@rallycry/conveyor-agent 11.0.17 → 11.0.19

package/dist/{boot-CCRZMY2P.js → boot-4ZNOCKFZ.js}

@@ -1,6 +1,6 @@
 import {
   startWorkbenchServer
-} from "./chunk-7TSQXIN3.js";
+} from "./chunk-EIHZRSYI.js";
 import {
   TOMBSTONE_MESSAGE,
   isLegacyEntrypointLaunch
@@ -12,7 +12,7 @@ import {
   refreshSkillsAfterCheckout,
   runPreReadyBinds
 } from "./chunk-SR66HQKB.js";
-import "./chunk-QLMNQSJL.js";
+import "./chunk-W5INK3NE.js";
 import {
   GitPrepJob,
   defaultGit,
@@ -20,6 +20,8 @@ import {
   reportBootMilestone
 } from "./chunk-GL2DIQEQ.js";
 import "./chunk-W4LZ7R6Z.js";
+import "./chunk-372R6E4C.js";
+import "./chunk-SQM2BQ7H.js";
 import {
   workbenchPort
 } from "./chunk-KMB3BU4S.js";

package/dist/chunk-372R6E4C.js

@@ -0,0 +1,147 @@
+import {
+  getWorkbenchClient
+} from "./chunk-SQM2BQ7H.js";
+import {
+  sharedDir,
+  workbenchEnabled
+} from "./chunk-KMB3BU4S.js";
+
+// src/runner/heavy-gate.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import path from "path";
+var GATE_KEYS = ["heavy", "test", "typecheck", "build"];
+var GATES_DIR_NAME = "gates";
+function runDir() {
+  return process.env.CONVEYOR_RUN_DIR ?? "/tmp/conveyor-run";
+}
+function gatesDir() {
+  return path.join(sharedDir() ?? runDir(), GATES_DIR_NAME);
+}
+function pidAlive(pid) {
+  if (process.platform === "linux" && pidIsZombie(pid)) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pidIsZombie(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    const closingParen = stat.lastIndexOf(")");
+    return closingParen >= 0 && stat.slice(closingParen + 1).trimStart().startsWith("Z");
+  } catch {
+    return false;
+  }
+}
+function parsePid(raw) {
+  const pid = Number.parseInt(raw.trim(), 10);
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+function singletonPidFiles() {
+  return GATE_KEYS.map((key) => path.join(runDir(), `${key}.pid`));
+}
+var splitGenericGateStatus = null;
+var splitGenericGateStatusRefresh = null;
+function getLocalGenericGateStatus() {
+  const activeLabels = [];
+  const abandonedReceipts = [];
+  let entries;
+  try {
+    entries = readdirSync(gatesDir());
+  } catch {
+    return { activeLabels, abandonedReceipts };
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith(".pid")) continue;
+    const pidPath = path.join(gatesDir(), entry);
+    const label = entry.slice(0, -".pid".length);
+    try {
+      const pid = parsePid(readFileSync(pidPath, "utf8"));
+      if (pid === null) continue;
+      if (pidAlive(pid)) {
+        activeLabels.push(label);
+      } else if (!existsSync(path.join(gatesDir(), `${label}.exit`))) {
+        abandonedReceipts.push({ path: pidPath, label, pid, mtimeMs: statSync(pidPath).mtimeMs });
+      }
+    } catch {
+    }
+  }
+  abandonedReceipts.sort((a, b) => a.mtimeMs - b.mtimeMs);
+  return { activeLabels, abandonedReceipts };
+}
+function genericGateStatus() {
+  if (!workbenchEnabled()) return getLocalGenericGateStatus();
+  return splitGenericGateStatus ?? { activeLabels: ["unknown"], abandonedReceipts: [] };
+}
+function refreshGenericGateStatus() {
+  if (!workbenchEnabled()) return Promise.resolve(getLocalGenericGateStatus());
+  if (splitGenericGateStatusRefresh) return splitGenericGateStatusRefresh;
+  splitGenericGateStatusRefresh = getWorkbenchClient().gateStatus().then((status) => {
+    splitGenericGateStatus = {
+      activeLabels: status.activeLabels,
+      abandonedReceipts: status.abandonedReceipts.map((receipt) => ({
+        ...receipt,
+        path: path.join(gatesDir(), `${receipt.label}.pid`)
+      }))
+    };
+    return splitGenericGateStatus;
+  }).catch(() => {
+    splitGenericGateStatus = null;
+    return genericGateStatus();
+  }).finally(() => {
+    splitGenericGateStatusRefresh = null;
+  });
+  return splitGenericGateStatusRefresh;
+}
+function listAbandonedGateReceipts() {
+  return genericGateStatus().abandonedReceipts;
+}
+function listGateExitSentinels() {
+  const sentinels = [];
+  let entries;
+  try {
+    entries = readdirSync(gatesDir());
+  } catch {
+    return sentinels;
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith(".exit")) continue;
+    const file = path.join(gatesDir(), entry);
+    try {
+      const mtimeMs = statSync(file).mtimeMs;
+      let code = null;
+      try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        const value = parsed?.code;
+        if (typeof value === "number") code = value;
+      } catch {
+      }
+      sentinels.push({ path: file, label: entry.slice(0, -".exit".length), code, mtimeMs });
+    } catch {
+    }
+  }
+  sentinels.sort((a, b) => a.mtimeMs - b.mtimeMs);
+  return sentinels;
+}
+function isHeavyGateActive() {
+  if (genericGateStatus().activeLabels.length > 0) return true;
+  for (const file of singletonPidFiles()) {
+    try {
+      const pid = parsePid(readFileSync(file, "utf8"));
+      if (pid !== null && pidAlive(pid)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+
+export {
+  gatesDir,
+  getLocalGenericGateStatus,
+  refreshGenericGateStatus,
+  listAbandonedGateReceipts,
+  listGateExitSentinels,
+  isHeavyGateActive
+};

package/dist/{chunk-7TSQXIN3.js → chunk-EIHZRSYI.js}

@@ -1,9 +1,12 @@
 import {
   loadPtySpawn
-} from "./chunk-QLMNQSJL.js";
+} from "./chunk-W5INK3NE.js";
 import {
   terminateProcessGroup
 } from "./chunk-W4LZ7R6Z.js";
+import {
+  getLocalGenericGateStatus
+} from "./chunk-372R6E4C.js";
 import {
   FrameReader,
   timingSafeTokenEqual,
@@ -112,21 +115,25 @@ async function runRefreshSkills(socket, opts) {
   }
   socket.end();
 }
+function immediateResponse(req, opts) {
+  if (req.op === "ping") return { t: "pong", version: opts.version };
+  if (req.op === "gitStatus") return opts.getGitStatus?.() ?? { t: "gitStatus", state: "ready" };
+  if (req.op === "gateStatus") return { t: "gateStatus", ...getLocalGenericGateStatus() };
+  return null;
+}
 function dispatch(socket, req, sink, opts, liveOps) {
   if (!req || typeof req !== "object" || !timingSafeTokenEqual(req.token ?? "", opts.token)) {
     writeFrame(socket, { t: "error", message: "unauthorized", code: "unauthorized" });
     socket.destroy();
     return;
   }
+  const immediate = immediateResponse(req, opts);
+  if (immediate) {
+    writeFrame(socket, immediate);
+    socket.end();
+    return;
+  }
   switch (req.op) {
-    case "ping":
-      writeFrame(socket, { t: "pong", version: opts.version });
-      socket.end();
-      return;
-    case "gitStatus":
-      writeFrame(socket, opts.getGitStatus?.() ?? { t: "gitStatus", state: "ready" });
-      socket.end();
-      return;
     case "refreshSkills":
       void runRefreshSkills(socket, opts);
       return;

