@yagni-app/code-staging 1.2.3-staging.1570.1 → 1.2.3-staging.1580.1

package/dist/extension/askAdvisorTool.d.ts

@@ -32,13 +32,18 @@ import { type AdvisorLimits, type AdvisorStateHandle } from "./advisor.js";
 import type { ChildUsageHandle } from "./childUsage.js";
 import type { WorkingLineHandle } from "./workingLine.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
-import { type PipelineStage } from "./pipeline/types.js";
+import { type PipelineStage, type ResiliencePolicy } from "./pipeline/types.js";
 import { type RenderTheme, type SubagentTaskProgress } from "./subagentRender.js";
 /**
  * Read-only recon plus grounding. Mirrors the `plan` stage's allowlist for the
  * reason documented there: enough tools to navigate instead of flailing on a
  * single `read`. No `bash`.
  */
+/**
+ * A consult is one read-only question, so it keeps the 20-minute wall clock
+ * the /go stages had before their default grew to an hour.
+ */
+export declare const ADVISOR_RESILIENCE_POLICY: ResiliencePolicy;
 export declare const ADVISOR_TOOLS: string[];
 /** The consult's tool list under `grounding: false` — grounding read
  * stripped via the canonical filter (grounding.ts). */

package/dist/extension/askAdvisorTool.js

@@ -40,6 +40,11 @@ import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, p
  * reason documented there: enough tools to navigate instead of flailing on a
  * single `read`. No `bash`.
  */
+/**
+ * A consult is one read-only question, so it keeps the 20-minute wall clock
+ * the /go stages had before their default grew to an hour.
+ */
+export const ADVISOR_RESILIENCE_POLICY = { ...DEFAULT_RESILIENCE_POLICY, wallTimeoutMs: 20 * 60_000 };
 export const ADVISOR_TOOLS = ["read", "grep", "find", "ls", "ask_yagni"];
 /** The consult's tool list under `grounding: false` — grounding read
  * stripped via the canonical filter (grounding.ts). */
@@ -144,7 +149,7 @@ export function makeAskAdvisorTool(opts) {
     // driver's tool call until the user presses Esc. The synthetic stage id is
     // "plan" (read-only tools, no bash), so the wrapper's write-gate never
     // blocks a retry — re-running a consult cannot double-apply anything.
-    const runStage = opts.runStage ?? withResilience(defaultRunStage, DEFAULT_RESILIENCE_POLICY);
+    const runStage = opts.runStage ?? withResilience(defaultRunStage, ADVISOR_RESILIENCE_POLICY);
     return {
         name: "ask_advisor",
         label: "Ask the advisor",

package/dist/extension/index.d.ts

@@ -166,6 +166,8 @@ export type { MakeRecordContextToolOptions } from "./recordContextTool.js";
 export { makeRecordDecisionTool } from "./recordDecisionTool.js";
 export type { MakeRecordDecisionToolOptions } from "./recordDecisionTool.js";
 export { makeSuggestNextWorkTool, defaultNextAction } from "./nextWorkTool.js";
+export { makePrototypeCreateTool, makePrototypeAttachTool, makePrototypeReadTool, makePrototypeDraftTool, makePrototypeVerificationTool, makePrototypeReviseTool, makePrototypeListTool, makePrototypeShareTool, } from "./prototypeTool.js";
+export type { MakePrototypeToolOptions, PrototypeSummary } from "./prototypeTool.js";
 export type { MakeNextWorkToolOptions, DefaultNextAction, NextActionOption, } from "./nextWorkTool.js";
 export { recordDecision } from "./recordDecisionTool.js";
 export type { RecordDecisionParams } from "./recordDecisionTool.js";

