@shenlee/devcrew 0.1.1 → 0.1.3

package/packages/orchestrator/src/index.ts

@@ -1,11 +1,12 @@
 import { spawn } from "node:child_process";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, resolve as resolvePath } from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
 
 import { runRole } from "../../adapters/src/index.js";
 import type { RoleRunInput } from "../../adapters/src/index.js";
 import {
   answerWorkflow,
+  approveWorkflow,
   artifactForPhase,
   artifactPath,
   ARTIFACTS,
@@ -14,13 +15,18 @@ import {
   discoverVerifyCommands,
   gateForPhase,
   getWorkflowStatus,
+  nextPhaseAfterGate,
   readConfig,
   rejectWorkflow,
   renderArtifact,
   saveState,
   startWorkflow,
+  validateWorkflowApproval,
+  waiveVerificationWorkflow,
   type AnswerWorkflowInput,
+  type ApproveWorkflowInput,
   type ArtifactName,
+  type CompleteExecutionInput,
   type Phase,
   type RejectWorkflowInput,
   type RoleResult,
@@ -28,7 +34,16 @@ import {
   type RunState,
   type StartWorkflowInput,
   type VerificationResult,
+  type VerificationStatus,
+  type WaiveVerificationInput,
 } from "../../core/src/index.js";
+import {
+  captureExecutionChanges,
+  cleanupExecutionWorkspace,
+  ensureExecutionWorkspace,
+  promoteExecutionChanges,
+  rollbackPromotedExecutionChanges,
+} from "./worktree.js";
 
 // Hard cap so a hung apply/verify command cannot block the serialized MCP loop.
 const COMMAND_TIMEOUT_MS = 300_000;
@@ -40,6 +55,8 @@ function roleForPhase(phase: Phase): RoleResult["role"] | undefined {
     requirements: "pm",
     architecture: "architect",
     implementation: "implementer",
+    execution: "implementer",
+    review: "architect",
     testing: "tester",
   };
   return roles[phase];
@@ -66,7 +83,7 @@ function priorArtifactNamesForPhase(phase: Phase): ArtifactName[] {
 }
 
 async function writeMarkdownArtifact(state: RunState, artifact: ArtifactName, markdown: string): Promise<string> {
-  const path = artifactPath(state.cwd, state.runId, artifact);
+  const path = artifactPath(state.cwd, state.runId, artifact, state.artifactDirectory);
   await mkdir(dirname(path), { recursive: true });
   await writeFile(path, markdown, "utf8");
   return path;
@@ -159,116 +176,6 @@ export async function runShellCommand(
   });
 }
 