package/dist/{chunk-X2MKHJBZ.js → chunk-GZRZGBIK.js}

@@ -5,7 +5,7 @@ import {
   readWorkspaceBytes,
   statWorkspacePath,
   workspacePathExists
-} from "./chunk-M4SD2ESQ.js";
+} from "./chunk-WS7QRB37.js";
 import {
   reportBootMilestone
 } from "./chunk-GL2DIQEQ.js";
@@ -16,7 +16,7 @@ import {
 } from "./chunk-W4LZ7R6Z.js";
 import {
   getWorkbenchClient
-} from "./chunk-B54XFOXL.js";
+} from "./chunk-SQM2BQ7H.js";
 import {
   workbenchEnabled
 } from "./chunk-KMB3BU4S.js";

package/dist/{chunk-GVDQQZCO.js → chunk-N5LEVAGA.js}

@@ -29,7 +29,7 @@ import {
   spawnOptionsFingerprint,
   transcriptSize,
   turnOptionsFrom
-} from "./chunk-QLMNQSJL.js";
+} from "./chunk-W5INK3NE.js";
 import {
   AgentConnection,
   CodespacePortVisibility,
@@ -59,7 +59,7 @@ import {
   statWorkspacePath,
   updateRemoteToken,
   verifyGitCredential
-} from "./chunk-M4SD2ESQ.js";
+} from "./chunk-WS7QRB37.js";
 import {
   registerBootMilestoneSocketFallback,
   reportBootMilestone
@@ -72,15 +72,17 @@ import {
 } from "./chunk-W4LZ7R6Z.js";
 import {
   isHeavyGateActive,
-  listGateExitSentinels
-} from "./chunk-7P6QZHXZ.js";
+  listAbandonedGateReceipts,
+  listGateExitSentinels,
+  refreshGenericGateStatus
+} from "./chunk-372R6E4C.js";
 import {
   LoopLagMonitor,
   loopStatusForRunnerStatus
 } from "./chunk-IA45XHOA.js";
 import {
   getWorkbenchClient
-} from "./chunk-B54XFOXL.js";
+} from "./chunk-SQM2BQ7H.js";
 import {
   workbenchEnabled
 } from "./chunk-KMB3BU4S.js";
@@ -1414,6 +1416,7 @@ var ListProjectSessionGroupsRequestSchema = z5.object({
   projectId: z5.string()
 });
 var ListMyLiveSessionsAcrossProjectsRequestSchema = z5.object({});
+var ListSessionGroupsAcrossProjectsRequestSchema = z5.object({});
 var GetProjectAvailableTuisRequestSchema = z5.object({
   projectId: z5.string()
 });
@@ -2040,6 +2043,11 @@ var ANTHROPIC_CATALOG = [
   anthropicEntry(DEFAULT_HAIKU_MODEL, "Haiku 4.5", 1, 5, { supportsEffort: false }),
   anthropicEntry(FABLE_MODEL, "Fable 5.1", 10, 50)
 ];
+var CODEX_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+var DEFAULT_CODEX_CODING_MODEL = "gpt-5.6-terra";
+function isCodexReasoningEffort(value) {
+  return typeof value === "string" && CODEX_REASONING_EFFORTS.includes(value);
+}
 var HUMAN_PROSE_WRITING_STYLE = `## Writing style for humans
 When you write prose a person will read \u2014 chat messages, plan updates, PR titles and bodies, PR review guides (the \`publish_review_guide\` overview and section explanations), review comments \u2014 follow these rules (based on ASD-STE100 Simplified Technical English):
 - Use active voice. Say who does what ("The API rejects the request", not "the request is rejected").
@@ -2181,6 +2189,10 @@ var CATALOG = {
     // rejects (media_type_header_exception), breaking search/audit indexing
     // in pods. 512m heap matches the project compose sizing.
     image: "docker.elastic.co/elasticsearch/elasticsearch:9.4.0",
+    mirror: {
+      src: "docker.elastic.co/elasticsearch/elasticsearch:9.4.0",
+      dest: "mirror-elasticsearch:9.4.0"
+    },
     ports: [9200],
     // Baked service images are `docker commit`s of a recently-running ES, so
     // they carry a stale data-dir node.lock; ES 9 hard-fails on it at boot
@@ -3245,6 +3257,13 @@ var JsonlTailer = class {
 };
 
 // src/harness/codex/event-source.ts
+var USAGE_CAP_PATTERN = /usage_limit_(?:reached|exceeded)|rate_limit_reached|UsageLimitReached|hit your usage limit/i;
+var WEEKLY_WINDOW_MINUTES = 24 * 60;
+function isUsageCap(error) {
+  return [error.codex_error_info, error.code, error.type, error.message].some(
+    (value) => typeof value === "string" && USAGE_CAP_PATTERN.test(value)
+  );
+}
 var CodexEventSource = class {
   constructor(emit, onSession, chat) {
     this.emit = emit;
@@ -3257,6 +3276,8 @@ var CodexEventSource = class {
   sessionId = null;
   completed = /* @__PURE__ */ new Set();
   transcript = null;
+  /** Last reported reading per rate-limit window, keyed by `five_hour` / `seven_day`. */
+  windows = /* @__PURE__ */ new Map();
   handleRecord(raw) {
     if (!raw || typeof raw !== "object") return;
     const e = raw;
@@ -3311,11 +3332,16 @@ var CodexEventSource = class {
     if (record.type !== "event_msg" || !record.payload || typeof record.payload !== "object")
       return;
     const event = record.payload;
+    if (event.type === "token_count") {
+      this.handleTokenCount(event);
+      return;
+    }
     if (event.type !== "task_complete" || !event.error || typeof event.error !== "object") return;
     const turn = event.turn_id;
     if (typeof turn !== "string" || this.completed.has(turn)) return;
     this.rememberTurn(turn);
     const error = event.error;
+    if (isUsageCap(error)) this.emitUsageCap();
     this.emit({
       type: "result",
       subtype: "error",
@@ -3323,6 +3349,59 @@ var CodexEventSource = class {
     });
     this.chat({ kind: "turn_end" });
   }
+  /**
+   * `token_count` carries the account's rate-limit gauges on every turn:
+   * `rate_limits.primary` (the 5-hour window) and `.secondary` (weekly), each
+   * with `used_percent`, `window_minutes` and `resets_at` in epoch seconds.
+   * Classified by window length rather than by name, and reported only when a
+   * window's numbers changed — the event fires per turn, and every report
+   * rewrites the key row and fans out `project:codingAgentKeyUpdated`.
+   */
+  handleTokenCount(event) {
+    const limits = event.rate_limits;
+    if (!limits || typeof limits !== "object") return;
+    for (const name of ["primary", "secondary"]) {
+      const window = limits[name];
+      if (!window || typeof window !== "object") continue;
+      const reading = window;
+      if (typeof reading.used_percent !== "number") continue;
+      const minutes = typeof reading.window_minutes === "number" ? reading.window_minutes : name === "secondary" ? WEEKLY_WINDOW_MINUTES : 0;
+      const rateLimitType = minutes >= WEEKLY_WINDOW_MINUTES ? "seven_day" : "five_hour";
+      const resetsAt = typeof reading.resets_at === "number" ? reading.resets_at : void 0;
+      const last = this.windows.get(rateLimitType);
+      if (last && last.usedPercent === reading.used_percent && last.resetsAt === resetsAt) continue;
+      this.windows.set(rateLimitType, { usedPercent: reading.used_percent, resetsAt });
+      this.emit({
+        type: "rate_limit_event",
+        rate_limit_info: {
+          status: "allowed",
+          rateLimitType,
+          utilization: Math.max(0, Math.min(1, reading.used_percent / 100)),
+          resetsAt
+        }
+      });
+    }
+  }
+  /**
+   * The CLI does not say which window capped. The fullest window last reported
+   * is the one that did; with no reading at all, the 5-hour window is the
+   * conservative guess (its fallback pause is the shorter one).
+   */
+  emitUsageCap() {
+    let rateLimitType = "five_hour";
+    let resetsAt;
+    let fullest = -Infinity;
+    for (const [type, window] of this.windows) {
+      if (window.usedPercent <= fullest) continue;
+      fullest = window.usedPercent;
+      rateLimitType = type;
+      resetsAt = window.resetsAt;
+    }
+    this.emit({
+      type: "rate_limit_event",
+      rate_limit_info: { status: "rejected", rateLimitType, resetsAt }
+    });
+  }
   rememberTurn(turn) {
     this.completed.add(turn);
     const oldest = this.completed.values().next().value;
@@ -6465,13 +6544,16 @@ async function seedOpenCodeOauth(env) {
 }
 
