@wildorder/nightshift 0.3.1 → 0.5.0

package/dist/run-program.js

@@ -2,13 +2,18 @@ import { execFile } from "node:child_process";
 import { readFile, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { promisify } from "node:util";
-import { defaultAgentRunner, defaultVerifyRunner, describeAgent, resolveAgent, resolveDeciderAgent, resolveRecoveryAgent, tail, } from "./agent-runner.js";
+import { defaultAgentRunner, defaultVerifyRunner, describeAgent, invokeAgent, resolveAgent, resolveDeciderAgent, resolveRecoveryAgent, resolveReviewerAgent, tail, } from "./agent-runner.js";
 import { resolveSummary, summaryContract } from "./agent-summary.js";
+import { authorProgram } from "./author.js";
 import { decisionContract, decisionFingerprint, extractDecisions, } from "./decision.js";
 import { appendLedgerEvents, readDecisionLedger, } from "./decision-ledger.js";
+import { reviewDecisions } from "./decider-review.js";
 import { findCycles, stableTopologicalOrder } from "./graph.js";
+import { extractFindings, findingsContract, findingsToLedgerEvents, renderPassReport, reviewerAbsentOutcome, runReviewPass, } from "./review-pass.js";
 import { loadManifest, saveManifest, } from "./manifest.js";
 const execFileAsync = promisify(execFile);
+/** Matches every wording git uses to report an empty commit attempt. */
+const NOTHING_TO_COMMIT = /nothing to commit|nothing added to commit|no changes added to commit/u;
 export const defaultGitOps = {
     async isRepository(cwd) {
         try {
@@ -36,7 +41,25 @@ export const defaultGitOps = {
         catch (error) {
             const output = String(error.stdout ?? "");
             // An empty commit is not a failure; anything else is.
-            if (/nothing to commit|nothing added to commit/u.test(output)) {
+            if (NOTHING_TO_COMMIT.test(output)) {
+                return undefined;
+            }
+            throw error;
+        }
+        return this.currentCommit(cwd);
+    },
+    async commitPaths(cwd, message, paths) {
+        await execFileAsync("git", ["add", "--", ...paths], { cwd });
+        try {
+            await execFileAsync("git", ["commit", "-m", message], { cwd });
+        }
+        catch (error) {
+            const output = String(error.stdout ?? "");
+            // An empty commit is not a failure; anything else is. Unlike
+            // commitAll's `add -A`, a scoped `add` can leave other files dirty,
+            // which makes git report "no changes added to commit" instead of
+            // "nothing to commit" — both mean the same thing here.
+            if (NOTHING_TO_COMMIT.test(output)) {
                 return undefined;
             }
             throw error;
@@ -64,15 +87,56 @@ export const defaultGitOps = {
             return [];
         }
     },
+    async isAncestor(cwd, ancestor, descendant) {
+        try {
+            await execFileAsync("git", ["merge-base", "--is-ancestor", ancestor, descendant], { cwd });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    async resetHard(cwd, commit) {
+        await execFileAsync("git", ["reset", "--hard", commit], { cwd });
+    },
+    async createRef(cwd, ref, commit) {
+        await execFileAsync("git", ["update-ref", ref, commit], { cwd });
+    },
 };
-const DIFF_LIMIT = 20_000;
-function implementerBrief(manifest, workstream, spec, priorFailure) {
+/**
+ * Ledger decisions for one workstream, projected into its brief. A
+ * human-decided record is binding — the implementer is told to build that
+ * choice, not re-decide it; a ratified record is context, what the decider
+ * already blessed. Escalated and unratified records carry no authority yet
+ * and are left out.
