@runfusion/fusion 0.77.0-beta.11 → 0.77.0-beta.13

package/dist/pi-claude-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion/pi-claude-cli",
-  "version": "0.77.0-beta.11",
+  "version": "0.77.0-beta.13",
   "type": "module",
   "private": true,
   "main": "index.ts",

package/dist/plugin-sdk/index.d.ts

@@ -273,6 +273,7 @@ interface WorkflowStep {
     gateMode: WorkflowStepGateMode;
     prompt: string;
     toolMode?: WorkflowStepToolMode;
+    readonlyMcpServers?: string[];
     skillName?: string;
     requiresBrowser?: boolean;
     scriptName?: string;
@@ -336,6 +337,10 @@ interface WorkflowStepResult {
     repositoryScopeRevision?: number;
     remediationArchivedAt?: string;
     remediationArchivedFromStatus?: WorkflowStepResult["status"];
+    remediationAttemptSignature?: string;
+    remediationAttemptOwner?: string;
+    remediationAttemptClaimedAt?: string;
+    remediationRefusedReason?: "no-actionable-findings" | "upstream-out-of-scope" | "unclassified-gate-no-reopen" | "appender-declined";
     notRunReason?: WorkflowStepNotRunReason;
     reviewInputFingerprint?: string;
     reviewedCommitSha?: string;
@@ -5073,7 +5078,6 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
     taskIdIntegrityReport: TaskIdIntegrityReport;
     lastTaskIdIntegrityLogSignature: string | null;
     workflowStepsCache: WorkflowStep[] | null;
-    workflowDefinitionsCache: WorkflowDefinition[] | null;
     _pluginWorkflowStepTemplates: Array<{
         pluginId: string;
         template: WorkflowStepTemplate;
@@ -5823,6 +5827,10 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
     updateTaskAtomic(id: string, updater: (current: Task) => Parameters<TaskStore["updateTask"]>[1] | null | undefined | Promise<Parameters<TaskStore["updateTask"]>[1] | null | undefined>, runContext?: RunMutationContext): Promise<Task>;
     appendRemediationSteps(taskId: string, steps: readonly TaskStep[], options?: AppendRemediationStepsOptions): Promise<AppendRemediationStepsResult>;
     updateWorkflowStepResultsFenced(id: string, compute: WorkflowStepResultsFencedCompute): Promise<WorkflowStepResultsFencedUpdateResult>;
+    updateWorkflowStepResultsWithLogFenced(id: string, compute: (current: Task) => {
+        workflowStepResults: Task["workflowStepResults"];
+        logEntry: TaskLogEntry;
+    } | null): Promise<WorkflowStepResultsFencedUpdateResult>;
     dismissAiMergeReviewFinding(taskId: string, findingId: string, reason: string, actor?: string): Promise<Task>;
     linkTaskRecommendation(id: string, recommendationId: string, createdTaskId: string, completeColumns?: ReadonlySet<string>): Promise<Task>;
     normalizeWorkspaceTaskWorktreeMetadata(id: string): Promise<Task>;

package/dist/plugin-sdk/index.js

@@ -9027,8 +9027,23 @@ function planReviewOptionalGroupNode(column, options = {}) {
   };
 }
 
+// ../core/src/workflows/workflow-merge-region.ts
+var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+  "merge-gate",
+  "merge-attempt",
+  "manual-merge-hold",
+  "retry-backoff",
+  "recovery-router",
+  "branch-group-member-integration",
+  "branch-group-promotion",
+  "pr-create",
+  "pr-respond",
+  "pr-merge"
+]);
+
 // ../core/src/workflows/workflow-step-results.ts
 var PLAN_REVIEW_LEASE_STALENESS_MS = 15 * 60 * 1e3;
+var REMEDIATION_ATTEMPT_CLAIM_STALENESS_MS = 15 * 60 * 1e3;
 
 // ../core/src/merge/task-merge.ts
 var HARD_BLOCKING_TASK_STATUSES = /* @__PURE__ */ new Set([
@@ -10574,20 +10589,6 @@ function classifyWorkflowAgentNode(node) {
   }
 }
 