 // src/harness/openai-model.ts
-var DEFAULT_OPENAI_CODING_MODEL = "gpt-5.6-terra";
+var DEFAULT_OPENAI_CODING_MODEL = DEFAULT_CODEX_CODING_MODEL;
 function resolveOpenAiCodingModel(model) {
   if (!model || model.startsWith("claude-") || model.includes("/") && !model.startsWith("openai/")) {
     return DEFAULT_OPENAI_CODING_MODEL;
   }
   return model.replace(/^openai\//, "");
 }
+function resolveCodexReasoningEffort(...candidates) {
+  return candidates.find(isCodexReasoningEffort);
+}
 
 // src/harness/opencode/credentials.ts
 var PROVIDER_KEY_ENV = {
@@ -6981,11 +7063,16 @@ var CodexTuiAdapter = class {
       sandbox_mode: "danger-full-access",
       developer_instructions: [
         input.options.appendSystemPrompt,
-        "Conveyor workflow skills are stored in .claude/skills in the workspace. When instructed to run a /skill-name skill, read .claude/skills/skill-name/SKILL.md and follow its instructions. This is a file-based workflow, not a native slash command."
+        "Conveyor workflow skills are stored in .claude/skills in the workspace. When instructed to run a /skill-name skill, read .claude/skills/skill-name/SKILL.md and follow its instructions. This is a file-based workflow, not a native slash command. When a skill's Goal and finish line section tells you to create a thread goal, do so with your goal tool before the first step; the objective is that section's finish line."
       ].filter(Boolean).join("\n\n"),
       mcp_servers: codexMcpConfig(input.mcpEntries ?? {}),
       projects: { [trustedCwd]: { trust_level: "trusted" } }
     };
+    const effort = resolveCodexReasoningEffort(
+      this.env.CONVEYOR_AGENT_REASONING_EFFORT,
+      input.options.codex?.effort
+    );
+    if (effort) config.model_reasoning_effort = effort;
     if (input.pluginPath && input.eventsSinkPath) {
       const profile = basename(dirname3(input.pluginPath));
       const profilePath = join14(env.CODEX_HOME, `${profile}.config.toml`);
@@ -7003,7 +7090,9 @@ var CodexTuiAdapter = class {
     if (input.pluginPath) args.push("--profile", basename(dirname3(input.pluginPath)));
     for (const [key, value] of Object.entries(config))
       args.push("-c", `${key}=${tomlValue(value)}`);
-    const model = resolveOpenAiCodingModel(this.env.CONVEYOR_AGENT_MODEL ?? input.options.model);
+    const model = resolveOpenAiCodingModel(
+      this.env.CONVEYOR_AGENT_MODEL ?? input.options.codex?.model ?? input.options.model
+    );
     args.push("--model", model);
     if (input.resume) args.push("resume", input.resume);
     if (input.initialPrompt) args.push("--", input.initialPrompt);
@@ -13237,17 +13326,21 @@ function handleRateLimitEvent(event, host) {
   const { rate_limit_info } = event;
   logger4.info("Rate limit event received", { rate_limit_info });
   const status = rate_limit_info.status;
+  const resetsAt = epochSecondsToISO(rate_limit_info.resetsAt);
   const utilization = rate_limit_info.utilization ?? (status === "rejected" ? 1 : void 0);
   if (utilization !== void 0 && rate_limit_info.rateLimitType) {
     host.connection.sendEvent({
       type: "rate_limit_update",
       rateLimitType: rate_limit_info.rateLimitType,
       utilization,
-      status
+      status,
+      // The server parses this into the key's sessionResetsAt / weeklyResetsAt;
+      // Codex reports a reset instant with every gauge, so allowed events carry
+      // it too, not only rejections.
+      ...resetsAt ? { resetsAt } : {}
     });
   }
   if (status === "rejected") {
-    const resetsAt = epochSecondsToISO(rate_limit_info.resetsAt);
     const resetsAtDisplay = resetsAt ?? "unknown";
     const message = `Rate limit rejected (type: ${rate_limit_info.rateLimitType ?? "unknown"}, resets at: ${resetsAtDisplay})`;
     host.connection.sendEvent({ type: "error", message });
@@ -14157,6 +14250,7 @@ function buildQueryOptions(host, context) {
     effort: settings.effort,
     thinking: settings.thinking,
     betas: settings.betas,
+    codex: settings.codex,
     abortController: host.abortController ?? void 0,
     disallowedTools: buildDisallowedTools(settings, mode, host.hasExitedPlanMode),
     enableFileCheckpointing: settings.enableFileCheckpointing,
@@ -14312,6 +14406,7 @@ async function* watchForParkedTui(inner, host, opts) {
   const timer = setTimeout(() => {
     parked = true;
     host.connection.emitStatus("waiting_for_input");
+    host.callbacks.onSubmittedPtyParked?.();
     void host.callbacks.onStatusChange("waiting_for_input");
   }, PARKED_TUI_GRACE_MS);
   const silenceTimeoutMs = resolveTurnSilenceTimeoutMs();
@@ -15367,6 +15462,9 @@ async function runUsageProbe(deps = {}) {
 // src/execution/usage-sampler.ts
 var logger7 = createServiceLogger("usage-sampler");
 var NO_SAMPLES = { samples: [], unmeasurable: null };
+function usesNativeUsageReporting(env = process.env) {
+  return env.CONVEYOR_TUI === "codex";
+}
 function isAttributable(identity, sessionToken) {
   if (!identity) return { ok: true };
   if (identity.hasRefreshToken && !identity.isConveyorOwned) {
@@ -15688,7 +15786,7 @@ var SessionRunner = class _SessionRunner {
       onHeartbeat: () => {
         const loopStatus = this.refreshLoopStatus();
         this.connection.sendHeartbeat(this.loopLag.takeMaxLagMs(), loopStatus);
-        this.maybeWakeForOrphanedBackgroundWork();
+        void this.refreshGateStatusAndMaybeWake();
       },
       onIdleTimeout: () => {
         if (this.deferShutdownForLiveChild("idle")) return;
@@ -15829,6 +15927,10 @@ var SessionRunner = class _SessionRunner {
   /** One-shot latch: at most one watchdog wake per idle episode. Reset when a
    *  turn runs. */
   backgroundWakeFiredThisIdle = false;
+  /** Start of the last active episode. A gate can be launched shortly before
+   * the agent declares completion, so idle-start freshness would reject its
+   * terminal receipt as stale. */
+  activeEpisodeStartedAt = Date.now();
   /** When the current idle episode began — an exit sentinel older than this
    *  appeared while a turn could still have consumed it, so it never wakes. */
   idleEpisodeStartedAt = 0;
@@ -15843,22 +15945,30 @@ var SessionRunner = class _SessionRunner {
    * evidence of orphaned background work — a tracked launch with no live gate
    * process continuously past `ORPHAN_WAKE_GRACE_MS`, or an unconsumed
    * `gates/<label>.exit` sentinel that appeared this idle episode — never on
-   * "the agent seems stuck". A `completed` agent is never woken (the
-   * completion guard holds), and a live pid always suppresses the wake.
+   * "the agent seems stuck". A `completed` agent remains parked unless a
+   * current-episode generic receipt proves a required gate died without an
+   * exit record, and a live pid always suppresses the wake.
    */
   maybeWakeForOrphanedBackgroundWork() {
     try {
-      if (this._state !== "idle" || this.stopped || this.completedThisTurn) {
