@telora/daemon 0.22.85 → 0.22.91

package/dist/ci/ci-sensor-loop.d.ts

@@ -11,25 +11,28 @@
  * so the loop is unit-testable without a live remote or DB.
  *
  * The filing is a MACHINE receiver, not a human inbox line. Fixing a failing
- * lint/typecheck/test/build gate is CODING work, so the filing carries
- * disposition `agent_resolvable` (hidden from the operator inbox) anchored to a
- * FOCUS, so the daemon's focus-scoped agent_resolvable pickup
- * (reconcileAgentResolvableForFocus) rides it into that focus's next CODING pass
- * to be resolved. The ONLY path from here to a `needs_operator` filing is the
- * existing 24h agent_resolvable promotion backstop, after the machine has had
- * spawn cycles to clear it and has not -- never a direct operator filing.
+ * lint/typecheck/test/build gate is CODING work, so a focus-attributed filing
+ * carries disposition `agent_resolvable` (hidden from the operator inbox), and
+ * the daemon's focus-scoped pickup (reconcileAgentResolvableForFocus) rides it
+ * into that focus's next CODING pass. A BRANCH-ONLY filing (below) has no spawn
+ * to ride, so it is filed as a detector OBSERVATION (proposed needs_operator, no
+ * human act -- the fix is still coding work): with no focus anchor, the org-wide
+ * hand-off sweep (queries/agent-resolvable-promotion.ts) gives it to the routing
+ * decider agent on its next pass, and only that agent can make it human-facing.
+ * Neither path files a direct operator line (see ciRunRedEscalationParams).
  *
- * Anchor choice (decided, reversible): the tip's OWNING focus, resolved from the
- * tip commit's `Telora-Delivery` trailer -> delivery -> focus; falling back to
- * any currently-active focus for the product (a CI-gate fix is cross-cutting, so
- * any armed team can take it). If NO focus is armed at all there is no coding
- * pass to route the fix to, so the tick files nothing and retries next tick --
- * the fail-closed integration->main merge gate (resolveCiMergeGate, which reads
- * the git ref independently of this escalation) still holds main out on the red,
- * so nothing merges while the signal waits for a team. The recorded alternative,
- * a standing per-product "CI health" focus, would remove the fallback heuristic
- * but is a larger change (new focus lifecycle) and can replace this later with
- * no data migration.
+ * Anchor choice (decided, reversible): the focus -- and, when it is the only one,
+ * the delivery -- whose merge INTRODUCED the red tip (ci/ci-red-attribution.ts:
+ * the tip's own `Telora-Delivery` trailer, else the deliveries of the commits the
+ * merge brought onto integration, read against its integration-side parent). When
+ * that is not determinable (no attributable commit, or work from several foci)
+ * the filing anchors BRANCH-ONLY, with no focusId -- a wrong focus is worse than
+ * none, since it rides the fix into an unrelated team and correlates the red with
+ * that focus's unrelated symptoms. The former "any currently-active focus"
+ * fallback was that guess and is gone. A branch-only filing has no team to ride
+ * into, so the held merge gate is ALSO surfaced as a health event (TEL-6); the
+ * fail-closed integration->main merge gate (resolveCiMergeGate, which reads the
+ * git ref independently of this escalation) still holds main out on the red.
  *
  * The cause key is BRANCH-scoped (queries/cause-key.ciRunRedCauseKey): successive
  * red tips carrying the same unfixed breakage collapse onto ONE open filing
@@ -42,6 +45,9 @@
  */
 import type { DaemonConfig } from '../types/index.js';
 import { type CiStatusReader } from './ci-status.js';
+import { type CiRedRunAnchor } from './ci-red-attribution.js';
+import { type CreateEscalationParams } from '../queries/escalations.js';
+import { type CallApiDeps } from '../queries/shared.js';
 /** Health-event code for a red integration run that has no team to route to. */
 export declare const MERGE_HELD_NO_RECEIVER_CODE = "merge.held_no_receiver";
 /** Test-only: clear the held-gate dedup state. */
@@ -93,18 +99,25 @@ export declare function ciRunRedEscalationDescription(params: {
     sha: string;
     branch: string;
 }): string;
+/** Params a ci_run_red filing is built from. focusId/deliveryId null = branch-only. */
+export interface CiRedFilingParams {
+    organizationId: string;
+    productId: string;
+    focusId: string | null;
+    deliveryId: string | null;
+    sha: string;
+    branch: string;
+}
 /**
  * Structured metadata for a ci_run_red filing: the cause-key routing fields, the
- * posture it sets and that posture's termination condition, PLUS the self-
- * contained `diagnosis` route (see ciLogDiagnosisRoute) so a team inheriting the
- * escalation later reads the same log route the original filing carried. Pure and
- * exported so the metadata contract is unit-testable without mocking createEscalation.
