@sjawhar/pi-legion-envoy 7.11.0 → 7.11.2

package/dist/legion.js

@@ -18042,7 +18042,7 @@ function endInjectedUserTurns(sessionID) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "7.11.0",
+  version: "7.11.2",
   license: "Apache-2.0",
   type: "module",
   omp: {
@@ -18055,7 +18055,7 @@ var package_default = {
     ]
   },
   legion: {
-    daemonApiVersion: 12
+    daemonApiVersion: 13
   },
   repository: {
     type: "git",
@@ -18421,7 +18421,8 @@ var LegionGrantRequest = exports_external.strictObject({
   sessionId: nonEmptyString,
   secret: nonEmptyString,
   tree: nonEmptyString,
-  issue: nonEmptyString
+  issue: nonEmptyString,
+  push: exports_external.boolean().optional()
 });
 var LegionControllerGrantRequest = exports_external.strictObject({
   sessionId: nonEmptyString,
@@ -19413,8 +19414,24 @@ function splitShellCommands(command) {
   endCommand();
   return commands;
 }
+function commandMatch(words, name, sequence) {
+  for (let index = 0;index < words.length; index += 1) {
+    const word = words[index];
+    if (word !== name && !word?.endsWith(`/${name}`))
+      continue;
+    if (sequence.every((expected, offset) => words[index + 1 + offset] === expected))
+      return index;
+  }
+  return -1;
+}
+function isPushInvocation(words) {
+  return commandMatch(words, "legion", ["push"]) !== -1;
+}
+function commandsRunPush(commands) {
+  return commands?.some(isPushInvocation) ?? false;
+}
 function jjLogRewriteInvocation(words) {
-  const jj = words.findIndex((word) => word === "jj" || word.endsWith("/jj"));
+  const jj = commandMatch(words, "jj", []);
   if (jj === -1)
     return;
   const args = words.slice(jj + 1);
@@ -19430,7 +19447,7 @@ var LEGION_HANDOFF_COMPLETE_MENTION = /\blegion[\s"'`,[\]]+handoff[\s"'`,[\]]+co
 var LEGION_HANDOFF_COMPLETE = {
   mention: (text) => LEGION_HANDOFF_COMPLETE_MENTION.test(text) ? "legion handoff complete" : undefined,
   invocation: (words) => {
-    const legion = words.findIndex((word, index) => (word === "legion" || word.endsWith("/legion")) && words[index + 1] === "handoff" && words[index + 2] === "complete");
+    const legion = commandMatch(words, "legion", ["handoff", "complete"]);
     return legion === -1 ? undefined : words.slice(legion).join(" ");
   },
   refusal: (attempt) => `refused \`${attempt}\`: a phase is completed with the \`legion\` tool's ` + "`handoff_complete`, never a shell command: the tool call is what records the phase " + "complete. A root architect or a `task` subagent has no handoff actions: it leaves the " + "completion to the worker. Text that only names the command (a commit message, a PR body) " + "reads as the command: pass it in a file."
@@ -19477,14 +19494,13 @@ function nonFileWriteScheme(toolCall) {
     return;
   return NON_FILE_WRITE_URL.exec(writeTarget(toolCall.input.path))?.[1]?.toLowerCase();
 }
-function paneRuleRefusal(toolCall, rules) {
+function paneRuleRefusal(toolCall, rules, commands) {
   if (rules.length === 0)
     return;
   const { toolName, input } = toolCall;
   if (toolName === "bash") {
     if (typeof input.command !== "string")
       return;
-    const commands = splitShellCommands(input.command);
     for (const rule of rules) {
       const attempt = refusedCommand(input.command, commands, rule);
       if (attempt !== undefined)
@@ -19584,7 +19600,8 @@ function legionExtension(pi) {
       toolName: toolCall.toolName
     });
     paneRules ??= PANE_RULES[classifySession(process.env).kind] ?? [];
-    const refusal = paneRuleRefusal(toolCall, paneRules);
+    const commands = toolCall.toolName === "bash" && typeof toolCall.input.command === "string" ? splitShellCommands(toolCall.input.command) : undefined;
+    const refusal = paneRuleRefusal(toolCall, paneRules, commands);
     if (refusal !== undefined)
       return { block: true, reason: refusal };
     if (await checkSubagentSession(context))
@@ -19614,7 +19631,8 @@ function legionExtension(pi) {
       tree: active.tree,
       issue: active.issue,
       sessionId: sessionID,
-      secret: active.secret
+      secret: active.secret,
+      push: commandsRunPush(commands)
     }));
   });
   pi.on("message_start", async (event, context) => {

