@papi-ai/server 0.7.60 → 0.7.62

package/design-assets/agents/frontend-design-engineer.md

@@ -88,6 +88,13 @@ Your output is **not done** if ANY of these is true (these are falsifiable — c
 - [ ] Guidance, state, or a next action explained in a sentence of helper text where a visual cue
       (position, size, colour, icon, a signpost, motion-on-change) would carry it — prose used as a
       crutch for missing visual steering.
+- [ ] A label, its value, and its explanation each taking their own line ("The Stacked Caption").
+      Anywhere the three exist, they share ONE line.
+- [ ] A new datum added as a sibling row beside a row it could extend ("The Siblinged Row").
+      Extend the existing row — inline suffix, extra cell, chip on the same baseline — never stack
+      a twin row underneath.
+- [ ] An eyebrow label or an explanatory subtitle above/below a heading ("The Eyebrow Crutch").
+      Labels carry themselves; if a heading needs a subtitle to be understood, the heading is wrong.
 - [ ] More than ~3 sections fully visible above the fold.
 - [ ] Identical-sized cards in a uniform row (flat hierarchy — needs a dominant 2×+ cell).
 - [ ] Monospace on labels, status, timestamps, or nav.

package/design-assets/skills/design-critique/SKILL.md

@@ -108,6 +108,12 @@ Run through every named anti-pattern and flag matches. Common universal ones:
 - Guidance, state, or a next action carried by a sentence of helper text where a visual cue
   (position, size, colour, an icon, a signpost, motion-on-change) would do — prose as a crutch for
   missing visual steering. Prefer showing over telling.
+- A label, its value, and its explanation each taking their own line ("The Stacked Caption") —
+  anywhere the three exist, they share ONE line.
+- A new datum added as a sibling row beside a row it could extend ("The Siblinged Row") — extend
+  the existing row (inline suffix, extra cell, chip on the same baseline), never stack a twin row.
+- An eyebrow label or explanatory subtitle above/below a heading ("The Eyebrow Crutch") — labels
+  carry themselves; a heading that needs a subtitle to be understood is the wrong heading.
 - Identical-sized cards in a uniform row (flat hierarchy).
 - Monospace on labels / status / timestamps / nav.
 - Header, label, and value at the same size+weight.

package/dist/backfill-cycle-metrics.js

@@ -1189,7 +1189,12 @@ var init_proxy_adapter = __esm({
       "listContributorReleasePrs",
       "claimReview",
       "getSiblingAds",
-      "getSiblingRepoTasks"
+      "getSiblingRepoTasks",
+      // task-2828 (C339): attributed-intelligence analytics reader — pg-only this cycle.
+      // Hosted forwarding needs a SECURITY DEFINER RPC + edge handler (like task-2394 did
+      // for getModuleEstimationStats); until then keep it here so hosted degrades to a
+      // safe `undefined` rather than forwarding into a 403. Wire under task-2390.
+      "getModelOutcomeStats"
       // task-2394 (C329) — Batch A wired: findPendingDocActionsForTask,
       // getModuleEstimationStats and getDecisionScorePatterns now have edge case handlers
       // (each backed by a SECURITY DEFINER RPC, migration 20260714140000) plus

package/dist/index.js

@@ -1306,7 +1306,12 @@ var init_proxy_adapter = __esm({
       "listContributorReleasePrs",
       "claimReview",
       "getSiblingAds",
-      "getSiblingRepoTasks"
+      "getSiblingRepoTasks",
+      // task-2828 (C339): attributed-intelligence analytics reader — pg-only this cycle.
+      // Hosted forwarding needs a SECURITY DEFINER RPC + edge handler (like task-2394 did
+      // for getModuleEstimationStats); until then keep it here so hosted degrades to a
+      // safe `undefined` rather than forwarding into a 403. Wire under task-2390.
