your natural language output, include this EXACT format on its own line:
   "boardHealth": "string \u2014 e.g. 5 tasks (3 backlog, 2 done)",
   "strategicDirection": "string \u2014 one sentence about current phase/direction",
   "recommendedTaskId": "string or null \u2014 task ID to set In Progress",
-  "cycleHandoffs": [{"taskId": "string \u2014 existing task ID or new-N for new tasks", "buildHandoff": "string \u2014 full BUILD HANDOFF text"}],
+  "cycleHandoffs": [{"taskId": "string \u2014 an existing task ID, or the EXACT tempId of a newTasks entry (e.g. "new-1") it provides the handoff for", "buildHandoff": "string \u2014 full BUILD HANDOFF text"}],
   "newTasks": [],
   "boardCorrections": [],
   "productBrief": null,
@@ -8298,7 +8361,7 @@ Everything in Part 1 (natural language) is **display-only**. Part 2 (structured
 **Example with populated fields (DO NOT copy literally \u2014 adapt to your actual analysis):**
 \`\`\`json
 {
-  "newTasks": [{"title": "Example task", "status": "Backlog", "priority": "P2 Medium", "complexity": "Small", "module": "Core", "epic": "Platform", "phase": "Phase 1", "owner": "TBD", "notes": "Created during triage"}],
+  "newTasks": [{"tempId": "new-1", "title": "Example task", "status": "Backlog", "priority": "P2 Medium", "complexity": "Small", "module": "Core", "epic": "Platform", "phase": "Phase 1", "owner": "TBD", "notes": "Created during triage"}],
   "activeDecisions": [{"id": "AD-3", "body": "### AD-3: Use REST over GraphQL [Confidence: HIGH]\\n\\n- **Decision:** REST API for v1.\\n- **Evidence:** Simpler for current scope."}],
   "boardCorrections": [{"taskId": "task-005", "updates": {"priority": "P1 High", "reviewed": true}}, {"taskId": "task-009", "updates": {"status": "Cancelled", "closureReason": "Duplicates task-003"}}],
   "cycleHandoffs": [{"taskId": "task-002", "buildHandoff": "BUILD HANDOFF \u2014 task-002\\nTask: ..."}]
@@ -8336,7 +8399,7 @@ This is Cycle 0 \u2014 the first planning cycle for a brand-new project.
 
 4. **First Active Decision** \u2014 If the description implies a clear architectural choice, create AD-1 with Confidence: MEDIUM. If no clear choice, skip this.
 
-5. **BUILD HANDOFFs** \u2014 Generate a full BUILD HANDOFF block for EVERY task created in step 3 (all 3-5 tasks). Include each in the \`cycleHandoffs\` array. Use \`new-N\` IDs to reference them (matching the \`newTasks\` array). The builder needs handoffs to run \`build_execute\` \u2014 without them, tasks must be completed via \`ad_hoc\`, which breaks the normal flow.
+5. **BUILD HANDOFFs** \u2014 Generate a full BUILD HANDOFF block for EVERY task created in step 3 (all 3-5 tasks). Include each in the \`cycleHandoffs\` array. **tempId join (REQUIRED \u2014 mismatches silently scramble handoffs):** give EVERY \`newTasks\` entry a unique \`tempId\` (\`"new-1"\`, \`"new-2"\`, \u2026), and set each \`cycleHandoffs\` \`taskId\` to the EXACT \`tempId\` of the newTask it belongs to. Do NOT rely on array order, and do NOT reuse a tempId. The builder needs handoffs to run \`build_execute\` \u2014 without them, tasks must be completed via \`ad_hoc\`, which breaks the normal flow.
 
 ### Structured output for Bootstrap:
 In the JSON block, you MUST include:
@@ -8544,7 +8607,7 @@ ${AD_REJECTION_RULES}
    **Reference docs:** If a task's notes include a \`Reference:\` path (e.g. \`Reference: docs/architecture/papi-brain-v1.md\`), include a REFERENCE DOCS section in the BUILD HANDOFF with those paths. This tells the builder to read the referenced doc for background context before implementing. Do NOT omit or summarise the reference \u2014 pass it through so the builder can access the full document. Only tasks with explicit \`Reference:\` paths in their notes should have this section.
    **Full notes lookup:** Notes in the Board section are truncated to 300 chars for concise task selection. When generating a BUILD HANDOFF for a task, check the "Full Notes for Candidate Tasks" section (if present in context) for that task's complete untruncated notes before writing SCOPE, SCOPE BOUNDARY, and PRE-MORTEM. Submitter context, constraints, and reasoning often live past the 300-char cutoff and must not be dropped from the handoff.
    **Pre-build verification:** EVERY handoff MUST include a PRE-BUILD VERIFICATION section listing 2-5 specific file paths the builder should read before implementing. Derive these from FILES LIKELY TOUCHED \u2014 pick the files most likely to already contain the target functionality. This is the #1 prevention mechanism for wasted build slots (C120, C125, C126 all scheduled already-shipped work). If the builder finds >80% of the scope already implemented, they report "already built" instead of re-implementing.
-   **Pre-mortem:** For projects with 10+ cycles, include a PRE-MORTEM section in every BUILD HANDOFF with 1-3 bullet points: (a) most likely technical blocker based on module history, (b) integration risk with adjacent systems, (c) scope creep signal \u2014 what the builder might be tempted to expand beyond scope. Draw from \`dead_ends\` and \`surprises\` in recent build reports for the same module. Omit this section entirely for projects with fewer than 10 cycles.
+   **Pre-mortem:** For projects with 10+ cycles, include a PRE-MORTEM section in every BUILD HANDOFF with 1-3 bullet points: (a) most likely technical blocker based on module history, (b) integration risk with adjacent systems, (c) scope creep signal \u2014 what the builder might be tempted to expand beyond scope. Draw from \`dead_ends\` and \`surprises\` in recent build reports for the same module. **If a "Recurring Learning Patterns (cross-cycle)" section is provided in the context, treat a module or theme that recurs across many cycles as a strong signal \u2014 size such tasks up (lean toward the larger estimate) and name the recurring failure mode explicitly in the pre-mortem.** Omit this section entirely for projects with fewer than 10 cycles.