+ */
+function decisionsRuledOnSection(records) {
+    if (records.length === 0)
+        return [];
+    const lines = ["## Decisions already ruled on", ""];
+    for (const record of records) {
+        if (record.status === "human-decided") {
+            lines.push(`- **${record.decision.title}** — binding: the human ruled ` +
+                `\`${record.humanChosen}\` — ${record.humanReason}. Implement ` +
+                "that choice; it is not yours or the decider's to revisit.");
+        }
+        else {
+            lines.push(`- **${record.decision.title}** — context: ratified as ` +
+                `\`${record.decision.chosen}\` — ${record.reviewRationale ?? record.decision.rationale}.`);
+        }
+    }
+    lines.push("");
+    return lines;
+}
+function implementerBrief(manifest, workstream, spec, ledger, priorFailure) {
     const roster = manifest.workstreams
         .map((entry) => {
         const scope = entry.scope?.summary ?? entry.name;
         return `- ${entry.id} ${entry.name}: ${scope}`;
     })
         .join("\n");
+    const relevantDecisions = ledger.decisions.filter((record) => record.workstream === workstream.id &&
+        (record.status === "human-decided" || record.status === "ratified"));
     return [
         `# Workstream ${workstream.id}: ${workstream.name}`,
         "",
@@ -84,6 +148,7 @@ function implementerBrief(manifest, workstream, spec, priorFailure) {
         "",
         roster,
         "",
+        ...decisionsRuledOnSection(relevantDecisions),
         ...(priorFailure
             ? [
                 "## Previous attempt failed",
@@ -114,71 +179,6 @@ function implementerBrief(manifest, workstream, spec, priorFailure) {
         summaryContract(),
     ].join("\n");
 }
-function deciderBrief(manifest, record, diff) {
-    const clippedDiff = diff.length > DIFF_LIMIT
-        ? `${diff.slice(0, DIFF_LIMIT)}\n… (diff clipped at ${DIFF_LIMIT} characters)`
-        : diff;
-    return [
-        "# Review one decision",
-        "",
-        `Program: ${manifest.program.id} — ${manifest.program.name}`,
-        `Workstream: ${record.workstream}`,
-        "",
-        "An implementing agent made the judgment call below and continued. Your",
-        "job is to review that one decision — not the code style, not the whole",
-        "diff — from the program's point of view. You never edit anything.",
-        "",
-        "```json",
-        JSON.stringify(record.decision, null, 2),
-        "```",
-        "",
-        "The work that resulted:",
-        "",
-        "```diff",
-        clippedDiff.trim() === "" ? "(no diff available)" : clippedDiff,
-        "```",
-        "",
-        "Reply with exactly one verdict block:",
-        "",
-        "```verdict",
-        "{",
-        '  "verdict": "ratify" | "escalate",',
-        '  "rationale": "One or two sentences, written for the human who reads the run report."',
-        "}",
-        "```",
-        "",
-        "Ratify when the choice is defensible — it does not have to be the one",
-        "you would have made. Escalate when the choice materially affects",
-        "user-visible behavior, data, or a public contract AND you believe the",
-        "human would plausibly choose differently; say what you would ask them.",
-        "One review, one verdict: this is a judgment, not a dialogue.",
-    ].join("\n");
-}
-function extractVerdict(output) {
-    const matches = [...output.matchAll(/```verdict[^\S\r\n]*\r?\n([\s\S]*?)```/gu)];
-    for (const match of matches.reverse()) {
-        try {
-            const parsed = JSON.parse(match[1] ?? "");
-            if ((parsed.verdict === "ratify" || parsed.verdict === "escalate") &&
-                typeof parsed.rationale === "string") {
-                return { verdict: parsed.verdict, rationale: parsed.rationale };
-            }
-        }
-        catch {
-            // Try an earlier block.