-// ../core/src/workflows/workflow-merge-region.ts
-var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-  "merge-gate",
-  "merge-attempt",
-  "manual-merge-hold",
-  "retry-backoff",
-  "recovery-router",
-  "branch-group-member-integration",
-  "branch-group-promotion",
-  "pr-create",
-  "pr-respond",
-  "pr-merge"
-]);
-
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -11579,6 +11580,16 @@ function validateReviewerAgentOverrides(nodes2) {
     if (Array.isArray(templateNodes)) validateReviewerAgentOverrides(templateNodes);
   }
 }
+function validateReadonlyMcpServersConfig(nodes2) {
+  for (const node of nodes2) {
+    const value = node.config?.readonlyMcpServers;
+    if (value !== void 0 && (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw new WorkflowIrError(`Workflow node '${node.id}' readonlyMcpServers must be an array of non-empty strings when present`);
+    }
+    const templateNodes = node.config?.template?.nodes;
+    if (Array.isArray(templateNodes)) validateReadonlyMcpServersConfig(templateNodes);
+  }
+}
 function validateThinkingLevelConfig(nodes2) {
   for (const node of nodes2) {
     const value = node.config?.thinkingLevel;
@@ -12193,6 +12204,7 @@ function validateV2(ir) {
   const topLevelIds = new Set(ir.nodes.map((n) => n.id));
   validateStepExecutePlacement(ir.nodes);
   validateThinkingLevelConfig(ir.nodes);
+  validateReadonlyMcpServersConfig(ir.nodes);
   validateCredentialInstanceIdConfig(ir.nodes);
   validateReviewerAgentOverrides(ir.nodes);
   for (const node of ir.nodes) {
@@ -14392,6 +14404,7 @@ Be specific: cite \`file:line\` for every finding and explain the concrete failu
 - APPROVE_WITH_NOTES: shippable. Use this when your findings are all P1/P2 \u2014 they are recorded and handed to the implementer without another remediation round.
 - REVISE: a correctness bug, regression, or contract break requires changes before merge. Requires at least one \`critical\` finding in \`findings\`; a REVISE without one will be treated as APPROVE_WITH_NOTES.
 - Every blocking issue MUST appear as an entry in \`findings\` with its severity and \`filePath\`/\`line\`. Prose in \`notes\` alone does not block.
+- Every REVISE finding is a required Fix-step record. Its \`id\`, \`title\`, \`body\`, \`filePath\`, \`line\`, and \`severity\` must be concrete enough for an executor to implement without asking what to fix. If you cannot name an affected file and correction, do not return REVISE: investigate until you can, or return the appropriate non-blocking verdict.
 - \`notes\` MUST contain one to three sentences naming what was checked and why the verdict was reached. An empty \`notes\` string is a protocol violation.
 - Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):
 {"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"...","findings":[{"id":"stable-id","title":"concise issue","body":"concrete failure and remediation","filePath":"path/to/file.ts","line":1,"severity":"critical|high|medium|low","resolution":"open|resolved-in-review|superseded"}]}`;

package/dist/plugins/fusion-plugin-acp-runtime/bundled.js

@@ -9026,8 +9026,23 @@ function planReviewOptionalGroupNode(column, options = {}) {
   };
 }
 
+// ../core/src/workflows/workflow-merge-region.ts
+var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+  "merge-gate",
+  "merge-attempt",
+  "manual-merge-hold",
+  "retry-backoff",
+  "recovery-router",
+  "branch-group-member-integration",
+  "branch-group-promotion",
+  "pr-create",
+  "pr-respond",
+  "pr-merge"
+]);
+
 // ../core/src/workflows/workflow-step-results.ts
 var PLAN_REVIEW_LEASE_STALENESS_MS = 15 * 60 * 1e3;
+var REMEDIATION_ATTEMPT_CLAIM_STALENESS_MS = 15 * 60 * 1e3;
 
 // ../core/src/merge/task-merge.ts
 var HARD_BLOCKING_TASK_STATUSES = /* @__PURE__ */ new Set([
@@ -10582,20 +10597,6 @@ function classifyWorkflowAgentNode(node) {
   }
 }
 