    **Intra-cycle dependency detection:** After selecting cycle tasks, check every pair for build-order dependencies. Two tasks A and B have an intra-cycle dependency when A must be built before B because B consumes an artifact A creates \u2014 e.g. A adds a new adapter method that B calls, A creates a DB migration B depends on, A introduces a new shared type B imports, A refactors a utility B modifies. Signals: same module + adjacent scope (one is "add X", another is "use X"), or notes explicitly reference the other task. For each dependency detected: (a) populate the DEPENDS ON section in the dependent task's BUILD HANDOFF with the upstream task ID(s); (b) add a \`boardCorrections\` entry for the dependent task with \`updates.dependsOn\` set to the comma-separated upstream IDs \u2014 this persists the dependency so the builder's runtime can reuse the upstream branch; (c) keep SCOPE sections independent but note the ordering in "Why now". Do NOT invent dependencies where tasks merely share a module \u2014 only real build-order coupling counts. Linear chains only \u2014 no multi-level graph resolution. When in doubt, omit.
    **Dependency Chain section (Part 1 markdown):** When intra-cycle dependencies are detected, include a visible **## Dependency Chain** section in Part 1 markdown immediately before the first BUILD HANDOFF block. List each dependency as an arrow chain with a brief reason: \`task-A \u2192 task-B (B calls the adapter method A creates)\`. Then show the full recommended build sequence for all cycle tasks, including standalone tasks: e.g. \`Build order: task-A \u2192 task-B; task-C standalone; task-D standalone\`. Flag circular dependencies with \u26A0\uFE0F and a note. Omit this section entirely when no intra-cycle dependencies exist \u2014 do not include an empty section.
    **Build order in cycle log:** If intra-cycle dependencies were detected, include a "Build order:" line in \`cycleLogNotes\` showing the recommended sequence as arrow chains (e.g. "Build order: task-123 \u2192 task-124; task-130 standalone"). Skip when no dependencies exist.
@@ -8568,7 +8631,7 @@ ${AD_REJECTION_RULES}
    - **Architecture Notes:** If a pattern was established that needs follow-up (e.g. "shared service layer created, MCP migration needed"), propose the follow-up.
    - **Strategy gaps:** If an Active Decision has no board tasks supporting it, propose one.
    - **Dogfood observations:** Unactioned dogfood entries span FOUR categories (friction, methodology, signal, commercial) \u2014 consider ALL of them, not just friction. If an entry (with ID) maps to no existing task, propose one, matching task type to category: friction/signal \u2192 fix or improvement; methodology \u2192 process/tooling change; commercial \u2192 GTM/positioning. **CRITICAL: Include \`dogfood:<uuid>\` in the new task's \`notes\` field** (e.g. \`"notes": "dogfood:abc12345-..."\`). This links the task to the observation so the pipeline can track what was actioned. Without this annotation, the observation stays unactioned forever.
-   Create new tasks via the \`newTasks\` array in Part 2. Use \`new-N\` IDs in \`cycleHandoffs\` to reference them. **New-task cap \u2014 scale it to backlog depth, do NOT hard-cap at 3:** when 5+ unblocked backlog candidates already exist, limit new tasks to 3 (there is plenty to select from, so prevent backlog bloat). When the backlog is thin (fewer than 5 unblocked candidates), create as many as needed to bring the cycle into the healthy 5-8 range \u2014 roughly \`6 \u2212 unblocked_candidates\` additional new tasks, derived from the brief, roadmap phases, and recent build reports \u2014 up to an absolute ceiling of **8 new tasks**. This removes the contradiction with the Cycle-sizing rule above (a healthy cycle is 6-10 tasks; <5 needs justification), which the old flat cap of 3 violated whenever the backlog was thin. Never invent filler to hit a number: every new task must trace to a real discovered issue, dogfood entry, roadmap phase, or brief item.
+   Create new tasks via the \`newTasks\` array in Part 2. Give each a unique \`tempId\` (\`"new-1"\`, \`"new-2"\`, \u2026) and set the matching \`cycleHandoffs\` \`taskId\` to that exact tempId (the apply step joins on tempId \u2014 array order is NOT used). **New-task cap \u2014 scale it to backlog depth, do NOT hard-cap at 3:** when 5+ unblocked backlog candidates already exist, limit new tasks to 3 (there is plenty to select from, so prevent backlog bloat). When the backlog is thin (fewer than 5 unblocked candidates), create as many as needed to bring the cycle into the healthy 5-8 range \u2014 roughly \`6 \u2212 unblocked_candidates\` additional new tasks, derived from the brief, roadmap phases, and recent build reports \u2014 up to an absolute ceiling of **8 new tasks**. This removes the contradiction with the Cycle-sizing rule above (a healthy cycle is 6-10 tasks; <5 needs justification), which the old flat cap of 3 violated whenever the backlog was thin. Never invent filler to hit a number: every new task must trace to a real discovered issue, dogfood entry, roadmap phase, or brief item.
    **\u26A0\uFE0F DUPLICATE CHECK:** Before adding a task to \`newTasks\`, scan the Cycle Board above for any existing task with the same or very similar title/scope. If a matching task already exists (even with slightly different wording), do NOT create a duplicate \u2014 reference the existing task ID instead. The board already contains all active tasks; re-creating them wastes IDs and bloats the board.
    **\u26A0\uFE0F ALREADY-BUILT CHECK:** Before creating a task, check the recent build reports and cycle log for evidence that this capability was already shipped. If a recent build report shows this feature was completed (even under a different task name), do NOT create a new task for it. This is especially important for UI features, data models, and integrations that may already exist.`);
   parts.push(PLAN_FRAGMENT_PRODUCT_BRIEF);
@@ -8688,6 +8751,26 @@ function buildPlanUserMessage(ctx) {
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");
     }
+    if (ctx.learningPatterns) {
+      parts.push(
+        "### Recurring Learning Patterns (cross-cycle)",
+        "",
+        "Tags from cycle learnings (surprises, issues, dead-ends, estimation misses) that keep recurring. Treat a module/theme that recurs across many cycles as a signal: size its tasks up and write a sharper pre-mortem.",
+        "",
+        ctx.learningPatterns,
+        ""
+      );
+    }
+    if (ctx.decisionScorePatterns) {
+      parts.push(
+        "### Decision Risk Scores (high-risk + movement)",
+        "",
+        "Per-decision risk scores (effort+risk+reversibility+scaleCost+lockIn, /25; lower = safer). Decisions flagged \u26A0 high-risk (>15/25) or whose score moved since the last scoring. When a task depends on or advances a \u26A0 high-risk or \u2191 riskier decision, name that decision in the BUILD HANDOFF pre-mortem and lean toward the larger estimate. Do NOT re-score decisions here \u2014 this is read-only input.",
+        "",
+        ctx.decisionScorePatterns,
+        ""
+      );
+    }
     if (ctx.reviewPatterns) {
       parts.push("### Review Patterns", "", ctx.reviewPatterns, "");
     }
@@ -8824,6 +8907,8 @@ function coerceStructuredOutput(parsed) {
     buildHandoff: coerceToString(h.buildHandoff)
   })) : [];
   const newTasks = Array.isArray(parsed.newTasks) ? parsed.newTasks.map((t) => ({
+    // task-2242: stable join key (optional — undefined falls back to index).
