@saadnvd1/agent-os 0.3.466 → 0.3.467

package/README.md

@@ -908,10 +908,13 @@ it may do on its own, and the lines that always come back to you as asks.
   `BLOCKED:` or waiting, the diff stays in scope (no secrets, not only
   lockfiles, nothing outside the repo, within the card) and its stack parent
   has merged, and the PR body's Code review section names that commit. `land` judges each item again at its own head right before
-  merging it. The second failure of a gate or a repo with no CI goes to you
-  as an ask, and the orchestrator stops merging that task. Failures count per
-  task and gate: a review that blocks counts when its verdict arrives, once
-  per commit, whether or not `sign_off` ever reads it.
+  merging it. A gate failing again on a different commit, or a repo with no
+  CI, goes to you as an ask, and the orchestrator stops merging that task.
+  A failure counts once per task, gate and head commit, however many times
+  and from wherever that commit is judged (the armed watcher, CI finishing,
+  `sign_off`, `done`, `land`); a pass in between doesn't reset it. A review
+  that blocks counts when its verdict arrives, whether or not `sign_off`
+  ever reads it.
 - **Arm to merge:** `arm` (or **Arm merge** on a task's row) makes AgentOS
   merge the task's PR itself the moment every `sign_off` gate passes at its
   head, starting the review once CI is green, so nothing polls `sign_off`.

package/lib/db/migrations.ts

@@ -1327,6 +1327,37 @@ const migrations: Migration[] = [
       installChangeTriggers(db, TABLES_WATCHED_58);
     },
   },
+  {
+    id: 59,
+    name: "gate_failure_commits",
+    up: (db) => {
+      // Each head a gate failed on, once: a gate's failure counts once per
+      // commit however many times that commit is judged (the armed watcher,
+      // CI finishing, sign_off, done, land), and the second commit it fails
+      // on goes to Saad. The key is what makes it once, across restarts and
+      // concurrent evaluations.
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS orchestrator_gate_failure_commits (
+          session_id TEXT NOT NULL,
+          gate TEXT NOT NULL,
+          sha TEXT NOT NULL,
+          workspace_id TEXT NOT NULL,
+          reason TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          PRIMARY KEY (session_id, gate, sha)
+        );
+        INSERT OR IGNORE INTO orchestrator_gate_failure_commits (session_id, gate, sha, workspace_id, reason)
+          SELECT session_id, gate, last_sha, workspace_id, last_reason
+          FROM orchestrator_gate_failures WHERE last_sha IS NOT NULL;
+        CREATE TRIGGER IF NOT EXISTS gate_failures_clear_commits
+          AFTER DELETE ON orchestrator_gate_failures
+        BEGIN
+          DELETE FROM orchestrator_gate_failure_commits
+            WHERE session_id = OLD.session_id AND gate = OLD.gate;
+        END;
+      `);
+    },
+  },
 ];
 
 // `upTo`: stop after this id (tests that start from an older database).

package/lib/orchestrator/armed.ts

@@ -229,8 +229,8 @@ async function mergeOne(
   }
   const seen = `${pr.head}:${failures(verdict.text)}`;
   if (task.merge_armed_seen === seen) return;
-  // Counted once, as sign_off would count it: a second failure of a gate
-  // goes to Saad.
+  // Counted as sign_off would count it: once per head (the database keys
+  // it), and a gate failing on a second commit goes to Saad.
   if (!stillArmed(workspaceId, task.id)) return;
   const counted = await deps.judge(workspaceId, task);
   if (counted.ok) return merge(workspaceId, task, counted, deps);

package/lib/orchestrator/brief.ts

@@ -54,7 +54,7 @@ When the base moves and a task's PR conflicts with it, AgentOS rebases it onto t
 
 Tasks are woken by AgentOS itself when a check fails on their PR's head (with the failing step and the log around the error) and when a collaborator reviews or comments on their PR, and you get one "task X woken: ..." line for each. Don't message a task about the same failure or review; act only if it doesn't fix it.
 
-"Not yet" (CI running or settling, no review of this commit yet) is not a failure: wait for the event and try again. A failure counts against the task: a review that blocks counts when its verdict arrives, once per commit, and the second failure of the same gate goes to Saad, with a note in your chat, and from then on only he merges or drops that task. Don't retry it; say so in your chat and move on. ${mergeApprovalsOn() ? APPROVALS_ON : APPROVALS_OFF} \`land\` merges a whole stack only if every open item passes the same gates, and judges each one again at its own head right before merging it.
+"Not yet" (CI running or settling, no review of this commit yet) is not a failure: wait for the event and try again. A failure counts against the task once per commit, whichever path judges that commit and however often (a review that blocks counts when its verdict arrives); the same gate failing again on a different commit goes to Saad, with a note in your chat, and from then on only he merges or drops that task. Don't retry it; say so in your chat and move on. ${mergeApprovalsOn() ? APPROVALS_ON : APPROVALS_OFF} \`land\` merges a whole stack only if every open item passes the same gates, and judges each one again at its own head right before merging it.
 