+      "getModelOutcomeStats"
       // task-2394 (C329) — Batch A wired: findPendingDocActionsForTask,
       // getModuleEstimationStats and getDecisionScorePatterns now have edge case handlers
       // (each backed by a SECURITY DEFINER RPC, migration 20260714140000) plus
@@ -5054,7 +5059,7 @@ var init_setup = __esm({
 
 // src/index.ts
 import { readFileSync as readFileSync16 } from "fs";
-import { dirname as dirname6, join as join24 } from "path";
+import { dirname as dirname6, join as join24, basename as basename2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
@@ -10946,7 +10951,7 @@ function computeCarryForwardStaleness(log2, doneTaskIds) {
   if (stale.length === 0) return void 0;
   const lines = stale.map(([id, count]) => `- **${id}** \u2014 deferred ${count} consecutive cycle(s)`);
   return [
-    `\u26A0\uFE0F ${stale.length} task(s) have been in carry-forward for 3+ consecutive cycles. The planner must resolve each \u2014 either escalate to P1 High or recommend cancellation with a closure reason. Deferring again without justification is not acceptable.`,
+    `\u26A0\uFE0F ${stale.length} task(s) have been in carry-forward for 3+ consecutive cycles. The planner must resolve each \u2014 either escalate it to P1 High, or move it to Deferred with a reason. Do NOT cancel a stale carry-forward task: cancelling removes it from the owner's field of view, and only the owner may cancel. Deferring again without a fresh justification is not acceptable.`,
     "",
     ...lines
   ].join("\n");
@@ -11096,6 +11101,15 @@ async function resolveOwnerGate(adapter2, config2) {
 
 // src/services/plan.ts
 var PLAN_BUILD_REPORT_BUDGET = { maxReports: 12, fieldBudget: 280 };
+function leadChainWithRecommended(chain, recommendedTaskId) {
+  const rec = recommendedTaskId?.trim();
+  const existing = (chain ?? "").trim();
+  if (!rec) return existing || void 0;
+  const firstMentioned = existing.match(/task-\d+/)?.[0];
+  if (firstMentioned === rec) return existing || void 0;
+  const lead = `Build order: ${rec} first.`;
+  return existing ? `${lead} ${existing}` : lead;
+}
 async function resolvePlanScope(adapter2, config2) {
   const gate = await resolveOwnerGate(adapter2, config2);
   return { callerUserId: gate.callerUserId, ownerUserId: gate.ownerUserId, callerIsOwner: gate.callerIsOwner };
@@ -12044,7 +12058,12 @@ ${cleanContent}`;
     // project owner when unset, so owner-operated plans stay correct).
     ...options.ownerUserId ? { userId: options.ownerUserId } : {},
     // task-2483 (C319): persist the plan's Dependency Chain build-order markdown.
-    ...data.dependencyChain ? { dependencyChain: data.dependencyChain } : {}
+    // task-2823 (C338): seed it to lead with recommendedTaskId when the plan omits a
+    // chain or it doesn't lead with the planner's pick, so the hub next-move agrees.
+    ...(() => {
+      const chain = leadChainWithRecommended(data.dependencyChain, data.recommendedTaskId);
+      return chain ? { dependencyChain: chain } : {};
+    })()
   };
   const earlyCreateWarnings = [];
   try {
@@ -12477,7 +12496,13 @@ ${cleanContent}`;
         ...options.ownerUserId ? { userId: options.ownerUserId } : {},
         // task-2483 (C319): persist the plan's Dependency Chain build-order markdown.
         // This full write patches the early minimal row created in Phase 1.
-        ...data.dependencyChain ? { dependencyChain: data.dependencyChain } : {}
+        // task-2823 (C338): seed it to lead with recommendedTaskId (mapped from any
+        // new-task tempId) so the hub next-move matches the planner's explicit pick.