+      if (this._state !== "idle" || this.stopped) {
         this.orphanGraceStartedAt = null;
         return;
       }
       if (this.backgroundWakeFiredThisIdle) return;
       if (!this.inputResolver) return;
+      const abandoned = listAbandonedGateReceipts().find(
+        (receipt) => receipt.mtimeMs >= this.activeEpisodeStartedAt
+      );
+      if (this.completedThisTurn && !abandoned) {
+        this.orphanGraceStartedAt = null;
+        return;
+      }
       if (isHeavyGateActive()) {
         this.orphanGraceStartedAt = null;
         return;
       }
-      const evidence = this.findOrphanEvidence(Date.now());
+      const evidence = abandoned ? this.abandonedReceiptEvidence(abandoned) : this.findOrphanEvidence(Date.now());
       if (!evidence) return;
       process.stderr.write(
         `[conveyor-agent] Background-work watchdog: waking agent \u2014 ${evidence.description}
@@ -15867,11 +15977,16 @@ var SessionRunner = class _SessionRunner {
       this.backgroundWakeFiredThisIdle = true;
       this.orphanGraceStartedAt = null;
       if (evidence.sentinel) rmSync(evidence.sentinel.path, { force: true });
+      if (evidence.abandonedReceipt) rmSync(evidence.abandonedReceipt.path, { force: true });
       this.backgroundWork.clear();
+      if (evidence.abandonedReceipt) {
+        this.completedThisTurn = false;
+        this.dormantDeadline = null;
+      }
       const resolver = this.inputResolver;
       this.inputResolver = null;
       resolver({
-        content: `A background job you started appears to have finished or died without delivering its completion notification (${evidence.description}). Read the job's output \u2014 its log file, or the corresponding file under $CONVEYOR_RUN_DIR/gates/ \u2014 to determine the real result, then continue your plan. Do not assume the job succeeded; verify its output first, and rerun it if it was killed.`,
+        content: `A required gate you started appears to have finished or died without delivering its completion notification (${evidence.description}). Read the job's output \u2014 its log file, or the corresponding file under $CONVEYOR_SHARED_DIR/gates on split pods \u2014 to determine the real result, then continue your plan. Do not assume the job succeeded; verify its output first. If it died, rerun it in the foreground without shell '&' and retain the command session until its exit result.`,
         userId: "system",
         source: "background_work_check"
       });
@@ -15902,6 +16017,25 @@ var SessionRunner = class _SessionRunner {
       description: `${this.backgroundWork.pendingCount()} tracked background launch(es) with no live gate process for ${Math.round(ORPHAN_WAKE_GRACE_MS / 6e4)}+ minutes`
     };
   }
+  abandonedReceiptEvidence(receipt) {
+    return {
+      abandonedReceipt: receipt,
+      description: `gate '${receipt.label}' stopped before writing an exit receipt (pid ${receipt.pid})`
+    };
+  }
+  /** Refresh PID liveness in the owning workbench namespace before checking
+   * terminal receipts. The local path is immediate; socket failures preserve
+   * the conservative cached state and never interrupt the heartbeat. */
+  async refreshGateStatusAndMaybeWake() {
+    try {
+      await refreshGenericGateStatus();
+      this.refreshLoopStatus();
+      this.maybeWakeForOrphanedBackgroundWork();
+    } catch (err) {
+      process.stderr.write(`[conveyor-agent] Gate status refresh failed: ${err}
+`);
+    }
+  }
   get sessionId() {
     return this.connection.sessionId;
   }
@@ -16564,7 +16698,7 @@ var SessionRunner = class _SessionRunner {
    *  `selectBestKey` rotation honest. Best-effort — never throws, no-op when the
    *  pod has no OAuth token (e.g. API-key projects). */
   async sampleAndReportKeyUsage() {
-    if (this.stopped) return;
+    if (this.stopped || usesNativeUsageReporting()) return;
     const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
     const { samples, unmeasurable } = await sampleKeyUsage(
       process.env.CLAUDE_CODE_OAUTH_TOKEN,
@@ -16712,13 +16846,8 @@ var SessionRunner = class _SessionRunner {
       isAuto: this.config.isAuto
     };
     const bridge = new QueryBridge(this.connection, this.mode, runnerConfig, {
-      onStatusChange: (status) => {
-        if (status === "running" && this._state === "waiting_for_input") {
-          this._state = "running";
-          this.lifecycle.cancelIdleTimer();
-        }
-        return this.callbacks.onStatusChange(status);
-      },
+      onStatusChange: (status) => this.handleQueryStatus(status),
+      onSubmittedPtyParked: () => this.applySubmittedPtyParkedStatus(),
       onEvent: (event) => {
         if (!this.agentLiveReported) {
           this.agentLiveReported = true;
@@ -16963,8 +17092,7 @@ ${outcome.failures.join("\n")}
   }
   async setState(status) {
     if (status === "running") {
-      this.backgroundDeferStartedAt = null;
-      this.backgroundWakeFiredThisIdle = false;
+      this.beginRunningEpisode();
     }
     if (status === "idle" && this._state !== "idle") this.idleEpisodeStartedAt = Date.now();
     this._state = status;
@@ -16972,6 +17100,39 @@ ${outcome.failures.join("\n")}
     await this.connection.emitStatus(status);
     await this.callbacks.onStatusChange(status);
   }
+  /**
+   * A submitted PTY query can park on an unexpected terminal dialog without
+   * returning its turn. Keep the runner's local state (which drives heartbeat
+   * liveness) in sync with that specific watchdog signal, but do not emit it
+   * again: QueryBridge already sent it.
+   *
+   * Retry delays and pending questionnaires also report `waiting_for_input`,
+   * but they retain their existing bounded liveness holds and must not change
+   * `_state` here.
+   */
+  applySubmittedPtyParkedStatus() {
+    this._state = "waiting_for_input";
+    this.refreshLoopStatus();
+  }
+  /** Forward an ordinary query status without changing liveness for transient
+   * waiting states. The submitted-PTY watchdog calls its dedicated handler. */
+  handleQueryStatus(status) {
+    if (status === "running") {
+      this.beginRunningEpisode();
+      if (this._state === "waiting_for_input") {
+        this._state = "running";
+        this.lifecycle.cancelIdleTimer();
+      }
+    }
+    return this.callbacks.onStatusChange(status);
+  }
+  /** Mark a fresh turn without emitting a duplicate status. QueryExecutor's
+   * prefilled PTY callback already emitted `running` before it reaches here. */
+  beginRunningEpisode() {
+    this.activeEpisodeStartedAt = Date.now();
+    this.backgroundDeferStartedAt = null;
+    this.backgroundWakeFiredThisIdle = false;
+  }
   async shutdown(finalState) {
     process.stderr.write(`[conveyor-agent] Shutdown: reason=${finalState}
 `);
@@ -17070,6 +17231,7 @@ export {
   resolveSessionStart,
   parseUsageGauges,
   runUsageProbe,
+  usesNativeUsageReporting,
   sampleKeyUsage,
   buildRateLimitEvents,
   buildUnmeasurableEvent,

