@webpresso/agent-kit 3.3.0 → 3.3.2

package/dist/esm/cli/commands/init/convergence-apply.js

@@ -14,25 +14,44 @@ export const GIT_PROBE_TIMEOUT_MS = 15_000;
  * raise/lower via `WP_SETUP_COMMIT_TIMEOUT_MS` or `AuthorCommitOptions.commitTimeoutMs`.
  */
 export const DEFAULT_GIT_COMMIT_TIMEOUT_MS = 600_000;
-const GIT_MAX_BUFFER = 1024 * 1024;
-function git(repoRoot, args, timeoutMs) {
+/** Max stdout+stderr retained from probe git subprocesses (Node spawnSync maxBuffer). */
+export const GIT_MAX_BUFFER = 1024 * 1024;
+/**
+ * Max stdout+stderr for the single hookful `git commit`. Quiet hooks cost nothing
+ * (Node does not preallocate); chatty consumer format+audit chains can exceed 1 MiB
+ * and would otherwise die with ENOBUFS+SIGTERM mid-commit.
+ */
+export const GIT_COMMIT_MAX_BUFFER = 16 * 1024 * 1024;
+/** Hook output snippet size kept in first-class failure diagnoses (tail, not head). */
+const HOOK_OUTPUT_SNIPPET_CHARS = 800;
+/** spawnSync error codes that mean maxBuffer / stdio overflow killed the child. */
+const BUFFER_OVERFLOW_ERROR_CODES = new Set(["ENOBUFS", "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"]);
+function git(repoRoot, args, timeoutMs, maxBuffer = GIT_MAX_BUFFER) {
     const result = spawnSync("git", [...args], {
         cwd: repoRoot,
         encoding: "utf8",
         // Node: timeout > 0 arms SIGTERM; 0 / omitted means no artificial wall.
         ...(timeoutMs > 0 ? { timeout: timeoutMs } : {}),
-        maxBuffer: GIT_MAX_BUFFER,
+        maxBuffer,
         stdio: ["ignore", "pipe", "pipe"],
     });
-    const timedOut = result.error !== undefined && "code" in result.error && result.error.code === "ETIMEDOUT";
+    const errorCode = result.error !== undefined && "code" in result.error && result.error.code != null
+        ? String(result.error.code)
+        : null;
+    const timedOut = errorCode === "ETIMEDOUT";
     return {
         ok: result.status === 0 && !result.error,
         stdout: (result.stdout ?? "").trim(),
         stderr: (result.stderr ?? "").trim(),
         timedOut,
         signal: result.signal,
+        errorCode,
     };
 }
+/** True when spawnSync killed the child for maxBuffer / stdio overflow. */
+export function isBufferOverflowErrorCode(code) {
+    return typeof code === "string" && BUFFER_OVERFLOW_ERROR_CODES.has(code);
+}
 /**
  * Resolve the hookful-commit timeout. Preference order:
  * 1. explicit `commitTimeoutMs` option (tests / programmatic callers)
@@ -60,7 +79,10 @@ function appendHookOutput(diagnosis, hookOutput) {
     const trimmed = hookOutput?.trim();
     if (!trimmed)
         return diagnosis;
-    const snippet = trimmed.length > 400 ? `${trimmed.slice(0, 400)}…` : trimmed;
+    // Keep the tail: failing audits / last lines at kill time matter more than husky banner.
+    const snippet = trimmed.length > HOOK_OUTPUT_SNIPPET_CHARS
+        ? `…${trimmed.slice(-HOOK_OUTPUT_SNIPPET_CHARS)}`
+        : trimmed;
     return `${diagnosis}\n--- hook output (truncated) ---\n${snippet}`;
 }
 /** First-class timeout diagnosis; partial hook stdout/stderr is diagnostic only. */
@@ -87,24 +109,57 @@ export function formatCommitInterruptError(options) {
         `Partial hook lines such as "format applied" / "audit … passed" are not success.`;
     return appendHookOutput(diagnosis, options.hookOutput);
 }
+/**
+ * First-class diagnosis when Node spawnSync kills the child because hook/git
+ * output exceeded maxBuffer (ENOBUFS / ERR_CHILD_PROCESS_STDIO_MAXBUFFER).
+ * Distinct from budget timeout and from external signal kills.
+ */
+export function formatCommitBufferError(options) {
+    const code = options.errorCode?.trim() || "ENOBUFS";
+    const diagnosis = `Convergence commit failed because git/hook output exceeded the spawnSync maxBuffer limit ` +