package/dist/skills/AGENTS.md

@@ -14,7 +14,7 @@ event intake, process lifecycle, credentials, and role delivery.
 | `legion-architect/` | root and sub-architects | tree ownership, decomposition, waves, gates, integration, sign-off |
 | `legion-controller/` | the controller root process | wake routing, keeping the admission slots full from `todo`, the daily report, escalation |
 | `legion-oracle/` | any role doing research | repository-grounded research |
-| `legion-retro/` | the implementer, at retro | the pre-merge retrospective and its Dispatch message |
+| `legion-retro/` | the implementer, at retro | the pre-merge retrospective, its Dispatch message, and the PR body content the pull request's changed paths require at its commit |
 | `legion-worker/` | planner, implementer, tester, reviewer, merger | the phase contracts: handoffs, GitHub identity, PR body and READY discipline, the merge-gate order |
 | `thermonuclear-code-quality/` | the `thermonuclear-code-quality` agent | the maintainability rubric of the reviewer's pair (adapted from the MIT-licensed Thermos plugin in `cursor/plugins`; `LICENSE` beside it) |
 | `thermonuclear-deep-review/` | the `thermonuclear-deep-review` agent, and the reviewer (the Security Guidelines) | the correctness rubric of the reviewer's pair, with its tagged, diff-triggered Security Guidelines and the attack on the PR body's claims (adapted from the MIT-licensed Thermos plugin in `cursor/plugins`; `LICENSE` beside it) |

package/dist/skills/legion-architect/SKILL.md

@@ -235,8 +235,13 @@ ends, never after an idle window). You start nothing for it. Never `envoy_publis
 worker's role topic to start retro: a suspended role is not running to receive it.
 
 Wait for the implementer to report its durable retro result. Retro output is
-`docs/solutions/` plus one `dispatch_message` on the issue; it must not create a `.legion`
-file or rewrite the reviewer-approved head.
+`docs/solutions/`, the PR body content the repository's instructions derive from the pull
+request's changed paths at that commit, and one `dispatch_message` on the issue; it must not create
+a `.legion` file or rewrite the reviewer-approved head. When the implementer reports that it cannot
+compute that body content or do the work a line of it affirms, that its read of the body failed or
+came back empty, or that GitHub refused the body, it has pushed nothing and is still in its phase.
+Answer it with `envoy_publish` to its role topic, saying how from the deployment instructions;
+when they do not say, open a `dispatch_ask` naming the missing instruction.
 
 ## 6. Architect sign-off and merge
 

package/dist/skills/legion-retro/SKILL.md

@@ -9,8 +9,9 @@ Retro is mandatory for every issue that passed review. The daemon starts the imp
 once the reviewer approves, so the person with implementation context performs the retrospective,
 and the skill obtains a separate fresh-eyes perspective. Retro runs before merge.
 
-Every path this skill cites (`packages/...`, `docs/...`) is in sjawhar/legion, the Legion
-repository, which need not be the repository you are working in.
+The `scripts/e2e/` proofs this skill names are in sjawhar/legion, the Legion repository, which
+need not be the repository you are working in. `docs/solutions/` and `.legion/` are on the issue
+branch of the repository you are working in.
 
