@yagni-app/code-staging 1.2.3-staging.1621.1 → 1.2.3-staging.1632.1

package/dist/extension/pipeline/budget.d.ts

@@ -79,9 +79,9 @@ export declare const DEFAULT_STAGE_ESTIMATE_MS: Record<TimedStageKind, number>;
  */
 export declare function stageWontFit(budget: RunBudget, kind: TimedStageKind, expectedMs: number, nowMs?: number): string | null;
 /**
- * The shortest wall clock any /go stage gets: the old fixed limit. A run close
- * to its deadline keeps this much rather than a stage being cut off sooner than
- * it ever was.
+ * The shortest wall clock a /go stage gets while the build has time for it: the
+ * old fixed limit. A run close to its deadline keeps this much, but never more
+ * than the time actually left, since the host stops the run at the deadline.
  */
 export declare const STAGE_WALL_FLOOR_MS: number;
 /** Time the verify gate is allowed after the last write, on top of the stage estimates. */
@@ -94,7 +94,8 @@ export declare const VERIFY_ALLOWANCE_MS: number;
 export declare const STAGE_WALL_RESERVE_MS: number;
 /**
  * Where a stage's wall clock came from: the build's remaining time, the
- * 20-minute floor because the deadline was close, or the no-deadline default.
+ * 20-minute floor (or the less time left) because the deadline was close, or
+ * the no-deadline default.
  */
 export type StageWallSource = "deadline" | "floor" | "default";
 /**
@@ -102,7 +103,10 @@ export type StageWallSource = "deadline" | "floor" | "default";
  * mission runs) a working stage gets the build's remaining time less
  * {@link STAGE_WALL_RESERVE_MS}, never under {@link STAGE_WALL_FLOOR_MS}: the
  * idle timer is the check for a stuck model, and stopping a live stage at a
- * fixed limit throws away work the run had time for. Without a deadline
+ * fixed limit throws away work the run had time for. The floor is capped at the
+ * time left before the deadline (zero once it has passed): a wall past the
+ * deadline would only let the host kill the stage partway through, with no
+ * stop the run can report. Without a deadline
  * (interactive /go, where a person can abort) `fallbackMs` applies. The
  * source rides the stage's attempt record.
  */

package/dist/extension/pipeline/budget.js

@@ -108,9 +108,9 @@ export function stageWontFit(budget, kind, expectedMs, nowMs = Date.now()) {
     return `not enough time left for a ${kind} stage (${Math.max(0, Math.round(leftMs / 1000))}s left, expected ${Math.round(expectedMs / 1000)}s)`;
 }
 /**
- * The shortest wall clock any /go stage gets: the old fixed limit. A run close
- * to its deadline keeps this much rather than a stage being cut off sooner than
- * it ever was.
+ * The shortest wall clock a /go stage gets while the build has time for it: the
+ * old fixed limit. A run close to its deadline keeps this much, but never more
+ * than the time actually left, since the host stops the run at the deadline.
  */
 export const STAGE_WALL_FLOOR_MS = 20 * 60_000;
 /** Time the verify gate is allowed after the last write, on top of the stage estimates. */
@@ -126,7 +126,10 @@ export const STAGE_WALL_RESERVE_MS = DEFAULT_STAGE_ESTIMATE_MS.review + DEFAULT_
  * mission runs) a working stage gets the build's remaining time less
  * {@link STAGE_WALL_RESERVE_MS}, never under {@link STAGE_WALL_FLOOR_MS}: the
  * idle timer is the check for a stuck model, and stopping a live stage at a
- * fixed limit throws away work the run had time for. Without a deadline
+ * fixed limit throws away work the run had time for. The floor is capped at the
+ * time left before the deadline (zero once it has passed): a wall past the
+ * deadline would only let the host kill the stage partway through, with no
+ * stop the run can report. Without a deadline
  * (interactive /go, where a person can abort) `fallbackMs` applies. The
  * source rides the stage's attempt record.
  */
@@ -134,6 +137,8 @@ export function stageWall(budget, fallbackMs, nowMs = Date.now()) {
     if (budget.deadlineMs === undefined)
         return { ms: fallbackMs, source: "default" };
     const leftMs = budget.deadlineMs - nowMs - STAGE_WALL_RESERVE_MS;
-    return leftMs > STAGE_WALL_FLOOR_MS ? { ms: leftMs, source: "deadline" } : { ms: STAGE_WALL_FLOOR_MS, source: "floor" };
+    if (leftMs > STAGE_WALL_FLOOR_MS)
+        return { ms: leftMs, source: "deadline" };
+    return { ms: Math.min(STAGE_WALL_FLOOR_MS, Math.max(0, budget.deadlineMs - nowMs)), source: "floor" };
 }
 //# sourceMappingURL=budget.js.map