+    tempId: t.tempId !== void 0 && t.tempId !== null ? coerceToString(t.tempId) : void 0,
     title: coerceToString(t.title),
     status: coerceToString(t.status),
     priority: coerceToString(t.priority),
@@ -9152,6 +9237,16 @@ function buildReviewUserMessage(ctx) {
   if (ctx.decisionUsage) {
     parts.push("### Decision Usage (Reference Frequency)", "", ctx.decisionUsage, "");
   }
+  if (ctx.decisionScoreTrajectory) {
+    parts.push(
+      "### Decision Risk Trajectory (score movement)",
+      "",
+      "Decision risk scores (/25, lower = safer) that are high-risk (>15) or have moved since they were last scored. Call out which decisions got riskier (\u2191) and whether their confidence still holds; consider re-scoring or revisiting a decision whose risk is rising.",
+      "",
+      ctx.decisionScoreTrajectory,
+      ""
+    );
+  }
   if (ctx.recommendationEffectiveness) {
     parts.push("### Recommendation Follow-Through", "", ctx.recommendationEffectiveness, "");
   }
@@ -10290,6 +10385,8 @@ function applyContextTier(ctx, cycleCount) {
     ctx.discoveryCanvas = void 0;
     ctx.estimationCalibration = void 0;
     ctx.buildPatterns = void 0;
+    ctx.learningPatterns = void 0;
+    ctx.decisionScorePatterns = void 0;
     ctx.reviewPatterns = void 0;
     ctx.horizonContext = void 0;
     ctx.registeredDocs = void 0;
@@ -10792,7 +10889,9 @@ async function assembleContext(adapter2, mode, _config, filters, focus) {
       preAssignedResult,
       reportsForCapsResult,
       contextHashesResult,
-      doneTasksResult
+      doneTasksResult,
+      learningPatternsResult,
+      decisionScoresResult
     ] = await Promise.allSettled([
       detectReviewPatterns(reviews2, health.totalCycles, 5),
       adapter2.getPendingRecommendations(),
@@ -10807,7 +10906,11 @@ async function assembleContext(adapter2, mode, _config, filters, focus) {
       adapter2.queryBoard({ status: ["Backlog", "In Cycle", "Ready"], compact: true }),
       Promise.resolve(leanBuildReports.slice(0, 10)),
       adapter2.getContextHashes?.(health.totalCycles) ?? Promise.resolve(null),
-      adapter2.queryBoard({ status: ["Done", "Cancelled"], compact: true })
+      adapter2.queryBoard({ status: ["Done", "Cancelled"], compact: true }),
+      // task-2241: cross-cycle recurring learning patterns (the compounding-intelligence loop).
+      adapter2.getCycleLearningPatterns?.() ?? Promise.resolve([]),
+      // task-2264: per-decision risk scores + movement (second compounding-intelligence signal).
+      adapter2.getDecisionScorePatterns?.() ?? Promise.resolve([])
     ]);
     timings["parallelReads"] = t();
     let reviewPatternsText2;
@@ -10837,6 +10940,8 @@ async function assembleContext(adapter2, mode, _config, filters, focus) {
         estimationCalibrationText = (estimationCalibrationText ?? "") + moduleLines;
       }
     }
+    const learningPatternsText = learningPatternsResult.status === "fulfilled" ? formatLearningPatterns(learningPatternsResult.value) : void 0;
+    const decisionScorePatternsText = decisionScoresResult.status === "fulfilled" ? formatDecisionScorePatterns(decisionScoresResult.value) : void 0;
     let registeredDocsText;
     let unactionedDocsTextLean;
     if (docsResult.status === "fulfilled" && docsResult.value && docsResult.value.length > 0) {
@@ -10897,6 +11002,8 @@ ${lines.join("\n")}`;
       taskComments: taskCommentsText,
       discoveryCanvas: discoveryCanvasText,
       estimationCalibration: estimationCalibrationText,
+      learningPatterns: learningPatternsText,
+      decisionScorePatterns: decisionScorePatternsText,
       registeredDocs: registeredDocsText,
       unactionedDocs: unactionedDocsTextLean,
       focus,
@@ -10948,7 +11055,9 @@ ${lines.join("\n")}`;
     taskCommentsResultFull,
     docsResultFull,
     contextHashesResultFull,
-    doneTasksResultFull
+    doneTasksResultFull,
+    learningPatternsResultFull,
+    decisionScoresResultFull
   ] = await Promise.allSettled([
     Promise.resolve(allBuildReports),
     detectReviewPatterns(reviews, health.totalCycles, 5),
@@ -10957,7 +11066,11 @@ ${lines.join("\n")}`;
     assembleTaskComments(adapter2),
     adapter2.searchDocs?.({ status: "active", limit: 15 }),
     adapter2.getContextHashes?.(health.totalCycles) ?? Promise.resolve(null),
-    adapter2.queryBoard({ status: ["Done", "Cancelled"], compact: true })
+    adapter2.queryBoard({ status: ["Done", "Cancelled"], compact: true }),
+    // task-2241: cross-cycle recurring learning patterns (the compounding-intelligence loop).
+    adapter2.getCycleLearningPatterns?.() ?? Promise.resolve([]),
+    // task-2264: per-decision risk scores + movement (second compounding-intelligence signal).