+        ...(() => {
+          const recId = data.recommendedTaskId ? newTaskIdMap.get(data.recommendedTaskId) ?? data.recommendedTaskId : null;
+          const chain = leadChainWithRecommended(data.dependencyChain, recId);
+          return chain ? { dependencyChain: chain } : {};
+        })()
       };
       await adapter2.createCycle(cycle);
     } catch (err) {
@@ -12740,6 +12765,7 @@ async function preparePlan(adapter2, config2, filters, focus, force, handoffsOnl
     const contextBytes2 = Buffer.byteLength(userMessage2, "utf-8");
     console.error(`[plan-perf] contextBytes=${contextBytes2} (handoffs-only)`);
     const planSystemPrompt2 = await getPrompt("plan-system");
+    await recordPlanGenerationActive(tracker, incomingCycle);
     return {
       mode: "full",
       // apply phase treats it the same
@@ -12800,6 +12826,7 @@ async function preparePlan(adapter2, config2, filters, focus, force, handoffsOnl
   } catch {
   }
   const planSystemPrompt = await getPrompt("plan-system");
+  await recordPlanGenerationActive(tracker, incomingCycle);
   return {
     mode,
     cycleNumber,
@@ -12823,6 +12850,15 @@ async function streamPlanStageSteps(tracker, newCycleNumber) {
     await tracker.recordStep(step);
   }
 }
+async function recordPlanGenerationActive(tracker, incomingCycleNumber) {
+  if (!tracker) return;
+  await tracker.recordStep("recommendation", {
+    cycle: incomingCycleNumber,
+    stage: "plan",
+    status: "active",
+    metadata: { phase: "generating" }
+  });
+}
 async function applyPlan(adapter2, config2, rawLlmOutput, mode, cycleNumber, strategyReviewWarning, contextHashes, planRunMeta, tracker) {
   const applyTimer = startTimer();
   console.error(`[plan-perf] applyPlan: start (llm_response=${rawLlmOutput.length} chars)`);
@@ -13053,7 +13089,6 @@ function defaultHint(tool) {
 function buildSubagentDispatchPrompt(input) {
   const {
     tool,
-    applyMode,
     cycleNumber = 0,
     strategyReviewWarning = "",
     taskId,
@@ -13065,7 +13100,7 @@ function buildSubagentDispatchPrompt(input) {
   const isReview = tool === "review_submit";
   let applyNote;
   if (tool === "plan") {
-    applyNote = `\`plan\` again with mode="apply", llm_response=<sub-agent output>, plan_mode="${applyMode ?? "full"}", cycle_number=${cycleNumber + 1}, strategy_review_warning=${JSON.stringify(strategyReviewWarning)}`;
+    applyNote = `\`plan\` again with mode="apply", llm_response=<sub-agent output>, cycle_number=${cycleNumber + 1}, strategy_review_warning=${JSON.stringify(strategyReviewWarning)}`;
   } else if (tool === "strategy_review") {
     applyNote = `\`strategy_review\` again with mode="apply", llm_response=<sub-agent output>, cycle_number=${cycleNumber}`;
   } else if (tool === "zoom_out") {
@@ -13129,6 +13164,105 @@ Do NOT post-process the sub-agent reply. The apply path expects the full structu
     step2Note
   ].join("\n");
 }
+var REVIEW_PRESETS = {
+  // Minimal gate: does it work, and is every write actually read (AD-74)?
+  gate: ["correctness", "wiring"],
+  // Everything.
+  full: ["correctness", "security", "wiring", "test-quality", "scope-drift"],
+  // Security first, plus correctness and a lighter wiring check.
+  "security-focused": ["security", "correctness", "wiring"]
+};
+var LENS_INSTRUCTIONS = {
+  correctness: "CORRECTNESS lens. Does the change do what the build report claims, without bugs? Hunt logic errors, off-by-one/boundary mistakes, unhandled error branches, null/undefined hazards, race conditions, and wrong assumptions about inputs. Ignore style, security, and scope \u2014 other lenses own those.",
+  security: "SECURITY lens. Any auth/data/secret/injection risk introduced? Check for missing project_id scoping on multi-tenant SQL, RLS bypass via service role, unescaped input, leaked credentials/tokens in logs or responses, and newly-public routes (PUBLIC_PATHS). Ignore correctness/style unless it is the vector for a security issue.",
+  wiring: "WIRING lens (AD-74 \u2014 producer\u2192store\u2192consumer). A write with no reader is NOT done. For every new value produced (state, DB column, event, field), confirm something actually CONSUMES it \u2014 grep for the reader. localStorage is a cache, never a store. Flag decorative writes, dead affordances, and green gates that guard a component nothing imports. Ignore correctness/security details \u2014 focus on whether the data path is actually connected end-to-end.",
+  "test-quality": "TEST-QUALITY lens. Are the tests present and meaningful? A test that cannot fail is worse than none. Check that assertions test TRANSITIONS not snapshots, that a probe would actually go RED if the code broke, and that new behaviour is covered. Flag tests that assert on mocks instead of real behaviour, and missing coverage on the changed paths.",
+  "scope-drift": "SCOPE-DRIFT lens. Does the diff match the BUILD HANDOFF scope? Flag unrelated changes, files touched outside the stated scope, new dependencies/abstractions not asked for, and \u2014 conversely \u2014 acceptance criteria from the handoff that were skipped. Ignore whether the in-scope code is correct; only judge whether it is the RIGHT set of changes."