+        `(${options.maxBufferBytes} bytes; Node error ${code}), so no setup commit was authored. ` +
+        `This is a buffer/output-limit failure, not a time budget timeout and not an external kill. ` +
+        `Staged and worktree changes were preserved for remediation. ` +
+        `Reduce hook verbosity, raise the maxBuffer only with measured need, or fix chatty hooks. ` +
+        `Partial hook lines such as "format applied" / "audit … passed" are not success.`;
+    return appendHookOutput(diagnosis, options.hookOutput);
+}
 /**
  * Classify a failed hookful `git commit` result.
  *
- * - `timedOut` (spawnSync ETIMEDOUT) → budget timeout diagnosis
- * - non-null `signal` without timedOut → interrupt diagnosis (names the signal)
- * - otherwise → hook/git stderr when present, else a generic preserved-index message
+ * Order (first match wins):
+ * 1. `timedOut` (spawnSync ETIMEDOUT) → budget timeout diagnosis
+ * 2. buffer overflow (ENOBUFS / ERR_CHILD_PROCESS_STDIO_MAXBUFFER) → buffer-limit diagnosis
+ * 3. non-null `signal` → interrupt diagnosis (names the signal)
+ * 4. otherwise → hook/git stderr when present, else spawn errorCode / generic preserved-index
  *
- * Never lead with bare hook "passed" lines for timeout/interrupt paths.
+ * Never lead with bare hook "passed" lines for first-class failure paths.
  */
-export function classifyCommitFailure(result, timeoutMs) {
+export function classifyCommitFailure(result, timeoutMs, maxBufferBytes = GIT_COMMIT_MAX_BUFFER) {
     const hookOutput = [result.stderr, result.stdout].filter(Boolean).join("\n");
     if (result.timedOut) {
         return formatCommitTimeoutError({ timeoutMs, hookOutput });
     }
+    if (isBufferOverflowErrorCode(result.errorCode)) {
+        return formatCommitBufferError({
+            maxBufferBytes,
+            errorCode: result.errorCode,
+            hookOutput,
+        });
+    }
     if (result.signal) {
         return formatCommitInterruptError({ signal: result.signal, hookOutput });
     }
-    return hookOutput || "git commit failed; hook changes were preserved.";
+    if (hookOutput) {
+        if (result.errorCode) {
+            return `${hookOutput}\n(spawn error ${result.errorCode})`;
+        }
+        return hookOutput;
+    }
+    if (result.errorCode) {
+        return `git commit failed (spawn error ${result.errorCode}); hook changes were preserved.`;
+    }
+    return "git commit failed; hook changes were preserved.";
 }
 /**
  * Prefix every line of a setup failure so multi-line timeout diagnoses stay
@@ -230,13 +285,20 @@ export function authorConvergenceCommit(options) {
     const commitTimeoutMs = resolveCommitTimeoutMs({
         commitTimeoutMs: options.commitTimeoutMs,
     });
-    const commit = git(options.repoRoot, ["commit", "-m", options.message], commitTimeoutMs);
+    const budgetLabel = commitTimeoutMs > 0
+        ? commitTimeoutMs >= 60_000
+            ? `up to ${Math.round(commitTimeoutMs / 60_000)}m`
+            : `up to ${commitTimeoutMs}ms`
+        : "no artificial time wall";
+    // stderr: setup success path stays machine-friendly on stdout; hooks can take minutes.
+    console.error(`wp setup: running repository pre-commit hooks (${budgetLabel})…`);
+    const commit = git(options.repoRoot, ["commit", "-m", options.message], commitTimeoutMs, GIT_COMMIT_MAX_BUFFER);
     if (!commit.ok) {
         return {
             status: "failed",
             ok: false,
             allowlist,
-            error: classifyCommitFailure(commit, commitTimeoutMs),
+            error: classifyCommitFailure(commit, commitTimeoutMs, GIT_COMMIT_MAX_BUFFER),
         };
     }
     const committedHead = probe(["rev-parse", "--verify", "HEAD"]);