package/dist/extension/index.js

@@ -13,8 +13,10 @@ import { makeFileTicketTool, makeUpdateTicketStatusTool } from "./ticketTools.js
 import { makeReviewBusinessMatchTool } from "./reviewTool.js";
 import { registerCmuxBridge } from "./cmux/index.js";
 import { makeRecordEngineeringContextTool } from "./recordContextTool.js";
+import { makePrototypeVerifyTool } from "./prototypeVerify.js";
 import { makeRecordDecisionTool } from "./recordDecisionTool.js";
 import { makeSuggestNextWorkTool } from "./nextWorkTool.js";
+import { makePrototypeCreateTool, makePrototypeAttachTool, makePrototypeReadTool, makePrototypeDraftTool, makePrototypeVerificationTool, makePrototypeReviseTool, makePrototypeListTool, makePrototypeShareTool, } from "./prototypeTool.js";
 import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_DRIVER_GROUNDING_FREE, YAGNI_IDENTITY_GROUNDING_FREE, YAGNI_IDENTITY_ULTRA, YAGNI_IDENTITY_ULTRA_GROUNDING_FREE } from "./branding.js";
 import { claudeRulesSection } from "./claudeRules.js";
 import { ensureScratchpadDir, SCRATCHPAD_TMPDIR_ENV, scratchpadDir as scratchpadDirFor, scratchpadOwnerRootFor, scratchpadSection } from "./scratchpad.js";
@@ -408,6 +410,25 @@ export async function registerYagni(pi, deps = {}) {
             onRecorded: (id) => recordedThisSession.add(id),
         }));
     }
+    if (!evalMode) {
+        // Prototypes v1: create/revise/list/share runnable single-file HTML
+        // Prototypes through the app's REST API. Workspace writes, so gated out of
+        // eval mode with the other external-side-effect tools.
+        pi.registerTool(makePrototypeReadTool(toolOpts));
+        pi.registerTool(makePrototypeDraftTool({ ...toolOpts, getSessionId: () => env.YAGNI_SESSION_ID }));
+        pi.registerTool(makePrototypeVerificationTool(toolOpts));
+        pi.registerTool(makePrototypeVerifyTool(toolOpts));
+        pi.registerTool(makePrototypeCreateTool({ ...toolOpts, getSessionId: () => env.YAGNI_SESSION_ID }));
+        pi.registerTool(makePrototypeAttachTool(toolOpts));
+        pi.registerTool(makePrototypeReviseTool(toolOpts));
+        pi.registerTool(makePrototypeListTool(toolOpts));
+        pi.registerTool(makePrototypeShareTool(toolOpts));
+    }
+    else if (env.YAGNI_MISSION_DIR && env.YAGNI_RUN_ID) {
+        // The server authorizes only exact revisions in this Run's approved packet.
+        pi.registerTool(makePrototypeReadTool(toolOpts));
+        pi.registerTool(makePrototypeVerifyTool(toolOpts));
+    }
     // YAG-574: the silent-turn reminder, driver-only. A child/subagent/advisor
     // process has no direct user to answer, so it is never nudged (same gating
     // as the delegation identity in branding.ts); eval mode is untouched so its
@@ -444,6 +465,7 @@ export async function registerYagni(pi, deps = {}) {
     // map → plan → implement → review → fix, each child grounded by inheritance.
     registerGoCommand(pi, {
         childUsage,
+        canPrepareDesign: () => !evalMode && modeHolder.get() === "auto",
         attribution,
         // The grounding switch threads into every /go run: `grounded: false`
         // selects the existing blind personas + blind lens clauses (the M6
@@ -2029,6 +2051,8 @@ export { makeReviewBusinessMatchTool } from "./reviewTool.js";
 export { makeRecordEngineeringContextTool } from "./recordContextTool.js";
 export { makeRecordDecisionTool } from "./recordDecisionTool.js";
 export { makeSuggestNextWorkTool, defaultNextAction } from "./nextWorkTool.js";
+// Prototypes v1: the four prototype tools (create/revise/list/share).
+export { makePrototypeCreateTool, makePrototypeAttachTool, makePrototypeReadTool, makePrototypeDraftTool, makePrototypeVerificationTool, makePrototypeReviseTool, makePrototypeListTool, makePrototypeShareTool, } from "./prototypeTool.js";
 export { recordDecision } from "./recordDecisionTool.js";
 // Onramp Door B (as amended by ADR-0033): the first-run welcome (write-free,
 // free text first-class) + the explicit /setup-team drafting flow.

package/dist/extension/permission/gate.js

@@ -51,9 +51,9 @@ export function createModeHolder(initial = "auto") {
     };
 }
 export const DEFAULT_PERMISSION_POLICY = {
-    planBlockTools: ["write", "edit", "bash", "file_ticket", "update_ticket_status"],
-    reviewConfirmTools: ["write", "edit", "bash", "file_ticket", "update_ticket_status"],
-    alwaysConfirmTools: ["file_ticket", "update_ticket_status"],
+    planBlockTools: ["write", "edit", "bash", "file_ticket", "update_ticket_status", "prototype_share", "prototype_create", "prototype_attach", "prototype_revise", "prototype_draft", "prototype_verification", "prototype_verify"],
+    reviewConfirmTools: ["write", "edit", "bash", "file_ticket", "update_ticket_status", "prototype_share", "prototype_create", "prototype_attach", "prototype_revise", "prototype_draft", "prototype_verification", "prototype_verify"],
+    alwaysConfirmTools: ["file_ticket", "update_ticket_status", "prototype_share"],
 };
 export function allowRuleFloorVerdict(toolName, params, mode, policy) {
     // Floor 0 — plan mode: the mode's contract (no mutations without Guardian