-        }
-    }
-    return undefined;
-}
-async function invokeAgent(runner, agent, prompt, cwd) {
-    return runner({
-        command: agent.command,
-        args: agent.args,
-        prompt,
-        promptMode: agent.promptMode,
-        cwd,
-    });
-}
 /** Every workstream in the transitive downstream cone of the given ids. */
 export function downstreamCone(workstreams, rootIds) {
     const cone = new Set(rootIds);
@@ -216,7 +216,7 @@ export async function runProgram(options) {
     const git = options.git ?? defaultGitOps;
     const log = options.log ?? ((line) => console.log(line));
     const now = options.now ?? (() => new Date());
-    const manifest = await loadManifest(root, options.programId);
+    let manifest = await loadManifest(root, options.programId);
     const resolvedAgent = resolveAgent(config);
     if (!resolvedAgent) {
         throw new Error("No implementer configured. Set the `agent` block in nightshift.config.json.");
@@ -224,10 +224,14 @@ export async function runProgram(options) {
     const agent = resolvedAgent;
     const recovery = resolveRecoveryAgent(config);
     const decider = resolveDeciderAgent(config);
+    const reviewer = resolveReviewerAgent(config);
     log(`implementer: ${describeAgent(agent)}`);
     log(decider
         ? `decider: ${describeAgent(decider)}`
         : "decider: none configured — implementer defaults will stand unratified");
+    log(reviewer
+        ? `test critique reviewer: ${describeAgent(reviewer)}`
+        : "test critique reviewer: none configured — test critique disabled");
     const cycles = findCycles(manifest.workstreams);
     if (cycles.length > 0) {
         // A cyclic graph cannot be ordered; this is a planning defect, not a
@@ -248,16 +252,41 @@ export async function runProgram(options) {
         // The runner's own artifacts under docs/programs/ are exempt: they are
         // output, not work in progress.
         const dirty = (await git.dirtyPaths(root)).filter((path) => !path.replaceAll("\\", "/").startsWith("docs/programs/"));
-        const resuming = manifest.workstreams.some((workstream) => workstream.status === "failed" || workstream.status === "in_progress");
+        const resuming = manifest.workstreams.some((workstream) => workstream.status === "failed" ||
+            workstream.status === "in_progress" ||
+            workstream.status === "parked");
         if (dirty.length > 0 && !resuming) {
             throw new Error(`The working tree has uncommitted changes the run would sweep into its commits:\n` +
                 dirty.map((path) => `  ${path}`).join("\n") +
                 `\nCommit or stash them, then re-run.`);
         }
     }
+    // Authoring runs before building: every workstream whose spec is missing
+    // gets one, in dependency order, before anything is implemented. It
+    // reloads the manifest afterward because authoring may have merged
+    // discovered dependency edges or parked workstreams it could not author.
+    const authorResult = await authorProgram({
+        cwd: options.cwd,
+        programId: options.programId,
+        config,
+        agentRunner,
+        git,
+        log,
+        now,
+    });
+    manifest = await loadManifest(root, options.programId);
+    // Loaded once so every brief in this run projects the same picture of
+    // human-decided and ratified choices; decisions this run itself journals
+    // are picked up fresh by `readDecisionLedger` at the end, for escalations.
+    const ledgerAtStart = await readDecisionLedger(root, options.programId);
     const ordered = stableTopologicalOrder(manifest.workstreams);
     const results = [];
-    const blocked = new Set();
+    // Seeded with every workstream whose spec authoring failed or parked —
+    // their briefs would be missing a producer's spec, so the build stage
+    // must not attempt them this run either.