package/dist/{chunk-B54XFOXL.js → chunk-SQM2BQ7H.js}

@@ -37,7 +37,31 @@ var RemoteProcessHandle = class extends EventEmitter {
   }
 };
 
+// src/workbench/gate-status.ts
+function readGateStatus(open, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let status = null;
+    let timer = null;
+    const socket = open(
+      (frame) => {
+        if (frame.t === "gateStatus") status = frame;
+      },
+      (error) => {
+        if (timer) clearTimeout(timer);
+        if (status) resolve(status);
+        else reject(error ?? new WorkbenchError("connection closed before gateStatus"));
+      }
+    );
+    timer = setTimeout(
+      () => socket.destroy(new WorkbenchError("gateStatus timed out", "workbench_timeout")),
+      timeoutMs
+    );
+    timer.unref();
+  });
+}
+
 // src/workbench/client.ts
+var DEFAULT_GATE_STATUS_TIMEOUT_MS = 5e3;
 var WORKBENCH_COMMAND_ENV_DENYLIST = /* @__PURE__ */ new Set([
   "POD_BOOTSTRAP_TOKEN",
   "CONVEYOR_BOOTSTRAP_TOKEN",
@@ -107,10 +131,12 @@ var WorkbenchClient = class {
   port;
   host;
   token;
+  gateStatusTimeoutMs;
   constructor(options = {}) {
     this.port = options.port ?? workbenchPort() ?? DEFAULT_WORKBENCH_PORT;
     this.host = options.host ?? "127.0.0.1";
     this.token = options.token ?? workbenchToken();
+    this.gateStatusTimeoutMs = options.gateStatusTimeoutMs ?? DEFAULT_GATE_STATUS_TIMEOUT_MS;
   }
   /** Open a connection, send the request, route response frames. */
   open(request, onFrame, onClose) {
@@ -168,6 +194,12 @@ var WorkbenchClient = class {
       );
     });
   }
+  gateStatus() {
+    return readGateStatus(
+      (onFrame, onClose) => this.open({ op: "gateStatus" }, onFrame, onClose),
+      this.gateStatusTimeoutMs
+    );
+  }
   /** Ask the workbench — which owns the repo filesystem in split mode — to
    *  re-run the skill floor after the agent's authoritative task-branch
    *  checkout. A daemon without a provider answers an empty result. */

package/dist/{chunk-QLMNQSJL.js → chunk-W5INK3NE.js}

@@ -200,7 +200,7 @@ async function loadPtySpawn() {
 async function resolvePtySpawn() {
   const { workbenchEnabled } = await import("./mode-ZJSOSLGU.js");
   if (!workbenchEnabled()) return loadPtySpawn();
-  const { getWorkbenchClient } = await import("./client-DVVHMIOO.js");
+  const { getWorkbenchClient } = await import("./client-VIFYMBT2.js");
   return (file, args, options) => getWorkbenchClient().spawnPty(file, args, options);
 }
 function sessionTempBase() {

package/dist/{chunk-M4SD2ESQ.js → chunk-WS7QRB37.js}

@@ -20,7 +20,7 @@ import {
 import {
   WorkbenchError,
   getWorkbenchClient
-} from "./chunk-B54XFOXL.js";
+} from "./chunk-SQM2BQ7H.js";
 import {
   workbenchEnabled
 } from "./chunk-KMB3BU4S.js";

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   WorkspaceCommandSupervisor,
   startWorkspaceCommandsAfterConnect,
   stopWorkspaceCommands
-} from "./chunk-X2MKHJBZ.js";
+} from "./chunk-GZRZGBIK.js";
 import {
   DEFAULT_SONNET_MODEL,
   PtyHarness,
@@ -26,14 +26,15 @@ import {
   resolveTuiAdapter,
   resolveTuiKindFromEnv,
   runUsageProbe,
-  sampleKeyUsage
-} from "./chunk-GVDQQZCO.js";
+  sampleKeyUsage,
+  usesNativeUsageReporting
+} from "./chunk-N5LEVAGA.js";
 import "./chunk-SR66HQKB.js";
 import {
   inheritedEnv,
   resolvePtySpawn,
   sessionTempBase
-} from "./chunk-QLMNQSJL.js";
+} from "./chunk-W5INK3NE.js";
 import {
   AgentConnection,
   CodespacePortVisibility,
@@ -44,12 +45,12 @@ import {
   createServiceLogger,
   fetchBootstrap,
   loadConveyorConfig
-} from "./chunk-M4SD2ESQ.js";
+} from "./chunk-WS7QRB37.js";
 import "./chunk-GL2DIQEQ.js";
 import "./chunk-W4LZ7R6Z.js";
-import "./chunk-7P6QZHXZ.js";
+import "./chunk-372R6E4C.js";
 import "./chunk-IA45XHOA.js";
-import "./chunk-B54XFOXL.js";
+import "./chunk-SQM2BQ7H.js";
 import "./chunk-KMB3BU4S.js";
 import "./chunk-6Q6LQBWO.js";
 