+ * attributed anchor (focus_id / delivery_id, null when branch-only), the posture
+ * it sets and that posture's termination condition, PLUS the self-contained
+ * `diagnosis` route (see ciLogDiagnosisRoute) so a team inheriting the escalation
+ * later reads the same log route the original filing carried. Pure and exported
+ * so the metadata contract is unit-testable without mocking createEscalation.
  */
-export declare function ciRunRedEscalationMetadata(params: {
-    sha: string;
-    branch: string;
-    productId: string;
-    focusId: string;
+export declare function ciRunRedEscalationMetadata(params: Omit<CiRedFilingParams, 'organizationId' | 'deliveryId'> & {
+    deliveryId?: string | null;
 }): Record<string, unknown>;
 /** Minimal open-escalation row shape the sensor's dedup / resolve reads. */
 interface CiEscalationRow {
@@ -115,23 +128,31 @@ interface CiEscalationRow {
     metadata?: Record<string, unknown> | null;
 }
 /**
- * Whether a re-file for THIS red sha must be suppressed. Two ways it is:
- *   - an OPEN or DISMISSED row already carries the same cause key (sha+branch) --
- *     the cause-keyed path with DISMISSAL MEMORY. This is what fixes the incident
- *     where an operator dismissed a ci_run_red for a sha and the daemon re-filed
- *     the SAME sha on the next scan: a dismissed cause_key now keeps it silent
- *     until a NEW sha (a different cause key) goes red.
- *   - a legacy OPEN product+kind row with no cause_key exists (deployment-window
- *     back-compat for rows filed before this change).
- *
- * A new sha yields a different cause key with no matching open/dismissed row and
- * re-files; a later green run resolves the open row via resolveCiRedEscalations.
+ * An OPEN ci_run_red row for this product, including the two HAND-OFF rows that
+ * stand in for one:
+ *  - a routing decider's human-facing filing (MCP escalate with sourceCauseKey):
+ *    kind agent_filed, carrying metadata.original_cause_key `ci_run_red::...` and
+ *    metadata.originalEscalationId but NO originalKind;
+ *  - a historic promotion-backstop refile (the daemon no longer files these):
+ *    re-kinded agent_resolvable_promoted, carrying metadata.originalKind.
+ * A row's originalKind, when it carries one, is authoritative for its origin; the
+ * original_cause_key prefix decides only for a row without it (the decider's).
+ * Covering both lets a later green resolve the human-facing row too (no stale
+ * inbox item once the red cleared), and keeps an open one suppressing a fresh
+ * branch-only observation. Exported for direct unit testing.
  */
+export declare function isOpenCiRedForProduct(e: CiEscalationRow, productId: string): boolean;
 /**
  * Pure suppression predicate over already-fetched rows. A re-file for this red
- * sha is suppressed when an open/dismissed row carries the same cause key
- * (dismissal memory), or a legacy open product+kind row exists. Exported for
- * direct unit testing (no callApi mocking needed).
+ * sha is suppressed when an OPEN or DISMISSED row carries the same cause key
+ * (dismissal memory: an operator-dismissed branch stays silent until a new
+ * breakage resolves and re-reds it), an OPEN row carries it as a live absorbed
+ * symptom (the filing would only be "already carried" by the incident reducer --
+ * and a green tick must still see it open, so resolve-on-green retires it), or a
+ * legacy OPEN product+kind row with no cause_key exists (deployment-window
+ * back-compat). A later green run resolves the open row via
+ * resolveCiRedEscalations. Exported for direct unit testing (no callApi mocking
+ * needed).
  */
 export declare function isCiRedRefileSuppressed(rows: readonly CiEscalationRow[], params: {
     productId: string;
@@ -139,57 +160,40 @@ export declare function isCiRedRefileSuppressed(rows: readonly CiEscalationRow[]
     branch: string;
 }): boolean;
 /**
- * Resolve the focus a red integration run's fix should be routed to. Primary:
- * the tip commit's OWNING focus, via its `Telora-Delivery` trailer -> delivery ->
- * focus. When the tip is a MERGE commit it carries no trailer of its own -- so
- * before giving up, walk the commits the merge introduced (its own work is
- * `<sha>^1...<sha>`) and resolve the owning focus from the first commit that DOES
- * carry a trailer. Only then fall back to any currently-active focus for the
- * product (a CI-gate fix is cross-cutting, so any armed team can take it). Returns
- * null when nothing resolves -- there is no coding pass to route the fix to, so
- * the caller files nothing and retries next tick (the fail-closed merge gate
- * still holds main). Best-effort: any git/DB failure degrades to null, never throws.