+    const blocked = new Set(authorResult.results
+        .filter((entry) => entry.outcome.status === "failed" || entry.outcome.status === "parked")
+        .map((entry) => entry.id));
     for (const workstream of ordered) {
         if (workstream.status === "complete") {
             results.push({
@@ -299,9 +328,9 @@ export async function runProgram(options) {
     manifest.program.status = complete ? "complete" : "partial";
     await saveManifest(root, options.programId, manifest);
     const reportPath = join(root, "docs", "programs", `${options.programId}-run-report.md`);
-    await writeFile(reportPath, renderRunReport(manifest, results, ledger.decisions, escalations, now()), "utf8");
+    await writeFile(reportPath, renderRunReport(manifest, results, ledger.decisions, escalations, authorResult, now()), "utf8");
     if (isRepository) {
-        await git.commitAll(root, `nightshift(${options.programId}): run report and decision ledger`);
+        await git.commitPaths(root, `nightshift(${options.programId}): run report and decision ledger`, ["docs/programs"]);
     }
     log(`run report: ${reportPath}`);
     return {
@@ -344,7 +373,7 @@ export async function runProgram(options) {
         }
         for (const [index, attempt] of attempts.entries()) {
             log(`${workstream.id} ${workstream.name}: ${attempt.label} attempt`);
-            const brief = implementerBrief(manifest, workstream, spec, priorFailure);
+            const brief = implementerBrief(manifest, workstream, spec, ledgerAtStart, priorFailure);
             const invocation = await invokeAgent(agentRunner, attempt.agent, brief, root);
             const summary = resolveSummary(invocation.output);
             base.summary = summary.text;
@@ -352,18 +381,65 @@ export async function runProgram(options) {
             base.decisionErrors.push(...parsed.errors);
             await journalDecisions(workstream, parsed.decisions, baseCommit);
             base.decisionIds = parsed.decisions.map((decision) => decisionFingerprint(workstream.id, decision));
-            const failure = await verifyAttempt(invocation.exitCode);
+            const failure = await verifyAttempt(config, verifyRunner, root, invocation.exitCode);
             if (failure === undefined) {
-                workstream.status = "complete";
-                await saveManifest(root, options.programId, manifest);
-                let commit;
+                let c0;
                 if (isRepository) {
-                    commit = await git.commitAll(root, `nightshift(${options.programId}): ${workstream.id} ${workstream.name}`);
+                    // Unlike the authoring, run-report, and replay commits, this one
+                    // stays a whole-tree sweep: an implementing agent touches whatever
+                    // files the work required, and that set is exactly what the
+                    // runner cannot know in advance. c0 is the green anchor the test
+                    // critique's fix loop resets to on a failing fix (SC-07).
+                    c0 = await git.commitAll(root, `nightshift(${options.programId}): ${workstream.id} ${workstream.name}`);
                 }
-                await reviewDecisions(workstream, parsed.decisions, baseCommit);
+                const critique = isRepository && c0 !== undefined
+                    ? await runTestCritique({
+                        root,
+                        manifest,
+                        workstream,
+                        spec,
+                        config,
+                        agentRunner,
+                        verifyRunner,
+                        git,
+                        reviewer,
+                        agent,
+                        baseCommit,
+                        greenCommit: c0,
+                        now,
+                        log,
+                    })
+                    : undefined;
+                // The manifest's single commit field records the workstream's final
+                // verified state — after any kept fix, that is the fix commit, not
+                // the earlier green one.
+                const finalCommit = critique?.finalCommit ?? c0;
+                // Findings anchor to c0 (the green, pre-critique commit) — the
+                // honest rollback point — while the decider below diffs from
+                // baseCommit (pre-workstream), so it sees the whole workstream.
+                const findingEvents = findingsToLedgerEvents({
+                    workstreamId: workstream.id,
+                    findings: critique?.outcome.open ?? [],
+                    ...(c0 === undefined ? {} : { baseCommit: c0 }),
+                    now,
+                });
+                await appendLedgerEvents(root, options.programId, findingEvents);
+                const findingDecisions = findingEvents.flatMap((event) => event.kind === "decision-recorded" ? [event.decision] : []);
+                // The commit's own sha cannot be part of the tree it commits, so the
+                // manifest records it only now — swept forward into whatever commits
+                // next. Replay reads the manifest's current state, not the commit
+                // that last touched it, so this lag is harmless.
+                workstream.status = "complete";
+                if (finalCommit !== undefined)
+                    workstream.commit = finalCommit;
+                await saveManifest(root, options.programId, manifest);
+                await reviewWorkstreamDecisions(workstream.id, [...parsed.decisions, ...findingDecisions], baseCommit);
+                if (critique)
+                    base.testCritique = critique.outcome;
+                base.testCritiqueDiffClipped = critique?.diffClipped ?? false;
                 base.outcome = {
                     status: "complete",
-                    ...(commit === undefined ? {} : { commit }),
+                    ...(finalCommit === undefined ? {} : { commit: finalCommit }),
                 };
                 return base;
             }
@@ -374,26 +450,13 @@ export async function runProgram(options) {
                 await saveManifest(root, options.programId, manifest);
                 // The work stays in the tree for a resume; decisions made on the way
                 // to a failure are still journaled and still reviewable.