+    adapter2.getDecisionScorePatterns?.() ?? Promise.resolve([])
   ]);
   timings["parallelAdvisory"] = t();
   let buildPatternsText;
@@ -10970,6 +11083,8 @@ ${lines.join("\n")}`;
     } catch {
     }
   }
+  const learningPatternsTextFull = learningPatternsResultFull.status === "fulfilled" ? formatLearningPatterns(learningPatternsResultFull.value) : void 0;
+  const decisionScorePatternsTextFull = decisionScoresResultFull.status === "fulfilled" ? formatDecisionScorePatterns(decisionScoresResultFull.value) : void 0;
   let reviewPatternsText;
   if (reviewPatternsResultFull.status === "fulfilled") {
     reviewPatternsText = hasReviewPatterns(reviewPatternsResultFull.value) ? formatReviewPatterns(reviewPatternsResultFull.value) : void 0;
@@ -11073,6 +11188,8 @@ ${logLines}`);
     methodologyMetrics: formatCycleMetrics(metricsSnapshots),
     recentReviews: formatReviews(reviews),
     buildPatterns: buildPatternsText,
+    learningPatterns: learningPatternsTextFull,
+    decisionScorePatterns: decisionScorePatternsTextFull,
     reviewPatterns: reviewPatternsText,
     horizonContext: horizonCtx,
     strategyRecommendations: strategyRecommendationsText,
@@ -11204,6 +11321,8 @@ ${cleanContent}`;
       strategicDirection: data.strategicDirection
     },
     newTasks: dedupedNewTasks.map((t) => ({
+      tempId: t.tempId,
+      // task-2242: stable handoff join key
       title: t.title,
       status: t.status || "Backlog",
       priority: t.priority || "P1 High",
@@ -11353,7 +11472,7 @@ ${cleanContent}`;
         visibility,
         ownerUserId: inheritedVis.ownerUserId
       });
-      newTaskIdMap.set(`new-${i + 1}`, created.id);
+      newTaskIdMap.set(newTaskJoinKey(task, i), created.id);
       if (adapter2.updateCycleLearningActionRef && task.notes) {
         const learningRefs = task.notes.match(/learning:([a-f0-9-]+)/gi);
         if (learningRefs) {
@@ -11512,6 +11631,13 @@ ${cleanContent}`;
     }
     for (const handoff of data.cycleHandoffs) {
       const resolvedId = newTaskIdMap.get(handoff.taskId) ?? handoff.taskId;
+      if (resolvedId === handoff.taskId && /^new-\d+$/i.test(handoff.taskId)) {
+        const titleLine = handoff.buildHandoff.match(/^Task:\s*(.+)/m)?.[1] ?? "(unknown)";
+        console.error(
+          `[plan] UNRESOLVED handoff reference "${handoff.taskId}" (task: ${titleLine.slice(0, 80)}) \u2014 no newTask carries this tempId/index. Handoff NOT written. Ensure each newTasks entry has a tempId matching its cycleHandoffs taskId (task-2242).`
+        );
+        continue;
+      }
       try {
         if (existingHandoffSet.has(resolvedId)) {
           console.error(`[plan] skipping handoff write for ${resolvedId} \u2014 already has one`);
@@ -13469,7 +13595,8 @@ async function assembleContext2(adapter2, cycleNumber, cyclesSinceLastReview, pr
     recData,
     pendingRecs,
     registeredDocs,
-    docsWithPendingActions
+    docsWithPendingActions,
+    decisionScores
   ] = await Promise.all([
     adapter2.readProductBrief(),
     // Strategy review needs to see retired ADs to triage/restore them as needed.
@@ -13496,7 +13623,9 @@ async function assembleContext2(adapter2, cycleNumber, cyclesSinceLastReview, pr
     // Doc registry — summaries for strategy review context
     adapter2.searchDocs?.({ status: "active", limit: 10 })?.catch(() => []) ?? Promise.resolve([]),
     // Doc registry — docs with pending actions for staleness audit
-    adapter2.searchDocs?.({ hasPendingActions: true, limit: 20 })?.catch(() => []) ?? Promise.resolve([])
+    adapter2.searchDocs?.({ hasPendingActions: true, limit: 20 })?.catch(() => []) ?? Promise.resolve([]),
+    // task-2264: decision risk scores + movement, so the review can show trajectory.
+    adapter2.getDecisionScorePatterns?.()?.catch(() => []) ?? Promise.resolve([])
   ]);
   const pendingAgendaTopics = await (adapter2.getPendingAgendaTopics?.().catch(() => []) ?? Promise.resolve([]));
   const tasks = [...activeTasks, ...recentDoneTasks];
@@ -13777,6 +13906,7 @@ ${lines.join("\n")}`;
     previousReviews: previousReviewsText,
     phases: phasesText,
     decisionUsage: decisionUsageText,
+    decisionScoreTrajectory: formatDecisionScorePatterns(decisionScores),
     northStar: currentNorthStar ?? void 0,
     recommendationEffectiveness: recEffectivenessText,
     adHocCommits: adHocCommitsText,
@@ -16874,6 +17004,10 @@ async function applySetup(adapter2, config2, input, briefText, adSeedText, conve
             priority: task.priority || "P2 Medium",
             complexity: task.complexity || "Small",
             module: task.module || "Core",
+            // epic is NOT NULL in cycle_tasks; default starter tasks to the
+            // 'Platform' epic (matches the idea tool) rather than leaving it
+            // unset (SUP-2026-020 — omitting it tripped a 23502 on every seed).
