@seanyao/roll 4.720.1 → 4.721.2

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## v4.721.2 — 2026-07-21
+
+### 稳定性
+- loop 的构建子进程失联或被系统杀掉后，现在会在限定时间内察觉、收尾并写入终态（标记为 aborted），不再让整个受监督周期永久挂住；新增子进程存活/超时检测（FIX-1474）[loop]
+
+## v4.721.1 — 2026-07-21
+
+### 稳定性
+- loop 看门狗的"进展"判定从 stdout 改为 git 状态（新 commit / 工作区文件变动）：输出缓冲型 agent 写文件时不再被 15 分钟无进展误杀；新增 `no-state-change` 杀因——默认 25 分钟无 commit 且无文件变动即终止（即使 stdout 仍在输出），原地打转的 cycle 不再烧满 45 分钟墙钟；阈值可用 `ROLL_CYCLE_NO_STATE_CHANGE_SEC` 覆盖（FIX-1477）[loop]
+- attest 闸的"无 AC 块豁免"提前到渲染之前评估：无 AC 块的卡不再因渲染失败或空壳报告被硬拦，直接合法放行（FIX-1476）[loop]
+
 ## v4.720.1 — 2026-07-20
 
 ### 稳定性

package/dist/roll.mjs

@@ -14639,18 +14639,36 @@ function timeoutTeardownCommands(ctx) {
     { kind: "release_lock" }
   ];
 }
+function abortedTeardownCommands(ctx) {
+  return [
+    { kind: "kill_agent", graceSec: WATCHDOG_KILL_GRACE_SEC },
+    { kind: "measure_worktree" },
+    { kind: "emit_event", event: cycleEndEvent(ctx, "aborted") },
+    { kind: "append_run", status: "aborted", outcome: mapV2Status("aborted"), cycleId: ctx.cycleId },
+    {
+      kind: "append_alert",
+      message: `cycle ${ctx.cycleId}: builder child process lost (killed out-of-band) \u2014 cycle aborted; worktree preserved`
+    },
+    { kind: "release_lock" }
+  ];
+}
 function cycleTimeoutVerdict(input) {
   const wall = input.wallLimitSec ?? CYCLE_WALL_TIMEOUT_SEC;
   const idle = input.noProgressLimitSec ?? CYCLE_NO_PROGRESS_SEC;
+  const stateIdle = input.noStateChangeLimitSec ?? CYCLE_NO_STATE_CHANGE_SEC;
   if (wall > 0 && input.elapsedSec >= wall) {
     return { timedOut: true, reason: "wall", elapsedSec: input.elapsedSec, idleSec: input.idleSec };
   }
   if (idle > 0 && input.idleSec >= idle) {
     return { timedOut: true, reason: "no-progress", elapsedSec: input.elapsedSec, idleSec: input.idleSec };
   }
+  if (input.stateIdleSec !== void 0 && stateIdle > 0 && input.stateIdleSec >= stateIdle) {
+    return { timedOut: true, reason: "no-state-change", elapsedSec: input.elapsedSec, idleSec: input.idleSec };
+  }
   const wallRemain = wall > 0 ? wall - input.elapsedSec : Number.POSITIVE_INFINITY;
   const idleRemain = idle > 0 ? idle - input.idleSec : Number.POSITIVE_INFINITY;
-  return { timedOut: false, remainingSec: Math.min(wallRemain, idleRemain) };
+  const stateRemain = input.stateIdleSec !== void 0 && stateIdle > 0 ? stateIdle - input.stateIdleSec : Number.POSITIVE_INFINITY;
+  return { timedOut: false, remainingSec: Math.min(wallRemain, idleRemain, stateRemain) };
 }
 function stallVerdict(input) {
   const threshold = input.stallThresholdSec ?? CYCLE_STALL_THRESHOLD_SEC;
@@ -14828,6 +14846,12 @@ function cycleStep(state, event) {
         { kind: "cleanup_worktree", branch: state.ctx.branch }
       ]);
     case "agent_exited": {
+      if (event.lost === true) {
+        return {
+          state: { ...state, phase: "execute", terminal: "aborted", done: true, ctx: { ...state.ctx, agentExitCode: event.exit, agentTimedOut: event.timedOut } },
+          commands: abortedTeardownCommands(terminalCtx(state))
+        };
+      }
       const plan = retryPlan({ attempt: state.attempt, exit: event.exit, timedOut: event.timedOut });
       if (plan.action === "abort_timeout") {
         return {
@@ -15141,7 +15165,7 @@ function adversarialDegradedCmd(cycleId, storyId, cause, from = "adversarial") {
 function initialCycleState(ctx) {
   return { phase: "pick", ctx, attempt: 0, done: false };