package/dist/extension/pipeline/budget.d.ts

@@ -78,4 +78,36 @@ export declare const DEFAULT_STAGE_ESTIMATE_MS: Record<TimedStageKind, number>;
  * so the only safe place to stop is before it begins.
  */
 export declare function stageWontFit(budget: RunBudget, kind: TimedStageKind, expectedMs: number, nowMs?: number): string | null;
+/**
+ * The shortest wall clock any /go stage gets: the old fixed limit. A run close
+ * to its deadline keeps this much rather than a stage being cut off sooner than
+ * it ever was.
+ */
+export declare const STAGE_WALL_FLOOR_MS: number;
+/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
+export declare const VERIFY_ALLOWANCE_MS: number;
+/**
+ * What must still run after a stage stops: a review round, one fix, and the
+ * verify gate. Held back from the stage's wall clock so a long stage still
+ * leaves the run time to review what it wrote.
+ */
+export declare const STAGE_WALL_RESERVE_MS: number;
+/**
+ * Where a stage's wall clock came from: the build's remaining time, the
+ * 20-minute floor because the deadline was close, or the no-deadline default.
+ */
+export type StageWallSource = "deadline" | "floor" | "default";
+/**
+ * The wall clock for a stage spawning at `nowMs`. With a deadline (sandbox and
+ * mission runs) a working stage gets the build's remaining time less
+ * {@link STAGE_WALL_RESERVE_MS}, never under {@link STAGE_WALL_FLOOR_MS}: the
+ * idle timer is the check for a stuck model, and stopping a live stage at a
+ * fixed limit throws away work the run had time for. Without a deadline
+ * (interactive /go, where a person can abort) `fallbackMs` applies. The
+ * source rides the stage's attempt record.
+ */
+export declare function stageWall(budget: RunBudget, fallbackMs: number, nowMs?: number): {
+    ms: number;
+    source: StageWallSource;
+};
 //# sourceMappingURL=budget.d.ts.map

package/dist/extension/pipeline/budget.js

@@ -107,4 +107,33 @@ export function stageWontFit(budget, kind, expectedMs, nowMs = Date.now()) {
         return null;
     return `not enough time left for a ${kind} stage (${Math.max(0, Math.round(leftMs / 1000))}s left, expected ${Math.round(expectedMs / 1000)}s)`;
 }
+/**
+ * The shortest wall clock any /go stage gets: the old fixed limit. A run close
+ * to its deadline keeps this much rather than a stage being cut off sooner than
+ * it ever was.
+ */
+export const STAGE_WALL_FLOOR_MS = 20 * 60_000;
+/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
+export const VERIFY_ALLOWANCE_MS = 5 * 60_000;
+/**
+ * What must still run after a stage stops: a review round, one fix, and the
+ * verify gate. Held back from the stage's wall clock so a long stage still
+ * leaves the run time to review what it wrote.
+ */
+export const STAGE_WALL_RESERVE_MS = DEFAULT_STAGE_ESTIMATE_MS.review + DEFAULT_STAGE_ESTIMATE_MS.fix + VERIFY_ALLOWANCE_MS;
+/**
+ * The wall clock for a stage spawning at `nowMs`. With a deadline (sandbox and
+ * mission runs) a working stage gets the build's remaining time less
+ * {@link STAGE_WALL_RESERVE_MS}, never under {@link STAGE_WALL_FLOOR_MS}: the
+ * idle timer is the check for a stuck model, and stopping a live stage at a
+ * fixed limit throws away work the run had time for. Without a deadline
+ * (interactive /go, where a person can abort) `fallbackMs` applies. The
+ * source rides the stage's attempt record.
+ */
+export function stageWall(budget, fallbackMs, nowMs = Date.now()) {
+    if (budget.deadlineMs === undefined)
+        return { ms: fallbackMs, source: "default" };
+    const leftMs = budget.deadlineMs - nowMs - STAGE_WALL_RESERVE_MS;
+    return leftMs > STAGE_WALL_FLOOR_MS ? { ms: leftMs, source: "deadline" } : { ms: STAGE_WALL_FLOOR_MS, source: "floor" };
+}
 //# sourceMappingURL=budget.js.map

package/dist/extension/pipeline/goCommand.d.ts

@@ -60,6 +60,7 @@
  */
 import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 import type { SpendResponse } from "../costHud.js";
+import { draftPrototype } from "../prototypeTool.js";
 import { type CrashReporter } from "../crashReport.js";
 import { runFinish as defaultRunFinish } from "./finish.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
@@ -144,6 +145,8 @@ export interface RegisterGoDeps {
      * test) simply means "not ultra", which is today's behavior.
      */
     isUltra?: () => boolean;
+    canPrepareDesign?: () => boolean;
+    draftPrototype?: typeof draftPrototype;
     /**
      * The boot-time `grounding` settings switch, threaded into the orchestrator's
      * `grounded` flag: false runs the whole pipeline on the existing blind