+            epic: task.epic || "Platform",
             phase: task.phase || "Phase 1",
             owner: "TBD",
             reviewed: false,
@@ -17566,12 +17700,60 @@ ${existing}`;
   }
   await writeFile3(changelogPath, body, "utf-8");
 }
-function mergeGroupedCycleBranches(config2, cycleNum, baseBranch) {
+async function allCancelledBranches(adapter2, cycleNum) {
+  const skip = /* @__PURE__ */ new Set();
+  try {
+    const ALL_STATUSES = [
+      "Backlog",
+      "In Cycle",
+      "Ready",
+      "In Progress",
+      "In Review",
+      "Done",
+      "Blocked",
+      "Cancelled",
+      "Deferred"
+    ];
+    const tasks = await adapter2.queryBoard({ cycleSince: cycleNum, status: ALL_STATUSES, compact: true });
+    const byModule = /* @__PURE__ */ new Map();
+    for (const t of tasks) {
+      if (t.cycle !== cycleNum) continue;
+      const moduleName = (t.module ?? "").trim();
+      if (!moduleName) continue;
+      const entry = byModule.get(moduleName) ?? { total: 0, cancelled: 0 };
+      entry.total++;
+      if (t.status === "Cancelled") entry.cancelled++;
+      byModule.set(moduleName, entry);
+    }
+    for (const [moduleName, entry] of byModule) {
+      if (entry.total > 0 && entry.cancelled === entry.total) {
+        skip.add(cycleBranchName(cycleNum, moduleName));
+      }
+    }
+  } catch {
+  }
+  return skip;
+}
+function mergeGroupedCycleBranches(config2, cycleNum, baseBranch, skipBranches = /* @__PURE__ */ new Set()) {
   const branches = listGroupedCycleBranches(config2.projectRoot, cycleNum, baseBranch);
   if (branches.length === 0) return [];
   const ghAvailable = isGhAvailable();
   const results = [];
   for (const branch of branches) {
+    if (skipBranches.has(branch)) {
+      results.push({ branch, prUrl: null, status: "skipped", message: "all cycle tasks Cancelled \u2014 branch not merged (task-2253)" });
+      continue;
+    }
+    if (isBranchContentAlreadyInBase(config2.projectRoot, branch, baseBranch)) {
+      deleteLocalBranch(config2.projectRoot, branch);
+      results.push({
+        branch,
+        prUrl: null,
+        status: "skipped",
+        message: `content already on '${baseBranch}' (tree-equal \u2014 squash-merged); lingering branch cleaned, no re-merge`
+      });
+      continue;
+    }
     if (branchExists(config2.projectRoot, branch) && hasRemote(config2.projectRoot)) {
       const push = gitPush(config2.projectRoot, branch);
       if (!push.success) {
@@ -17794,7 +17976,8 @@ async function createRelease(config2, branch, version, adapter2, cycleNum, optio
   }
   let groupedBranchMerges;
   if (resolvedCycleNum > 0) {
-    const mergeResults = mergeGroupedCycleBranches(config2, resolvedCycleNum, branch);
+    const skipBranches = adapter2 ? await allCancelledBranches(adapter2, resolvedCycleNum) : /* @__PURE__ */ new Set();
+    const mergeResults = mergeGroupedCycleBranches(config2, resolvedCycleNum, branch, skipBranches);
     if (mergeResults.length > 0) {
       groupedBranchMerges = mergeResults;
       const failures = mergeResults.filter((r) => r.status === "failed");
@@ -18598,6 +18781,23 @@ If you intend to discard the work, run build_cancel instead.`
   err.gitStderr = scrubbed;
   return err;
 }
+var UI_FILE_RE = /^(app\/.+\.(tsx|css)|components\/.+\.tsx)$/;
+var NON_UI_RE = /(^app\/api\/|\.test\.|\.spec\.|\/__tests__\/)/;
+function inferRouteFromPage(file) {
+  const m = file.match(/^app\/(.*)\/page\.tsx$/);
+  if (!m) return null;
+  const segments = m[1].split("/").filter((s) => s.length > 0 && !(s.startsWith("(") && s.endsWith(")")));
+  return "/" + segments.join("/");
+}
+function computeLocalPreview(filesChanged, provided) {
+  const uiFiles = (filesChanged ?? []).filter((f) => UI_FILE_RE.test(f) && !NON_UI_RE.test(f));
+  const hasProvided = !!(provided && (provided.urls?.length || provided.screenshotPath || provided.notes));
+  if (uiFiles.length === 0 && !hasProvided) return void 0;
+  const routes = Array.from(
+    new Set(uiFiles.map(inferRouteFromPage).filter((r) => r !== null))
+  );
+  return { uiFiles, routes, provided: hasProvided ? provided : void 0 };
+}
 var AMBIENT_DRIFT_PATTERNS = [
   /^\.next\//,
   /^\.next$/,
@@ -19274,6 +19474,7 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}) {
     const drift = computeScopeDriftSignal(task.buildHandoff?.filesLikelyTouched, driftChanged);
     if (drift) report.scopeDriftSignal = drift;
   }
+  const localPreview = computeLocalPreview(report.filesChanged, input.preview);
   let prLines = [];
   if (options.light) {
     prLines.push("Light mode: skipping push and PR creation.");
@@ -19376,7 +19577,8 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}) {
     autoTriagedCount: autoTriagedCount > 0 ? autoTriagedCount : void 0,
     autoTriagedIds: autoTriagedIds.length > 0 ? autoTriagedIds : void 0,
     autoTriagedDupes: autoTriagedDupes.length > 0 ? autoTriagedDupes : void 0,
-    reportWriteVerified
+    reportWriteVerified,
+    localPreview
   };
 }
 async function cancelBuild(adapter2, taskId, reason) {
@@ -19596,6 +19798,15 @@ var buildExecuteTool = {
           verified_at: { type: "string", description: "ISO 8601 timestamp." }
         },
         required: ["urls", "curl_command", "http_status", "response_excerpt", "verified_at"]
+      },
+      preview: {
+        type: "object",
+        description: `Optional. For a build that touched USER-FACING UI: tell the owner how to SEE the result locally so reviewing it doesn't mean reading code or asking "show me". urls = the localhost route(s) to open (e.g. ["http://localhost:3000/hub"]); notes = what to look at; screenshot_path = a path to an image you captured. Surfaced verbatim in the completion output. When the diff touched UI and you omit this, the output nudges you to provide it.`,
+        properties: {
+          urls: { type: "array", items: { type: "string" }, description: "Localhost route(s) to open to view the work." },
+          notes: { type: "string", description: "What the owner should look at / verify." },
+          screenshot_path: { type: "string", description: "Path to a captured screenshot of the rendered result." }
+        }
       }
     },
     required: ["task_id"]
@@ -19873,6 +20084,12 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
   const deadEnds = args.dead_ends;