@@ -236,7 +237,7 @@ var ProjectSessionRunner = class {
   /** Report the running subscription key's rate-limit utilization (same path as
    *  the task runner). Best-effort — never throws, no-op without an OAuth token. */
   async sampleAndReportKeyUsage() {
-    if (this.stopped) return;
+    if (this.stopped || usesNativeUsageReporting()) return;
     const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
     const { samples, unmeasurable } = await sampleKeyUsage(
       process.env.CLAUDE_CODE_OAUTH_TOKEN,
@@ -575,7 +576,7 @@ var AdhocSessionRunner = class {
   }
   /** Single-key fallback: sample only the key this pod booted under. */
   async sampleAndReportOwnKey() {
-    if (this.stopped) return;
+    if (this.stopped || usesNativeUsageReporting()) return;
     const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
     const { samples, unmeasurable } = await sampleKeyUsage(
       process.env.CLAUDE_CODE_OAUTH_TOKEN,
@@ -1205,7 +1206,7 @@ function wireSpawnChildren(mode, connection, supervisors, logger7) {
 
 // src/cli.ts
 if (process.argv[2] === "boot") {
-  const { runBoot } = await import("./boot-CCRZMY2P.js");
+  const { runBoot } = await import("./boot-4ZNOCKFZ.js");
   process.exit(await runBoot(process.argv.slice(3)));
 }
 if (isLegacyEntrypointLaunch(process.env)) {
@@ -1307,7 +1308,7 @@ process.on("unhandledRejection", (reason) => {
   process.exit(1);
 });
 if (process.env.CONVEYOR_MODE === "workbench") {
-  const { startWorkbenchServer } = await import("./server-WM23BC5C.js");
+  const { startWorkbenchServer } = await import("./server-L5CQ5EJB.js");
   const { oomWatchdogOptionsFromEnv } = await import("./oom-watchdog-PAC5OJJG.js");
   const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QBCYO4GI.js");
   const port = Number(process.env.CONVEYOR_WORKBENCH_PORT) || DEFAULT_WORKBENCH_PORT;
@@ -1458,7 +1459,7 @@ if (!RUNNER_MODES.includes(CONVEYOR_MODE)) {
   process.exit(1);
 }
 if (CONVEYOR_MODE === "serving") {
-  const { runServingSession } = await import("./serve-boot-VJR6J5PL.js");
+  const { runServingSession } = await import("./serve-boot-RU5BYIK4.js");
   exitContext.runnerMode = "serving";
   exitContext.sessionId = process.env.CONVEYOR_SESSION_ID ?? exitContext.sessionId;
   const outcome = await runServingSession({

package/dist/{client-DVVHMIOO.js → client-VIFYMBT2.js}

@@ -4,7 +4,7 @@ import {
   WorkbenchError,
   getWorkbenchClient,
   resetWorkbenchClient
-} from "./chunk-B54XFOXL.js";
+} from "./chunk-SQM2BQ7H.js";
 import "./chunk-KMB3BU4S.js";
 import "./chunk-6Q6LQBWO.js";
 export {

package/dist/gate-cli.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import {
   gatesDir
-} from "./chunk-7P6QZHXZ.js";
+} from "./chunk-372R6E4C.js";
+import "./chunk-SQM2BQ7H.js";
+import "./chunk-KMB3BU4S.js";
+import "./chunk-6Q6LQBWO.js";
 
 // src/runner/gate-wrapper.ts
 import { mkdirSync, rmSync, writeFileSync } from "fs";

package/dist/index.d.ts

@@ -810,6 +810,10 @@ declare class SessionRunner {
     /** One-shot latch: at most one watchdog wake per idle episode. Reset when a
      *  turn runs. */
     private backgroundWakeFiredThisIdle;
+    /** Start of the last active episode. A gate can be launched shortly before
+     * the agent declares completion, so idle-start freshness would reject its
+     * terminal receipt as stale. */
+    private activeEpisodeStartedAt;
     /** When the current idle episode began — an exit sentinel older than this
      *  appeared while a turn could still have consumed it, so it never wakes. */
     private idleEpisodeStartedAt;
@@ -824,13 +828,19 @@ declare class SessionRunner {
      * evidence of orphaned background work — a tracked launch with no live gate
      * process continuously past `ORPHAN_WAKE_GRACE_MS`, or an unconsumed
      * `gates/<label>.exit` sentinel that appeared this idle episode — never on
-     * "the agent seems stuck". A `completed` agent is never woken (the
-     * completion guard holds), and a live pid always suppresses the wake.
+     * "the agent seems stuck". A `completed` agent remains parked unless a
+     * current-episode generic receipt proves a required gate died without an
+     * exit record, and a live pid always suppresses the wake.
      */
     private maybeWakeForOrphanedBackgroundWork;
     /** Orphan evidence that has held past the grace, or null. Maintains the
      *  grace clock for the tracked-work condition as a side effect. */
     private findOrphanEvidence;
+    private abandonedReceiptEvidence;
+    /** Refresh PID liveness in the owning workbench namespace before checking
+     * terminal receipts. The local path is immediate; socket failures preserve
+     * the conservative cached state and never interrupt the heartbeat. */
+    private refreshGateStatusAndMaybeWake;
     get sessionId(): string;
     get isStopped(): boolean;
     /** Wire the boot supervisor handle post-construction — cli.ts constructs it
@@ -1097,6 +1107,23 @@ declare class SessionRunner {
      *  the tool starts work that outlives the turn. */
     private noteToolUseForBackgroundWork;
     private setState;
+    /**
+     * A submitted PTY query can park on an unexpected terminal dialog without
+     * returning its turn. Keep the runner's local state (which drives heartbeat
+     * liveness) in sync with that specific watchdog signal, but do not emit it
+     * again: QueryBridge already sent it.
+     *
+     * Retry delays and pending questionnaires also report `waiting_for_input`,
+     * but they retain their existing bounded liveness holds and must not change
+     * `_state` here.
+     */
+    private applySubmittedPtyParkedStatus;
+    /** Forward an ordinary query status without changing liveness for transient
+     * waiting states. The submitted-PTY watchdog calls its dedicated handler. */
+    private handleQueryStatus;
+    /** Mark a fresh turn without emitting a duplicate status. QueryExecutor's
+     * prefilled PTY callback already emitted `running` before it reaches here. */
+    private beginRunningEpisode;
     private shutdown;
     private _finalState;
     /** The final status after run() completes. Use to determine exit code. */
@@ -1152,6 +1179,10 @@ type UserQuestionSignal = {
 interface AgentRunnerCallbacks {
     onEvent: (event: Record<string, unknown>) => void | Promise<void>;
     onStatusChange: (status: string) => void | Promise<void>;
+    /** Fired only when a submitted PTY query stays silent past the parked-TUI
+     * grace window. This differs from ordinary `waiting_for_input` reports:
+     * retry delays and questionnaires keep the runner locally live. */
+    onSubmittedPtyParked?: () => void;
     /** Optional — fired on question-pending transitions (see UserQuestionSignal). */
     onUserQuestion?: (signal: UserQuestionSignal) => void;
 }

package/dist/index.js

@@ -1,9 +1,9 @@
 import {
   SessionRunner,
   unshallowRepo
-} from "./chunk-GVDQQZCO.js";
+} from "./chunk-N5LEVAGA.js";
 import "./chunk-SR66HQKB.js";
-import "./chunk-QLMNQSJL.js";
+import "./chunk-W5INK3NE.js";
 import {
   AgentConnection,
   GIT_TIMEOUT_MS,
@@ -17,18 +17,18 @@ import {
   stageAndCommit,
   updateRemoteToken,
   workspacePathExists
-} from "./chunk-M4SD2ESQ.js";
+} from "./chunk-WS7QRB37.js";
 import "./chunk-GL2DIQEQ.js";
 import {
   runAuthTokenCommand,
   runSetupCommand,
   runStartCommand
 } from "./chunk-W4LZ7R6Z.js";
-import "./chunk-7P6QZHXZ.js";
+import "./chunk-372R6E4C.js";
 import "./chunk-IA45XHOA.js";
 import {
   getWorkbenchClient
-} from "./chunk-B54XFOXL.js";
+} from "./chunk-SQM2BQ7H.js";
 import {
   workbenchEnabled
 } from "./chunk-KMB3BU4S.js";