package/dist/esm/cli/commands/opencode-probe.d.ts

@@ -71,6 +71,17 @@ export interface OpencodeProbeRunnerInput {
 }
 export type OpencodeProbeRunner = (input: OpencodeProbeRunnerInput) => Promise<OpencodeProbeResult>;
 export declare function isOpencodeProbeEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Spawn a bounded `opencode run` against one account's isolated credential
+ * store and classify the first conclusive thing it says.
+ *
+ * There is no OpenCode Go HTTP endpoint anywhere in this codebase — the review
+ * adapter also reaches the provider only by spawning this binary — so a
+ * subprocess is the only available probe vehicle. Per-account isolation is the
+ * same `XDG_DATA_HOME` trick the review adapter uses, so a probe can never race
+ * a live interactive TUI's global `auth.json`.
+ */
+export declare function spawnOpencodeProbe(input: OpencodeProbeRunnerInput): Promise<OpencodeProbeResult>;
 export interface ProbeOpencodeAccountDeps {
     readonly run?: OpencodeProbeRunner;
     readonly materialize?: (key: string, dataDir: string) => void;

package/dist/esm/cli/commands/opencode-probe.js

@@ -157,7 +157,7 @@ function classifyChunk(captured) {
  * same `XDG_DATA_HOME` trick the review adapter uses, so a probe can never race
  * a live interactive TUI's global `auth.json`.
  */
-function spawnOpencodeProbe(input) {
+export function spawnOpencodeProbe(input) {
     return new Promise((resolve) => {
         let probeCwd;
         try {

package/dist/esm/cli/commands/quality-runner.js

@@ -145,9 +145,13 @@ function renderSummaryLines(summary, transformed, entry, passed) {
     else if (!passed && transformed.rawOutput?.trim()) {
         lines.push(transformed.rawOutput.trimEnd());
     }
-    if (!passed || transformed.truncated) {
+    // Any elided bytes must remain retrievable: fail, clip, OR compaction that
+    // recorded an elision without setting truncated. Hide Full log / retrieve
+    // hints only when the summary still contains the full content.
+    const hasElisions = (transformed.elisions?.length ?? 0) > 0;
+    if (!passed || transformed.truncated || hasElisions) {
         lines.push(`Full log: wp logs ${entry.command}`);
-        if (transformed.elisions && transformed.elisions.length > 0) {
+        if (hasElisions) {
             lines.push(...transformed.elisions.map((elision) => `Retrieve elision: ${elision.retrieveTool} id=${elision.id}`));
         }
     }

package/dist/esm/cli/commands/release-progress.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `wp release-progress` — report Release workflow phase (detect / native-matrix / publish).
+ *
+ * Agents must not poll only `npm view` after Version Packages merge. This command
+ * loads the live GitHub Actions job list and classifies progress via
+ * {@link classifyReleaseRunProgress}.
+ */
+import type { CAC } from "cac";
+import { type ReleaseJobSnapshot, type ReleaseProgress } from "#ci/release-progress.js";
+export declare const RELEASE_PROGRESS_COMMAND_HELP: string;
+export interface GhRunJobsFetcher {
+    (options: {
+        readonly runId: string;
+        readonly repo: string;
+    }): ReleaseJobSnapshot[];
+}
+export interface LatestReleaseRunResolver {
+    (options: {
+        readonly repo: string;
+    }): string;
+}
+/** Production fetcher: `gh run view --json jobs`. */
+export declare function fetchReleaseJobsViaGh(options: {
+    readonly runId: string;
+    readonly repo: string;
+}): ReleaseJobSnapshot[];
+/** Production resolver: latest Release workflow run for the repo. */
+export declare function resolveLatestReleaseRunIdViaGh(options: {
+    readonly repo: string;
+}): string;
+export interface RunReleaseProgressOptions {
+    readonly runId?: string | number;
+    readonly repo?: string;
+    readonly json?: boolean;
+    readonly fetchJobs?: GhRunJobsFetcher;
+    readonly resolveLatestRunId?: LatestReleaseRunResolver;
+    readonly stdout?: {
+        write(chunk: string): void;
+    };
+    readonly stderr?: {
+        write(chunk: string): void;
+    };
+}
+/**
+ * Core command body — injectable for tests; production uses gh CLI defaults.
+ */
+export declare function runReleaseProgress(options?: RunReleaseProgressOptions): {
+    readonly exitCode: number;
+    readonly progress: ReleaseProgress;
+    readonly runId: string;
+    readonly line: string;
+};
+export declare function registerReleaseProgressCommand(cli: CAC): void;