package/dist/extension/pipeline/goCommand.js

@@ -69,6 +69,7 @@ import { RunState } from "./runState.js";
 import { aggregateRunUsage } from "./budget.js";
 import { formatRunCostTable } from "./runCostTable.js";
 import { makeCombinedCheckpointStore, makeFileCheckpointStore, makePiJournalCheckpointStore, } from "./checkpoint.js";
+import { absoluteUrl, draftPrototype } from "../prototypeTool.js";
 import { getToken as defaultGetToken, resolveBaseUrl } from "../config.js";
 import { makeCrashReporter } from "../crashReport.js";
 import { logEvent } from "../errorSink.js";
@@ -785,6 +786,35 @@ export function registerGoCommand(pi, deps = {}) {
                     let result = await runPipeline(ticket, {
                         cwd: runCwd,
                         signal: runSignal,
+                        // Interactive /go tracks no backend work item (#2134), so the draft
+                        // is private to this session and keyed on the run: a resumed run
+                        // reuses its prototype instead of drafting a second one.
+                        ...(deps.canPrepareDesign?.() ? {
+                            prepareDesign: async ({ ticket: designTicket, exploration, signal }) => {
+                                if (!deps.canPrepareDesign?.())
+                                    return undefined;
+                                const baseUrl = deps.baseUrl ?? resolveBaseUrl();
+                                try {
+                                    const draft = await (deps.draftPrototype ?? draftPrototype)({ baseUrl, getToken: deps.getToken ?? defaultGetToken }, {
+                                        title: designTicket.slice(0, 160), spec: `${designTicket}\n\nRepository exploration:\n${exploration}`,
+                                        sessionId: (deps.env ?? process.env).YAGNI_SESSION_ID,
+                                        automatic: true, requestKey: `go:${sessionKey}`,
+                                    }, signal);
+                                    if (draft.reference) {
+                                        notify(`Prototype ready: ${absoluteUrl(baseUrl, draft.prototype?.url ?? draft.reference.url ?? `/prototypes/${draft.reference.prototypeId}`)}`, "info");
+                                        return `## Prototype design reference\n${JSON.stringify(draft.reference)}\nRead this exact revision with prototype_read. Review it with the plan. Implement with the repository's real components. Preserve this reference through implementation and review. Run prototype_verify against the implemented local app with agreed interaction states; it captures mobile/desktop screenshots and records observed checks or explicitly unverified when no browser is available. Visually inspect those screenshots against this design and document intentional departures. Document intentional departures. Never substitute a newer revision or share automatically.`;
+                                    }
+                                    if (draft.status === "failed")
+                                        notify("Prototype drafting failed. Continue without it or retry with prototype_draft before approving the plan.", "warning");
+                                    return undefined;
+                                }
+                                catch {
+                                    if (!signal?.aborted)
+                                        notify("Prototype drafting unavailable. Continue without it or retry before plan approval.", "warning");
+                                    return undefined;
+                                }
+                            },
+                        } : {}),
                         fanout: fanoutMode,
                         grounded: goGrounded,
                         ...(isUltra ? { isUltra } : {}),