 }
-var CYCLE_TIMEOUT_SEC, WATCHDOG_KILL_GRACE_SEC, CYCLE_WALL_TIMEOUT_SEC, CYCLE_NO_PROGRESS_SEC, CYCLE_STALL_THRESHOLD_SEC, STALL_STARTUP_GRACE_SEC, MAX_AGENT_ATTEMPTS, RETRY_BASE_BACKOFF_SEC, EVENT_VALID_PHASES;
+var CYCLE_TIMEOUT_SEC, WATCHDOG_KILL_GRACE_SEC, CYCLE_WALL_TIMEOUT_SEC, CYCLE_NO_PROGRESS_SEC, CYCLE_NO_STATE_CHANGE_SEC, CYCLE_STALL_THRESHOLD_SEC, STALL_STARTUP_GRACE_SEC, MAX_AGENT_ATTEMPTS, RETRY_BASE_BACKOFF_SEC, EVENT_VALID_PHASES;
 var init_orchestrator = __esm({
   "packages/core/dist/loop/orchestrator.js"() {
     "use strict";
@@ -15153,6 +15177,7 @@ var init_orchestrator = __esm({
     WATCHDOG_KILL_GRACE_SEC = 5;
     CYCLE_WALL_TIMEOUT_SEC = 2700;
     CYCLE_NO_PROGRESS_SEC = 900;
+    CYCLE_NO_STATE_CHANGE_SEC = 1500;
     CYCLE_STALL_THRESHOLD_SEC = 600;
     STALL_STARTUP_GRACE_SEC = 120;
     MAX_AGENT_ATTEMPTS = 3;
@@ -246181,6 +246206,10 @@ function spawnAndWait(bin, args, opts, pty = false, profile) {
       stderr += d.toString("utf8");
     });
     liveAgents.add(child);
+    try {
+      opts.onSpawn?.(child);
+    } catch {
+    }
     let settled = false;
     let exitDrainFallback;
     const settle = (result2) => {
@@ -251254,6 +251283,11 @@ function runAttestGate(worktreeCwd, storyId, cycleId, mode, sinceSec, sinks, sco
       sinks.event({ cycleId, verdict: "skipped", reasons: reasons2 });
       return { verdict: "skipped", mode, reasons: reasons2, blocked: blocked4 };
     }
+    if (storyHasAcBlock(specRepoCwd, storyId) === false) {
+      const reasons2 = ["story has no AC block; acceptance report not required"];
+      sinks.event({ cycleId, verdict: "produced", reasons: reasons2 });
+      return { verdict: "produced", mode, reasons: reasons2, blocked: false };
+    }
     if (renderExitCode !== 0) {
       const reasons2 = [`attest render failed for ${storyId} (exit ${renderExitCode})`];
       const blocked4 = mode === "hard";
@@ -251261,11 +251295,6 @@ function runAttestGate(worktreeCwd, storyId, cycleId, mode, sinceSec, sinks, sco
       sinks.event({ cycleId, verdict: "skipped", reasons: reasons2 });
       return { verdict: "skipped", mode, reasons: reasons2, blocked: blocked4 };
     }
-    if (storyHasAcBlock(specRepoCwd, storyId) === false) {
-      const reasons2 = ["story has no AC block; acceptance report not required"];
-      sinks.event({ cycleId, verdict: "produced", reasons: reasons2 });
-      return { verdict: "produced", mode, reasons: reasons2, blocked: false };
-    }
     const diagnostics = violatesMustDeclareSurface(specRepoCwd, storyId) ? [MUST_DECLARE_FAIL_REASON] : [];
     const redAcs = redAcFailures(worktreeCwd, storyId, scoreRepoCwd);
     if (redAcs.length > 0) {
@@ -284515,7 +284544,8 @@ function readCycleTimeoutThresholds(repoCwd) {
   }
   return {
     wallSec: envNum("ROLL_CYCLE_WALL_TIMEOUT_SEC") ?? wallSec,
-    noProgressSec: envNum("ROLL_CYCLE_NO_PROGRESS_SEC") ?? noProgressSec
+    noProgressSec: envNum("ROLL_CYCLE_NO_PROGRESS_SEC") ?? noProgressSec,
+    noStateChangeSec: envNum("ROLL_CYCLE_NO_STATE_CHANGE_SEC") ?? CYCLE_NO_STATE_CHANGE_SEC
   };
 }
 function readStallThreshold(repoCwd) {
@@ -284531,15 +284561,18 @@ function readStallThreshold(repoCwd) {
 }
 function startSpawnTimeoutWatchdog(opts) {
   const { cycleId, thresholds, clock: clock2, commitCount, appendEvent: appendEvent3 } = opts;
+  const stateSignature = opts.stateSignature;