 ## Merge-gate ordering
 
@@ -22,8 +23,9 @@ retrospective's durable output.
    merge. The daemon strips whatever `.legion/` main still carries from the next issue's branch
    before any of its roles start, so that tree's own merge carries the removal onto the default
    branch; no operator sweep follows.
-3. Run this retro: commit durable learnings to `docs/solutions/` and post the retro message on
-   the Dispatch issue.
+3. Run this retro: commit durable learnings to `docs/solutions/`, bring the pull request body's
+   path-derived content up to date for that commit before you push it, and post the retro
+   message on the Dispatch issue.
    Retro writes **no `.legion` file**, so it never changes the approved head's handoffs.
 4. The merger verifies the tip is the approved head plus commits that change only
    `docs/solutions/` — `jj diff --from <approved-sha> --to <tip-sha> --summary`, quoted in READY —
@@ -103,8 +105,50 @@ related_issues:
 ---
 ```
 
-Commit the documentation on the existing issue branch and push it with `legion push`. Do not
-create a replacement branch or bookmark. Then post one Dispatch message on
+Commit the documentation on the existing issue branch. Do not create a replacement branch or
+bookmark.
+
+Before you push that commit, bring up to date the body content the repository derives from the
+pull request's changed paths. A repository can require such content, a line naming a checklist
+for each class of changed path for instance, and have a required check read it from the PR body.
+When your commit adds a `docs/solutions/` path the approved body never accounted for, that check
+fails at your head; the merger reports a stale body rather than rewriting it, and READY refuses a
+head whose required check failed, so the tree stops at the merger.
+
+1. Read what the deployment instructions in your system prompt, and the agent guide and pull
+   request template of the repository you are working in, derive from the changed paths. When
+   they derive nothing, skip steps 2 to 4 and go on to the push.
+2. Compute it the way they say, for the paths the pull request changes at your commit, the files
+   GitHub lists on it:
+   `cd -- "$LEGION_WORKSPACE" && jj -R "$LEGION_WORKSPACE" git fetch && jj -R "$LEGION_WORKSPACE" diff --from 'fork_point(<base>@origin | <commit>)' --to <commit> --name-only`
+   lists them, `<base>` the pull request's base branch and `<commit>` your docs commit. Where a
+   line affirms work, such as a checklist completed for a class of path, do that work for the
+   paths your commit adds before you write the line: the line is a claim. That work may change
+   files under `docs/solutions/` only, folded into your docs commit before the push, since
+   anything else above the approved head voids the approval.
+3. In a fresh `mktemp -d` directory outside `$LEGION_WORKSPACE` (the one place you write outside
+   it: jj snapshots a file inside it, and a fixed name in a shared `/tmp` can hold another
+   session's body), save the live body twice, and stop unless the read succeeded and is not
+   empty. `pipefail` makes a failed read fail the line (without it the line exits with `tee`'s
+   status and leaves two empty files), and the parentheses keep it to that line, since your
+   session's shell persists and a later `cmd | head` would exit 141 under it:
+   `cd -- "$LEGION_WORKSPACE" && ( set -o pipefail && legion gh -- api repos/{owner}/{repo}/pulls/{number} --jq .body | tee <dir>/before.md <dir>/body.md ) && test -s <dir>/before.md`.
+   In `<dir>/body.md`, change the lines it carries for that content and add any it lacks where
+   the instructions place them; other phases' lines stay as they wrote them.
+4. Write it back before the push:
+   `cd -- "$LEGION_WORKSPACE" && legion gh -- api --method PATCH repos/{owner}/{repo}/pulls/{number} -F body=@<dir>/body.md`.
+   The checks the push starts read the body as it stands then; an edit after the push re-runs
+   only a check that also starts on an edited body. Such a check re-runs now at the approved
+   head, on a diff without your commit, and may fail there; READY reads the head your push makes.
+
+When you cannot compute that content, cannot do the work a line affirms within
+`docs/solutions/`, the body read fails or comes back empty, or GitHub refuses the body, push
+nothing and do not complete: tell the architect with `envoy_publish` to its role topic, naming
+what failed.
+
+Then push the commit with `legion push`. When the push is refused after step 4 wrote the body,
+write `<dir>/before.md` back the same way before you report the refusal to the architect, so the
+body matches the head GitHub has. After the push, post one Dispatch message on
 the issue — `issue` is your `LEGION_ISSUE`; Legion issues live on Dispatch, never on a GitHub
 issue, and the `gh` shim refuses every GitHub-issue write — naming the documents, the
 one-to-three most useful takeaways, the two proofs you read, and the production check that
@@ -130,10 +174,11 @@ dispatch_message({
 })
 ```
 