-                await reviewDecisions(workstream, parsed.decisions, baseCommit);
+                await reviewWorkstreamDecisions(workstream.id, parsed.decisions, baseCommit);
                 base.outcome = { status: "failed", reason: failure };
                 return base;
             }
         }
         return base;
     }
-    /** Undefined means the attempt verified clean; otherwise the diagnosis. */
-    async function verifyAttempt(agentExitCode) {
-        if (agentExitCode !== 0) {
-            return `agent exited with code ${agentExitCode}`;
-        }
-        for (const [name, command] of Object.entries(config.verify)) {
-            const result = await verifyRunner(command, root);
-            if (result.exitCode !== 0) {
-                return `verify \`${name}\` (${command}) exited ${result.exitCode}:\n${tail(result.output, 1500)}`;
-            }
-        }
-        return undefined;
-    }
     async function journalDecisions(workstream, decisions, baseCommit) {
         const events = decisions.map((decision) => ({
             kind: "decision-recorded",
@@ -409,44 +472,286 @@ export async function runProgram(options) {
             log(`${workstream.id} decision: ${decision.title} -> ${decision.chosen}`);
         }
     }
-    /**
-     * Post-hoc review: the decider sees each decision with the diff it
-     * produced. One decision, one invocation, one verdict — a judgment, not a
-     * dialogue. No decider configured means defaults stand unratified, which
-     * the report says plainly.
-     */
-    async function reviewDecisions(workstream, decisions, baseCommit) {
-        if (!decider || decisions.length === 0)
-            return;
-        const diff = isRepository && baseCommit !== undefined
-            ? await git.diffSince(root, baseCommit)
-            : "";
-        for (const decision of decisions) {
-            const id = decisionFingerprint(workstream.id, decision);
-            const brief = deciderBrief(manifest, { workstream: workstream.id, decision }, diff);
-            const invocation = await invokeAgent(agentRunner, decider, brief, root);
-            const verdict = extractVerdict(invocation.output);
-            if (invocation.exitCode !== 0 || verdict === undefined) {
-                // Fail open: an unreviewable decision stays unratified and the
-                // report says so; it never blocks the run.
-                log(`${workstream.id} decision ${id}: decider produced no verdict; left unratified`);
-                continue;
-            }
-            await appendLedgerEvents(root, options.programId, [
-                {
-                    kind: "decision-reviewed",
-                    at: now().toISOString(),
-                    id,
-                    verdict: verdict.verdict,
-                    rationale: verdict.rationale,
-                    reviewedBy: "decider",
-                },
-            ]);
-            log(`${workstream.id} decision ${id}: ${verdict.verdict}`);
+    function reviewWorkstreamDecisions(workstreamId, decisions, baseCommit) {
+        return reviewDecisions({
+            root,
+            programId: options.programId,
+            manifest,
+            workstreamId,
+            decisions,
+            baseCommit,
+            decider,
+            agentRunner,
+            git,
+            isRepository,
+            now,
+            log,
+        });
+    }
+}
+/** Undefined means the attempt verified clean; otherwise the diagnosis. */
+async function verifyAttempt(config, verifyRunner, root, agentExitCode) {
+    if (agentExitCode !== 0) {
+        return `agent exited with code ${agentExitCode}`;
+    }
+    for (const [name, command] of Object.entries(config.verify)) {
+        const result = await verifyRunner(command, root);
+        if (result.exitCode !== 0) {
+            return `verify \`${name}\` (${command}) exited ${result.exitCode}:\n${tail(result.output, 1500)}`;
+        }
+    }
+    return undefined;
+}
+// A constant, never a config key — the charter keeps tuning knobs off the
+// config surface. Larger than the decider's 20,000-character diff limit
+// because the reviewer's whole job here is to read the tests.
+const TEST_CRITIQUE_DIFF_LIMIT = 60_000;
+/**
+ * Clips oversized reviewer input with a visible marker rather than silently
+ * truncating — a review of half a diff that does not say so is worse than no
+ * review at all.