   const kill = opts.kill ?? (() => killLiveAgents("SIGKILL"));
   const pollMs = opts.pollMs ?? (Number((process.env["ROLL_TIMEOUT_POLL_MS"] ?? "").trim()) || TIMEOUT_POLL_MS);
-  if (thresholds.wallSec <= 0 && thresholds.noProgressSec <= 0) {
+  if (thresholds.wallSec <= 0 && thresholds.noProgressSec <= 0 && thresholds.noStateChangeSec <= 0) {
     return { markProgress: () => {
     }, stop: () => ({ firedReason: null }) };
   }
   const startSec = clock2();
   let lastProgressSec = startSec;
+  let lastStateSec = startSec;
   let lastCommitCount = -1;
+  let lastSignature;
   let firedReason = null;
   let running = false;
   const markProgress = () => {
@@ -284554,16 +284587,32 @@ function startSpawnTimeoutWatchdog(opts) {
         const n = await commitCount();
         if (n > lastCommitCount) {
           lastCommitCount = n;
-          lastProgressSec = clock2();
+          const now3 = clock2();
+          lastProgressSec = now3;
+          lastStateSec = now3;
         }
       } catch {
       }
+      if (stateSignature !== void 0) {
+        try {
+          const sig = await stateSignature();
+          if (lastSignature !== void 0 && sig !== lastSignature) {
+            const now3 = clock2();
+            lastProgressSec = now3;
+            lastStateSec = now3;
+          }
+          lastSignature = sig;
+        } catch {
+        }
+      }
       const now2 = clock2();
       const verdict = cycleTimeoutVerdict({
         elapsedSec: now2 - startSec,
         idleSec: now2 - lastProgressSec,
+        stateIdleSec: now2 - lastStateSec,
         wallLimitSec: thresholds.wallSec,
-        noProgressLimitSec: thresholds.noProgressSec
+        noProgressLimitSec: thresholds.noProgressSec,
+        noStateChangeLimitSec: thresholds.noStateChangeSec
       });
       if (verdict.timedOut) {
         firedReason = verdict.reason;
@@ -284593,6 +284642,12 @@ function startSpawnTimeoutWatchdog(opts) {
       lastCommitCount = await commitCount();
     } catch {
     }
+    if (stateSignature !== void 0) {
+      try {
+        lastSignature = await stateSignature();
+      } catch {
+      }
+    }
   })();
   const timer = setInterval(() => void tick(), pollMs);
   timer.unref?.();
@@ -284662,6 +284717,68 @@ function startStallDetector(opts) {
     }
   };
 }
+var LIVENESS_POLL_MS = 5e3;
+var LIVENESS_CONFIRM_TICKS = 2;
+function defaultIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+function startBuilderLivenessProbe(opts) {
+  const { cycleId, agent, appendEvent: appendEvent3 } = opts;
+  const isAlive = opts.isAlive ?? defaultIsAlive;
+  const kill = opts.kill ?? (() => killLiveAgents("SIGKILL"));
+  const pollMs = opts.pollMs ?? (Number((process.env["ROLL_LIVENESS_POLL_MS"] ?? "").trim()) || LIVENESS_POLL_MS);
+  const confirmTicks = opts.confirmTicks ?? LIVENESS_CONFIRM_TICKS;
+  let lost = false;
+  let deadStreak = 0;
+  const tick = () => {
+    if (lost || !opts.spawnPending())
+      return;
+    const pid = opts.pid();
+    if (pid === void 0) {
+      deadStreak = 0;
+      return;
+    }
+    let alive = true;
+    try {
+      alive = isAlive(pid);
+    } catch {
+    }
+    if (alive) {
+      deadStreak = 0;
+      return;
+    }
+    deadStreak += 1;
+    if (deadStreak < confirmTicks)
+      return;
+    lost = true;
+    clearInterval(timer);
+    try {
+      appendEvent3({ type: "cycle:agent_lost", cycleId, agent, pid, ts: Date.now() });
+    } catch {