-// ../core/src/workflows/workflow-merge-region.ts
-var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-  "merge-gate",
-  "merge-attempt",
-  "manual-merge-hold",
-  "retry-backoff",
-  "recovery-router",
-  "branch-group-member-integration",
-  "branch-group-promotion",
-  "pr-create",
-  "pr-respond",
-  "pr-merge"
-]);
-
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -11587,6 +11588,16 @@ function validateReviewerAgentOverrides(nodes2) {
     if (Array.isArray(templateNodes)) validateReviewerAgentOverrides(templateNodes);
   }
 }
+function validateReadonlyMcpServersConfig(nodes2) {
+  for (const node of nodes2) {
+    const value = node.config?.readonlyMcpServers;
+    if (value !== void 0 && (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw new WorkflowIrError(`Workflow node '${node.id}' readonlyMcpServers must be an array of non-empty strings when present`);
+    }
+    const templateNodes = node.config?.template?.nodes;
+    if (Array.isArray(templateNodes)) validateReadonlyMcpServersConfig(templateNodes);
+  }
+}
 function validateThinkingLevelConfig(nodes2) {
   for (const node of nodes2) {
     const value = node.config?.thinkingLevel;
@@ -12201,6 +12212,7 @@ function validateV2(ir) {
   const topLevelIds = new Set(ir.nodes.map((n) => n.id));
   validateStepExecutePlacement(ir.nodes);
   validateThinkingLevelConfig(ir.nodes);
+  validateReadonlyMcpServersConfig(ir.nodes);
   validateCredentialInstanceIdConfig(ir.nodes);
   validateReviewerAgentOverrides(ir.nodes);
   for (const node of ir.nodes) {
@@ -14400,6 +14412,7 @@ Be specific: cite \`file:line\` for every finding and explain the concrete failu
 - APPROVE_WITH_NOTES: shippable. Use this when your findings are all P1/P2 \u2014 they are recorded and handed to the implementer without another remediation round.
 - REVISE: a correctness bug, regression, or contract break requires changes before merge. Requires at least one \`critical\` finding in \`findings\`; a REVISE without one will be treated as APPROVE_WITH_NOTES.
 - Every blocking issue MUST appear as an entry in \`findings\` with its severity and \`filePath\`/\`line\`. Prose in \`notes\` alone does not block.
+- Every REVISE finding is a required Fix-step record. Its \`id\`, \`title\`, \`body\`, \`filePath\`, \`line\`, and \`severity\` must be concrete enough for an executor to implement without asking what to fix. If you cannot name an affected file and correction, do not return REVISE: investigate until you can, or return the appropriate non-blocking verdict.
 - \`notes\` MUST contain one to three sentences naming what was checked and why the verdict was reached. An empty \`notes\` string is a protocol violation.
 - Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):
 {"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"...","findings":[{"id":"stable-id","title":"concise issue","body":"concrete failure and remediation","filePath":"path/to/file.ts","line":1,"severity":"critical|high|medium|low","resolution":"open|resolved-in-review|superseded"}]}`;
@@ -37992,11 +38005,19 @@ async function authenticateAcpConnection(connection, opts) {
   return { methodId };
 }
 async function newAcpSession(connection, opts) {
-  const res = await connection.conn.newSession({
-    cwd: opts.cwd,
-    mcpServers: opts.mcpServers ?? [],
-    ...opts.meta && Object.keys(opts.meta).length > 0 ? { _meta: opts.meta } : {}
-  });
+  let res;
+  try {
+    res = await connection.conn.newSession({
+      cwd: opts.cwd,
+      mcpServers: opts.mcpServers ?? [],
+      ...opts.meta && Object.keys(opts.meta).length > 0 ? { _meta: opts.meta } : {}
+    });
+  } catch (error51) {
+    throw new Error(
+      `session/new failed (cwd ${opts.cwd}): ${describeAcpTurnError(error51)}`,
+      { cause: error51 }
+    );
+  }
   return { sessionId: boundIdentifier(res.sessionId), modes: res.modes ?? void 0 };
 }
 var RETRYABLE_JSONRPC_CODES = /* @__PURE__ */ new Set([

package/dist/plugins/fusion-plugin-acp-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/acp-runtime",
-  "version": "0.1.36-beta.11",
+  "version": "0.1.36-beta.13",
   "type": "module",
   "exports": {
     ".": {

package/dist/plugins/fusion-plugin-claude-runtime/bundled.js

@@ -9026,8 +9026,23 @@ function planReviewOptionalGroupNode(column, options = {}) {
   };
 }
 