+ */
+function clipForReview(text, label) {
+    if (text.length <= TEST_CRITIQUE_DIFF_LIMIT)
+        return { text, clipped: false };
+    return {
+        text: `${text.slice(0, TEST_CRITIQUE_DIFF_LIMIT)}\n… (${label} clipped at ` +
+            `${TEST_CRITIQUE_DIFF_LIMIT} characters — the reviewer saw a partial ${label})`,
+        clipped: true,
+    };
+}
+/** Presence of at least one fenced findings block, distinguishing "clean" from "no read at all". */
+function hasFindingsBlock(output) {
+    return /```findings/u.test(output);
+}
+function successCriteriaLines(manifest) {
+    if (manifest.successCriteria.length === 0) {
+        return ["None recorded in the manifest."];
+    }
+    return manifest.successCriteria.map((criterion) => `- **${criterion.id}**: ${criterion.description}`);
+}
+function scopeLines(workstream) {
+    const scope = workstream.scope;
+    if (!scope)
+        return ["No scope recorded in the manifest."];
+    const lines = [scope.summary];
+    if (scope.includes.length > 0) {
+        lines.push("Includes:", ...scope.includes.map((entry) => `- ${entry}`));
+    }
+    if (scope.excludes.length > 0) {
+        lines.push("Excludes:", ...scope.excludes.map((entry) => `- ${entry}`));
+    }
+    return lines;
+}
+/**
+ * The test-critique reviewer's brief: this workstream's scope and the
+ * program's success criteria (so the reviewer can tell which are in scope),
+ * the spec, the full workstream diff, and the three questions from the spec
+ * (SC-06) — would a plausible wrong implementation pass, does every in-scope
+ * criterion have a test that could actually fail, and was any test weakened
+ * to reach green.
+ */
+function testCritiqueReviewerBrief(manifest, workstream, spec, diff, priorOpen) {
+    const priorSection = priorOpen.length > 0
+        ? [
+            "## Findings from the last round",
+            "",
+            "Last round, another reviewer raised the following; check whether",
+            "the current diff addresses them:",
+            "",
+            ...priorOpen.map((finding) => `- **${finding.severity}** (${finding.category}) ${finding.subject}: ${finding.message}`),
+            "",
+        ]
+        : [];
+    return [
+        `# Test critique for ${workstream.id}: ${workstream.name}`,
+        "",
+        `Program: ${manifest.program.id} — ${manifest.program.name}`,
+        "",
+        "An implementer built this workstream and its own tests, and the",
+        "runner's own verify commands passed. The same agent wrote the code",
+        "and the tests, which makes \"the tests pass\" circular — a stub that",
+        "returns a fixed value can sail through a suite that never exercises",
+        "the real path. You are an independent second read: look at the diff,",
+        "the spec, and the program's success criteria, and judge whether the",
+        "tests actually prove anything.",
+        "",
+        "## Success criteria",
+        "",
+        ...successCriteriaLines(manifest),
+        "",
+        "## This workstream's scope",
+        "",
+        ...scopeLines(workstream),
+        "",
+        "## Specification",
+        "",
+        spec.trim(),
+        "",
+        "## Diff (implementation and tests together)",
+        "",
+        "```diff",
+        diff.trim() === "" ? "(no diff available)" : diff,
+        "```",
+        "",
+        ...priorSection,
+        "## Questions",
+        "",
+        "1. Would a **plausible wrong implementation** pass this test suite?",
+        "   Name the wrong implementation you have in mind and the test that",
+        "   would let it through.",
+        "2. Does **every success criterion in this workstream's scope** have a",