package/dist/extension/pipeline/continuation.d.ts

@@ -0,0 +1,61 @@
+/**
+ * PURE continuation rules for a headless mission run (`--continue-file`).
+ *
+ * When a cloud build stops before it finishes (a timeout, a crash), the host
+ * starts a new build from the earlier attempt's saved change: the sandbox work
+ * tree already holds that change as UNCOMMITTED edits on top of HEAD (the base
+ * commit), and the host says where the earlier attempt stopped. Two rules:
+ *
+ *  - the build's baseline is the CLEAN base, so the saved change counts as this
+ *    run's own change (an implement that only confirms finished work is not
+ *    `no_changes`, and the verify gate scopes to the whole diff against HEAD);
+ *  - an attempt that stopped in review, fix or verify re-enters the review→fix
+ *    loop at the next round, through the same `resume_loop` seam a resumed
+ *    interactive run uses. An attempt that stopped in implement (or before)
+ *    runs implement again on the approved plan.
+ *
+ * The file is the host's contract, so anything unreadable is refused here and
+ * the caller runs a normal mission instead of crashing.
+ */
+import { type MissionInputs } from "./mission.js";
+import { type ResumePlan } from "./types.js";
+/** Where the earlier attempt stopped, as the host reports it. */
+export type ContinuationStage = "implement" | "review" | "fix" | "verify";
+/** The parsed `--continue-file` (contract version 1). */
+export interface ContinuationInputs {
+    /** The stage the earlier attempt was in when it stopped; null when unknown. */
+    stageAtStop: ContinuationStage | null;
+    /** Review rounds the earlier attempt finished. */
+    reviewRoundsDone: number;
+    /** The host's short code for why the earlier attempt stopped. */
+    priorStop: string;
+}
+/** Parse and validate the continue file's text; a reason when it cannot be used. */
+export declare function parseContinuation(raw: string): {
+    ok: true;
+    value: ContinuationInputs;
+} | {
+    ok: false;
+    reason: string;
+};
+/** True when the earlier attempt got past implement, so the run re-enters the review loop. */
+export declare function continuesInLoop(continuation: ContinuationInputs): boolean;
+/**
+ * The round-1 review handoff for a continuation that skips implement. The live
+ * run hands review the implement summary (plus the pinned design context); a
+ * continuation has no summary, so it says where the change is instead and pins
+ * the same design context.
+ */
+export declare function continuationReviewInput(continuation: ContinuationInputs, mission: MissionInputs | undefined): string;
+/**
+ * The resume plan that re-enters the review→fix loop for a continuation that
+ * stopped in review, fix or verify; undefined when implement must run again.
+ * The round continues the earlier attempt's count, capped at the last round so
+ * a continuation always gets one review.
+ */
+export declare function continuationResumePlan(continuation: ContinuationInputs, ctx: {
+    ticket: string;
+    runId?: string;
+    mission?: MissionInputs;
+}): ResumePlan | undefined;
+//# sourceMappingURL=continuation.d.ts.map