+// ../core/src/workflows/workflow-merge-region.ts
+var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+  "merge-gate",
+  "merge-attempt",
+  "manual-merge-hold",
+  "retry-backoff",
+  "recovery-router",
+  "branch-group-member-integration",
+  "branch-group-promotion",
+  "pr-create",
+  "pr-respond",
+  "pr-merge"
+]);
+
 // ../core/src/workflows/workflow-step-results.ts
 var PLAN_REVIEW_LEASE_STALENESS_MS = 15 * 60 * 1e3;
+var REMEDIATION_ATTEMPT_CLAIM_STALENESS_MS = 15 * 60 * 1e3;
 
 // ../core/src/merge/task-merge.ts
 var HARD_BLOCKING_TASK_STATUSES = /* @__PURE__ */ new Set([
@@ -10582,20 +10597,6 @@ function classifyWorkflowAgentNode(node) {
   }
 }
 
-// ../core/src/workflows/workflow-merge-region.ts
-var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-  "merge-gate",
-  "merge-attempt",
-  "manual-merge-hold",
-  "retry-backoff",
-  "recovery-router",
-  "branch-group-member-integration",
-  "branch-group-promotion",
-  "pr-create",
-  "pr-respond",
-  "pr-merge"
-]);
-
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -11587,6 +11588,16 @@ function validateReviewerAgentOverrides(nodes2) {
     if (Array.isArray(templateNodes)) validateReviewerAgentOverrides(templateNodes);
   }
 }
+function validateReadonlyMcpServersConfig(nodes2) {
+  for (const node of nodes2) {
+    const value = node.config?.readonlyMcpServers;
+    if (value !== void 0 && (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw new WorkflowIrError(`Workflow node '${node.id}' readonlyMcpServers must be an array of non-empty strings when present`);
+    }
+    const templateNodes = node.config?.template?.nodes;
+    if (Array.isArray(templateNodes)) validateReadonlyMcpServersConfig(templateNodes);
+  }
+}
 function validateThinkingLevelConfig(nodes2) {
   for (const node of nodes2) {
     const value = node.config?.thinkingLevel;
@@ -12201,6 +12212,7 @@ function validateV2(ir) {
   const topLevelIds = new Set(ir.nodes.map((n) => n.id));
   validateStepExecutePlacement(ir.nodes);
   validateThinkingLevelConfig(ir.nodes);
+  validateReadonlyMcpServersConfig(ir.nodes);
   validateCredentialInstanceIdConfig(ir.nodes);
   validateReviewerAgentOverrides(ir.nodes);
   for (const node of ir.nodes) {
@@ -14400,6 +14412,7 @@ Be specific: cite \`file:line\` for every finding and explain the concrete failu
 - APPROVE_WITH_NOTES: shippable. Use this when your findings are all P1/P2 \u2014 they are recorded and handed to the implementer without another remediation round.
 - REVISE: a correctness bug, regression, or contract break requires changes before merge. Requires at least one \`critical\` finding in \`findings\`; a REVISE without one will be treated as APPROVE_WITH_NOTES.
 - Every blocking issue MUST appear as an entry in \`findings\` with its severity and \`filePath\`/\`line\`. Prose in \`notes\` alone does not block.
+- Every REVISE finding is a required Fix-step record. Its \`id\`, \`title\`, \`body\`, \`filePath\`, \`line\`, and \`severity\` must be concrete enough for an executor to implement without asking what to fix. If you cannot name an affected file and correction, do not return REVISE: investigate until you can, or return the appropriate non-blocking verdict.
 - \`notes\` MUST contain one to three sentences naming what was checked and why the verdict was reached. An empty \`notes\` string is a protocol violation.
 - Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):
 {"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"...","findings":[{"id":"stable-id","title":"concise issue","body":"concrete failure and remediation","filePath":"path/to/file.ts","line":1,"severity":"critical|high|medium|low","resolution":"open|resolved-in-review|superseded"}]}`;

package/dist/plugins/fusion-plugin-claude-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/claude-runtime",
-  "version": "0.1.11-beta.11",
+  "version": "0.1.11-beta.13",
   "type": "module",
   "exports": {
     ".": {

package/dist/plugins/fusion-plugin-cli-printing-press/bundled.js

@@ -9146,8 +9146,23 @@ function planReviewOptionalGroupNode(column, options = {}) {
   };
 }
 