-async function runGit(args: string[], cwd: string): Promise<{ exitCode: number; stdout: string }> {
-  return new Promise((resolveResult) => {
-    const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (chunk: Buffer) => {
-      stdout += chunk.toString("utf8");
-    });
-    child.stderr.on("data", (chunk: Buffer) => {
-      stderr += chunk.toString("utf8");
-    });
-    child.on("error", () => resolveResult({ exitCode: 1, stdout: "" }));
-    child.on("close", (code) => resolveResult({ exitCode: code ?? 1, stdout: stdout || stderr }));
-  });
-}
-
-async function listChangedLines(cwd: string, options: { requireGit?: boolean } = {}): Promise<string[]> {
-  const result = await runShellCommand("git status --porcelain -uall", cwd, 30_000);
-  if (result.exitCode !== 0) {
-    if (options.requireGit) {
-      throw new Error("DevCrew apply mode requires a git repository so implementation changes can be reviewed and reverted.");
-    }
-    return [];
-  }
-  return result.output
-    .split("\n")
-    .map((line) => line.trimEnd())
-    .filter(Boolean)
-    .filter((line) => {
-      const path = line.slice(3);
-      return !path.startsWith(".devcrew/") && !path.startsWith("docs/devcrew/");
-    });
-}
-
-async function assertCleanApplyWorkspace(cwd: string): Promise<void> {
-  const changedLines = await listChangedLines(cwd, { requireGit: true });
-  if (changedLines.length === 0) {
-    return;
-  }
-  const visibleLines = changedLines.slice(0, 20).join(", ");
-  const suffix = changedLines.length > 20 ? `, and ${changedLines.length - 20} more` : "";
-  throw new Error(
-    `DevCrew apply mode requires a clean working tree before implementation. Commit, stash, or remove these files: ${visibleLines}${suffix}`,
-  );
-}
-
-async function collectImplementationDiff(cwd: string): Promise<string> {
-  const result = await runShellCommand("git diff --no-ext-diff --", cwd, 30_000);
-  if (result.exitCode !== 0) {
-    return "";
-  }
-  return result.output;
-}
-
-// Files attributable to this run are the porcelain lines that appeared (or
-// changed status) since the baseline captured before the role executed. This
-// keeps a user's pre-existing uncommitted edits out of the changed-files list.
-// The porcelain status prefix is preserved for review (?? = new, M = modified).
-export function changedSinceBaseline(baseline: string[], current: string[]): string[] {
-  const baselineLines = new Set(baseline);
-  return current.filter((line) => !baselineLines.has(line));
-}
-
-// Strip the two-character porcelain status plus its separating space. For
-// rename entries ("R  old -> new") the destination path is what remains
-// relevant, so keep only the post-arrow path when present.
-export function porcelainPath(line: string): string {
-  const raw = line.slice(3).trim();
-  const arrow = raw.indexOf(" -> ");
-  return arrow >= 0 ? raw.slice(arrow + 4) : raw;
-}
-
-export interface RevertDeps {
-  runGit?: (args: string[], cwd: string) => Promise<{ exitCode: number; stdout: string }>;
-  removeFile?: (absolutePath: string) => Promise<void>;
-}
-
-// Roll back implementer edits when an apply-mode gate is rejected.
-// Only the files this run introduced/changed are reverted, so unrelated work in
-// the repository is preserved. Tracked files are restored from HEAD; files that
-// did not exist in HEAD are deleted. Failures are surfaced to the MCP caller.
-export async function revertChangedFiles(
-  cwd: string,
-  changedFiles: string[],
-  deps: RevertDeps = {},
-): Promise<void> {
-  const git = deps.runGit ?? runGit;
-  const removeFile = deps.removeFile ?? ((absolutePath: string) => rm(absolutePath, { force: true }));
-  for (const line of changedFiles) {
-    const file = porcelainPath(line);
-    if (!file) {
-      continue;
-    }
-    const tracked = await git(["cat-file", "-e", `HEAD:${file}`], cwd);
-    if (tracked.exitCode === 0) {
-      const restored = await git(["restore", "--source=HEAD", "--", file], cwd);
-      if (restored.exitCode !== 0) {
-        throw new Error(`Failed to restore ${file}: ${restored.stdout || "git restore failed"}`);
-      }
-    } else {
-      try {
-        await removeFile(resolvePath(cwd, file));
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        throw new Error(`Failed to remove ${file}: ${message}`);
-      }
-    }
-  }
-}
-
 async function runCommands(commands: string[], cwd: string): Promise<VerificationResult[]> {
   const results: VerificationResult[] = [];
   for (const command of commands) {
@@ -293,30 +200,23 @@ function uniqueCommands(commands: string[]): string[] {
 // Tester verification runs the normal verification path first, then coverage
 // as supplemental evidence. Configured commands win per category; otherwise
 // DevCrew discovers common project commands.
-async function runConfiguredVerification(state: RunState): Promise<VerificationResult[]> {
+async function runConfiguredVerification(state: RunState, commandCwd: string): Promise<VerificationResult[]> {
   const config = await readConfig(state.cwd);
   const configuredVerify = config.verifyCommands.filter((command) => command.trim().length > 0);
   const configuredCoverage = (config.coverageCommands ?? []).filter((command) => command.trim().length > 0);
-  const verifyCommands = configuredVerify.length > 0 ? configuredVerify : await discoverVerifyCommands(state.cwd);
-  const coverageCommands = configuredCoverage.length > 0 ? configuredCoverage : await discoverCoverageCommands(state.cwd);
+  const verifyCommands = configuredVerify.length > 0 ? configuredVerify : await discoverVerifyCommands(commandCwd);
+  const coverageCommands = configuredCoverage.length > 0 ? configuredCoverage : await discoverCoverageCommands(commandCwd);
   const commands = uniqueCommands([...verifyCommands, ...coverageCommands]);
-  return runCommands(commands, state.cwd);
+  return runCommands(commands, commandCwd);
 }
 