+ * Resolve-on-green (the production resolveCiRedEscalations): resolve the product's
+ * open ci_run_red rows (and the hand-off rows standing in for one: a routing decider's
+ * human-facing filing, a historic promoted refile) auto_swept, then retire a ci_run_red
+ * absorbed as a symptom onto another open row of the product (incident contract
+ * rule 6), over the same read. Best-effort per row. Exported with a callApi seam
+ * for tests.
  */
+export declare function defaultResolveCiRedEscalations(productId: string, deps?: CallApiDeps): Promise<number>;
 /**
- * Injected IO for owning-focus resolution -- git reads + DB lookups, so the
- * pure walk order is unit-testable over a real merge without mocking the module.
- */
-export interface OwningFocusResolverDeps {
-    readTrailer: (repoPath: string, sha: string) => string;
-    resolveMergeRange: (repoPath: string, sha: string) => string | null;
-    listCommits: (repoPath: string, range: string) => string[];
-    /** delivery id -> owning focus id (null when unknown). */
-    focusForDelivery: (deliveryId: string) => Promise<string | null>;
-    /** first currently-active focus id for the product (null when none). */
-    firstActiveFocus: (config: DaemonConfig) => Promise<string | null>;
-}
-/**
- * Resolve the focus a red run's fix routes to. Order: (1) the tip's own
- * `Telora-Delivery` trailer; (2) when the tip is a MERGE (no own trailer), the
- * owning focus of the first trailered commit the merge introduced; (3) fallback
- * to any active focus. The arbitrary-active-focus fallback is reached ONLY when
- * no attributable commit exists at all. Best-effort: any git/DB failure degrades
- * to the fallback / null, never throws.
+ * The ci_run_red filing. Pure and exported so its routing is unit-testable (the
+ * poll-loop tests inject a mock fileCiRedEscalation).
+ *
+ *  - Focus-attributed: agent_resolvable. Fixing a failing CI gate is CODING work;
+ *    the focus whose merge turned integration red carries it into its next coding
+ *    pass (the focus-scoped agent_resolvable pickup).
+ *  - Branch-only: a plain agent_resolvable row reaches no spawn and is never
+ *    promoted, so the red would sit invisible while the merge gate holds main. It
+ *    is proposed needs_operator with an explicit NO_HUMAN_ACT (the fix is still
+ *    coding work, not a human act), so the filing chokepoint files it as a
+ *    detector OBSERVATION, which the anchorless promotion sweep surfaces next pass.
  */
-export declare function resolveOwningFocus(config: DaemonConfig, sha: string, deps?: OwningFocusResolverDeps): Promise<string | null>;
+export declare function ciRunRedEscalationParams(params: CiRedFilingParams): CreateEscalationParams;
 /** Injected IO for the sensor tick. Defaults reach for the real implementations. */
 export interface CiSensorDeps {
     getCiStatus: CiStatusReader;
     resolveIntegrationTip: (config: DaemonConfig) => string | null;
-    /** Resolve the focus a red run's fix routes to (tip-owner, fallback active). */
-    resolveOwningFocus: (config: DaemonConfig, sha: string) => Promise<string | null>;
+    /** Attribute a red run to the focus/delivery whose merge introduced it (branch-only when not determinable). */
+    resolveRedRunAnchor: (config: DaemonConfig, sha: string) => Promise<CiRedRunAnchor>;
     hasOpenCiRedEscalation: (params: {
         productId: string;
         sha: string;
         branch: string;
     }) => Promise<boolean>;
-    fileCiRedEscalation: (params: {
-        organizationId: string;
-        productId: string;
-        focusId: string;
-        sha: string;
-        branch: string;
-    }) => Promise<void>;
+    fileCiRedEscalation: (params: CiRedFilingParams) => Promise<void>;
     resolveCiRedEscalations: (productId: string) => Promise<number>;
 }
 export interface CiSensorTickCounts {

package/dist/ci/ci-sensor-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-sensor-loop.d.ts","sourceRoot":"","sources":["../../src/ci/ci-sensor-loop.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAuD,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAa1G,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAUpE,kDAAkD;AAClD,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAGD,uDAAuD;AACvD,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AACtD,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;AAEnE,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,mBAAmB,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAiB7F;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;CACjE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAW1B;AAED,4EAA4E;AAC5E,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAaD;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,eAAe,EAAE,EAChC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAcT;AAwDD;;;;;;;;;;;GAWG;AACH;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACvD,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpE,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC3D,0DAA0D;IAC1D,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjE,wEAAwE;IACxE,gBAAgB,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AAWD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,uBAAwD,GAC7D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAMD,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,cAAc,CAAC;IAC5B,qBAAqB,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,GAAG,IAAI,CAAC;IAC/D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClF,sBAAsB,EAAE,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzG,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5I,uBAAuB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE;AAWD,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,YAA0B,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAmE7B"}