+};
+var SYNTHESIS_CONTRACT_SHAPE = '{"verdict":"pass|warn|fail","summary":"<one-line consolidated assessment>","findings":[{"severity":"error|warning|info","file":"<path>","line":<number>,"message":"<specific issue>"}]}';
+var LEG_CONTRACT_SHAPE = '{"lens":"<lens-name>","verdict":"pass|warn|fail","findings":[{"severity":"error|warning|info","file":"<path>","line":<number>,"message":"<specific issue>"}]}';
+function legId(lens) {
+  return `leg-${lens}`;
+}
+function buildFanoutReviewDispatchPrompt(input) {
+  const { taskId, preset, systemPrompt, userMessage, contextBytes } = input;
+  const lenses = REVIEW_PRESETS[preset];
+  const n = lenses.length;
+  const sizeNote = contextBytes !== void 0 ? ` \xB7 ~${Math.round(contextBytes / 1024)} KB context` : "";
+  const sharedContext = `<review_rubric>
+${systemPrompt}
+</review_rubric>
+
+<build_under_review>
+${userMessage}
+</build_under_review>`;
+  const legBlocks = lenses.map((lens, i) => {
+    const legPrompt = `You are lens ${i + 1} of ${n} in a PAPI multi-lens build review. Review the completed build below through ONE lens only.
+
+LENS \u2014 ${LENS_INSTRUCTIONS[lens]}
+
+CONTRACT:
+- The build report says what was intended; the diff is what actually changed.
+- Report ONLY findings your lens (${lens}) is responsible for. Do not stray into other lenses.
+- Return ONLY a single JSON object \u2014 no preamble, no commentary, no fences \u2014 in exactly this shape:
+  ${LEG_CONTRACT_SHAPE.replace("<lens-name>", lens)}
+- "pass" = no blocking issues for this lens; "warn" = minor/non-blocking; "fail" = a blocking issue this lens found. \`file\`/\`line\` are optional. Empty \`findings\` is valid when your lens is clean.
+
+${sharedContext}`;
+    return [
+      `#### Lens ${i + 1}/${n} \u2014 ${lens}  \`[${legId(lens)}]\``,
+      "",
+      `<<<BEGIN_LENS_PROMPT:${lens}>>>`,
+      legPrompt,
+      `<<<END_LENS_PROMPT:${lens}>>>`
+    ].join("\n");
+  });
+  const dependsOn = `[${lenses.map(legId).join(", ")}]`;
+  const synthesisPrompt = `You are the SYNTHESIS step of a PAPI multi-lens build review.
+
+depends_on = ${dependsOn}
+
+You receive the JSON outputs of all ${n} specialist lens legs below. Your job:
+- Merge every leg's findings into ONE consolidated review.
+- Dedupe: collapse findings that multiple lenses raised about the same file/line/issue into a single entry (keep the highest severity).
+- Prioritize: order findings most-severe first (error \u2192 warning \u2192 info).
+- Decide ONE overall verdict: "fail" if any leg found a blocking issue, "warn" if only minor nits remain, "pass" if all legs were clean.