 // Implementer apply runs lint/format/typecheck so reviewers see standards
 // compliance evidence. Configured lintCommands win, otherwise discover them.
-async function runConfiguredLint(state: RunState): Promise<VerificationResult[]> {
+async function runConfiguredLint(state: RunState, commandCwd: string): Promise<VerificationResult[]> {
   const config = await readConfig(state.cwd);
   const configuredLint = (config.lintCommands ?? []).filter((command) => command.trim().length > 0);
-  const commands = configuredLint.length > 0 ? configuredLint : await discoverLintCommands(state.cwd);
-  return runCommands(commands, state.cwd);
-}
-
-function changedFilesBlock(changedFiles: string[]): string {
-  if (changedFiles.length === 0) {
-    return "No changed files were detected.";
-  }
-  return changedFiles.map((file) => `- ${file}`).join("\n");
+  const commands = configuredLint.length > 0 ? configuredLint : await discoverLintCommands(commandCwd);
+  return runCommands(commands, commandCwd);
 }
 
 function verificationBlock(results: VerificationResult[]): string {
@@ -331,34 +231,172 @@ function verificationBlock(results: VerificationResult[]): string {
     .join("\n\n");
 }
 
-function lintBlock(results: VerificationResult[]): string {
+function verificationStatusFor(results: VerificationResult[]): VerificationStatus {
   if (results.length === 0) {
-    return "No lint or format commands were detected.";
+    return "not_run";
   }
-  return verificationBlock(results);
+  return results.every((result) => result.exitCode === 0) ? "passed" : "failed";
 }
 
-function appendExecutionSections(artifact: ArtifactName, markdown: string, state: RunState): string {
-  if (artifact === "implementation-plan") {
-    let next = markdown.trim();
-    if (!next.includes("## Recorded Changes")) {
-      next = `${next}\n\n## Recorded Changes\n\n${changedFilesBlock(state.changedFiles)}`;
+function setTestingGateFromVerification(state: RunState): void {
+  if (state.verificationStatus === "failed") {
+    state.gates.testing = "rejected";
+    state.status = "awaiting_input";
+    state.feedback.push({
+      gate: "testing",
+      message: "Automated verification failed. Inspect the test report, revise the implementation, or record an explicit verification waiver with its reason.",
+      createdAt: now(),
+    });
+    return;
+  }
+  state.gates.testing = "pending";
+  state.status = "awaiting_approval";
+}
+
+function executionInstructions(state: RunState, phase: "execution" | "testing", workspacePath: string): string {
+  if (phase === "execution") {
+    return `Use the native ${state.host} host agent to implement the approved change in ${workspacePath}. Do not modify the requester checkout at ${state.cwd}. When complete, call devcrew_complete_execution with a concise summary.`;
+  }
+  return `Use the native ${state.host} host agent to validate the approved change in ${workspacePath}. Then call devcrew_complete_execution with a concise summary and each command's exit code and output.`;
+}
+
+function hostCompletionResult(state: RunState, summary: string): RoleResult {
+  const role = state.phase === "execution" ? "implementer" : "tester";
+  const artifact = artifactForPhase(state.phase);
+  return {
+    role,
+    backend: state.backend,
+    summary: `${role} completed through the native ${state.host} host: ${summary}`,
+    markdown: `${renderArtifact(artifact, state).trim()}\n\n## Native Host Summary\n\n${summary}\n`,
+    usedFallback: false,
+  };
+}
+
+function parseCompletionSummary(value: unknown): string {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error("summary must be a non-empty string");
+  }
+  return value.trim();
+}
+
+function parseCompletionVerification(value: unknown): VerificationResult[] {
+  if (value === undefined) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    throw new Error("verification must be an array");
+  }
+  return value.map((entry, index) => {
+    if (
+      !entry ||
+      typeof entry !== "object" ||
+      typeof entry.command !== "string" ||
+      entry.command.trim().length === 0 ||
+      !Number.isInteger(entry.exitCode) ||
+      typeof entry.output !== "string" ||
+      typeof entry.startedAt !== "string" ||
+      typeof entry.completedAt !== "string"
+    ) {
+      throw new Error(`verification[${index}] must include command, integer exitCode, output, startedAt, and completedAt`);
     }
-    if (!next.includes("## Lint Results")) {
-      next = `${next}\n\n## Lint Results\n\n${lintBlock(state.lintResults)}`;
+    return {
+      command: entry.command.trim(),
+      exitCode: entry.exitCode,
+      output: entry.output,
+      startedAt: entry.startedAt,
+      completedAt: entry.completedAt,
+    };
+  });
+}
+
+function appendExecutionSections(artifact: ArtifactName, markdown: string, state: RunState): string {
+  if (artifact === "architecture-review" && state.architectureReview) {
+    let content = markdown.trim();
+    if (!content.includes("## Review Decision")) {
+      content += `\n\n## Review Decision\n\nDecision: ${state.architectureReview.decision}\n\nSummary: ${state.architectureReview.summary}`;
     }
-    return `${next}\n`;
+    return `${content}\n`;
   }
-  if (artifact === "test-report" && !markdown.includes("## Acceptance Evidence")) {
-    return `${markdown.trim()}\n\n## Acceptance Evidence\n\n${verificationBlock(state.verification)}\n`;
+  if (artifact === "test-report") {
+    let content = markdown.trim();
+    if (!content.includes("## Acceptance Evidence")) {
+      content += `\n\n## Acceptance Evidence\n\n${verificationBlock(state.verification)}`;
+    }
+    if (!content.includes("## Verification Outcome")) {
+      content += `\n\n## Verification Outcome\n\nStatus: ${state.verificationStatus}`;
+    }
+    if (state.verificationWaiver && !content.includes("## Verification Waiver")) {
+      content += `\n\n## Verification Waiver\n\nReason: ${state.verificationWaiver.reason}\nRecorded At: ${state.verificationWaiver.createdAt}`;
+    }
+    return `${content}\n`;
   }
   return markdown;
 }
 