package/dist/esm/cli/commands/release-progress.js

@@ -0,0 +1,155 @@
+/**
+ * `wp release-progress` — report Release workflow phase (detect / native-matrix / publish).
+ *
+ * Agents must not poll only `npm view` after Version Packages merge. This command
+ * loads the live GitHub Actions job list and classifies progress via
+ * {@link classifyReleaseRunProgress}.
+ */
+import { spawnSync } from "node:child_process";
+import { classifyReleaseRunProgress, formatReleaseProgressLine, jobsFromGhRunViewJson, } from "#ci/release-progress.js";
+export const RELEASE_PROGRESS_COMMAND_HELP = [
+    "Report agent-kit Release workflow progress by phase.",
+    "",
+    "Phases: detect | native-matrix | publish | done | failed.",
+    "Use after merging Version Packages so long session-memory native builds are",
+    "not mistaken for a hung merge or silent npm wait.",
+    "",
+    "Examples:",
+    "  wp release-progress",
+    "  wp release-progress --run-id 30152651072",
+    "  wp release-progress --repo webpresso/agent-kit --json",
+].join("\n");
+const DEFAULT_REPO = "webpresso/agent-kit";
+const RELEASE_WORKFLOW = "release.yml";
+function runGhJson(args) {
+    const result = spawnSync("gh", [...args], {
+        encoding: "utf8",
+        timeout: 60_000,
+        maxBuffer: 8 * 1024 * 1024,
+    });
+    if (result.error)
+        throw result.error;
+    if ((result.status ?? 1) !== 0) {
+        const stderr = (result.stderr ?? "").trim();
+        throw new Error(stderr || `gh ${args.join(" ")} failed (exit ${result.status ?? 1})`);
+    }
+    const stdout = (result.stdout ?? "").trim();
+    if (!stdout)
+        throw new Error(`gh ${args.join(" ")} returned empty stdout`);
+    return JSON.parse(stdout);
+}
+/** Production fetcher: `gh run view --json jobs`. */
+export function fetchReleaseJobsViaGh(options) {
+    const payload = runGhJson([
+        "run",
+        "view",
+        options.runId,
+        "--repo",
+        options.repo,
+        "--json",
+        "jobs,status,conclusion,url,displayTitle",
+    ]);
+    return jobsFromGhRunViewJson(payload);
+}
+/** Production resolver: latest Release workflow run for the repo. */
+export function resolveLatestReleaseRunIdViaGh(options) {
+    const payload = runGhJson([
+        "run",
+        "list",
+        "--repo",
+        options.repo,
+        "--workflow",
+        RELEASE_WORKFLOW,
+        "--limit",
+        "1",
+        "--json",
+        "databaseId,status,displayTitle",
+    ]);
+    if (!Array.isArray(payload) || payload.length === 0) {
+        throw new Error(`No Release workflow runs found for ${options.repo}`);
+    }
+    const first = payload[0];
+    const id = first.databaseId;
+    if (typeof id === "number" && Number.isFinite(id))
+        return String(id);
+    if (typeof id === "string" && id.trim())
+        return id.trim();
+    throw new Error("Latest Release run is missing databaseId");
+}
+function coerceNonEmptyString(value) {
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        return trimmed.length > 0 ? trimmed : undefined;
+    }
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return undefined;
+}
+/**
+ * Core command body — injectable for tests; production uses gh CLI defaults.
+ */
+export function runReleaseProgress(options = {}) {
+    const repo = coerceNonEmptyString(options.repo) || DEFAULT_REPO;
+    const resolveLatest = options.resolveLatestRunId ?? resolveLatestReleaseRunIdViaGh;
+    const fetchJobs = options.fetchJobs ?? fetchReleaseJobsViaGh;
+    const stdout = options.stdout ?? process.stdout;
+    const stderr = options.stderr ?? process.stderr;
+    // cac may parse purely numeric --run-id values as numbers; coerce before trim.
+    const runId = coerceNonEmptyString(options.runId) || resolveLatest({ repo });
+    const jobs = fetchJobs({ runId, repo });
+    const progress = classifyReleaseRunProgress(jobs);
+    const line = formatReleaseProgressLine(progress);
+    if (options.json) {
+        stdout.write(`${JSON.stringify({
+            runId,
+            repo,
+            phase: progress.phase,
+            detail: progress.detail,
+            native: progress.native,
+            publishRunning: progress.publishRunning,
+            publishDone: progress.publishDone,
+            publishFailed: progress.publishFailed,
+            line,
+        }, null, 2)}\n`);
+    }
+    else {
+        stdout.write(`${line}\n`);
+        stdout.write(`  run-id: ${runId}\n`);
+        stdout.write(`  repo: ${repo}\n`);
+        if (progress.phase === "done") {
+            stdout.write("  next: npm view @webpresso/agent-kit version  # only after phase=done\n");
+        }
+        else if (progress.phase === "native-matrix" || progress.phase === "publish") {
+            stdout.write("  note: do not treat npm view alone as progress; matrix/publish still running\n");
+        }
+    }
+    if (progress.phase === "failed") {
+        stderr.write(`wp release-progress: ${progress.detail}\n`);
+        return { exitCode: 1, progress, runId, line };
+    }
+    return { exitCode: 0, progress, runId, line };
+}
+export function registerReleaseProgressCommand(cli) {
+    cli
+        .command("release-progress", RELEASE_PROGRESS_COMMAND_HELP)
+        .option("--run-id <id>", "GitHub Actions run id (default: latest Release workflow run)")
+        .option("--repo <owner/name>", `GitHub repo (default: ${DEFAULT_REPO})`)
+        .option("--json", "Emit structured JSON")
+        .action((flags) => {
+        try {
+            const result = runReleaseProgress({
+                runId: flags.runId,
+                repo: flags.repo,
+                json: Boolean(flags.json),
+            });
+            process.exitCode = result.exitCode;
+            return result.exitCode;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            process.stderr.write(`wp release-progress: ${message}\n`);
+            process.exitCode = 1;
+            return 1;
+        }
+    });
+}