+        "   test that could **actually fail** — one that is not tautological,",
+        "   not asserting a constant, not skipped? Call out by id any in-scope",
+        "   criterion with no such test.",
+        "3. Were any tests **weakened, skipped, or deleted** to reach green —",
+        "   an assertion loosened, a case `.skip`ped, a file removed — visible",
+        "   in the diff?",
+        "",
+        "A suite that holds up is a fine answer: if you have no objection, say",
+        "so and emit an empty findings array. Severity is a routing hint for",
+        "where a finding goes, never a verdict. A genuinely structural",
+        "objection is a **blocker**; it routes to a decision the human weighs,",
+        "never a gate that stops anything here.",
+        "",
+        "Always end your reply with a findings block, using an empty array `[]`",
+        "when you have no objection, so a clean read and a skipped read stay",
+        "distinguishable.",
+        "",
+        findingsContract(),
+    ].join("\n");
+}
+function findingEvidenceLine(finding) {
+    const evidence = finding.evidence
+        .map((entry) => {
+        if (entry.kind === "location") {
+            return `${entry.file}:${entry.startLine}${entry.excerpt ? ` — ${entry.excerpt}` : ""}`;
+        }
+        if (entry.kind === "concern") {
+            return entry.detail ? `${entry.named} — ${entry.detail}` : entry.named;
+        }
+        return `${entry.metric}: ${entry.value}`;
+    })
+        .join("; ");
+    return evidence === "" ? "" : `  Evidence: ${evidence}`;
+}
+/**
+ * The implementer's fix re-brief: this round's triaged findings in prose,
+ * inviting judgment rather than demanding compliance — the manual workflow's
+ * own framing (WS-03 design §2). Never asks the implementer to commit or to
+ * echo a block back.
+ */
+function testCritiqueFixBrief(workstream, spec, findings) {
+    const findingsList = findings.map((finding) => [
+        `- **${finding.severity}** (${finding.category}) ${finding.subject}: ${finding.message}`,
+        findingEvidenceLine(finding),
+    ]
+        .filter((line) => line !== "")
+        .join("\n"));
+    return [
+        `# Your tests for ${workstream.id}: ${workstream.name} were reviewed`,
+        "",
+        "An independent reviewer read the diff you produced — implementation",
+        "and tests together — and raised the following:",
+        "",
+        ...findingsList,
+        "",
+        "## Specification",
+        "",
+        spec.trim(),
+        "",
+        "Strengthen the tests, and the implementation where the tests exposed",
+        "a real gap, for what you agree with. State plainly what you decline",
+        "and why — declines are recorded and reported, never argued with. Do",
+        "not reach green by weakening the suite further: the finding is that",
+        "the tests are too weak, and loosening an assertion, skipping a case,",
+        "or deleting a test is the one fix that misses the point.",
+        "",
+        "Never commit — the runner owns commits, verifies your fix itself, and",
+        "either keeps it or discards it depending on whether it actually",
+        "verifies. Reply in prose, not a block: what you fixed and what you",
+        "declined, and why.",
+        "",
+        summaryContract(),
+    ].join("\n");
+}
+/**
+ * The test-critique driver: wires WS-01's bounded review loop to the two
+ * briefs above, and owns the green-state invariant (SC-07) — a closure
+ * variable holding the last verified commit, which every fix round either
+ * advances (on a clean re-verify) or falls back to (`resetHard`, on a
+ * failure), so a review can never turn green work red.