+async function writeImplementationReview(state: RunState): Promise<void> {
+  state.artifacts["implementation-review"] = await writeMarkdownArtifact(
+    state,
+    "implementation-review",
+    renderArtifact("implementation-review", state),
+  );
+}
+
 async function runCurrentPhaseRole(state: RunState, runner: RoleRunner = runRole): Promise<RunState> {
-  const gate = gateForPhase(state.phase);
+  if (state.phase === "execution") {
+    if (state.executionMode !== "apply") {
+      throw new Error("DevCrew execution phase requires apply mode");
+    }
+    const workspace = await ensureExecutionWorkspace(state);
+    state.executionWorkspace = workspace;
+    state.verification = [];
+    state.verificationStatus = "not_run";
+    delete state.verificationWaiver;
+    delete state.artifacts["test-report"];
+    await saveState(state);
+
+    if (state.executionPolicy === "interactive-host") {
+      state.executionInstruction = {
+        phase: "execution",
+        workspacePath: workspace.path,
+        instructions: executionInstructions(state, "execution", workspace.path),
+        createdAt: now(),
+      };
+      state.status = "awaiting_execution";
+      return saveState(state);
+    }
+
+    const result = await runner({
+      backend: state.backend,
+      role: "implementer",
+      phase: "execution",
+      request: state.request,
+      mode: state.mode,
+      executionMode: "apply",
+      executionPolicy: state.executionPolicy,
+      cwd: workspace.path,
+      standards: state.standards.combined,
+      artifactPath: artifactPath(state.cwd, state.runId, "implementation-review", state.artifactDirectory),
+      answers: state.answers.map((entry) => entry.answer),
+      feedback: state.feedback.map((entry) => `${entry.gate}: ${entry.message}`),
+      priorArtifacts: await readPriorArtifacts(state),
+    });
+    await captureExecutionChanges(workspace);
+    state.lintResults = await runConfiguredLint(state, workspace.path);
+    const captured = await captureExecutionChanges(workspace);
+    state.changedFiles = captured.changedFiles;
+    state.implementationDiff = captured.patch;
+    state.roles.push(result);
+    state.executionInstruction = undefined;
+    await writeImplementationReview(state);
+    state.phase = "review";
+    state.status = "ready";
+    return saveState(state);
+  }
+
+  const configuredGate = gateForPhase(state.phase);
+  const gate = gateForPhase(state.phase, state.enabledGates);
   const role = roleForPhase(state.phase);
-  if (!gate || !role) {
+  if (!role) {
     const artifact = artifactForPhase(state.phase);
     const markdown = renderArtifact(artifact, state);
     state.artifacts[artifact] = await writeMarkdownArtifact(state, artifact, markdown);
@@ -368,17 +406,24 @@ async function runCurrentPhaseRole(state: RunState, runner: RoleRunner = runRole
   }
 