+{"version":3,"file":"ci-sensor-loop.d.ts","sourceRoot":"","sources":["../../src/ci/ci-sensor-loop.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAuD,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE1G,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAoE,KAAK,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAG1I,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAOjE,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAUpE,kDAAkD;AAClD,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAGD,uDAAuD;AACvD,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AACtD,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;AAEnE,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,mBAAmB,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAiB7F;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,YAAY,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAChG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB;AAED,4EAA4E;AAC5E,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAUpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,eAAe,EAAE,EAChC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAkBT;AAaD;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB/G;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,sBAAsB,CAqB1F;AAMD,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,cAAc,CAAC;IAC5B,qBAAqB,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,GAAG,IAAI,CAAC;IAC/D,+GAA+G;IAC/G,mBAAmB,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACpF,sBAAsB,EAAE,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzG,mBAAmB,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE;AAWD,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAwBD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,YAA0B,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAkD7B"}

package/dist/ci/ci-sensor-loop.js

@@ -1,14 +1,15 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/ci/ci-owning-focus-resolve.test.ts,
-//   packages/daemon/src/ci/ci-sensor-loop.test.ts
+// Pinned by: packages/daemon/src/ci/ci-sensor-loop.test.ts,
+//   packages/daemon/src/queries/incident-correlation.test.ts,
+//   packages/daemon/src/queries/incident-stamping.test.ts
 // PINNED-BY-END
 import { configForProduct } from '../shell/config.js';
 import { decideCiSensorAction, createGitNativeCiStatusReader } from './ci-status.js';
 import { listCiStatusRefs, resolveRemoteIntegrationTip } from './ci-status-git.js';
-import { createEscalation, markEscalationResolved } from '../queries/escalations.js';
-import { getDeliveryContext } from '../queries/deliveries.js';
-import { getActiveFocuses } from '../queries/focus-discovery.js';
-import { readDeliveryTrailer, resolveRecordedMergeRange, listRangeCommits } from '../resolvers/shared/git-diff.js';
+import { resolveRedRunAnchor } from './ci-red-attribution.js';
+import { createEscalation, markEscalationResolved, retireAbsorbedSymptoms } from '../queries/escalations.js';
+import { NO_HUMAN_ACT } from '../queries/filing-observation.js';
+import { openRowSymptomCauseKeys } from '../queries/incident-correlation.js';
 import { callApi } from '../queries/shared.js';
 import { ciRunRedCauseKey } from '../queries/cause-key.js';
 import { ESCALATION_REASONS, ESCALATION_DISPOSITIONS, healthEvents } from '@telora/daemon-core';
@@ -81,15 +82,16 @@ export function ciRunRedEscalationDescription(params) {
         `Do not hand-roll the Gitea API chain or wait for a human to paste the log. Full ` +
         `reference: ${route.runbook}.\n\n` +
         `This filing auto-resolves when a later integration run goes green; if ` +
-        `the machine cannot clear it, the 24h agent_resolvable promotion backstop surfaces ` +
+        `no agent clears it, the agent_resolvable promotion backstop surfaces ` +
         `it to an operator.`);
 }
 /**
  * Structured metadata for a ci_run_red filing: the cause-key routing fields, the
- * posture it sets and that posture's termination condition, PLUS the self-
- * contained `diagnosis` route (see ciLogDiagnosisRoute) so a team inheriting the
- * escalation later reads the same log route the original filing carried. Pure and
- * exported so the metadata contract is unit-testable without mocking createEscalation.
+ * attributed anchor (focus_id / delivery_id, null when branch-only), the posture
+ * it sets and that posture's termination condition, PLUS the self-contained
+ * `diagnosis` route (see ciLogDiagnosisRoute) so a team inheriting the escalation
+ * later reads the same log route the original filing carried. Pure and exported
+ * so the metadata contract is unit-testable without mocking createEscalation.