   const rawBriefImplications = args.brief_implications;
   const resolvesLearnings = Array.isArray(args.resolves_learnings) ? args.resolves_learnings : void 0;
+  const rawPreview = args.preview;
+  const preview = rawPreview ? {
+    urls: Array.isArray(rawPreview.urls) ? rawPreview.urls.filter((u) => typeof u === "string") : void 0,
+    notes: typeof rawPreview.notes === "string" ? rawPreview.notes : void 0,
+    screenshotPath: typeof rawPreview.screenshot_path === "string" ? rawPreview.screenshot_path : void 0
+  } : void 0;
   const rawProductionVerification = args.production_verification;
   const productionVerification = rawProductionVerification ? {
     urls: Array.isArray(rawProductionVerification.urls) ? rawProductionVerification.urls.filter((u) => typeof u === "string") : [],
@@ -19929,7 +20146,8 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
         type: bi.type ?? "new",
         detail: bi.detail ?? ""
       })),
-      productionVerification
+      productionVerification,
+      preview
     }, { light });
     tracker.mark("complete_format");
     if (resolvesLearnings && resolvesLearnings.length > 0 && adapter2.updateCycleLearningActionRef) {
@@ -19986,6 +20204,26 @@ function formatCompleteResult(result) {
   if (result.cycleProgress.total > 0) {
     lines.push("", `Cycle progress: ${result.cycleProgress.completed} of ${result.cycleProgress.total} cycle tasks complete.`);
   }
+  if (result.localPreview) {
+    const { routes, provided, uiFiles } = result.localPreview;
+    const previewLines = ["", "### \u{1F441} Preview the work"];
+    if (provided?.urls?.length) {
+      previewLines.push(`Open: ${provided.urls.join(" \xB7 ")}`);
+    } else if (routes.length > 0) {
+      const urls = routes.map((r) => `http://localhost:3000${r}`);
+      previewLines.push(`Run \`npm run dev\` and open: ${urls.join(" \xB7 ")}`);
+    } else {
+      previewLines.push(
+        `This build changed UI (${uiFiles.slice(0, 4).join(", ")}${uiFiles.length > 4 ? `, +${uiFiles.length - 4} more` : ""}). Run \`npm run dev\` and open the page that renders it.`
+      );
+    }
+    if (provided?.screenshotPath) previewLines.push(`Screenshot: ${provided.screenshotPath}`);
+    if (provided?.notes) previewLines.push(`Look at: ${provided.notes}`);
+    if (!provided) {
+      previewLines.push("_Tip: pass `preview` (the route you viewed / a screenshot) on complete so the result travels with the build._");
+    }
+    lines.push(...previewLines);
+  }
   if (result.phaseChanges.length > 0) {
     for (const c of result.phaseChanges) {
       lines.push(`Phase auto-updated: ${c.phaseId} ${c.oldStatus} \u2192 ${c.newStatus}`);
@@ -26652,6 +26890,8 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 var BEARER_PREFIX = "papi_";
 var BEARER_REGEX = /^(papi_|papi_oauth_)[a-f0-9]{64}$/;
 var RESOURCE_METADATA_URL = process.env["PAPI_RESOURCE_METADATA_URL"] ?? "https://getpapi.ai/.well-known/oauth-protected-resource";
+var DASHBOARD_ORIGIN = process.env["PAPI_DASHBOARD_URL"] ?? "https://getpapi.ai";
+var MCP_RESOURCE_URL = process.env["NEXT_PUBLIC_MCP_URL"] ?? "https://mcp.getpapi.ai";
 var FRIENDLY_GET_HTML = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -26779,6 +27019,31 @@ function startHttpTransport(opts) {
       res.end("ok");
       return;
     }
+    if (req.method === "GET" && req.url === "/.well-known/oauth-protected-resource") {
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Cache-Control": "public, max-age=3600",
+        ...cors
+      });
+      res.end(
+        JSON.stringify({
+          resource: MCP_RESOURCE_URL,
+          authorization_servers: [DASHBOARD_ORIGIN],
+          scopes_supported: ["mcp:full"],
+          bearer_methods_supported: ["header"]
+        })
+      );
+      return;
+    }
+    if (req.method === "GET" && req.url === "/.well-known/oauth-authorization-server") {
+      res.writeHead(302, {
+        Location: `${DASHBOARD_ORIGIN}/.well-known/oauth-authorization-server`,
+        "Cache-Control": "public, max-age=3600",
+        ...cors
+      });
+      res.end();
+      return;
+    }
     if (req.url !== "/mcp" && req.url !== "/sse") {
       sendError(res, { status: 404, body: { error: "Not found" } }, cors);
       return;

package/dist/prompts.js

@@ -89,7 +89,7 @@ After your natural language output, include this EXACT format on its own line:
   "boardHealth": "string \u2014 e.g. 5 tasks (3 backlog, 2 done)",
   "strategicDirection": "string \u2014 one sentence about current phase/direction",
   "recommendedTaskId": "string or null \u2014 task ID to set In Progress",
-  "cycleHandoffs": [{"taskId": "string \u2014 existing task ID or new-N for new tasks", "buildHandoff": "string \u2014 full BUILD HANDOFF text"}],
+  "cycleHandoffs": [{"taskId": "string \u2014 an existing task ID, or the EXACT tempId of a newTasks entry (e.g. "new-1") it provides the handoff for", "buildHandoff": "string \u2014 full BUILD HANDOFF text"}],
   "newTasks": [],
   "boardCorrections": [],
   "productBrief": null,
@@ -134,7 +134,7 @@ Everything in Part 1 (natural language) is **display-only**. Part 2 (structured
 **Example with populated fields (DO NOT copy literally \u2014 adapt to your actual analysis):**
 \`\`\`json
 {
-  "newTasks": [{"title": "Example task", "status": "Backlog", "priority": "P2 Medium", "complexity": "Small", "module": "Core", "epic": "Platform", "phase": "Phase 1", "owner": "TBD", "notes": "Created during triage"}],
+  "newTasks": [{"tempId": "new-1", "title": "Example task", "status": "Backlog", "priority": "P2 Medium", "complexity": "Small", "module": "Core", "epic": "Platform", "phase": "Phase 1", "owner": "TBD", "notes": "Created during triage"}],
   "activeDecisions": [{"id": "AD-3", "body": "### AD-3: Use REST over GraphQL [Confidence: HIGH]\\n\\n- **Decision:** REST API for v1.\\n- **Evidence:** Simpler for current scope."}],
   "boardCorrections": [{"taskId": "task-005", "updates": {"priority": "P1 High", "reviewed": true}}, {"taskId": "task-009", "updates": {"status": "Cancelled", "closureReason": "Duplicates task-003"}}],
   "cycleHandoffs": [{"taskId": "task-002", "buildHandoff": "BUILD HANDOFF \u2014 task-002\\nTask: ..."}]
@@ -172,7 +172,7 @@ This is Cycle 0 \u2014 the first planning cycle for a brand-new project.