+// ../core/src/workflows/workflow-merge-region.ts
+var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+  "merge-gate",
+  "merge-attempt",
+  "manual-merge-hold",
+  "retry-backoff",
+  "recovery-router",
+  "branch-group-member-integration",
+  "branch-group-promotion",
+  "pr-create",
+  "pr-respond",
+  "pr-merge"
+]);
+
 // ../core/src/workflows/workflow-step-results.ts
 var PLAN_REVIEW_LEASE_STALENESS_MS = 15 * 60 * 1e3;
+var REMEDIATION_ATTEMPT_CLAIM_STALENESS_MS = 15 * 60 * 1e3;
 
 // ../core/src/merge/task-merge.ts
 var HARD_BLOCKING_TASK_STATUSES = /* @__PURE__ */ new Set([
@@ -10694,20 +10709,6 @@ function classifyWorkflowAgentNode(node) {
   }
 }
 
-// ../core/src/workflows/workflow-merge-region.ts
-var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-  "merge-gate",
-  "merge-attempt",
-  "manual-merge-hold",
-  "retry-backoff",
-  "recovery-router",
-  "branch-group-member-integration",
-  "branch-group-promotion",
-  "pr-create",
-  "pr-respond",
-  "pr-merge"
-]);
-
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -11699,6 +11700,16 @@ function validateReviewerAgentOverrides(nodes2) {
     if (Array.isArray(templateNodes)) validateReviewerAgentOverrides(templateNodes);
   }
 }
+function validateReadonlyMcpServersConfig(nodes2) {
+  for (const node of nodes2) {
+    const value = node.config?.readonlyMcpServers;
+    if (value !== void 0 && (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw new WorkflowIrError(`Workflow node '${node.id}' readonlyMcpServers must be an array of non-empty strings when present`);
+    }
+    const templateNodes = node.config?.template?.nodes;
+    if (Array.isArray(templateNodes)) validateReadonlyMcpServersConfig(templateNodes);
+  }
+}
 function validateThinkingLevelConfig(nodes2) {
   for (const node of nodes2) {
     const value = node.config?.thinkingLevel;
@@ -12313,6 +12324,7 @@ function validateV2(ir) {
   const topLevelIds = new Set(ir.nodes.map((n) => n.id));
   validateStepExecutePlacement(ir.nodes);
   validateThinkingLevelConfig(ir.nodes);
+  validateReadonlyMcpServersConfig(ir.nodes);
   validateCredentialInstanceIdConfig(ir.nodes);
   validateReviewerAgentOverrides(ir.nodes);
   for (const node of ir.nodes) {
@@ -14512,6 +14524,7 @@ Be specific: cite \`file:line\` for every finding and explain the concrete failu
 - APPROVE_WITH_NOTES: shippable. Use this when your findings are all P1/P2 \u2014 they are recorded and handed to the implementer without another remediation round.
 - REVISE: a correctness bug, regression, or contract break requires changes before merge. Requires at least one \`critical\` finding in \`findings\`; a REVISE without one will be treated as APPROVE_WITH_NOTES.
 - Every blocking issue MUST appear as an entry in \`findings\` with its severity and \`filePath\`/\`line\`. Prose in \`notes\` alone does not block.
+- Every REVISE finding is a required Fix-step record. Its \`id\`, \`title\`, \`body\`, \`filePath\`, \`line\`, and \`severity\` must be concrete enough for an executor to implement without asking what to fix. If you cannot name an affected file and correction, do not return REVISE: investigate until you can, or return the appropriate non-blocking verdict.
 - \`notes\` MUST contain one to three sentences naming what was checked and why the verdict was reached. An empty \`notes\` string is a protocol violation.
 - Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):
 {"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"...","findings":[{"id":"stable-id","title":"concise issue","body":"concrete failure and remediation","filePath":"path/to/file.ts","line":1,"severity":"critical|high|medium|low","resolution":"open|resolved-in-review|superseded"}]}`;

package/dist/plugins/fusion-plugin-cli-printing-press/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/cli-printing-press",
-  "version": "0.1.53-beta.11",
+  "version": "0.1.53-beta.13",
   "type": "module",
   "exports": {
     ".": {

package/dist/plugins/fusion-plugin-compound-engineering/bundled.js

@@ -9026,8 +9026,23 @@ function planReviewOptionalGroupNode(column, options = {}) {
   };
 }
 