package/dist/extension/pipeline/orchestrator.d.ts

@@ -26,11 +26,18 @@
  */
 import { type RunBudget } from "./budget.js";
 import { type MissionInputs } from "./mission.js";
+import { type ResilienceAttemptRecord, type RunStageFn } from "./resilience.js";
 import { runStage as defaultRunStage } from "./runner.js";
 import { type VerifyOutcome, type WorkstreamCheckResult, type WorkstreamCheckTarget } from "./verify.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
-import { type CheckpointStore, type FanoutBudgetVerdict, type FanoutMode, type PipelineStage, type JsonEvent, type PipelineProgress, type PipelineResult, type ResumePlan, type StageId, type StageResult, type StageTag } from "./types.js";
+import { type CheckpointStore, type FanoutBudgetVerdict, type FanoutMode, type PipelineStage, type JsonEvent, type PipelineProgress, type PipelineResult, type ResiliencePolicy, type ResumePlan, type StageId, type StageResult, type StageTag } from "./types.js";
 export interface RunPipelineDeps {
+    /** Bounded external design preparation; never runs inside the read-only planner or approved missions. */
+    prepareDesign?: (input: {
+        ticket: string;
+        exploration: string;
+        signal?: AbortSignal;
+    }) => Promise<string | undefined>;
     cwd: string;
     signal?: AbortSignal;
     runStage?: typeof defaultRunStage;
@@ -174,5 +181,19 @@ export declare class PipelineStageError extends Error {
     readonly partial: StageResult[];
     constructor(stageId: string, message: string, partial: StageResult[]);
 }
+/**
+ * The resilience policy for a run's stages. With a deadline, a stage that
+ * spent its wall clock spent the build's time: a retry would only get the
+ * floor and run past the deadline, so it fails instead of retrying.
+ */
+export declare function stageRunnerPolicy(budget: RunBudget): ResiliencePolicy;
+/**
+ * The pipeline's default stage runner: `base` under the R1 resilience wrapper
+ * with {@link stageRunnerPolicy}, each stage's wall clock taken from the run's
+ * deadline when it spawns (budget.ts#stageWall). A run with no deadline keeps
+ * the policy's fixed wall clock. Exported so a test can pin the wall a stage
+ * actually gets.
+ */
+export declare function resilientStageRunner(base: RunStageFn, budget: RunBudget, clock: () => number, telemetry: (rec: ResilienceAttemptRecord) => void): RunStageFn;
 export declare function runPipeline(ticket: string, deps: RunPipelineDeps): Promise<PipelineResult>;
 //# sourceMappingURL=orchestrator.d.ts.map