 
 4. **First Active Decision** \u2014 If the description implies a clear architectural choice, create AD-1 with Confidence: MEDIUM. If no clear choice, skip this.
 
-5. **BUILD HANDOFFs** \u2014 Generate a full BUILD HANDOFF block for EVERY task created in step 3 (all 3-5 tasks). Include each in the \`cycleHandoffs\` array. Use \`new-N\` IDs to reference them (matching the \`newTasks\` array). The builder needs handoffs to run \`build_execute\` \u2014 without them, tasks must be completed via \`ad_hoc\`, which breaks the normal flow.
+5. **BUILD HANDOFFs** \u2014 Generate a full BUILD HANDOFF block for EVERY task created in step 3 (all 3-5 tasks). Include each in the \`cycleHandoffs\` array. **tempId join (REQUIRED \u2014 mismatches silently scramble handoffs):** give EVERY \`newTasks\` entry a unique \`tempId\` (\`"new-1"\`, \`"new-2"\`, \u2026), and set each \`cycleHandoffs\` \`taskId\` to the EXACT \`tempId\` of the newTask it belongs to. Do NOT rely on array order, and do NOT reuse a tempId. The builder needs handoffs to run \`build_execute\` \u2014 without them, tasks must be completed via \`ad_hoc\`, which breaks the normal flow.
 
 ### Structured output for Bootstrap:
 In the JSON block, you MUST include:
@@ -380,7 +380,7 @@ ${AD_REJECTION_RULES}
    **Reference docs:** If a task's notes include a \`Reference:\` path (e.g. \`Reference: docs/architecture/papi-brain-v1.md\`), include a REFERENCE DOCS section in the BUILD HANDOFF with those paths. This tells the builder to read the referenced doc for background context before implementing. Do NOT omit or summarise the reference \u2014 pass it through so the builder can access the full document. Only tasks with explicit \`Reference:\` paths in their notes should have this section.
    **Full notes lookup:** Notes in the Board section are truncated to 300 chars for concise task selection. When generating a BUILD HANDOFF for a task, check the "Full Notes for Candidate Tasks" section (if present in context) for that task's complete untruncated notes before writing SCOPE, SCOPE BOUNDARY, and PRE-MORTEM. Submitter context, constraints, and reasoning often live past the 300-char cutoff and must not be dropped from the handoff.
    **Pre-build verification:** EVERY handoff MUST include a PRE-BUILD VERIFICATION section listing 2-5 specific file paths the builder should read before implementing. Derive these from FILES LIKELY TOUCHED \u2014 pick the files most likely to already contain the target functionality. This is the #1 prevention mechanism for wasted build slots (C120, C125, C126 all scheduled already-shipped work). If the builder finds >80% of the scope already implemented, they report "already built" instead of re-implementing.
-   **Pre-mortem:** For projects with 10+ cycles, include a PRE-MORTEM section in every BUILD HANDOFF with 1-3 bullet points: (a) most likely technical blocker based on module history, (b) integration risk with adjacent systems, (c) scope creep signal \u2014 what the builder might be tempted to expand beyond scope. Draw from \`dead_ends\` and \`surprises\` in recent build reports for the same module. Omit this section entirely for projects with fewer than 10 cycles.
+   **Pre-mortem:** For projects with 10+ cycles, include a PRE-MORTEM section in every BUILD HANDOFF with 1-3 bullet points: (a) most likely technical blocker based on module history, (b) integration risk with adjacent systems, (c) scope creep signal \u2014 what the builder might be tempted to expand beyond scope. Draw from \`dead_ends\` and \`surprises\` in recent build reports for the same module. **If a "Recurring Learning Patterns (cross-cycle)" section is provided in the context, treat a module or theme that recurs across many cycles as a strong signal \u2014 size such tasks up (lean toward the larger estimate) and name the recurring failure mode explicitly in the pre-mortem.** Omit this section entirely for projects with fewer than 10 cycles.
    **Intra-cycle dependency detection:** After selecting cycle tasks, check every pair for build-order dependencies. Two tasks A and B have an intra-cycle dependency when A must be built before B because B consumes an artifact A creates \u2014 e.g. A adds a new adapter method that B calls, A creates a DB migration B depends on, A introduces a new shared type B imports, A refactors a utility B modifies. Signals: same module + adjacent scope (one is "add X", another is "use X"), or notes explicitly reference the other task. For each dependency detected: (a) populate the DEPENDS ON section in the dependent task's BUILD HANDOFF with the upstream task ID(s); (b) add a \`boardCorrections\` entry for the dependent task with \`updates.dependsOn\` set to the comma-separated upstream IDs \u2014 this persists the dependency so the builder's runtime can reuse the upstream branch; (c) keep SCOPE sections independent but note the ordering in "Why now". Do NOT invent dependencies where tasks merely share a module \u2014 only real build-order coupling counts. Linear chains only \u2014 no multi-level graph resolution. When in doubt, omit.
    **Dependency Chain section (Part 1 markdown):** When intra-cycle dependencies are detected, include a visible **## Dependency Chain** section in Part 1 markdown immediately before the first BUILD HANDOFF block. List each dependency as an arrow chain with a brief reason: \`task-A \u2192 task-B (B calls the adapter method A creates)\`. Then show the full recommended build sequence for all cycle tasks, including standalone tasks: e.g. \`Build order: task-A \u2192 task-B; task-C standalone; task-D standalone\`. Flag circular dependencies with \u26A0\uFE0F and a note. Omit this section entirely when no intra-cycle dependencies exist \u2014 do not include an empty section.
    **Build order in cycle log:** If intra-cycle dependencies were detected, include a "Build order:" line in \`cycleLogNotes\` showing the recommended sequence as arrow chains (e.g. "Build order: task-123 \u2192 task-124; task-130 standalone"). Skip when no dependencies exist.
@@ -404,7 +404,7 @@ ${AD_REJECTION_RULES}
    - **Architecture Notes:** If a pattern was established that needs follow-up (e.g. "shared service layer created, MCP migration needed"), propose the follow-up.