+// ../core/src/workflows/workflow-merge-region.ts
+var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+  "merge-gate",
+  "merge-attempt",
+  "manual-merge-hold",
+  "retry-backoff",
+  "recovery-router",
+  "branch-group-member-integration",
+  "branch-group-promotion",
+  "pr-create",
+  "pr-respond",
+  "pr-merge"
+]);
+
 // ../core/src/workflows/workflow-step-results.ts
 var PLAN_REVIEW_LEASE_STALENESS_MS = 15 * 60 * 1e3;
+var REMEDIATION_ATTEMPT_CLAIM_STALENESS_MS = 15 * 60 * 1e3;
 
 // ../core/src/merge/task-merge.ts
 var HARD_BLOCKING_TASK_STATUSES = /* @__PURE__ */ new Set([
@@ -10574,20 +10589,6 @@ function classifyWorkflowAgentNode(node) {
   }
 }
 
-// ../core/src/workflows/workflow-merge-region.ts
-var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-  "merge-gate",
-  "merge-attempt",
-  "manual-merge-hold",
-  "retry-backoff",
-  "recovery-router",
-  "branch-group-member-integration",
-  "branch-group-promotion",
-  "pr-create",
-  "pr-respond",
-  "pr-merge"
-]);
-
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -11579,6 +11580,16 @@ function validateReviewerAgentOverrides(nodes2) {
     if (Array.isArray(templateNodes)) validateReviewerAgentOverrides(templateNodes);
   }
 }
+function validateReadonlyMcpServersConfig(nodes2) {
+  for (const node of nodes2) {
+    const value = node.config?.readonlyMcpServers;
+    if (value !== void 0 && (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw new WorkflowIrError(`Workflow node '${node.id}' readonlyMcpServers must be an array of non-empty strings when present`);
+    }
+    const templateNodes = node.config?.template?.nodes;
+    if (Array.isArray(templateNodes)) validateReadonlyMcpServersConfig(templateNodes);
+  }
+}
 function validateThinkingLevelConfig(nodes2) {
   for (const node of nodes2) {
     const value = node.config?.thinkingLevel;
@@ -12193,6 +12204,7 @@ function validateV2(ir) {
   const topLevelIds = new Set(ir.nodes.map((n) => n.id));
   validateStepExecutePlacement(ir.nodes);
   validateThinkingLevelConfig(ir.nodes);
+  validateReadonlyMcpServersConfig(ir.nodes);
   validateCredentialInstanceIdConfig(ir.nodes);
   validateReviewerAgentOverrides(ir.nodes);
   for (const node of ir.nodes) {
@@ -14392,6 +14404,7 @@ Be specific: cite \`file:line\` for every finding and explain the concrete failu
 - APPROVE_WITH_NOTES: shippable. Use this when your findings are all P1/P2 \u2014 they are recorded and handed to the implementer without another remediation round.
 - REVISE: a correctness bug, regression, or contract break requires changes before merge. Requires at least one \`critical\` finding in \`findings\`; a REVISE without one will be treated as APPROVE_WITH_NOTES.
 - Every blocking issue MUST appear as an entry in \`findings\` with its severity and \`filePath\`/\`line\`. Prose in \`notes\` alone does not block.
+- Every REVISE finding is a required Fix-step record. Its \`id\`, \`title\`, \`body\`, \`filePath\`, \`line\`, and \`severity\` must be concrete enough for an executor to implement without asking what to fix. If you cannot name an affected file and correction, do not return REVISE: investigate until you can, or return the appropriate non-blocking verdict.
 - \`notes\` MUST contain one to three sentences naming what was checked and why the verdict was reached. An empty \`notes\` string is a protocol violation.
 - Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):
 {"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"...","findings":[{"id":"stable-id","title":"concise issue","body":"concrete failure and remediation","filePath":"path/to/file.ts","line":1,"severity":"critical|high|medium|low","resolution":"open|resolved-in-review|superseded"}]}`;

package/dist/plugins/fusion-plugin-compound-engineering/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/compound-engineering",
-  "version": "0.1.36-beta.11",
+  "version": "0.1.36-beta.13",
   "type": "module",
   "exports": {
     ".": {

package/dist/plugins/fusion-plugin-cursor-runtime/bundled.js

@@ -9029,8 +9029,23 @@ function planReviewOptionalGroupNode(column, options = {}) {
   };
 }
 