+    }
+    try {
+      kill();
+    } catch {
+    }
+    try {
+      opts.onLost?.({ pid });
+    } catch {
+    }
+  };
+  const timer = setInterval(tick, pollMs);
+  timer.unref?.();
+  return {
+    stop: () => {
+      clearInterval(timer);
+      return { lost };
+    }
+  };
+}
 function createCaptureMarkerSink(runDir, capture) {
   let buf = "";
   const pending = [];
@@ -284760,11 +284877,13 @@ async function executeSpawnAgentCommand(cmd, ports, ctx) {
         appendEvent: (ev) => ports.events.appendEvent(ports.paths.eventsPath, ev),
         thresholdSec: readStallThreshold(ports.repoCwd).thresholdSec
       });
+      const statusSignature = ports.git.worktreeStatusSignature;
       const timeoutWatchdog = startSpawnTimeoutWatchdog({
         cycleId: ctx.cycleId ?? "",
         thresholds: readCycleTimeoutThresholds(ports.repoCwd),
         clock: ports.clock,
         commitCount: () => ports.git.commitsAhead(execCwd, observeBase),
+        ...statusSignature !== void 0 ? { stateSignature: () => statusSignature(execCwd) } : {},
         appendEvent: (ev) => ports.events.appendEvent(ports.paths.eventsPath, ev)
       });
       const skillBodyForSpawn = maybeInjectProjectMap(
@@ -284783,6 +284902,24 @@ ${skillBodyForSpawn}` : skillBodyForSpawn;
       let timeoutFired = null;
       let activeMainLeak = { detected: false, files: [] };
       let mainLeakWatchdog;
+      let spawnedPid;
+      let spawnSettled = false;
+      let agentLost = false;
+      let resolveLostRace;
+      const lostRace = new Promise((resolve17) => {
+        resolveLostRace = () => resolve17({ stdout: "", stderr: "", exitCode: 137, timedOut: false });
+      });
+      const livenessProbe = startBuilderLivenessProbe({
+        cycleId: ctx.cycleId ?? "",
+        agent: cmd.agent,
+        pid: () => spawnedPid,
+        spawnPending: () => !spawnSettled,
+        appendEvent: (ev) => ports.events.appendEvent(ports.paths.eventsPath, ev),
+        onLost: () => {
+          agentLost = true;
+          resolveLostRace?.();
+        }
+      });
       try {
         appendWriteProtectionEvent(ports, applyMainCheckoutWriteProtection({
           repoCwd: ports.repoCwd,
@@ -284791,37 +284928,47 @@ ${skillBodyForSpawn}` : skillBodyForSpawn;
           nowMs: () => eventTs2(ports)
         }));
         mainLeakWatchdog = startMainCheckoutLeakWatchdog(ports, ctx);
-        res = await ports.agentSpawn(cmd.agent, {
-          purpose: "builder",
-          // E4: the builder runs in the submodule cycle worktree for a submodule
-          // story (execCwd); its git env + writable roots target the submodule's
-          // own repo/object store so its commits actually land there.
-          cwd: execCwd,
-          skillBody: finalSkillBody,
-          ...ctx.evidenceRunDir !== void 0 ? { runDir: ctx.evidenceRunDir } : {},
-          writableRoots: submoduleAgentWritableRoots(ports.repoCwd, execRepoCwd, ports.paths.alertsPath),
-          ...ctx.model !== void 0 && ctx.model !== "" ? { model: ctx.model } : {},
-          env: {
-            ...process.env,
-            ROLL_LOOP_ALERT: ports.paths.alertsPath,
-            ...worktreeGitEnv(execCwd, ports.repoCwd),
-            ...agentSpawnEnvironment(cmd.agent)
-          },
-          // FIX-204B: pin the executor-picked story into the agent prompt — the
-          // claim (pick_story → 🔨) and the work must be the same story.