   const artifact = artifactForPhase(state.phase);
-  const path = artifactPath(state.cwd, state.runId, artifact);
-
-  // Apply-mode implementation starts from a clean tree, so changed files after
-  // the role runs are attributable to the current DevCrew run.
-  const applyingImplementation = state.executionMode === "apply" && state.phase === "implementation";
-  const implementationBaseline: string[] = [];
-  if (applyingImplementation) {
-    await assertCleanApplyWorkspace(state.cwd);
+  const path = artifactPath(state.cwd, state.runId, artifact, state.artifactDirectory);
+  const applyingTesting = state.executionMode === "apply" && state.phase === "testing";
+  const roleCwd = applyingTesting ? state.executionWorkspace?.path : state.cwd;
+  if (!roleCwd) {
+    throw new Error("DevCrew apply testing requires an execution workspace");
+  }
+  state.roles.push(conductorDecision(state, role, gate ?? `${state.phase} automatic transition`));
+
+  if (applyingTesting && state.executionPolicy === "interactive-host") {
+    state.executionInstruction = {
+      phase: "testing",
+      workspacePath: roleCwd,
+      instructions: executionInstructions(state, "testing", roleCwd),
+      createdAt: now(),
+    };
+    state.status = "awaiting_execution";
+    return saveState(state);
   }
-
-  state.roles.push(conductorDecision(state, role, gate));
 
   const result = await runner({
     backend: state.backend,
@@ -387,7 +432,8 @@ async function runCurrentPhaseRole(state: RunState, runner: RoleRunner = runRole
     request: state.request,
     mode: state.mode,
     executionMode: state.executionMode,
-    cwd: state.cwd,
+    executionPolicy: state.executionPolicy,
+    cwd: roleCwd,
     standards: state.standards.combined,
     artifactPath: path,
     answers: state.answers.map((entry) => entry.answer),
@@ -395,13 +441,24 @@ async function runCurrentPhaseRole(state: RunState, runner: RoleRunner = runRole
     priorArtifacts: await readPriorArtifacts(state),
   });
 
-  if (applyingImplementation) {
-    state.changedFiles = changedSinceBaseline(implementationBaseline, await listChangedLines(state.cwd));
-    state.implementationDiff = await collectImplementationDiff(state.cwd);
-    state.lintResults = await runConfiguredLint(state);
+  if (applyingTesting && state.executionWorkspace) {
+    state.verification = await runConfiguredVerification(state, roleCwd);
+    state.verificationStatus = verificationStatusFor(state.verification);
+    const captured = await captureExecutionChanges(state.executionWorkspace);
+    state.changedFiles = captured.changedFiles;
+    state.implementationDiff = captured.patch;
+    await writeImplementationReview(state);
   }
-  if (state.executionMode === "apply" && state.phase === "testing") {
-    state.verification = await runConfiguredVerification(state);
+
+  if (state.phase === "review") {
+    if (!result.reviewDecision) {
+      throw new Error("DevCrew architecture review must return a structured review decision");
+    }
+    state.architectureReview = {
+      decision: result.reviewDecision,
+      summary: result.summary,
+      reviewedAt: now(),
+    };
   }
 