package/dist/esm/cli/commands/review.js

@@ -167,6 +167,11 @@ function resolveReviewModel(provider, model) {
     const fableVersion = /^fable[-\s]?(\d+)$/iu.exec(model)?.[1];
     return fableVersion ? `claude-fable-${fableVersion}` : model;
 }
+// How many DISTINCT rejected semantic subjects are allowed before the anti-runaway
+// budget cap trips. Identical resubmissions never reach here (they reuse the prior
+// rejection for free), so this only bounds genuinely different converging attempts.
+// A human may extend past it in place with WP_REVIEW_SCOPE_CONTINUE=1 (recorded).
+const REVIEW_SUBJECT_REJECTION_LIMIT = 4;
 function classificationForFailureCode(code) {
     if (!code)
         return undefined;
@@ -182,6 +187,7 @@ function isLocalReviewFailureCode(code) {
         code === "expected-marker-missing" ||
         code === "missing-terminal-result" ||
         code === "semantic-progress-budget-exceeded" ||
+        code === "sandbox-unavailable" ||
         code.startsWith("provider-stdin-"));
 }
 function reviewRunTerminalClassification(summary) {
@@ -1157,16 +1163,24 @@ const reviewGateAttemptSchema = z.object({
 });
 const reviewGateVerificationCommandSchema = z.object({
     command: z.string(),
-    outcome: z.enum(["passed", "failed", "timed-out"]),
+    // "deferred" is produced for approval-dependent lifecycle gates
+    // (delivery-verifier.ts) and persisted into gate state, so it MUST round-trip
+    // through the reload schema or resumption/reuse of a lifecycle-gated review
+    // throws "Review gate state is malformed".
+    outcome: z.enum(["passed", "failed", "timed-out", "deferred"]),
     durationMs: z.number(),
     exitCode: z.number().nullable(),
     signal: z.string().optional(),
 });
+const _assertVerificationCommandReloadable = true;
+void _assertVerificationCommandReloadable;
 const reviewGateVerificationSchema = z.object({
     status: z.enum(["passed", "failed"]),
     commands: z.array(reviewGateVerificationCommandSchema),
     failureCode: z.string().optional(),
     logPath: z.string().optional(),
+    sandbox: z.enum(["srt", "disabled-by-operator", "unavailable"]).optional(),
+    sandboxReason: z.string().optional(),
 });
 const reviewGateStateSchema = z
     .object({
@@ -1259,15 +1273,42 @@ function buildGatePrompt(input) {
         ...(input.priorRejections && input.priorRejections.length > 0
             ? [
                 "",
-                "Prior formal rejection evidence (this is the final semantic remediation review):",
+                "Prior formal rejection evidence for this converging change:",
                 ...input.priorRejections.map((entry) => `- ${entry.subjectDigest}: ${entry.artifactPath}`),
-                "Inspect every prior finding and its disposition. Return all remaining blockers together; do not defer discoverable blockers to another review round.",
+                "For each prior finding, state its disposition (fixed / still-open / not-a-blocker) with evidence.",
                 "",
             ]
             : []),
-        "Inspect the target SHA and blueprint directly. Focus on correctness, security, concurrency, recovery, tests, and scope compliance.",
+        "Inspect the target SHA and blueprint directly.",
+        "",
+        "This is a CONVERGENCE gate. Your goal is to surface EVERY blocker in ONE pass so the author can fix them all at once; a blocker you leave for a later round costs a full review cycle. Be exhaustive, not incremental.",
+        "",
+        'Walk ALL of these dimensions in order. For EACH, either report specific findings or write "no blocker". Do not skip a dimension and do not stop early:',
+        "1. Correctness & logic — wrong results, edge cases, off-by-one, error handling.",
+        "2. Security & trust boundaries — trace EVERY place external or target-controlled input, config, or code influences execution, file writes, network, or process spawning, and confirm each is confined. Untrusted code or config that runs with insufficient isolation is a blocker.",
+        "3. Concurrency & races — shared state, ordering, cleanup-vs-use races.",
+        "4. Resource, recovery & process lifecycle — timeouts, orphaned/daemonized processes, unbounded growth, cleanup ordering, and every failure/cancellation path.",
+        "5. Test coverage adequacy — is every material claim backed by a test that would FAIL if the claim were false? Name the specific missing test; a claim asserted but not exercised by a test is a blocker.",
+        "6. Scope & spec compliance — does the delivered code match the blueprint's stated decisions and claims?",