  */
 export function ciRunRedEscalationMetadata(params) {
     return {
@@ -97,6 +99,7 @@ export function ciRunRedEscalationMetadata(params) {
         branch: params.branch,
         product_id: params.productId,
         focus_id: params.focusId,
+        delivery_id: params.deliveryId ?? null,
         cause_key: ciRunRedCauseKey(params.branch),
         posture: CI_RUN_RED_POSTURE,
         terminates_when: CI_RUN_RED_POSTURE_TERMINATES,
@@ -106,32 +109,46 @@ export function ciRunRedEscalationMetadata(params) {
 const OPEN_STATUSES = new Set(['pending', 'in_review']);
 /** Statuses whose cause_key suppresses a re-file: open (idempotency) + dismissed (memory). */
 const SUPPRESSING_STATUSES = new Set(['pending', 'in_review', 'dismissed']);
-function isOpenCiRedForProduct(e, productId) {
+/** The prefix every ci_run_red cause key carries (queries/cause-key.ciRunRedCauseKey). */
+const CI_RUN_RED_CAUSE_KEY_PREFIX = `${CI_RUN_RED_ESCALATION_KIND}::`;
+/**
+ * An OPEN ci_run_red row for this product, including the two HAND-OFF rows that
+ * stand in for one:
+ *  - a routing decider's human-facing filing (MCP escalate with sourceCauseKey):
+ *    kind agent_filed, carrying metadata.original_cause_key `ci_run_red::...` and
+ *    metadata.originalEscalationId but NO originalKind;
+ *  - a historic promotion-backstop refile (the daemon no longer files these):
+ *    re-kinded agent_resolvable_promoted, carrying metadata.originalKind.
+ * A row's originalKind, when it carries one, is authoritative for its origin; the
+ * original_cause_key prefix decides only for a row without it (the decider's).
+ * Covering both lets a later green resolve the human-facing row too (no stale
+ * inbox item once the red cleared), and keeps an open one suppressing a fresh
+ * branch-only observation. Exported for direct unit testing.
+ */
+export function isOpenCiRedForProduct(e, productId) {
     if (e.status && !OPEN_STATUSES.has(e.status))
         return false;
-    if (e.escalationKind !== CI_RUN_RED_ESCALATION_KIND)
-        return false;
     const meta = e.metadata ?? null;
-    return e.productId === productId || meta?.productId === productId;
+    const originalKind = meta?.originalKind;
+    const originalCauseKey = meta?.original_cause_key;
+    const handedOffCiRed = typeof originalKind === 'string'
+        ? originalKind === CI_RUN_RED_ESCALATION_KIND
+        : typeof originalCauseKey === 'string' && originalCauseKey.startsWith(CI_RUN_RED_CAUSE_KEY_PREFIX);
+    if (e.escalationKind !== CI_RUN_RED_ESCALATION_KIND && !handedOffCiRed)
+        return false;
+    return e.productId === productId || meta?.productId === productId || meta?.product_id === productId;
 }
-/**
- * Whether a re-file for THIS red sha must be suppressed. Two ways it is:
- *   - an OPEN or DISMISSED row already carries the same cause key (sha+branch) --
- *     the cause-keyed path with DISMISSAL MEMORY. This is what fixes the incident
- *     where an operator dismissed a ci_run_red for a sha and the daemon re-filed
- *     the SAME sha on the next scan: a dismissed cause_key now keeps it silent
- *     until a NEW sha (a different cause key) goes red.
- *   - a legacy OPEN product+kind row with no cause_key exists (deployment-window
- *     back-compat for rows filed before this change).
- *
- * A new sha yields a different cause key with no matching open/dismissed row and
- * re-files; a later green run resolves the open row via resolveCiRedEscalations.
- */
 /**
  * Pure suppression predicate over already-fetched rows. A re-file for this red
- * sha is suppressed when an open/dismissed row carries the same cause key
- * (dismissal memory), or a legacy open product+kind row exists. Exported for
- * direct unit testing (no callApi mocking needed).
+ * sha is suppressed when an OPEN or DISMISSED row carries the same cause key
+ * (dismissal memory: an operator-dismissed branch stays silent until a new
+ * breakage resolves and re-reds it), an OPEN row carries it as a live absorbed
+ * symptom (the filing would only be "already carried" by the incident reducer --
+ * and a green tick must still see it open, so resolve-on-green retires it), or a
+ * legacy OPEN product+kind row with no cause_key exists (deployment-window
+ * back-compat). A later green run resolves the open row via
+ * resolveCiRedEscalations. Exported for direct unit testing (no callApi mocking
+ * needed).