+- Return ONLY a single JSON object \u2014 no preamble, no commentary, no fences \u2014 in exactly this shape (the review_submit auto_review contract):
+  ${SYNTHESIS_CONTRACT_SHAPE}
+
+<lens_leg_outputs>
+Paste every lens leg's JSON output here, one per line or concatenated:
+<<<PASTE_ALL_LEG_OUTPUTS_HERE>>>
+</lens_leg_outputs>`;
+  const applyNote = `\`review_submit\` with task_id="${taskId}", stage="build-acceptance", verdict=<your decision: accept / request-changes / reject>, comments=<your reasoning>, and auto_review set to the synthesis JSON object verbatim. The synthesized verdict is a RECOMMENDATION \u2014 you make the final call.`;
+  return [
+    `## PAPI review_submit \u2014 Multi-Lens Fan-Out Review (${taskId} \xB7 preset: ${preset} \xB7 ${n} lens${n === 1 ? "" : "es"} + synthesis${sizeNote})`,
+    "",
+    "This build review fans out across specialist lenses: each lens below reviews the SAME diff in parallel, then a synthesis step dedupes their findings into one prioritized verdict. **PAPI emits this prompt \u2014 YOU (the host) run the Task calls. PAPI never executes the agents itself.**",
+    "",
+    "---",
+    "",
+    `### Step 1 \u2014 Dispatch ${n} specialist lens${n === 1 ? "" : "es"} IN PARALLEL`,
+    "",
+    `Make ${n} \`Task\` call${n === 1 ? "" : "s"} in a SINGLE message so they run concurrently. Each uses \`subagent_type: general-purpose\`. For each lens, pass the prompt block between its BEGIN/END markers (trimmed of the markers). Each leg returns ONLY its own tagged JSON.`,
+    "",
+    legBlocks.join("\n\n"),
+    "",
+    "### Step 2 \u2014 Synthesis (`depends_on` = ALL lens legs)",
+    "",
+    `Wait until ALL ${n} lens legs above have returned. The synthesis step below declares \`depends_on = ${dependsOn}\` \u2014 do NOT run it before every leg is back. Make ONE more \`Task\` call (\`subagent_type: general-purpose\`) with the block below, pasting every leg's JSON output where marked.`,
+    "",
+    "<<<BEGIN_SYNTHESIS_PROMPT>>>",
+    synthesisPrompt,
+    "<<<END_SYNTHESIS_PROMPT>>>",
+    "",
+    "### Step 3 \u2014 Apply the synthesized verdict",
+    "",
+    `When synthesis returns its JSON, surface the consolidated findings, decide your verdict, then call ${applyNote}`,
+    "",
+    "Do NOT post-process the synthesis JSON \u2014 the `auto_review` apply path expects it exactly as emitted."
+  ].join("\n");
+}
 
 // src/lib/resolve-llm-response.ts
 import { readFile as readFile3, stat } from "fs/promises";
@@ -21049,6 +21183,7 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}, cli
     completed: capitalizeCompleted(input.completed),
     actualEffort: input.effort,
     estimatedEffort: input.estimatedEffort,
+    model: input.model,
     surprises: input.surprises,
     discoveredIssues: input.discoveredIssues,
     architectureNotes: input.architectureNotes,
@@ -21985,6 +22120,11 @@ var buildExecuteTool = {
         enum: ["XS", "S", "M", "L", "XL"],
         description: "Estimated effort from the BUILD HANDOFF. Required for complete."
       },
+      model: {
+        type: "string",
+        maxLength: 120,
+        description: "The model/agent that executed this build, self-reported, e.g. 'claude-opus-4' / 'gpt-5' \u2014 optional; powers attributed-intelligence analytics. PAPI never selects a model (AD-58) \u2014 report the model YOU are running as."
+      },
       surprises: {
         type: "string",
         maxLength: 800,
@@ -21993,7 +22133,7 @@ var buildExecuteTool = {
       discovered_issues: {
         type: "string",
         maxLength: 800,
-        description: `Problems found DURING this build that are OUTSIDE this task's scope. Include severity (P0-P3). Good: "P2: Auth middleware doesn't validate token expiry \u2014 affects all protected routes." Bad: "Had to install a dependency." Only real bugs or gaps that need their own task. Use "None" if none. Required for complete. TIP: When submitting a follow-up idea for a discovered issue, include "learning:<uuid>" in the idea notes to link it to this cycle learning entry \u2014 use the UUID returned in the build completion output.`