package/dist/extension/pipeline/orchestrator.js

@@ -24,7 +24,7 @@
  * (an aborted/crashed child has empty output, which otherwise parses to zero
  * findings — i.e. a false "reviewed and clean").
  */
-import { addRunUsage, aggregateRunUsage, DEFAULT_RUN_BUDGET, DEFAULT_STAGE_ESTIMATE_MS, EMPTY_RUN_USAGE, exceedsBudget, stageWontFit, } from "./budget.js";
+import { addRunUsage, aggregateRunUsage, DEFAULT_RUN_BUDGET, DEFAULT_STAGE_ESTIMATE_MS, EMPTY_RUN_USAGE, exceedsBudget, stageWall, stageWontFit, } from "./budget.js";
 import { attributeFindings, checkerFindings, composeFixNote, composeResidue, composeSynthesizerInput, mergeFindings, parseOpenFindings, renderFindings, stripOpenFindings, } from "./checker.js";
 import { auditClaims, parsePartition } from "./fanout.js";
 import { extractFindingsBlock, hasBlockingFindings, parseFindings, shouldStop, unionFindings } from "./findings.js";
@@ -188,6 +188,27 @@ async function mapWithConcurrencyLimit(items, concurrency, fn) {
     await Promise.all(workers);
     return results;
 }
+/**
+ * The resilience policy for a run's stages. With a deadline, a stage that
+ * spent its wall clock spent the build's time: a retry would only get the
+ * floor and run past the deadline, so it fails instead of retrying.
+ */
+export function stageRunnerPolicy(budget) {
+    return budget.deadlineMs === undefined ? DEFAULT_RESILIENCE_POLICY : { ...DEFAULT_RESILIENCE_POLICY, retryWallTimeout: false };
+}
+/**
+ * The pipeline's default stage runner: `base` under the R1 resilience wrapper
+ * with {@link stageRunnerPolicy}, each stage's wall clock taken from the run's
+ * deadline when it spawns (budget.ts#stageWall). A run with no deadline keeps
+ * the policy's fixed wall clock. Exported so a test can pin the wall a stage
+ * actually gets.
+ */
+export function resilientStageRunner(base, budget, clock, telemetry) {
+    return withResilience(base, stageRunnerPolicy(budget), {
+        telemetry,
+        wallFor: () => stageWall(budget, DEFAULT_RESILIENCE_POLICY.wallTimeoutMs, clock()),
+    });
+}
 export async function runPipeline(ticket, deps) {
     const log = (event, data) => deps.logger?.(event, data);
     // R1: wrap the real child runner with in-loop resilience (idle/wall timeout +
@@ -195,10 +216,11 @@ export async function runPipeline(ticket, deps) {
     // across its up-to-8 spawns. A caller that injects its own `runStage` (the unit
     // tests, a custom lane) bypasses the wrapper untouched. Per-attempt telemetry
     // rides the existing logger seam, so resume + the checkpoint journal are unaffected.
+    // With a deadline (sandbox / mission runs) each stage's wall clock is the
+    // time left less a reserve for review, a fix and verify, so a live stage is
+    // not killed at a fixed limit the run had room to exceed.
     const runStageFn = deps.runStage ??
-        withResilience(defaultRunStage, DEFAULT_RESILIENCE_POLICY, {
-            telemetry: (rec) => log("resilience_attempt", rec),
-        });
+        resilientStageRunner(defaultRunStage, deps.budget ?? DEFAULT_RUN_BUDGET, deps.now ?? Date.now, (rec) => log("resilience_attempt", rec));
     const snapshotFn = deps.snapshotWorkspace ?? defaultSnapshotWorkspace;
     const runVerifyFn = deps.runVerify ?? makeRunVerify();
     const runWorkstreamCheckFn = deps.runWorkstreamCheck ?? makeWorkstreamCheck();
@@ -313,6 +335,11 @@ export async function runPipeline(ticket, deps) {
     const rounds = resume ? [...resume.priorRounds] : [];
     let round = resume ? resume.round : 1;
     let reviewInput = resume ? resume.reviewInput : "";
+    const designMarker = "## Pinned design context";
+    const resumedDesignOffset = reviewInput.indexOf(designMarker);
+    let designContext = mission?.plan
+        ? `${designMarker}\nApproved mission plan (preserve exact prototype references):\n${mission.plan}`
+        : resumedDesignOffset >= 0 ? reviewInput.slice(resumedDesignOffset) : undefined;
     let stopReason = "clean";
     // P4: honest note carried out when the verify gate could not give a verdict on
     // the final round (no command / unrunnable), so /go never claims a build it did
@@ -727,6 +754,12 @@ export async function runPipeline(ticket, deps) {
         baselinePaths = parseChangedPaths(beforeBuild.status);
         // Sequential build half — stop at the first failure (mirrors the chain).
         for (const stage of buildStages) {
+            if (stage.id === "plan" && !mission && deps.prepareDesign && !deps.signal?.aborted && !overBudget()) {
+                const prepared = await deps.prepareDesign({ ticket: promptTicket, exploration: previous ?? "", signal: deps.signal });
+                designContext = prepared ? `${designMarker}\n${prepared}` : undefined;
+                if (designContext)
+                    previous = `${previous ?? ""}\n\n${designContext}`;
+            }
             progress({ kind: "stage_start", stageId: stage.id });
             stageEvent(stage.id, "start");
             // The implement stage is a DIAMOND (partition → parallel builders →
@@ -817,12 +850,12 @@ export async function runPipeline(ticket, deps) {
             progress({ kind: "stage_done", stageId: stage.id });
             // The plan finish carries its finalOutput so /go can record the plan onto the
             // work item; no other boundary streams the full stage text.
-            stageEvent(stage.id, "finish", stage.id === "plan" ? { output: r.finalOutput } : undefined);
+            stageEvent(stage.id, "finish", stage.id === "plan" ? { output: designContext ? `${r.finalOutput}\n\n${designContext}` : r.finalOutput } : undefined);
             // The map brief is the partitioner's repo context on an interactive run
             // (mission runs skip map and hand it the injected memo instead).
             if (stage.id === "map")
                 mapBrief = r.finalOutput;
-            previous = r.finalOutput;
+            previous = designContext ? `${r.finalOutput}\n\n${designContext}` : r.finalOutput;
             // R3-b: stop honestly if the build half alone blew the run budget.
             const over = overBudget();
             if (over) {
@@ -1042,7 +1075,7 @@ export async function runPipeline(ticket, deps) {
         const fixStartedAt = clock();
         progress({ kind: "stage_start", stageId: "fix", round });
         stageEvent("fix", "start", { round });
-        const fixResult = await runStageFn(fix, { ticket: promptTicket, previous: serializeBlocking(findings), grounded }, stageDepsFor({ stageId: "fix", round }));
+        const fixResult = await runStageFn(fix, { ticket: promptTicket, previous: designContext ? `${serializeBlocking(findings)}\n\n${designContext}` : serializeBlocking(findings), grounded }, stageDepsFor({ stageId: "fix", round }));
         observedMs.fix = clock() - fixStartedAt;
         stages.push(fixResult);
         log("stage_done", { stageId: "fix", exitCode: fixResult.exitCode });
@@ -1092,8 +1125,8 @@ export async function runPipeline(ticket, deps) {
         // crash now can resume at the NEXT round against this fix's output. Snapshot
         // the post-fix tree as the resume consistency key.
         const afterFix = await snapshotFn(deps.cwd, deps.signal);
-        writeCheckpoint(mkRecord("round_done", { round, reviewInput: fixResult.finalOutput, findings, snapshot: afterFix, usage: currentUsage() }));
-        reviewInput = fixResult.finalOutput;
+        reviewInput = designContext ? `${fixResult.finalOutput}\n\n${designContext}` : fixResult.finalOutput;
+        writeCheckpoint(mkRecord("round_done", { round, reviewInput, findings, snapshot: afterFix, usage: currentUsage() }));
         round += 1;
     }
     log("pipeline_stop", { reason: stopReason, round });