package/dist/{serve-boot-VJR6J5PL.js → serve-boot-RU5BYIK4.js}

@@ -1,6 +1,6 @@
 import {
   WorkspaceCommandSupervisor
-} from "./chunk-X2MKHJBZ.js";
+} from "./chunk-GZRZGBIK.js";
 import {
   AgentConnection,
   CodespacePortVisibility,
@@ -11,11 +11,11 @@ import {
   createServiceLogger,
   ensureOnTaskBranch,
   loadConveyorConfig
-} from "./chunk-M4SD2ESQ.js";
+} from "./chunk-WS7QRB37.js";
 import "./chunk-GL2DIQEQ.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-IA45XHOA.js";
-import "./chunk-B54XFOXL.js";
+import "./chunk-SQM2BQ7H.js";
 import "./chunk-KMB3BU4S.js";
 import "./chunk-6Q6LQBWO.js";
 

package/dist/{server-WM23BC5C.js → server-L5CQ5EJB.js}

@@ -1,8 +1,11 @@
 import {
   startWorkbenchServer
-} from "./chunk-7TSQXIN3.js";
-import "./chunk-QLMNQSJL.js";
+} from "./chunk-EIHZRSYI.js";
+import "./chunk-W5INK3NE.js";
 import "./chunk-W4LZ7R6Z.js";
+import "./chunk-372R6E4C.js";
+import "./chunk-SQM2BQ7H.js";
+import "./chunk-KMB3BU4S.js";
 import "./chunk-6Q6LQBWO.js";
 import "./chunk-6W6UZ4SJ.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "11.0.17",
+  "version": "11.0.19",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",

package/skills/conveyor-build/SKILL.md

@@ -38,6 +38,42 @@ out in an **Environment** note — never assume; check which one you are in.
   serially. Parallel fan-out is a deliberate choice the user makes by pressing
   Build on the parent, not something a build session opts into.
 
+## Goal and finish line
+
+Which goal applies depends on the route below. State it once, then hold it: a
+run ends when its finish line is true, not earlier.
+
+**Task path goal:** a pull request for this card.
+**Finish line:** the card in ReviewPR, the PR open, CI started. Then aftercare
+per `## Aftercare` — in a pod you stay wake-able; standalone locally you stop.
+**A task turn may end only when:** a harness-tracked background gate is in
+flight (Claude Code only); you are blocked on a human with the question posted;
+or the finish line is true.
+
+**Pack path goal:** the WHOLE pack, not one child. Per child the goal covers
+the full cycle: plan reviewed and promoted → implemented on the pack branch →
+gated → reviewer-of-record pass → merged (locally) or
+`mcp__conveyor__update_task` → ReviewDev (pod) → base synced. Then
+cross-reference, then the finale.
+**Finish line:** every child is ReviewDev, Complete, or Cancelled AND the
+parent's finale PR into the base branch is open with CI started. One child done
+is not the finish line. A turn that ends with a ready child and no wake armed
+is the failure this section exists to prevent.
+**A pack turn may end only when:** a harness-tracked background gate is in
+flight (Claude Code only — Codex holds the gate's command session open
+instead); you are blocked on a human with the parked protocol posted; or the
+finale PR is open and green-and-quiet. Nothing else. Anything else is a stalled
+run, not a paused one.
+
+**Runtime:** *Codex CLI* — before the first step (Setup step 1 on the pack
+path), create a thread goal with your goal tool whose objective is the finish
+line sentence for this route, naming the card slug. Call `update_goal` with
+`complete` only when that finish line is true (for a pack: the finale PR is
+open); `blocked` only per the parked protocol; never because the budget is
+low. *Claude Code* — there is no goal tool; the pacing rule in
+[references/pack-path.md](references/pack-path.md) is the loop, and its pack
+heartbeat is the fallback.
+
 ## Environment
 
 Resolve which one you are in before touching git or the filesystem.

package/skills/conveyor-build/references/pack-path.md

@@ -96,18 +96,39 @@ End a turn with children remaining ONLY when a wake is guaranteed:
 
 - **A background gate is in flight.** Its completion notification re-invokes
   you. (Launch it with the harness's `run_in_background`; hand-rolled
-  backgrounding wakes nothing.)
+  backgrounding wakes nothing.) *Codex CLI substitution:* Codex has no
+  background gate. Hold the gate's command session open until it returns an
+  exit result, then continue in the same turn — ending the turn is not how a
+  Codex runner waits.
 - **You are blocked on a human** — the parked protocol below. The user's chat
   reply is the wake.
 - **The finale PR is open and quiet** — the Babysit tier. Green and quiet is
   the end.
 
-Any other end-of-turn must arm `ScheduleWakeup` first: 60–90s, prompt
-restating which child comes next. That is the pod-sanctioned mechanism (the
-pod prompt allows `ScheduleWakeup` exactly when nothing else will notify you),
-and it is a rare exception, not the cadence. Never end a turn "to report
-progress" — chat is where progress goes, and posting there does not end the
-pack.
+Any other end-of-turn is runtime-specific:
+
+**Claude Code.** Arm `ScheduleWakeup` first: 60–90s, prompt restating which
+child comes next. That is the pod-sanctioned mechanism (the pod prompt allows
+`ScheduleWakeup` exactly when nothing else will notify you), and it is a rare
+exception, not the cadence. On top of it, run a **pack heartbeat**: at Setup,
+before the first child, arm ONE long fallback wake (`ScheduleWakeup`,
+1200–1500s) whose prompt is the pack continuation — "re-derive with
+`mcp__conveyor__list_subtasks` and take the next ready child; if nothing is
+ready and no gate is in flight, stop" — and re-arm it at every child boundary
+so exactly one is outstanding. A heartbeat that fires mid-work re-derives
+state and is a no-op. This is NOT the "insurance wakeup" the pod prompt
+forbids: that rule is about a background job's own completion notification,
+which does fire. Nothing at all notifies a pack between children, so the
+heartbeat is the only guaranteed wake a Claude pack has. Do not delete it.
+
+**Codex CLI.** There is no `ScheduleWakeup` and no `/loop`. The thread goal
+created per the SKILL.md *Goal and finish line* section is the continuation:
+an idle thread is re-prompted to keep working toward it. The only way to leave
+a child ready is therefore to keep working in the same turn — merge, next
+child, merge. Mark the goal complete only when the finale PR is open.
+
+Never end a turn "to report progress" — in either runtime, chat is where
+progress goes, and posting there does not end the pack.
 