+ */
+async function runTestCritique(options) {
+    const { root, manifest, workstream, spec, config, agentRunner, verifyRunner, git, reviewer, agent, baseCommit, log, } = options;
+    let greenCommit = options.greenCommit;
+    let diffClipped = false;
+    if (!reviewer) {
+        return { outcome: reviewerAbsentOutcome(), finalCommit: greenCommit, diffClipped };
+    }
+    const review = async (_round, priorOpen) => {
+        const rawDiff = baseCommit !== undefined ? await git.diffSince(root, baseCommit) : "";
+        const diff = clipForReview(rawDiff, "diff");
+        const clippedSpec = clipForReview(spec, "spec");
+        if (diff.clipped || clippedSpec.clipped)
+            diffClipped = true;
+        const brief = testCritiqueReviewerBrief(manifest, workstream, clippedSpec.text, diff.text, priorOpen);
+        const invocation = await invokeAgent(agentRunner, reviewer, brief, root);
+        const parsed = extractFindings(invocation.output);
+        const ran = invocation.exitCode === 0 && hasFindingsBlock(invocation.output);
+        return { findings: parsed.findings, errors: parsed.errors, ran };
+    };
+    const respond = async (_round, findings) => {
+        const brief = testCritiqueFixBrief(workstream, spec, findings);
+        const invocation = await invokeAgent(agentRunner, agent, brief, root);
+        const summary = resolveSummary(invocation.output).text;
+        const failure = await verifyAttempt(config, verifyRunner, root, invocation.exitCode);
+        if (failure === undefined) {
+            const next = await git.commitAll(root, `nightshift(${manifest.program.id}): ${workstream.id} test critique fix`);
+            if (next !== undefined)
+                greenCommit = next;
+            log(`${workstream.id}: test critique fix verified and committed`);
+            return { note: `${summary} (fix verified and committed)` };
         }
+        await git.resetHard(root, greenCommit);
+        log(`${workstream.id}: test critique fix failed verification and was discarded — ${failure}`);
+        return { note: `${summary} (fix failed verification and was discarded; the green state was preserved)` };
+    };
+    const outcome = await runReviewPass({ review, respond });
+    return { outcome, finalCommit: greenCommit, diffClipped };
+}
+function renderSpecsSection(authorResult) {
+    if (authorResult.results.length === 0)
+        return [];
+    const lines = ["## Specs", ""];
+    if (authorResult.borrowedImplementer) {
+        lines.push("No `authorAgent` was configured; the implementer agent wrote these", "specs instead. A cheap implementer model tends to write sparse,", "context-free specs — configure `authorAgent` for better ones.", "");
     }
+    const authored = authorResult.results.filter((entry) => entry.outcome.status === "authored");
+    const kept = authorResult.results.filter((entry) => entry.outcome.status === "kept");
+    const failed = authorResult.results.filter((entry) => entry.outcome.status === "failed" || entry.outcome.status === "parked");
+    if (authored.length > 0) {
+        lines.push("Authored:", "", ...authored.map((entry) => `- ${entry.id} ${entry.name}`), "");
+    }
+    if (kept.length > 0) {
+        lines.push("Kept (already existed):", "", ...kept.map((entry) => `- ${entry.id} ${entry.name}`), "");
+    }
+    if (failed.length > 0) {
+        lines.push("Failed or parked:", "", ...failed.map((entry) => {
+            const reason = entry.outcome.status === "failed" || entry.outcome.status === "parked"
+                ? entry.outcome.reason
+                : "";
+            return `- ${entry.id} ${entry.name} — ${reason}`;
+        }), "");
+    }
+    for (const entry of authored) {
+        if (!entry.specCritique)
+            continue;
+        lines.push(`### ${entry.id} ${entry.name}`, "", ...renderPassReport("Spec critique", entry.specCritique), "");
+    }
+    return lines;
 }
-function renderRunReport(manifest, results, decisions, escalations, at) {
+function renderRunReport(manifest, results, decisions, escalations, authorResult, at) {
     const built = results.filter((result) => result.outcome.status === "complete" ||
         result.outcome.status === "skipped").length;
     const lines = [
@@ -456,6 +761,7 @@ function renderRunReport(manifest, results, decisions, escalations, at) {
         "",
         `**Outcome: ${built} of ${results.length} workstreams built.**`,
         "",
+        ...renderSpecsSection(authorResult),
     ];
     if (escalations.length > 0) {
         lines.push("## Needs your attention", "", "The decider reviewed these choices and believes you might decide", "differently. Each is anchored to the commit before it was made:", "");
@@ -481,6 +787,14 @@ function renderRunReport(manifest, results, decisions, escalations, at) {
         if (result.summary) {
             lines.push(`  - ${result.summary.replace(/\s+/gu, " ").trim()}`);
         }
+        if (result.testCritique) {
+            for (const line of renderPassReport("Test critique", result.testCritique)) {
+                lines.push(line === "" ? "" : `  ${line}`);
+            }
+            if (result.testCritiqueDiffClipped) {
+                lines.push("  The reviewer saw input clipped for length.");
+            }
+        }
     }
     lines.push("");
     if (decisions.length > 0) {