+        "7. Documentation & lifecycle accuracy — do the blueprint's stated status, evidence, and verified-head match reality?",
+        "",
+        "For EVERY finding, include all three of:",
+        "- Trigger: a concrete scenario or input that produces the failure. If you cannot name one, do not flag it as a blocker.",
+        "- Severity: BLOCKER (must fix to ship) or NIT (non-blocking), plus a one-line confidence note.",
+        "- Fix: the concrete change to make; when there is a real tradeoff, give 2 options with their costs so the author can choose and fix in one pass.",
+        "",
+        "Only flag as BLOCKER what a concrete failing scenario justifies. When impact is high (data loss, security, corruption) but your confidence is limited, still report it as a BLOCKER and state explicitly what remains uncertain — do not omit it.",
+        "",
+        "Before the verdict, do a COMPLETENESS pass: list what you did NOT inspect or could not verify that might still hide a blocker. If that list contains a plausible high-impact gap, convert it into a finding rather than leaving it for a later round.",
+        ...(input.purpose === "delivery"
+            ? [
+                "",
+                "Blueprint lifecycle scope: this delivery review judges the CODE at the target SHA. Blueprint lifecycle advancement — moving tasks to `done`, checking acceptance criteria, and transitioning the blueprint out of `draft` into `completed/` — happens AFTER this approval, at landing. A blueprint that is still `status: draft` with `todo` tasks and unchecked acceptance is EXPECTED here and is NOT a blocker: the lifecycle audit requires a draft to have zero checked acceptance, and a blueprint cannot leave `draft` without the very approval this review would grant. Do verify that the blueprint's stated verified-head matches the target and that its documented decisions match the delivered code; do NOT block on draft/todo lifecycle state.",
+            ]
+            : []),
+        "",
         "End with exactly one standalone verdict line: APPROVED, APPROVE-WITH-NITS, or BLOCKED.",
-        "APPROVE-WITH-NITS satisfies the gate only when every finding is non-blocking.",
+        "APPROVE-WITH-NITS satisfies the gate only when every finding is a NIT and carries a proposed fix.",
         "If any unresolved correctness, security, recovery, test, or scope blocker remains, end with BLOCKED.",
     ].join("\n");
 }
@@ -1886,7 +1927,7 @@ function rejectedReviewSubjects(input) {
  */
 export function reviewGateNonConvergenceHint(slug, context = {}) {
     if (context.status === "scope-exhausted") {
-        return `hint: formal review budget is exhausted for ${slug}. Stop automated review retries and obtain an explicit human scope decision before creating a successor blueprint.`;
+        return `hint: formal review budget is exhausted for ${slug} after ${REVIEW_SUBJECT_REJECTION_LIMIT} rejected semantic subjects. Stop automated review retries. If you have addressed the prior findings and this is a good-faith converging attempt, a human may record an explicit scope decision and continue reviewing this blueprint in place by setting WP_REVIEW_SCOPE_CONTINUE=1 — no successor blueprint is needed.`;
     }
     if (context.failureCode === "provider-event-too-large" && context.gateId) {
         return `hint: provider transport emitted a single provider JSON event above the bounded capture limit for ${slug}; no review verdict was produced. Retry the unchanged gate with "wp review gate ${slug} --resume ${context.gateId} --provider <provider>" and select a different provider when possible. Retrying the same provider/model is allowed for recovery but is likely to recur for deterministic oversized output. An independent "wp review run" can be recorded only as a human-adjudicated verdict through wp_blueprint_review_log; that tool cannot create a Claude/Codex/Grok/OpenCode-Go approval. The event-size and timeout bounds were not increased. See catalog/agent/rules/pre-implementation.md.`;
@@ -2114,7 +2155,7 @@ export async function runReviewGate(projectRoot, slug, input, dependencies = { i
             // (verifyDeliveryPromotionGates is a no-op for every other purpose).
             const deliveryCheckout = purpose === "delivery" ? ensureSharedCheckout() : undefined;
             if (deliveryCheckout) {
-                verification = verifyDeliveryPromotionGates({
+                verification = await verifyDeliveryPromotionGates({
                     purpose,
                     blueprintContent,
                     projectRoot,
@@ -2122,6 +2163,9 @@ export async function runReviewGate(projectRoot, slug, input, dependencies = { i