  */
 export function isCiRedRefileSuppressed(rows, params) {
     // Branch-scoped: one open ci_run_red per red integration branch. Successive
@@ -140,11 +157,16 @@ export function isCiRedRefileSuppressed(rows, params) {
     return rows.some((e) => {
         // A cause-key match suppresses only for OPEN or DISMISSED rows -- 'resolved'
         // is excluded so a recurrence of the same sha after a green resolve re-files.
+        // original_cause_key marks a hand-off row for a branch-only observation (a
+        // routing decider's filing with sourceCauseKey, or a historic promotion
+        // refile): it must keep suppressing, or the sensor would re-file while it is open.
         if (SUPPRESSING_STATUSES.has(e.status ?? '')) {
             const meta = e.metadata ?? null;
-            if (typeof meta?.cause_key === 'string' && meta.cause_key === causeKey)
+            if (meta?.cause_key === causeKey || meta?.original_cause_key === causeKey)
                 return true;
         }
+        if (openRowSymptomCauseKeys(e).includes(causeKey))
+            return true;
         // Legacy back-compat: an OPEN product+kind row with no cause_key still suppresses.
         return isOpenCiRedForProduct(e, params.productId);
     });
@@ -157,8 +179,16 @@ async function defaultHasOpenCiRedEscalation(params) {
     });
     return isCiRedRefileSuppressed(result.escalations ?? [], params);
 }
-async function defaultResolveCiRedEscalations(productId) {
-    const result = await callApi('escalation_list', {
+/**
+ * Resolve-on-green (the production resolveCiRedEscalations): resolve the product's
+ * open ci_run_red rows (and the hand-off rows standing in for one: a routing decider's
+ * human-facing filing, a historic promoted refile) auto_swept, then retire a ci_run_red
+ * absorbed as a symptom onto another open row of the product (incident contract
+ * rule 6), over the same read. Best-effort per row. Exported with a callApi seam
+ * for tests.
+ */
+export async function defaultResolveCiRedEscalations(productId, deps = {}) {
+    const result = await (deps.callApi ?? callApi)('escalation_list', {
         fields: { statuses: ['pending', 'in_review'] },
         limit: 500,
     });
@@ -166,28 +196,43 @@ async function defaultResolveCiRedEscalations(productId) {
     let resolved = 0;
     for (const e of open) {
         try {
-            await markEscalationResolved(e.id, 'Auto-resolved by the daemon: a later CI run on integration went green.');
+            await markEscalationResolved(e.id, 'auto_swept', 'Auto-resolved by the daemon: a later CI run on integration went green.', deps);
             resolved++;
         }
         catch (err) {
             log.warn(`Failed to resolve ci_run_red escalation ${e.id}: ${err.message}`);
         }
     }
+    const clearing = { kinds: [CI_RUN_RED_ESCALATION_KIND], scope: { productId }, resolutionClass: 'auto_swept' };
+    await retireAbsorbedSymptoms(clearing, { rows: result.escalations ?? [], skipIds: open.map((e) => e.id) }, deps);
     return resolved;
 }
-async function defaultFileCiRedEscalation(params) {
-    await createEscalation({
+/**
+ * The ci_run_red filing. Pure and exported so its routing is unit-testable (the
+ * poll-loop tests inject a mock fileCiRedEscalation).
+ *
+ *  - Focus-attributed: agent_resolvable. Fixing a failing CI gate is CODING work;
+ *    the focus whose merge turned integration red carries it into its next coding
+ *    pass (the focus-scoped agent_resolvable pickup).
+ *  - Branch-only: a plain agent_resolvable row reaches no spawn and is never
+ *    promoted, so the red would sit invisible while the merge gate holds main. It
+ *    is proposed needs_operator with an explicit NO_HUMAN_ACT (the fix is still
+ *    coding work, not a human act), so the filing chokepoint files it as a
+ *    detector OBSERVATION, which the anchorless promotion sweep surfaces next pass.
+ */
+export function ciRunRedEscalationParams(params) {
+    return {
         organizationId: params.organizationId,
         issueId: null,
         reasonType: ESCALATION_REASONS.ERROR_ENCOUNTERED,
-        // Fixing a failing CI gate is CODING work: file it as machine-routable
-        // (hidden from the operator inbox) and anchor it to a focus so the daemon's
-        // focus-scoped agent_resolvable pickup rides it into that focus's next
-        // coding pass. A needs_operator filing only ever comes from the 24h
-        // promotion backstop, after the machine has failed to clear it.