package/dist/extension/pipeline/continuation.js

@@ -0,0 +1,85 @@
+/**
+ * PURE continuation rules for a headless mission run (`--continue-file`).
+ *
+ * When a cloud build stops before it finishes (a timeout, a crash), the host
+ * starts a new build from the earlier attempt's saved change: the sandbox work
+ * tree already holds that change as UNCOMMITTED edits on top of HEAD (the base
+ * commit), and the host says where the earlier attempt stopped. Two rules:
+ *
+ *  - the build's baseline is the CLEAN base, so the saved change counts as this
+ *    run's own change (an implement that only confirms finished work is not
+ *    `no_changes`, and the verify gate scopes to the whole diff against HEAD);
+ *  - an attempt that stopped in review, fix or verify re-enters the review→fix
+ *    loop at the next round, through the same `resume_loop` seam a resumed
+ *    interactive run uses. An attempt that stopped in implement (or before)
+ *    runs implement again on the approved plan.
+ *
+ * The file is the host's contract, so anything unreadable is refused here and
+ * the caller runs a normal mission instead of crashing.
+ */
+import { missionDesignContext } from "./mission.js";
+import { MAX_REVIEW_ROUNDS } from "./types.js";
+const CONTINUATION_STAGES = ["implement", "review", "fix", "verify"];
+/** Parse and validate the continue file's text; a reason when it cannot be used. */
+export function parseContinuation(raw) {
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, reason: "it is not JSON" };
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return { ok: false, reason: "it is not a JSON object" };
+    const obj = data;
+    if (obj.version !== 1)
+        return { ok: false, reason: `unknown version ${JSON.stringify(obj.version)}` };
+    const stage = obj.stageAtStop;
+    if (stage !== null && !CONTINUATION_STAGES.includes(stage)) {
+        return { ok: false, reason: `unknown stageAtStop ${JSON.stringify(stage)}` };
+    }
+    const rounds = obj.reviewRoundsDone;
+    if (typeof rounds !== "number" || !Number.isInteger(rounds) || rounds < 0) {
+        return { ok: false, reason: `reviewRoundsDone is not a whole number (${JSON.stringify(rounds)})` };
+    }
+    const priorStop = typeof obj.priorStop === "string" ? obj.priorStop.trim() : "";
+    return { ok: true, value: { stageAtStop: stage, reviewRoundsDone: rounds, priorStop } };
+}
+/** True when the earlier attempt got past implement, so the run re-enters the review loop. */
+export function continuesInLoop(continuation) {
+    const stage = continuation.stageAtStop;
+    return stage === "review" || stage === "fix" || stage === "verify";
+}
+/**
+ * The round-1 review handoff for a continuation that skips implement. The live
+ * run hands review the implement summary (plus the pinned design context); a
+ * continuation has no summary, so it says where the change is instead and pins
+ * the same design context.
+ */
+export function continuationReviewInput(continuation, mission) {
+    const why = continuation.priorStop ? ` (${continuation.priorStop})` : "";
+    const summary = `No implement summary: this build continues an earlier attempt that stopped during its ${continuation.stageAtStop ?? "unknown"} stage${why}. ` +
+        "That attempt's change is already in the working tree as uncommitted edits on top of HEAD. " +
+        "Review the whole change against HEAD (`git diff HEAD`, plus any untracked files `git status` lists).";
+    const design = missionDesignContext(mission);
+    return design ? `${summary}\n\n${design}` : summary;
+}
+/**
+ * The resume plan that re-enters the review→fix loop for a continuation that
+ * stopped in review, fix or verify; undefined when implement must run again.
+ * The round continues the earlier attempt's count, capped at the last round so
+ * a continuation always gets one review.
+ */
+export function continuationResumePlan(continuation, ctx) {
+    if (!continuesInLoop(continuation))
+        return undefined;
+    return {
+        mode: "resume_loop",
+        round: Math.min(continuation.reviewRoundsDone + 1, MAX_REVIEW_ROUNDS),
+        reviewInput: continuationReviewInput(continuation, ctx.mission),
+        priorRounds: [],
+        ticket: ctx.ticket,
+        ...(ctx.runId ? { runId: ctx.runId } : {}),
+    };
+}
+//# sourceMappingURL=continuation.js.map