 **Pre-exit invariant.** Before ending ANY turn, re-run
 `mcp__conveyor__list_subtasks`. A child that is `Open` with its dependencies

package/skills/conveyor-plan/SKILL.md

@@ -19,6 +19,34 @@ identification decides.** Moving the card to Open fires identification
 automatically (story points, icon, agent, and tags if you set none). Never set
 icon or story points yourself, and never `start_task` unless the user asks.
 
+## Goal and finish line
+
+**Goal:** a plan on this card that a context-free executor can build, or one
+batched round of questions for a human when scope is genuinely ambiguous.
+**Finish line:** the plan is saved with `mcp__conveyor__update_task` AND the
+recommendation is posted with `mcp__conveyor__post_to_chat` and
+`milestone: "plan_ready"`. In a pod, story points and risk are also set
+(`mcp__conveyor__update_task_properties`) and plan mode is exited.
+**A turn may end only when:** (a) the finish line above is true, or (b) an
+`AskUserQuestion` is pending. Nothing else. Anything else is a stalled run, not
+a paused one.
+
+**Never ask whether to start building, and never offer to.** Once the plan is
+saved, the handoff is not yours: in the cloud the system spawns a separate
+Builder session for the card, and locally a human runs `/conveyor-build` when
+they are ready. Until one of those happens, every further turn on this card is
+a plan iteration — read the feedback, revise, re-save, re-post `plan_ready`.
+Do not claim the card, do not touch the tree, and do not invoke
+`/conveyor-build` unprompted. (Locally the user may ask for it in the same
+session; that request is the only trigger.)
+
+**Runtime:** *Codex CLI* — before Phase 0, create a thread goal with your goal
+tool whose objective is: "Save a plan on card <slug> that a context-free
+builder can execute, or ask the blocking questions; do not start
+implementation." Mark it complete only when the finish line is true, never
+because the budget is low. *Claude Code* — there is no goal tool; the finish
+line and the two turn endings above are the loop.
+
 ## Phase 0 — Resolve context
 
 1. `mcp__conveyor__get_connection_context` (all Conveyor tools fully-qualified;
@@ -135,7 +163,10 @@ touching Conveyor, unless they asked you to just ship it.
 > does not exist in a pod. In a pod, the card exists and you are on it: save
 > the plan with `mcp__conveyor__update_task` (`plan`, and `description` if it
 > needs sharpening), post the same recommendation message to chat with
-> `milestone: "plan_ready"`, and stop — a pod does not promote its own card to
+> `milestone: "plan_ready"`, and stop. "Stop" means end the turn with no
+> question about starting work — per *Goal and finish line*, the Builder is a
+> separate session the system spawns, and every later turn here is a plan
+> iteration. A pod does not promote its own card to
 > Open. A parked plan is never `blocked`: that milestone means you cannot
 > continue until a human acts, and it pages nobody. To page a person, ask them
 > with AskUserQuestion. If the pod also has to leave

package/skills/conveyor-review/SKILL.md

@@ -26,6 +26,30 @@ process, this skill loses: a project's own rules outrank a general one.
   PR touches are not this PR's job — note them in chat if they matter, or file
   a suggestion, but do not block on them.
 
+## Goal and finish line
+
+**Goal:** one verdict on this PR.
+**Finish line:** the environment's verdict tool returned success —
+`mcp__conveyor__approve_code_review` / `mcp__conveyor__request_code_changes`
+in a pod, `mcp__conveyor__approve_task` / `mcp__conveyor__request_changes`
+locally — OR a blocked note is posted with the specific blocker and no verdict
+(the `## Blocked` case).
+**A turn may end only when:** (a) the verdict call succeeded — read the
+response; a "superseded by a newer review cycle" error is not success; (b) the
+blocked note is posted; or (c) you pushed your own fix and are waiting for CI
+before approving. Nothing else. Findings posted with no verdict called is a
+stalled review, not a paused one.
+
+**Reviewer of record for a pack child** has no verdict tool: its finish line is
+the merge (locally) or the `mcp__conveyor__update_task` → ReviewDev write
+(pod), and the pack path's goal wording in conveyor-build governs instead.
+
+**Runtime:** *Codex CLI* — before reading the change, create a thread goal with
+your goal tool: "Render exactly one review verdict on PR <n> for card <slug>."
+Mark it complete only after the verdict call succeeded, never because the
+budget is low. *Claude Code* — there is no goal tool; the finish line above is
+the loop.
+
 ## Read the change
 
 1. `mcp__conveyor__get_task` for the plan — you cannot judge "does this do what
@@ -142,8 +166,10 @@ is the reviewer, and the independent review happens later on the pack's PR into
 
 - Apply the same criteria above. The absence of an automated pass makes this
   review more load-bearing, not less.
-- There is **no verdict tool** — merging the child PR is the approval. Say what
-  you checked in chat so the record exists.
+- There is **no verdict tool** — merging the child PR (locally) or the
+  `mcp__conveyor__update_task` → ReviewDev write (pod) is the approval, and
+  that write or merge is this review's finish line; the pack path's goal
+  wording applies. Say what you checked in chat so the record exists.
 - You wrote this code, which makes self-review the weak point. An independent
   reviewer with the diff and no memory of writing it catches what you cannot.
 

package/dist/chunk-7P6QZHXZ.js

@@ -1,76 +0,0 @@
-// src/runner/heavy-gate.ts
-import { readdirSync, readFileSync, statSync } from "fs";
-import path from "path";
-var GATE_KEYS = ["heavy", "test", "typecheck", "build"];
-var GATES_DIR_NAME = "gates";
-function runDir() {
-  return process.env.CONVEYOR_RUN_DIR ?? "/tmp/conveyor-run";
-}
-function gatesDir() {
-  return path.join(runDir(), GATES_DIR_NAME);
-}
-function pidAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function parsePid(raw) {
-  const pid = Number.parseInt(raw.trim(), 10);
-  return Number.isInteger(pid) && pid > 0 ? pid : null;
-}
-function gatePidFiles() {
-  const files = GATE_KEYS.map((key) => path.join(runDir(), `${key}.pid`));
-  try {
-    for (const entry of readdirSync(gatesDir())) {
-      if (entry.endsWith(".pid")) files.push(path.join(gatesDir(), entry));
-    }
-  } catch {
-  }
-  return files;
-}
-function listGateExitSentinels() {
-  const sentinels = [];
-  let entries;
-  try {
-    entries = readdirSync(gatesDir());
-  } catch {
-    return sentinels;
-  }
-  for (const entry of entries) {
-    if (!entry.endsWith(".exit")) continue;
-    const file = path.join(gatesDir(), entry);
-    try {
-      const mtimeMs = statSync(file).mtimeMs;
-      let code = null;
-      try {
-        const parsed = JSON.parse(readFileSync(file, "utf8"));
-        const value = parsed?.code;
-        if (typeof value === "number") code = value;
-      } catch {
-      }
-      sentinels.push({ path: file, label: entry.slice(0, -".exit".length), code, mtimeMs });
-    } catch {
-    }
-  }
-  sentinels.sort((a, b) => a.mtimeMs - b.mtimeMs);
-  return sentinels;
-}
-function isHeavyGateActive() {
-  for (const file of gatePidFiles()) {
-    try {
-      const pid = parsePid(readFileSync(file, "utf8"));
-      if (pid !== null && pidAlive(pid)) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-
-export {
-  gatesDir,
-  listGateExitSentinels,
-  isHeavyGateActive
-};