-        disposition: ESCALATION_DISPOSITIONS.AGENT_RESOLVABLE,
+        disposition: params.focusId
+            ? ESCALATION_DISPOSITIONS.AGENT_RESOLVABLE
+            : ESCALATION_DISPOSITIONS.NEEDS_OPERATOR,
+        humanAct: NO_HUMAN_ACT,
         productId: params.productId,
-        focusId: params.focusId,
+        // Branch-only when unattributable: no focus/delivery is guessed.
+        ...(params.focusId ? { focusId: params.focusId } : {}),
+        ...(params.deliveryId ? { deliveryId: params.deliveryId } : {}),
         escalationKind: CI_RUN_RED_ESCALATION_KIND,
         description: ciRunRedEscalationDescription(params),
         // cause_key (branch) collapses successive red tips onto one open filing and
@@ -195,68 +240,40 @@ async function defaultFileCiRedEscalation(params) {
         // The posture + terminates_when keys make the obligation's exit legible from
         // the escalation itself (see ciRunRedEscalationMetadata).
         metadata: ciRunRedEscalationMetadata(params),
-    });
-}
-const defaultOwningFocusResolverDeps = {
-    readTrailer: readDeliveryTrailer,
-    resolveMergeRange: resolveRecordedMergeRange,
-    listCommits: listRangeCommits,
-    focusForDelivery: async (deliveryId) => (await getDeliveryContext(deliveryId))?.focus?.id ?? null,
-    firstActiveFocus: async (config) => (await getActiveFocuses(config.organizationId, config.productId))[0]?.focus_id ?? null,
-};
-/**
- * Resolve the focus a red run's fix routes to. Order: (1) the tip's own
- * `Telora-Delivery` trailer; (2) when the tip is a MERGE (no own trailer), the
- * owning focus of the first trailered commit the merge introduced; (3) fallback
- * to any active focus. The arbitrary-active-focus fallback is reached ONLY when
- * no attributable commit exists at all. Best-effort: any git/DB failure degrades
- * to the fallback / null, never throws.
- */
-export async function resolveOwningFocus(config, sha, deps = defaultOwningFocusResolverDeps) {
-    try {
-        const deliveryId = deps.readTrailer(config.repoPath, sha);
-        if (deliveryId) {
-            const focusId = await deps.focusForDelivery(deliveryId);
-            if (focusId)
-                return focusId;
-        }
-        // Tip has no own trailer (the merge-commit case that made this path degrade
-        // to the arbitrary-active-focus fallback and route red runs to the wrong
-        // focus). Walk the merge's own commits and route to their owning focus.
-        const mergeRange = deps.resolveMergeRange(config.repoPath, sha);
-        if (mergeRange) {
-            for (const commit of deps.listCommits(config.repoPath, mergeRange)) {
-                const did = deps.readTrailer(config.repoPath, commit);
-                if (!did)
-                    continue;
-                const focusId = await deps.focusForDelivery(did);
-                if (focusId)
-                    return focusId;
-            }
-        }
-    }
-    catch (err) {
-        log.debug(`owning-focus trailer resolution failed for ${sha.slice(0, 12)}: ${err.message}`);
-    }
-    try {
-        return await deps.firstActiveFocus(config);
-    }
-    catch (err) {
-        log.debug(`active-focus fallback failed for product ${config.productId}: ${err.message}`);
-        return null;
-    }
+    };
 }
-function defaultResolveOwningFocus(config, sha) {
-    return resolveOwningFocus(config, sha);
+async function defaultFileCiRedEscalation(params) {
+    await createEscalation(ciRunRedEscalationParams(params));
 }
 const defaultDeps = {
     getCiStatus: createGitNativeCiStatusReader(listCiStatusRefs),
     resolveIntegrationTip: resolveRemoteIntegrationTip,
-    resolveOwningFocus: defaultResolveOwningFocus,
+    resolveRedRunAnchor: (config, sha) => resolveRedRunAnchor(config, sha),
     hasOpenCiRedEscalation: defaultHasOpenCiRedEscalation,
     fileCiRedEscalation: defaultFileCiRedEscalation,
     resolveCiRedEscalations: defaultResolveCiRedEscalations,
 };
+/**
+ * Surface a red run that has no team to route to as durable operator-visible
+ * STATE (TEL-6): a health event, not an escalation -- the hold clears itself when
+ * the run goes green. Emitted once per red episode (cleared on green in the tick).
+ * Returns whether this call emitted.