-          ...ctx.storyId !== void 0 && ctx.storyId !== "" ? { storyId: ctx.storyId } : {},
-          onChunk: (d) => {
-            timeoutWatchdog.markProgress();
-            stallDetector.markProgress();
-            captureSink?.onChunk(d);
-            try {
-              appendFileSync16(livePath, d);
-            } catch {
+        res = await Promise.race([
+          ports.agentSpawn(cmd.agent, {
+            purpose: "builder",
+            // E4: the builder runs in the submodule cycle worktree for a submodule
+            // story (execCwd); its git env + writable roots target the submodule's
+            // own repo/object store so its commits actually land there.
+            cwd: execCwd,
+            skillBody: finalSkillBody,
+            ...ctx.evidenceRunDir !== void 0 ? { runDir: ctx.evidenceRunDir } : {},
+            writableRoots: submoduleAgentWritableRoots(ports.repoCwd, execRepoCwd, ports.paths.alertsPath),
+            ...ctx.model !== void 0 && ctx.model !== "" ? { model: ctx.model } : {},
+            env: {
+              ...process.env,
+              ROLL_LOOP_ALERT: ports.paths.alertsPath,
+              ...worktreeGitEnv(execCwd, ports.repoCwd),
+              ...agentSpawnEnvironment(cmd.agent)
+            },
+            // FIX-204B: pin the executor-picked story into the agent prompt — the
+            // claim (pick_story → 🔨) and the work must be the same story.
+            ...ctx.storyId !== void 0 && ctx.storyId !== "" ? { storyId: ctx.storyId } : {},
+            onChunk: (d) => {
+              timeoutWatchdog.markProgress();
+              stallDetector.markProgress();
+              captureSink?.onChunk(d);
+              try {
+                appendFileSync16(livePath, d);
+              } catch {
+              }
+              signalRecorder.accept(d);
+            },
+            // FIX-1474: hand the live child to the liveness probe so an
+            // out-of-band death is detected within a bounded window.
+            onSpawn: (child) => {
+              spawnedPid = child.pid;
             }
-            signalRecorder.accept(d);
-          }
-        });
+          }),
+          lostRace
+        ]);
       } finally {
+        spawnSettled = true;
+        livenessProbe.stop();
         if (mainLeakWatchdog !== void 0) {
           activeMainLeak = await mainLeakWatchdog.stop();
         }
@@ -284929,7 +285076,7 @@ ${res.stderr}`.split("\n").find((l) => l.trim() !== "") ?? "").slice(0, 200);
           // FIX-343 (step ①): the builder session id is part of the auditable
           // header — the attest gate's scorer≠builder-session invariant is then
           // traceable to a recorded build-session id, not asserted.
-          `# exit=${res.exitCode} timedOut=${res.timedOut} build-session=${builderSessionId}
+          `# exit=${res.exitCode} timedOut=${res.timedOut} lost=${agentLost} build-session=${builderSessionId}
 --- stdout ---
 ${res.stdout}
 --- stderr ---
@@ -284977,7 +285124,10 @@ ${res.stderr}
         cycleStartSec: ctx.startSec
       }) ?? void 0 : void 0;
       return {
-        event: { type: "agent_exited", exit: res.exitCode, timedOut: res.timedOut },
+        // FIX-1474: a lost child converges the cycle to the explicit `aborted`
+        // terminal in the orchestrator (no retry, no blocked) — the death was
+        // environmental, recorded fail-loud via cycle:agent_lost.
+        event: { type: "agent_exited", exit: res.exitCode, timedOut: res.timedOut, ...agentLost ? { lost: true } : {} },
         // FIX-343 (step ①): persist the builder session id on the cycle context so
         // it survives to the attest gate (the scorer≠builder-session invariant is then
         // traceable to a recorded build-session id, not asserted).
@@ -287752,6 +287902,13 @@ function nodePorts(opts) {
         const n = Number((r.stdout ?? "0").trim());
         return Number.isFinite(n) ? n : 0;
       },
+      async worktreeStatusSignature(worktreeCwd) {
+        const r = await execFileAsync17("git", ["status", "--porcelain"], {
+          cwd: worktreeCwd,
+          encoding: "utf8"
+        });
+        return r.stdout ?? "";
+      },
       async mainAhead(repoCwd) {
         const r = await execFileAsync17("git", ["rev-list", "--count", "origin/main..main"], {
           cwd: repoCwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seanyao/roll",
-  "version": "4.720.1",
+  "version": "4.721.2",
   "description": "Roll — Roll out features with AI agents",
   "packageManager": "pnpm@11.1.3",
   "scripts": {