                     checkout: deliveryCheckout,
                     ...(dependencies.signal ? { signal: dependencies.signal } : {}),
                 });
+                if (verification?.sandbox === "disabled-by-operator") {
+                    process.stderr.write("WARNING: WP_REVIEW_UNSANDBOXED_GATES=1 — delivery gates ran WITHOUT OS isolation (recorded as disabled-by-operator; approval reuse is disabled so this run publishes committed evidence).\n");
+                }
                 const summary = verificationPromptSummary(verification);
                 if (summary) {
                     prompt = renderPrompt(summary);
@@ -2135,7 +2179,11 @@ export async function runReviewGate(projectRoot, slug, input, dependencies = { i
                 }
             }
             let approvalGate = currentApprovalGate();
-            if (approvalGate.satisfied) {
+            // Under an unsandboxed operator override, never take the approval-reuse
+            // fast path: force a fresh provider review so the run publishes a
+            // committed artifact carrying `Sandbox: disabled-by-operator`. (The
+            // override is also recorded in the persisted gate state on every path.)
+            if (approvalGate.satisfied && verification?.sandbox !== "disabled-by-operator") {
                 const result = makeResult(approvalGate, reusedApprovals.length > 0 ? "approved" : "recorded-untracked");
                 assertReviewRefUnchanged(projectRoot, input.target ?? "HEAD", targetSha);
                 persistGateState(projectRoot, result);
@@ -2157,15 +2205,30 @@ export async function runReviewGate(projectRoot, slug, input, dependencies = { i
                 cleanupSharedCheckout();
                 return result;
             }
-            if (rejectedSubjects.length >= 2) {
-                const result = makeResult(approvalGate, "scope-exhausted", "Formal review budget exhausted after two rejected semantic subjects. No review provider was invoked; stop and obtain an explicit human scope decision before creating a successor blueprint.");
+            // Anti-runaway budget cap. Identical resubmissions are already
+            // short-circuited for free by the currentSubjectRejection check above, so
+            // this only ever fires on GENUINELY DIFFERENT (converging) subjects —
+            // i.e. changes that addressed the prior findings. That is legitimate
+            // iteration, not thrash, so a human MAY record an explicit in-place scope
+            // decision to continue reviewing THIS blueprint instead of being forced to
+            // fork a successor (which would only launder the counter). Automated runs
+            // do not set the flag and still hard-stop.
+            if (rejectedSubjects.length >= REVIEW_SUBJECT_REJECTION_LIMIT &&
+                process.env["WP_REVIEW_SCOPE_CONTINUE"] !== "1") {
+                const result = makeResult(approvalGate, "scope-exhausted", `Formal review budget exhausted after ${REVIEW_SUBJECT_REJECTION_LIMIT} rejected semantic subjects; no reviewer was invoked. If you have addressed the prior findings and this is a good-faith converging attempt, set WP_REVIEW_SCOPE_CONTINUE=1 to record an explicit human scope decision and continue reviewing this blueprint — no successor blueprint is needed. Automated runs must stop and escalate.`);
                 assertReviewRefUnchanged(projectRoot, input.target ?? "HEAD", targetSha);
                 persistGateState(projectRoot, result);
                 cleanupSharedCheckout();
                 return result;
             }
+            if (rejectedSubjects.length >= REVIEW_SUBJECT_REJECTION_LIMIT) {
+                // Recorded for audit: the operator explicitly extended the budget past
+                // the cap for this converging attempt. The reviewer's verdict is still
+                // required — the approval gate itself is unchanged.
+                gateIssues.push(`human scope-continue: WP_REVIEW_SCOPE_CONTINUE=1 extended the review budget past ${rejectedSubjects.length} rejected subjects`);
+            }
             if (rejectedSubjects.length > 0) {
-                prompt = renderPrompt(verification ? verificationPromptSummary(verification) : undefined, rejectedSubjects.slice(0, 2));
+                prompt = renderPrompt(verification ? verificationPromptSummary(verification) : undefined, rejectedSubjects.slice(0, REVIEW_SUBJECT_REJECTION_LIMIT));
             }
             const artifactDirectory = path.join(path.dirname(location.path), "review-artifacts");
             if (existsSync(artifactDirectory) && lstatSync(artifactDirectory).isSymbolicLink()) {