+        description: `A REAL bug or gap OUTSIDE this task's scope that needs its own task. Include severity (P0-P3). INCLUSION TEST \u2014 file it only if BOTH are true: (1) the bug would exist even if this task had never run, and (2) it is outside this task's scope. If either is false, it is NOT a discovered_issue. NEVER file a trivial in-file cleanup you noticed while editing (an em-dash tidy, a rename, a lint nit, a stray console.log) \u2014 those are not bugs, just clean them up or leave them. Good: "P2: Auth middleware doesn't validate token expiry \u2014 affects all protected routes." Bad: "Two em dashes remain in the file" / "Had to install a dependency." Use "None" if none. Required for complete. TIP: When submitting a follow-up idea for a discovered issue, include "learning:<uuid>" in the idea notes to link it to this cycle learning entry \u2014 use the UUID returned in the build completion output.`
       },
       architecture_notes: {
         type: "string",
@@ -22279,7 +22419,7 @@ async function handleBuildExecute(adapter2, config2, args, clientName) {
 **PRE-BUILD VERIFICATION:** Before writing any code, read these files and check if the functionality already exists:
 ${verificationFiles.map((f) => `- ${f}`).join("\n")}
 If >80% of the scope is already implemented, call \`build_execute\` with completed="yes" and note "already built" in surprises instead of re-implementing.` : "";
-    const chainInstruction = '\n\n---\n\n**IMPORTANT:** After implementing this task, immediately call `build_execute` again with report fields (`completed`, `effort`, `estimated_effort`, `surprises`, `discovered_issues`, `architecture_notes`) to complete the build. Do not wait for user confirmation.\n\n**Build Report Quality Bar:**\n- **surprises**: What was DIFFERENT from expected \u2014 wrong assumptions, scope changes, missing infrastructure. NOT implementation mechanics ("used X library").\n- **discovered_issues**: Bugs/gaps OUTSIDE this task\'s scope, with severity (P0-P3). NOT "had to install a dependency".\n- **architecture_notes**: Patterns/decisions that AFFECT FUTURE WORK. NOT "used React hooks".\n- If nothing meaningful to report for a field, use "None" \u2014 empty signal is better than noise.\n- **dead_ends**: approaches you tried and RULED OUT (with why). Ruled-out paths are first-class intelligence \u2014 send "None" only if nothing you tried failed.';
+    const chainInstruction = '\n\n---\n\n**IMPORTANT:** After implementing this task, immediately call `build_execute` again with report fields (`completed`, `effort`, `estimated_effort`, `surprises`, `discovered_issues`, `architecture_notes`) to complete the build. Do not wait for user confirmation.\n\n**Build Report Quality Bar:**\n- **surprises**: What was DIFFERENT from expected \u2014 wrong assumptions, scope changes, missing infrastructure. NOT implementation mechanics ("used X library").\n- **discovered_issues**: REAL bugs/gaps OUTSIDE this task\'s scope, with severity (P0-P3). Inclusion test: file it only if the bug would exist even if this task had never run AND it is outside this task\'s scope. NEVER a trivial in-file cleanup you noticed while editing (em-dash tidy, rename, lint nit) \u2014 those are not discovered_issues. NOT "had to install a dependency".\n- **architecture_notes**: Patterns/decisions that AFFECT FUTURE WORK. NOT "used React hooks".\n- If nothing meaningful to report for a field, use "None" \u2014 empty signal is better than noise.\n- **dead_ends**: approaches you tried and RULED OUT (with why). Ruled-out paths are first-class intelligence \u2014 send "None" only if nothing you tried failed.';
     const buildDisciplineNote = "\n\n---\n\n**BUILD DISCIPLINE:**\n- **Read before you claim.** Before asserting how something works \u2014 or that it is already done \u2014 read the actual code/state. Don't rely on memory or earlier context.\n- **Sweep existing material first.** Check the docs (`doc_search` or your docs index) and prior tasks, not just whether a file exists \u2014 the work may already be covered.\n- **Ranged reads.** For large or unfamiliar files, read the relevant range rather than the whole file.";
     let adSection = "";
     try {
@@ -22307,6 +22447,27 @@ ${entries}`;
       }
     } catch {
     }
+    let openIssuesSection = "";
+    try {
+      if (adapter2.getCycleLearnings) {
+        const issues = (await adapter2.getCycleLearnings({ category: "issue", limit: 20 })).filter((l) => !l.resolvedAt && l.id);