+ */
+function surfaceHeldGate(productId, branch, sha) {
+    const heldKey = `${productId}:${sha}`;
+    if (surfacedHeldGates.has(heldKey))
+        return false;
+    surfacedHeldGates.add(heldKey);
+    healthEvents.emit({
+        severity: 'error',
+        source: `ci:${productId}`,
+        code: MERGE_HELD_NO_RECEIVER_CODE,
+        message: `Integration '${branch}' is RED at ${sha.slice(0, 12)} and the merge gate is holding ` +
+            'main out, but the red could not be attributed to one focus -- there is no team to route ' +
+            'the fix to (filed branch-only). Push a green fix, or pick up the branch-scoped ci_run_red.',
+    });
+    return true;
+}
 /**
  * One CI-result sensor tick over every configured product. Per product: resolve
  * the remote integration tip, read its CI status (fail-closed), and file/resolve
@@ -276,40 +293,26 @@ export async function runCiSensorTick(config, deps = defaultDeps) {
             const hasOpen = await deps.hasOpenCiRedEscalation({ productId: pc.productId, sha, branch: pc.integrationBranch });
             const action = decideCiSensorAction(status, hasOpen);
             if (action === 'file') {
-                const focusId = await deps.resolveOwningFocus(pc, sha);
-                if (!focusId) {
-                    // No armed focus to route the fix to. File nothing and retry next
-                    // tick -- the fail-closed merge gate still holds main out on the red,
-                    // so nothing merges while the signal waits for a team. Filing an
-                    // unanchored agent_resolvable would be invisible forever (never
-                    // ridden, never promoted); a direct needs_operator is exactly the
-                    // inbox line this focus removes.
-                    //
-                    // But the held gate must not be SILENT (TEL-6): surface it as durable
-                    // operator-visible STATE (a health event, not an escalation -- there is
-                    // no human-only act to file, and the hold clears itself when a focus is
-                    // armed or the run goes green). Emitted once per red episode; cleared
-                    // when integration goes green below. This gives the held merge gate a
-                    // receiver even with no focus to anchor an escalation to.
-                    const heldKey = `${pc.productId}:${sha}`;
-                    if (!surfacedHeldGates.has(heldKey)) {
-                        surfacedHeldGates.add(heldKey);
+                const anchor = await deps.resolveRedRunAnchor(pc, sha);
+                await deps.fileCiRedEscalation({
+                    organizationId: pc.organizationId,
+                    productId: pc.productId,
+                    focusId: anchor.focusId,
+                    deliveryId: anchor.deliveryId,
+                    sha,
+                    branch: pc.integrationBranch,
+                });
+                counts.escalationsFiled++;
+                if (anchor.focusId) {
+                    log.warn(`ci_run_red (agent_resolvable) filed for product ${pc.productId}, focus ${anchor.focusId.slice(0, 8)} (integration @ ${sha.slice(0, 12)}).`);
+                }
+                else {
+                    // Not determinable: filed branch-only (never a guessed focus). No team
+                    // rides it, so the held gate must not be SILENT either.
+                    if (surfaceHeldGate(pc.productId, pc.integrationBranch, sha))
                         counts.heldGatesSurfaced++;
-                        healthEvents.emit({
-                            severity: 'error',
-                            source: `ci:${pc.productId}`,
-                            code: MERGE_HELD_NO_RECEIVER_CODE,
-                            message: `Integration '${pc.integrationBranch}' is RED at ${sha.slice(0, 12)} and the ` +
-                                'merge gate is holding main out, but no armed focus owns the fix -- there is no ' +
-                                'team to route it to. Arm a focus on this product (or push a green fix) to clear the hold.',
-                        });
-                    }
-                    log.warn(`CI red on ${pc.integrationBranch} @ ${sha.slice(0, 12)} but no armed focus to route the fix to; holding (merge gate still fail-closed, surfaced as ${MERGE_HELD_NO_RECEIVER_CODE}), will retry.`);
-                    continue;
+                    log.warn(`ci_run_red filed BRANCH-ONLY as an observation for product ${pc.productId} (integration @ ${sha.slice(0, 12)}): the red could not be attributed to one focus, so the promotion sweep surfaces it; merge gate still fail-closed, surfaced as ${MERGE_HELD_NO_RECEIVER_CODE}.`);
                 }
-                await deps.fileCiRedEscalation({ organizationId: pc.organizationId, productId: pc.productId, focusId, sha, branch: pc.integrationBranch });
-                counts.escalationsFiled++;
-                log.warn(`ci_run_red (agent_resolvable) filed for product ${pc.productId}, focus ${focusId.slice(0, 8)} (integration @ ${sha.slice(0, 12)}).`);
             }
             else if (action === 'resolve') {
                 counts.escalationsResolved += await deps.resolveCiRedEscalations(pc.productId);