    - **Strategy gaps:** If an Active Decision has no board tasks supporting it, propose one.
    - **Dogfood observations:** Unactioned dogfood entries span FOUR categories (friction, methodology, signal, commercial) \u2014 consider ALL of them, not just friction. If an entry (with ID) maps to no existing task, propose one, matching task type to category: friction/signal \u2192 fix or improvement; methodology \u2192 process/tooling change; commercial \u2192 GTM/positioning. **CRITICAL: Include \`dogfood:<uuid>\` in the new task's \`notes\` field** (e.g. \`"notes": "dogfood:abc12345-..."\`). This links the task to the observation so the pipeline can track what was actioned. Without this annotation, the observation stays unactioned forever.
-   Create new tasks via the \`newTasks\` array in Part 2. Use \`new-N\` IDs in \`cycleHandoffs\` to reference them. **New-task cap \u2014 scale it to backlog depth, do NOT hard-cap at 3:** when 5+ unblocked backlog candidates already exist, limit new tasks to 3 (there is plenty to select from, so prevent backlog bloat). When the backlog is thin (fewer than 5 unblocked candidates), create as many as needed to bring the cycle into the healthy 5-8 range \u2014 roughly \`6 \u2212 unblocked_candidates\` additional new tasks, derived from the brief, roadmap phases, and recent build reports \u2014 up to an absolute ceiling of **8 new tasks**. This removes the contradiction with the Cycle-sizing rule above (a healthy cycle is 6-10 tasks; <5 needs justification), which the old flat cap of 3 violated whenever the backlog was thin. Never invent filler to hit a number: every new task must trace to a real discovered issue, dogfood entry, roadmap phase, or brief item.
+   Create new tasks via the \`newTasks\` array in Part 2. Give each a unique \`tempId\` (\`"new-1"\`, \`"new-2"\`, \u2026) and set the matching \`cycleHandoffs\` \`taskId\` to that exact tempId (the apply step joins on tempId \u2014 array order is NOT used). **New-task cap \u2014 scale it to backlog depth, do NOT hard-cap at 3:** when 5+ unblocked backlog candidates already exist, limit new tasks to 3 (there is plenty to select from, so prevent backlog bloat). When the backlog is thin (fewer than 5 unblocked candidates), create as many as needed to bring the cycle into the healthy 5-8 range \u2014 roughly \`6 \u2212 unblocked_candidates\` additional new tasks, derived from the brief, roadmap phases, and recent build reports \u2014 up to an absolute ceiling of **8 new tasks**. This removes the contradiction with the Cycle-sizing rule above (a healthy cycle is 6-10 tasks; <5 needs justification), which the old flat cap of 3 violated whenever the backlog was thin. Never invent filler to hit a number: every new task must trace to a real discovered issue, dogfood entry, roadmap phase, or brief item.
    **\u26A0\uFE0F DUPLICATE CHECK:** Before adding a task to \`newTasks\`, scan the Cycle Board above for any existing task with the same or very similar title/scope. If a matching task already exists (even with slightly different wording), do NOT create a duplicate \u2014 reference the existing task ID instead. The board already contains all active tasks; re-creating them wastes IDs and bloats the board.
    **\u26A0\uFE0F ALREADY-BUILT CHECK:** Before creating a task, check the recent build reports and cycle log for evidence that this capability was already shipped. If a recent build report shows this feature was completed (even under a different task name), do NOT create a new task for it. This is especially important for UI features, data models, and integrations that may already exist.`);
   parts.push(PLAN_FRAGMENT_PRODUCT_BRIEF);
@@ -524,6 +524,26 @@ function buildPlanUserMessage(ctx) {
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");
     }
+    if (ctx.learningPatterns) {
+      parts.push(
+        "### Recurring Learning Patterns (cross-cycle)",
+        "",
+        "Tags from cycle learnings (surprises, issues, dead-ends, estimation misses) that keep recurring. Treat a module/theme that recurs across many cycles as a signal: size its tasks up and write a sharper pre-mortem.",
+        "",
+        ctx.learningPatterns,
+        ""
+      );
+    }
+    if (ctx.decisionScorePatterns) {
+      parts.push(
+        "### Decision Risk Scores (high-risk + movement)",
+        "",
+        "Per-decision risk scores (effort+risk+reversibility+scaleCost+lockIn, /25; lower = safer). Decisions flagged \u26A0 high-risk (>15/25) or whose score moved since the last scoring. When a task depends on or advances a \u26A0 high-risk or \u2191 riskier decision, name that decision in the BUILD HANDOFF pre-mortem and lean toward the larger estimate. Do NOT re-score decisions here \u2014 this is read-only input.",
+        "",
+        ctx.decisionScorePatterns,
+        ""
+      );
+    }
     if (ctx.reviewPatterns) {
       parts.push("### Review Patterns", "", ctx.reviewPatterns, "");
     }
@@ -660,6 +680,8 @@ function coerceStructuredOutput(parsed) {
     buildHandoff: coerceToString(h.buildHandoff)
   })) : [];
   const newTasks = Array.isArray(parsed.newTasks) ? parsed.newTasks.map((t) => ({
+    // task-2242: stable join key (optional — undefined falls back to index).
+    tempId: t.tempId !== void 0 && t.tempId !== null ? coerceToString(t.tempId) : void 0,
     title: coerceToString(t.title),
     status: coerceToString(t.status),
     priority: coerceToString(t.priority),
@@ -988,6 +1010,16 @@ function buildReviewUserMessage(ctx) {
   if (ctx.decisionUsage) {
     parts.push("### Decision Usage (Reference Frequency)", "", ctx.decisionUsage, "");
   }
+  if (ctx.decisionScoreTrajectory) {
+    parts.push(
+      "### Decision Risk Trajectory (score movement)",
+      "",
+      "Decision risk scores (/25, lower = safer) that are high-risk (>15) or have moved since they were last scored. Call out which decisions got riskier (\u2191) and whether their confidence still holds; consider re-scoring or revisiting a decision whose risk is rising.",
+      "",
+      ctx.decisionScoreTrajectory,
+      ""
+    );
+  }
   if (ctx.recommendationEffectiveness) {
     parts.push("### Recommendation Follow-Through", "", ctx.recommendationEffectiveness, "");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.36",
+  "version": "0.7.38",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.cathalos92/papi",