+        const taskIds = new Set([result.task.id, result.task.displayId].filter(Boolean));
+        const moduleTag = result.task.module?.trim().toLowerCase();
+        const score = (l) => (taskIds.has(l.taskId) ? 2 : 0) + (moduleTag && l.tags.some((t) => t.toLowerCase() === moduleTag) ? 1 : 0);
+        const top = issues.sort((a, b2) => score(b2) - score(a)).slice(0, 8);
+        if (top.length > 0) {
+          const rows = top.map((l) => `- \`${l.id}\` \xB7 ${l.severity ?? "P3"} \xB7 ${l.summary}`).join("\n");
+          openIssuesSection = `
+
+---
+
+**OPEN DISCOVERED ISSUES** (${top.length} shown):
+${rows}
+If this build fixes any of these, pass their UUIDs in \`fixed_issues\` on complete \u2014 that stamps them FIXED on the caught\u2192fixed ledger. Do not fix out-of-scope issues just to clear the list.`;
+        }
+      }
+    } catch {
+    }
     const moduleInstructions = getModuleInstructions(result.task.module);
     const moduleContext = await getModuleContext(adapter2, result.task);
     const filesToWriteSection = result.filesToWrite ? formatFilesToWriteSection(result.filesToWrite) : "";
@@ -22315,7 +22476,7 @@ ${entries}`;
       formatModelRecommendation(result.task.buildHandoff?.effort ?? result.task.complexity)
     ) ?? "";
     const gestaltNote = buildGestaltPreBuildDirective(caps) ?? "";
-    return textResponse(header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + verificationNote + buildDisciplineNote + chainInstruction + phaseNote + filesToWriteSection);
+    return textResponse(header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + openIssuesSection + verificationNote + buildDisciplineNote + chainInstruction + phaseNote + filesToWriteSection);
   } catch (err) {
     if (isNoHandoffError(err)) {
       const lines = [
@@ -22355,6 +22516,7 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
   const completed = args.completed;
   const effort = args.effort;
   const estimatedEffort = args.estimated_effort;
+  const model = typeof args.model === "string" && args.model.trim() !== "" ? args.model.trim() : void 0;
   const surprises = args.surprises;
   const discoveredIssues = args.discovered_issues;
   const architectureNotes = args.architecture_notes;
@@ -22410,6 +22572,7 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
       completed,
       effort: parsedEffort,
       estimatedEffort: parsedEstimatedEffort,
+      model,
       surprises,
       discoveredIssues,
       architectureNotes,
@@ -22487,9 +22650,14 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
         batchRollupNote = "";
       }
     }
-    const fixedNote = fixedResolvedCount > 0 ? `
+    let fixedNote = "";
+    if (fixedResolvedCount > 0) {
+      fixedNote = `
 
-\u2705 Marked ${fixedResolvedCount} discovered issue(s) FIXED \u2014 resolved_at stamped, now counted as fixed on the hub's caught\u2192fixed ledger.` : "";
+\u2705 Marked ${fixedResolvedCount} discovered issue(s) FIXED \u2014 resolved_at stamped, now counted as fixed on the hub's caught\u2192fixed ledger.`;
+    } else if (discoveredIssues && discoveredIssues.trim() !== "" && !/^none\b/i.test(discoveredIssues.trim())) {
+      fixedNote = "\n\n\u2139\uFE0F This build filed discovered issues but passed no `fixed_issues`. When a future build fixes one, pass its UUID in `fixed_issues` so it counts as FIXED (not just auto-cleared) on the hub ledger.";
+    }
     return textResponse(formatCompleteResult(result) + fixedNote + docsNote + batchRollupNote);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -22957,7 +23125,11 @@ async function handleBug(adapter2, config2, args) {
       type,
       description: text,
       diagnostics,
-      status: "open",
+      // Canonical triage vocabulary (submitted|investigating|fixed|wont_fix).
+      // Was 'open' — a third vocabulary that made the owner triage console
+      // render new upstream reports as un-triaged. Adapters pass status through,
+      // so emitting canonical here keeps hosted + pg writes consistent.
+      status: "submitted",
       notifyRequested,
       contactOk
     });
@@ -24058,7 +24230,7 @@ var REVIEW_RUBRIC = [
   "- Quality: tests present and meaningful, no obvious debt or dead code.",
   "Be specific and cite file/line where you can. Recommend fail only for blocking issues."