-The Dispatch message and the `docs/solutions/` commit are the only retro outputs. Never write a
-handoff, phase artifact, local feedback log, or completion label, and add or change nothing under
-`.legion/`. Report completion with the `legion` tool's `handoff_complete` alone (its
-summary: two sentences for the architect) — no `handoff_write`.
+The `docs/solutions/` commit, the PR body lines that commit makes stale, and the Dispatch message
+are the only retro outputs. Never write a handoff, phase artifact, local feedback log, or
+completion label, and add or change nothing under `.legion/`. Report completion with the `legion`
+tool's `handoff_complete` alone (its summary: two sentences for the architect) — no
+`handoff_write`.
 
 ## Completion check
 
@@ -142,6 +187,9 @@ Before returning, verify all of the following:
 - The reviewer-approved head remains below the retro documentation commit, and the reviewer's
   approval of that head stands: the merger accepts the approved head plus this commit.
 - The learning documents and the Dispatch message both exist (never a GitHub issue comment).
+- The PR body carries what the repository's instructions derive from the pull request's changed
+  paths at the retro head, written back before that head's push, and each line that affirms work
+  affirms work you did; or the instructions derive nothing.
 - Both proofs were read, and any gap in either is recorded as a learning.
 - No `.legion` file was created or modified by retro.
 - The fresh-eyes analysis was considered alongside the implementer's context.

package/dist/skills/legion-worker/references/merge-gate.md

@@ -12,7 +12,8 @@ removes `.legion/` before the merge: the approved head carries it. The daemon st
 operator sweep follows. After the approval, only retro's `docs/solutions/` commit leaves it
 standing on its own (*Retro*, below). A conflict-forced merge goes back to the reviewer for a
 confirmation or a new round, as the fingerprint decides (*The reviewer*, below, and
-`skill://legion-worker/references/conflicts-and-rewrites.md`), and any other change voids it.
+`skill://legion-worker/references/conflicts-and-rewrites.md`), and any other change to the head
+voids it.
 
 ## The reviewer
 
@@ -68,6 +69,12 @@ review posted without a completion leaves the issue in reviewing until you finis
   reviewer. Anything else above the approved head does void it, and the merger tells the
   architect the head must return to review instead of completing. A conflict-forced rebase
   after retro moves those documents with the branch; retro never re-runs.
+- **Retro brings the PR body's path-derived content up to date before its push.** Whatever the
+  repository's instructions derive from the pull request's changed paths (a checklist named for
+  each class of path, read by a required check), retro recomputes for the whole diff at its commit
+  and writes into the live body before `legion push` (`skill://legion-retro`), since the merger
+  reports a stale body rather than rewriting it. A body edit changes no commit, so the approval
+  stands.
 
 ## The merger
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "7.11.0",
+  "version": "7.11.2",
   "license": "Apache-2.0",
   "type": "module",
   "omp": {
@@ -13,7 +13,7 @@
     ]
   },
   "legion": {
-    "daemonApiVersion": 12
+    "daemonApiVersion": 13
   },
   "repository": {
     "type": "git",