+// ../core/src/workflows/workflow-merge-region.ts
+var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+  "merge-gate",
+  "merge-attempt",
+  "manual-merge-hold",
+  "retry-backoff",
+  "recovery-router",
+  "branch-group-member-integration",
+  "branch-group-promotion",
+  "pr-create",
+  "pr-respond",
+  "pr-merge"
+]);
+
 // ../core/src/workflows/workflow-step-results.ts
 var PLAN_REVIEW_LEASE_STALENESS_MS = 15 * 60 * 1e3;
+var REMEDIATION_ATTEMPT_CLAIM_STALENESS_MS = 15 * 60 * 1e3;
 
 // ../core/src/merge/task-merge.ts
 var HARD_BLOCKING_TASK_STATUSES = /* @__PURE__ */ new Set([
@@ -10577,20 +10592,6 @@ function classifyWorkflowAgentNode(node) {
   }
 }
 
-// ../core/src/workflows/workflow-merge-region.ts
-var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-  "merge-gate",
-  "merge-attempt",
-  "manual-merge-hold",
-  "retry-backoff",
-  "recovery-router",
-  "branch-group-member-integration",
-  "branch-group-promotion",
-  "pr-create",
-  "pr-respond",
-  "pr-merge"
-]);
-
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -11582,6 +11583,16 @@ function validateReviewerAgentOverrides(nodes2) {
     if (Array.isArray(templateNodes)) validateReviewerAgentOverrides(templateNodes);
   }
 }
+function validateReadonlyMcpServersConfig(nodes2) {
+  for (const node of nodes2) {
+    const value = node.config?.readonlyMcpServers;
+    if (value !== void 0 && (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw new WorkflowIrError(`Workflow node '${node.id}' readonlyMcpServers must be an array of non-empty strings when present`);
+    }
+    const templateNodes = node.config?.template?.nodes;
+    if (Array.isArray(templateNodes)) validateReadonlyMcpServersConfig(templateNodes);
+  }
+}
 function validateThinkingLevelConfig(nodes2) {
   for (const node of nodes2) {
     const value = node.config?.thinkingLevel;
@@ -12196,6 +12207,7 @@ function validateV2(ir) {
   const topLevelIds = new Set(ir.nodes.map((n) => n.id));
   validateStepExecutePlacement(ir.nodes);
   validateThinkingLevelConfig(ir.nodes);
+  validateReadonlyMcpServersConfig(ir.nodes);
   validateCredentialInstanceIdConfig(ir.nodes);
   validateReviewerAgentOverrides(ir.nodes);
   for (const node of ir.nodes) {
@@ -14395,6 +14407,7 @@ Be specific: cite \`file:line\` for every finding and explain the concrete failu
 - APPROVE_WITH_NOTES: shippable. Use this when your findings are all P1/P2 \u2014 they are recorded and handed to the implementer without another remediation round.
 - REVISE: a correctness bug, regression, or contract break requires changes before merge. Requires at least one \`critical\` finding in \`findings\`; a REVISE without one will be treated as APPROVE_WITH_NOTES.
 - Every blocking issue MUST appear as an entry in \`findings\` with its severity and \`filePath\`/\`line\`. Prose in \`notes\` alone does not block.
+- Every REVISE finding is a required Fix-step record. Its \`id\`, \`title\`, \`body\`, \`filePath\`, \`line\`, and \`severity\` must be concrete enough for an executor to implement without asking what to fix. If you cannot name an affected file and correction, do not return REVISE: investigate until you can, or return the appropriate non-blocking verdict.
 - \`notes\` MUST contain one to three sentences naming what was checked and why the verdict was reached. An empty \`notes\` string is a protocol violation.
 - Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):
 {"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"...","findings":[{"id":"stable-id","title":"concise issue","body":"concrete failure and remediation","filePath":"path/to/file.ts","line":1,"severity":"critical|high|medium|low","resolution":"open|resolved-in-review|superseded"}]}`;

package/dist/plugins/fusion-plugin-cursor-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/cursor-runtime",
-  "version": "0.1.55-beta.11",
+  "version": "0.1.55-beta.13",
   "type": "module",
   "exports": {
     ".": {