package/dist/extension/pipeline/resilience.d.ts

@@ -27,6 +27,7 @@
  * Pure-ish: all impurity (timers, sleep, clock, randomness) sits behind injectable
  * seams so the wrapper is unit-tested without real waits.
  */
+import type { StageWallSource } from "./budget.js";
 import type { RunStageDeps } from "./runner.js";
 import { type PipelineStage, type ResiliencePolicy, type ReviewLens, type StageResult } from "./types.js";
 export type { ResiliencePolicy } from "./types.js";
@@ -54,6 +55,13 @@ export interface ResilienceAttemptRecord {
     /** 1-based attempt number. */
     attempt: number;
     outcome: "ok" | "transient" | "fatal" | "timeout" | "aborted";
+    /** The wall clock this attempt was given (ms). */
+    wallTimeoutMs?: number;
+    /**
+     * Where that wall clock came from, when the caller said: the build's time
+     * left, the floor because the deadline was close, or the no-deadline default.
+     */
+    wallSource?: StageWallSource;
     /** Which timer fired, when the attempt timed out. */
     timeoutKind?: "idle" | "wall";
     /** On a timeout: ms the attempt spent with a tool running (the rest went to the model). */
@@ -76,6 +84,16 @@ export interface ResilienceSeams {
 }
 export interface WithResilienceOpts {
     telemetry?: (rec: ResilienceAttemptRecord) => void;
+    /**
+     * The wall clock for one attempt, asked when the attempt spawns so a later
+     * stage (or a retry) gets the time actually left. Absent, every attempt gets
+     * `policy.wallTimeoutMs`. The idle window always comes from the policy.
+     * `source` rides the attempt record as `wallSource`.
+     */
+    wallFor?: (stage: PipelineStage) => {
+        ms: number;
+        source?: StageWallSource;
+    };
     seams?: ResilienceSeams;
 }
 /**

package/dist/extension/pipeline/resilience.js

@@ -163,7 +163,9 @@ export function withResilience(base, policy, opts = {}) {
                 }
                 fireTimeout("idle");
             };
-            const wallTimer = setTimeout(() => fireTimeout("wall"), policy.wallTimeoutMs);
+            const wall = opts.wallFor?.(stage);
+            const wallTimeoutMs = wall?.ms ?? policy.wallTimeoutMs;
+            const wallTimer = setTimeout(() => fireTimeout("wall"), wallTimeoutMs);
             wallTimer.unref?.();
             armIdle();
             const originalOnEvent = deps.onEvent;
@@ -207,6 +209,8 @@ export function withResilience(base, policy, opts = {}) {
                     ...(deps.taskIndex !== undefined ? { taskIndex: deps.taskIndex } : {}),
                     attempt,
                     outcome,
+                    wallTimeoutMs,
+                    ...(wall?.source ? { wallSource: wall.source } : {}),
                     ...(timedOut && timeoutKind ? { timeoutKind } : {}),
                     ...(timedOut ? { toolMs, modelBound } : {}),
                     exitCode: last.exitCode,
@@ -229,7 +233,7 @@ export function withResilience(base, policy, opts = {}) {
             const transient = classifyTransient(last, timedOut);
             // A wall-clock exhaustion is a "task too big" signal, not a stall: a
             // lane that opts out (subagents) fails honestly instead of re-burning
-            // the same 20 minutes per attempt. Idle stalls stay retryable.
+            // the same wall clock per attempt. Idle stalls stay retryable.
             const wallNotRetryable = timedOut && timeoutKind === "wall" && policy.retryWallTimeout === false;
             // No double-apply: a write stage that already started working is never re-run.
             const blockedByWriteGate = isWriteStage && sawAnyEvent;