   // When the backend cannot run a real SDK we keep a single deterministic
@@ -410,15 +467,37 @@ async function runCurrentPhaseRole(state: RunState, runner: RoleRunner = runRole
   const markdown = appendExecutionSections(artifact, baseMarkdown, state);
   state.roles.push({ ...result, markdown });
   state.artifacts[artifact] = await writeMarkdownArtifact(state, artifact, markdown);
-  if (artifact === "implementation-plan") {
-    state.artifacts["implementation-review"] = await writeMarkdownArtifact(
-      state,
-      "implementation-review",
-      renderArtifact("implementation-review", state),
-    );
-  }
-  state.gates[gate] = "pending";
-  state.status = "awaiting_approval";
+  state.executionInstruction = undefined;
+  if (state.phase === "requirements" && result.questions && result.questions.length > 0) {
+    state.pendingQuestions = result.questions;
+    state.gates.requirements = "not_started";
+    state.status = "awaiting_input";
+    return saveState(state);
+  }
+  if (state.phase === "review" && state.architectureReview?.decision === "changes_required") {
+    state.gates["implementation-review"] = "rejected";
+    state.status = "awaiting_input";
+    state.feedback.push({
+      gate: "implementation-review",
+      message: state.architectureReview.summary,
+      createdAt: now(),
+    });
+    return saveState(state);
+  }
+  if (!gate && configuredGate) {
+    state.phase = nextPhaseAfterGate(state, configuredGate);
+    state.status = "ready";
+    return saveState(state);
+  }
+  if (applyingTesting) {
+    setTestingGateFromVerification(state);
+  } else {
+    if (!gate) {
+      throw new Error(`DevCrew has no configured gate for ${state.phase}`);
+    }
+    state.gates[gate] = "pending";
+    state.status = "awaiting_approval";
+  }
   return saveState(state);
 }
 
@@ -429,37 +508,153 @@ export async function startOrchestratedWorkflow(input: StartWorkflowInput, runne
 
 export async function continueOrchestratedWorkflow(input: RunRef, runner: RoleRunner = runRole): Promise<RunState> {
   const state = await getWorkflowStatus(input);
-  if (state.status === "awaiting_approval" || state.status === "awaiting_input" || state.status === "complete") {
+  if (
+    state.status === "awaiting_approval" ||
+    state.status === "awaiting_input" ||
+    state.status === "awaiting_execution" ||
+    state.status === "complete"
+  ) {
     return state;
   }
 
   return runCurrentPhaseRole(state, runner);
 }
 
-export async function rejectOrchestratedWorkflow(input: RejectWorkflowInput): Promise<RunState> {
-  const before = await getWorkflowStatus(input);
-  const state = await rejectWorkflow(input);
+export async function approveOrchestratedWorkflow(input: ApproveWorkflowInput): Promise<RunState> {
+  const before = await validateWorkflowApproval(input);
+  const promotingTesting =
+    input.gate === "testing" &&
+    before.executionMode === "apply" &&
+    before.phase === "testing" &&
+    before.status === "awaiting_approval" &&
+    before.gates.testing === "pending";
+  const cleaningCompletedPromotion =
+    input.gate === "testing" &&
+    before.executionMode === "apply" &&
+    before.gates.testing === "approved" &&
+    before.executionWorkspace !== undefined;
+
+  async function cleanupAfterApproval(state: RunState): Promise<RunState> {
+    try {
+      await cleanupExecutionWorkspace(state);
+    } catch {
+      return state;
+    }
+    state.executionWorkspace = undefined;
+    try {
+      return await saveState(state);
+    } catch {
+      return state;
+    }
+  }
+
+  if (cleaningCompletedPromotion) {
+    return cleanupAfterApproval(before);
+  }
+  if (promotingTesting) {
+    if (before.verificationStatus === "failed" && !before.verificationWaiver) {
+      throw new Error("Failed verification cannot be promoted without an explicit verification waiver");
+    }
+    await promoteExecutionChanges(before);
+    let approved: RunState;
+    try {
+      approved = await approveWorkflow(input);
+    } catch (error) {
+      try {
+        await rollbackPromotedExecutionChanges(before);
+      } catch (rollbackError) {
+        const detail = rollbackError instanceof Error ? rollbackError.message : String(rollbackError);
+        throw new Error(`DevCrew approval failed and promoted patch rollback failed: ${detail}`, { cause: error });
+      }
+      throw error;
+    }
+    return cleanupAfterApproval(approved);
+  }
+
+  return approveWorkflow(input);
+}
+
+export async function waiveOrchestratedVerification(input: WaiveVerificationInput): Promise<RunState> {
+  const state = await waiveVerificationWorkflow(input);
+  const reportPath = state.artifacts["test-report"];
+  if (reportPath) {
+    const report = await readFile(reportPath, "utf8");
+    await writeFile(reportPath, appendExecutionSections("test-report", report, state), "utf8");
+  }
+  return state;
+}
 