package/dist/esm/cli/commands/typecheck.js

@@ -24,7 +24,7 @@ export const TYPECHECK_COMMAND_HELP = [
     "  wp typecheck --affected --branch     # changed vs origin/${GITHUB_BASE_REF:-main}",
     "  wp typecheck --pretty",
     "  wp typecheck --tests                 # test-surface lane (tsconfig.test.json); required in",
-    "                                        # not part of the default gate or ci-preflight yet",
+    "                                        # ci-preflight and CI (not the default untargeted gate)",
 ].join("\n");
 export function registerTypecheckCommand(cli, deps = {}) {
     addAffectedOptions(cli

package/dist/esm/cli/commands/worktree/router-dispatch.d.ts

@@ -55,6 +55,12 @@ export interface MergeCleanupDecisionInput {
     readonly repoDirty: boolean;
     readonly targetDirty: boolean;
     readonly stashPrimary?: boolean;
+    /**
+     * When target is dirty, optional porcelain -z + slug enrich the refusal message
+     * (scaffold-only vs other dirt). Omitted messages stay generic for unit tests.
+     */
+    readonly targetPorcelainZ?: string;
+    readonly targetBlueprintSlug?: string;
 }
 export interface NewWorktreeTargetInput {
     branch?: string;
@@ -97,4 +103,6 @@ export interface CreateManagedWorktreeResult {
 export declare function formatWorktreeList(entries: WorktreeEntry[], currentWorktreePath: string): string[];
 export declare function formatManagedWorktreeList(entries: readonly ManagedWorktreeEntry[]): string[];
 export declare function createManagedWorktree(opts?: CreateManagedWorktreeOptions): Promise<CreateManagedWorktreeResult>;
+/** `.../blueprints/<slug>/owner` → slug */
+export declare function inferBlueprintSlugFromOwnerPath(ownerPath: string): string | undefined;
 export declare function executeWorktreeSubcommand(subcommand: string, args: string[], opts: WorktreeCommandOptions): Promise<void>;