 ].join("\n");
-async function buildReviewDispatch(adapter2, config2, taskId) {
+async function assembleReviewContext(adapter2, config2, taskId) {
   const task = await adapter2.getTask(taskId);
   if (!task) {
     return { ok: false, error: `Task ${taskId} not found \u2014 cannot assemble review context.` };
@@ -24091,13 +24263,13 @@ ${report}
 
 ${diffBlock}`;
   const contextBytes = Buffer.byteLength(userMessage, "utf-8");
-  const prompt2 = buildSubagentDispatchPrompt({
-    tool: "review_submit",
-    taskId,
-    systemPrompt: REVIEW_RUBRIC,
-    userMessage,
-    contextBytes
-  });
+  return { ok: true, userMessage, contextBytes };
+}
+async function buildReviewDispatch(adapter2, config2, taskId, preset) {
+  const ctx = await assembleReviewContext(adapter2, config2, taskId);
+  if (!ctx.ok) return ctx;
+  const { userMessage, contextBytes } = ctx;
+  const prompt2 = preset ? buildFanoutReviewDispatchPrompt({ taskId, preset, systemPrompt: REVIEW_RUBRIC, userMessage, contextBytes }) : buildSubagentDispatchPrompt({ tool: "review_submit", taskId, systemPrompt: REVIEW_RUBRIC, userMessage, contextBytes });
   return { ok: true, prompt: prompt2, contextBytes };
 }
 var reviewListTool = {
@@ -24149,6 +24321,11 @@ var reviewSubmitTool = {
         enum: ["inline", "subagent"],
         description: `task-1864: set "subagent" (build-acceptance only) to offload code review to a fresh sub-agent. Returns a Task() invocation prompt that feeds the build report + branch diff to the sub-agent, which returns structured auto_review findings. Verdict is NOT required on this call \u2014 you call review_submit again with the human verdict + the sub-agent's auto_review. Default "inline" (record the verdict directly).`
       },
+      review_preset: {
+        type: "string",
+        enum: ["gate", "full", "security-focused"],
+        description: 'task-2824 (opt-in): upgrade the sub-agent dispatch to a MULTI-LENS fan-out. Requires dispatch:"subagent" (build-acceptance only). Emits N specialist lens legs (correctness/security/wiring/test-quality/scope-drift) that review the same diff in parallel, plus a synthesis leg that dedupes their findings into ONE prioritized auto_review verdict. "gate" = correctness+wiring, "full" = all 5, "security-focused" = security+correctness+wiring. Omit for the existing single-lens review (unchanged default).'
+      },
       reviewer_confirmed: {
         type: "boolean",
         description: "Set to true to confirm you have reviewed the build (read the build report or the pending list via review_list) before submitting an accept verdict. Required to accept a build-acceptance review unless review_list was called in the same session within the last 15 minutes. Defense-in-depth against SUP-2026-010 (Codex prematurely accepted a task because review_list was missing from its tool surface)."
@@ -24363,11 +24540,24 @@ async function handleReviewSubmit(adapter2, config2, args) {
     caps = {};
   }
   const explicitDispatch = args.dispatch === "subagent";
+  const rawPreset = args.review_preset;
+  const reviewPreset = typeof rawPreset === "string" && rawPreset in REVIEW_PRESETS ? rawPreset : void 0;
+  if (rawPreset !== void 0 && !explicitDispatch) {
+    return errorResponse('review_preset requires dispatch:"subagent" (multi-lens fan-out is only available on an explicit sub-agent dispatch).');
+  }
+  if (typeof rawPreset === "string" && rawPreset.length > 0 && !reviewPreset) {
+    return errorResponse(`review_preset "${rawPreset}" is not valid. Use "gate", "full", or "security-focused".`);
+  }
   const autoDispatchOptIn = args.dispatch !== "inline" && process.env.PAPI_AUTO_DISPATCH !== "false" && isCapabilityEnabled(caps, "prReviewer");
   const autoDispatchEligible = !verdict && autoDispatchOptIn;
   const capabilityAutoReviewEligible = verdict === "accept" && !autoReview && autoDispatchOptIn;
   if ((explicitDispatch || autoDispatchEligible || capabilityAutoReviewEligible) && stage === "build-acceptance" && taskId) {
-    const dispatch = await buildReviewDispatch(adapter2, config2, taskId);
+    const dispatch = await buildReviewDispatch(
+      adapter2,
+      config2,
+      taskId,
+      explicitDispatch ? reviewPreset : void 0
+    );
     if (!dispatch.ok) {
       if (explicitDispatch) return errorResponse(dispatch.error);
     } else if (explicitDispatch || capabilityAutoReviewEligible || dispatch.contextBytes > REVIEW_DISPATCH_THRESHOLD) {
@@ -30050,4 +30240,10 @@ if (isHttpMode && httpPort !== void 0) {
   }
   const transport = new StdioServerTransport();
   await server.connect(transport);
+  const projectName = basename2(config.projectRoot);
+  const projectIdShort = config.projectId ? ` (${config.projectId.slice(0, 8)})` : process.env.PAPI_PROJECT_ID ? ` (${process.env.PAPI_PROJECT_ID.slice(0, 8)})` : "";
+  process.stderr.write(
+    `[papi] Connected \u2014 project: ${projectName}${projectIdShort}, adapter: ${config.adapterType}, v${pkgVersion}
+`
+  );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.60",
+  "version": "0.7.62",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",