-  // Roll back implementer edits when an apply-mode implementation gate is
-  // rejected so the next attempt starts from a clean working tree.
+export async function completeOrchestratedExecution(input: CompleteExecutionInput): Promise<RunState> {
+  const state = await getWorkflowStatus(input);
+  const instruction = state.executionInstruction;
   if (
-    before.executionMode === "apply" &&
-    before.phase === "implementation" &&
-    before.changedFiles.length > 0
+    state.executionMode !== "apply" ||
+    state.executionPolicy !== "interactive-host" ||
+    state.status !== "awaiting_execution" ||
+    !instruction ||
+    instruction.phase !== state.phase ||
+    !state.executionWorkspace ||
+    instruction.workspacePath !== state.executionWorkspace.path
   ) {
-    await revertChangedFiles(before.cwd, before.changedFiles);
-    state.changedFiles = [];
+    throw new Error("DevCrew is not awaiting an interactive-host execution completion");
+  }
+  const summary = parseCompletionSummary(input.summary);
+
+  if (state.phase === "execution") {
+    if (input.verification !== undefined) {
+      throw new Error("verification can only be submitted after interactive-host testing");
+    }
+    const captured = await captureExecutionChanges(state.executionWorkspace);
+    state.changedFiles = captured.changedFiles;
+    state.implementationDiff = captured.patch;
+    state.lintResults = [];
+    state.roles.push(hostCompletionResult(state, summary));
+    state.executionInstruction = undefined;
+    await writeImplementationReview(state);
+    state.phase = "review";
+    state.status = "ready";
     return saveState(state);
   }
 
-  return state;
+  if (state.phase !== "testing") {
+    throw new Error(`Cannot complete interactive-host work during ${state.phase}`);
+  }
+  state.verification = parseCompletionVerification(input.verification);
+  state.verificationStatus = verificationStatusFor(state.verification);
+  const captured = await captureExecutionChanges(state.executionWorkspace);
+  state.changedFiles = captured.changedFiles;
+  state.implementationDiff = captured.patch;
+  await writeImplementationReview(state);
+  const result = hostCompletionResult(state, summary);
+  const artifact = artifactForPhase(state.phase);
+  const markdown = appendExecutionSections(artifact, result.markdown, state);
+  state.roles.push({ ...result, markdown });
+  state.artifacts[artifact] = await writeMarkdownArtifact(state, artifact, markdown);
+  state.executionInstruction = undefined;
+  setTestingGateFromVerification(state);
+  return saveState(state);
+}
+
+export async function rejectOrchestratedWorkflow(input: RejectWorkflowInput): Promise<RunState> {
+  return rejectWorkflow(input);
 }
 
 export async function answerOrchestratedWorkflow(input: AnswerWorkflowInput, runner: RoleRunner = runRole): Promise<RunState> {
+  const before = await getWorkflowStatus(input);
   const state = await answerWorkflow(input, { skipArtifactWrite: true });
-  const gate = gateForPhase(state.phase);
+  if (
+    before.executionMode === "apply" &&
+    before.phase === "testing" &&
+    before.gates.testing === "rejected"
+  ) {
+    state.phase = "execution";
+    state.status = "ready";
+    state.gates.testing = "not_started";
+    return saveState(state);
+  }
+
   const role = roleForPhase(state.phase);
-  if (!gate || !role) {
+  if (!role) {
     return state;
   }