package/dist/extension/pipeline/stages.js

@@ -41,9 +41,9 @@ export const REVIEW_LENSES = ["correctness", "business_fit", "does_it_hold"];
  */
 export const REQUIRED_LENSES = ["correctness"];
 /** Read-only recon + grounding tools shared by scout and reviewer. */
-const READ_TOOLS = ["read", "grep", "find", "ls", "bash"];
+const READ_TOOLS = ["read", "grep", "find", "ls", "bash", "prototype_read"];
 /** Full write tools for the worker stages. */
-const WRITE_TOOLS = ["read", "write", "edit", "bash", "grep", "find", "ls"];
+const WRITE_TOOLS = ["read", "write", "edit", "bash", "grep", "find", "ls", "prototype_read", "prototype_verification", "prototype_verify"];
 const TICKET_CONTEXT = "Follow the approved plan and its explicit constraints, including approved answers. " +
     "Prior summaries and review findings do not authorize expanding scope or publication " +
     "permissions. Report conflicts requiring a scope change for approval.\n\n" +
@@ -65,7 +65,7 @@ export const PIPELINE_V1 = [
         // Read-only recon (read/grep/find/ls) so the planner can actually navigate
         // instead of flailing on a single `read` and ending mid-exploration; NO bash
         // (it must not build/run), and ask_yagni for grounding.
-        tools: ["read", "grep", "find", "ls", "ask_yagni"],
+        tools: ["read", "grep", "find", "ls", "ask_yagni", "prototype_read"],
         taskTemplate: "Turn the ticket and the repo map into an ordered, grounded implementation " +
             "plan. Call ask_yagni before inferring a convention.\n\n" +
             "Ticket: {ticket}\n\nRepo map:\n{previous}",
@@ -78,7 +78,7 @@ export const PIPELINE_V1 = [
         taskTemplate: TICKET_CONTEXT +
             "Implement the plan. Write the code against it, and call record_decision " +
             "only for a consequential product-intent or architecture call the plan did " +
-            "not settle (never for taste, naming, or formatting).\n\nPlan:\n{previous}",
+            "not settle (never for taste, naming, or formatting). If the plan names a prototype revision, read that exact revision with prototype_read, implement with the repository components, then call prototype_verify against the local app with the agreed interaction states. Inspect its mobile/desktop screenshots against the design and document departures; unavailable browser checks remain unverified.\n\nPlan:\n{previous}",
     },
     {
         id: "review",
@@ -95,7 +95,7 @@ export const PIPELINE_V1 = [
         tools: [...WRITE_TOOLS, "ask_yagni"],
         taskTemplate: TICKET_CONTEXT +
             "Reconcile ONLY the blocking review findings against the plan. Leave " +
-            "non-blocking findings alone.\n\nBlocking findings:\n{previous}",
+            "non-blocking findings alone. When fixing a prototype-backed UI, run prototype_verify again against the pinned revision and inspect the captured screenshots; never substitute a newer design.\n\nBlocking findings:\n{previous}",
     },
 ];
 /** The single review stage the orchestrator fans out across REVIEW_LENSES. */

package/dist/extension/pipeline/types.d.ts

@@ -527,18 +527,21 @@ export interface ResiliencePolicy {
     /**
      * Whether a WALL-clock exhaustion is retryable. Default true (the /go
      * doctrine: a wedged stage is worth another attempt). A lane whose children
-     * run read-only, fast work (subagents) sets false: a 20-minute burn means
-     * the task is too big, and re-running it just multiplies the spend before
+     * run read-only, fast work (subagents) sets false: a full wall-clock burn
+     * means the task is too big, and re-running it just multiplies the spend before
      * the same honest fail. Idle-stall timeouts stay retryable either way.
      */
     retryWallTimeout?: boolean;
 }
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed (the idle window sits well under the 5-min run heartbeat,
- * and the wall window bounds a truly wedged child); three attempts with short,
- * jittered backoff so a single transient blip across the up-to-8 child spawns no
- * longer terminates the whole run.
+ * stage is never killed: the idle window (well under the 5-min run heartbeat) is
+ * the check for a stuck model, and the wall window only bounds a runaway that
+ * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * person can abort; a run with a deadline replaces it per stage with the time
+ * left (budget.ts#stageWall). Three attempts with short, jittered
+ * backoff so a single transient blip across the up-to-8 child spawns no longer
+ * terminates the whole run.
  */
 export declare const DEFAULT_RESILIENCE_POLICY: ResiliencePolicy;
 /**

package/dist/extension/pipeline/types.js

@@ -17,14 +17,17 @@ export const MAX_REVIEW_ROUNDS = 3;
 export const MAX_FIX_TURNS = 3;
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed (the idle window sits well under the 5-min run heartbeat,
- * and the wall window bounds a truly wedged child); three attempts with short,
- * jittered backoff so a single transient blip across the up-to-8 child spawns no
- * longer terminates the whole run.
+ * stage is never killed: the idle window (well under the 5-min run heartbeat) is
+ * the check for a stuck model, and the wall window only bounds a runaway that
+ * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * person can abort; a run with a deadline replaces it per stage with the time
+ * left (budget.ts#stageWall). Three attempts with short, jittered
+ * backoff so a single transient blip across the up-to-8 child spawns no longer
+ * terminates the whole run.
  */
 export const DEFAULT_RESILIENCE_POLICY = {
     idleTimeoutMs: 4 * 60_000,
-    wallTimeoutMs: 20 * 60_000,
+    wallTimeoutMs: 60 * 60_000,
     maxAttempts: 3,
     backoffBaseMs: 1_000,
     backoffMaxMs: 30_000,