 ## Brakes
 

package/lib/orchestrator/escalate.ts

@@ -6,7 +6,6 @@ import { AskRefused, raiseAsk, workSubject } from "./asks";
 import {
   failureOf,
   markEscalated,
-  PER_COMMIT_GATES,
   recordFailure,
   type GateOutcome,
 } from "./gates";
@@ -20,7 +19,8 @@ export function escalate(
   url: string,
   sha: string | null = null
 ): string {
-  if (!failureOf(task.id, gate)) recordFailure(workspaceId, task.id, gate, why);
+  if (!failureOf(task.id, gate))
+    recordFailure(workspaceId, task.id, gate, why, sha);
   markEscalated(task.id, gate);
   let created = false;
   try {
@@ -50,8 +50,9 @@ export function escalate(
   return `Escalated to Saad: ${why}. It's on his asks list; his answer reaches you as an event. Don't retry; say so in your chat.`;
 }
 
-// Counts a gate's failure against the task; the second failure of the same
-// gate goes to Saad. A review or scope verdict counts once per commit.
+// Counts a gate's failure on this head against the task; the same gate
+// failing on a second, different head goes to Saad. The same head judged
+// again, from any path, isn't another failure.
 export function countFailure(
   workspaceId: string,
   task: { id: string; name: string },
@@ -59,12 +60,11 @@ export function countFailure(
   url: string,
   sha: string
 ): { line: string; escalated: boolean } {
-  const key = PER_COMMIT_GATES.includes(o.gate) ? sha : null;
-  const n = recordFailure(workspaceId, task.id, o.gate, o.reason ?? "", key);
+  const n = recordFailure(workspaceId, task.id, o.gate, o.reason ?? "", sha);
   const line = `- ${o.gate} failed (${n === 1 ? "first" : "again"}): ${o.reason}`;
   if (n < 2 || failureOf(task.id, o.gate)?.escalated_at)
     return { line, escalated: false };
-  const why = `the ${o.gate} gate failed twice: ${o.reason}`;
+  const why = `the ${o.gate} gate failed on two different commits: ${o.reason}`;
   return {
     line: `${line}\n  ${escalate(workspaceId, task, o.gate, why, url, sha)}`,
     escalated: true,

package/lib/orchestrator/gates.ts

@@ -2,10 +2,12 @@
  * The merge gates, ported from dispatch orchestrate. Each one passes, waits
  * (not ready yet: CI running or settling, no review of this commit yet),
  * fails, or goes straight to Saad (no CI at all). Only a failure counts
- * against the task, and the second failure of the same gate goes to Saad
- * instead of being retried. The count is per task and gate: a review that
- * blocks counts when its verdict arrives, whether or not sign_off ever
- * reads it, and reading the same commit's verdict again isn't another.
+ * against the task, and a gate failing again on a different commit goes to
+ * Saad instead of being retried. A failure counts once per task, gate and
+ * head commit, whichever path judged it (the armed watcher, CI finishing,
+ * sign_off, done, land, a review's verdict arriving): judging the same head
+ * again is never another failure. A pass doesn't reset the count, so a gate
+ * that fails on A, passes on B and fails on C has failed twice.
  */
 
 import { db } from "../db";
@@ -170,12 +172,10 @@ export interface FailureRow {
   last_sha: string | null;
 }
 
-// The gates whose failure is a verdict stored against one commit: the same
-// verdict read again is the same failure.
-export const PER_COMMIT_GATES: readonly string[] = ["review", "scope"];
-
-// Counts one failure; returns the count now. With `sha`, a failure of the
-// commit last counted for this gate isn't counted again.
+// Counts one failure; returns the count now. With `sha`, a failure is
+// counted once per commit: the (task, gate, sha) key in
+// orchestrator_gate_failure_commits decides, so neither a restart nor two
+// evaluations at once count the same head twice.
 export function recordFailure(
   workspaceId: string,
   sessionId: string,
@@ -183,14 +183,34 @@ export function recordFailure(
   reason: string,
   sha: string | null = null
 ): number {
+  return db
+    .transaction(countOnce)
+    .immediate(workspaceId, sessionId, gate, reason, sha);
+}
+
+function countOnce(
+  workspaceId: string,
+  sessionId: string,
+  gate: string,
+  reason: string,
+  sha: string | null
+): number {
+  const fresh =
+    sha === null ||
+    db
+      .prepare(
+        `INSERT OR IGNORE INTO orchestrator_gate_failure_commits (session_id, gate, sha, workspace_id, reason)
+           VALUES (?, ?, ?, ?, ?)`
+      )
+      .run(sessionId, gate, sha, workspaceId, reason).changes > 0;
   db.prepare(
     `INSERT INTO orchestrator_gate_failures (session_id, gate, workspace_id, count, last_reason, last_sha)
-     VALUES (?, ?, ?, 1, ?, ?)
-     ON CONFLICT(session_id, gate) DO UPDATE SET
-       count = count + CASE WHEN excluded.last_sha IS NOT NULL AND last_sha IS excluded.last_sha THEN 0 ELSE 1 END,
-       last_reason = excluded.last_reason,
-       last_sha = excluded.last_sha`
-  ).run(sessionId, gate, workspaceId, reason, sha);
+       VALUES (?, ?, ?, 1, ?, ?)
+       ON CONFLICT(session_id, gate) DO UPDATE SET
+         count = count + ?,
+         last_reason = excluded.last_reason,
+         last_sha = excluded.last_sha`
+  ).run(sessionId, gate, workspaceId, reason, sha, fresh ? 1 : 0);
   return failureOf(sessionId, gate)!.count;
 }
 

package/lib/orchestrator/signoff.ts

@@ -3,7 +3,7 @@
  * commit that was judged. With merge approvals on (merge-approvals.ts),
  * anything touching CI config, build and hook scripts, agent config, deploys
  * or secrets handling goes to Saad whatever the gates say. A repository with
- * no CI and a gate failing twice on a task go to him either way. Once a task
+ * no CI and a gate failing on two different commits go to him either way. Once a task
  * is with Saad the orchestrator doesn't merge it; he signs it off or drops it.
  */
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.466",
+  "version": "0.3.467",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"