package/dist/extension/pipeline/findings.js

@@ -13,8 +13,12 @@
  * after MAX_REVIEW_ROUNDS rounds, always with an explicit reason.
  */
 import { MAX_REVIEW_ROUNDS } from "./types.js";
-const SEVERITIES = ["critical", "high", "medium", "low"];
+const SEVERITIES = ["critical", "high", "medium", "low", "needs_person"];
 const DEFAULT_LENS = "correctness";
+/** `NEEDS PERSON`, `needs-person` and `needs_person` all read as `needs_person`. */
+function normalizeSeverity(value) {
+    return value.trim().toLowerCase().replace(/[\s-]+/g, "_");
+}
 function isSeverity(value) {
     return SEVERITIES.includes(value);
 }
@@ -33,7 +37,7 @@ function parsePipeLine(line, lens) {
     const parts = line.split("|").map((p) => p.trim());
     if (parts.length < 2)
         return null;
-    const severity = parts[0].toLowerCase();
+    const severity = normalizeSeverity(parts[0]);
     if (!isSeverity(severity))
         return null;
     let finding;
@@ -81,7 +85,7 @@ function parseJsonFindings(raw, lens) {
         if (!item || typeof item !== "object")
             continue;
         const obj = item;
-        const severity = typeof obj.severity === "string" ? obj.severity.toLowerCase() : "";
+        const severity = typeof obj.severity === "string" ? normalizeSeverity(obj.severity) : "";
         if (!isSeverity(severity))
             continue;
         const finding = {

package/dist/extension/pipeline/goCommand.js

@@ -906,7 +906,7 @@ export function registerGoCommand(pi, deps = {}) {
                                     })()
                                     : {}),
                                 openPr: parsed.flags.pr,
-                                remainingFindings: result.findings.filter((f) => f.severity === "medium" || f.severity === "low"),
+                                remainingFindings: result.findings.filter((f) => f.severity === "medium" || f.severity === "low" || f.severity === "needs_person"),
                                 ...(finishBaselinePaths.length > 0 ? { baselinePaths: finishBaselinePaths } : {}),
                                 signal: runSignal,
                             });

package/dist/extension/pipeline/headlessGo.d.ts

@@ -8,7 +8,7 @@
  * session instead of the product's staged pipeline. This module closes it:
  *
  *   yagni go --headless --ticket-file <p> [--plan-file <p>] [--memo-file <p>]
- *            [--run-id <id>] [--cwd <p>] [--json]
+ *            [--continue-file <p>] [--run-id <id>] [--cwd <p>] [--json]
  *
  * It is the SAME `runPipeline` path the interactive command drives (no forked
  * driver) with the interactive-only machinery left out: no worktree, no run
@@ -24,6 +24,13 @@
  * run ends at the reviewed candidate and never commits, pushes, opens a PR, or
  * reports one. The mission's own prHandoff owns all of that.
  *
+ * CONTINUATION (`--continue-file`, mission mode only): the run continues an
+ * earlier attempt whose change is already in the tree as uncommitted edits. The
+ * build baselines the clean base, and an attempt that stopped in review, fix or
+ * verify re-enters the review loop at its next round (see continuation.ts). An
+ * unreadable or unknown continue file is reported on stderr and the run goes on
+ * as a normal mission.
+ *
  * Output contract:
  *  - `--json`: one NDJSON line per event on stdout. Child events are the pi
  *    `--mode json` objects VERBATIM plus an additive `yagni` attribution key
@@ -55,7 +62,7 @@ import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { type RunBudget } from "./budget.js";
 import type { Finding, JsonEvent, ModelTier, PipelineStage, StageId, StageTag, StageUsage, StopReason } from "./types.js";
 /** One-line usage copy, shared by every argument error. */
-export declare const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
+export declare const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--continue-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
 /**
  * Exit codes. `verified` is deliberately narrow: only a `clean` stop means the
  * run produced a reviewed candidate, so a round_cap / no_changes / failed run
@@ -73,6 +80,7 @@ export interface HeadlessGoArgs {
     ticketFile?: string;
     planFile?: string;
     memoFile?: string;
+    continueFile?: string;
     runId?: string;
     cwd?: string;
     /** Any `--flag`-shaped token we do not know: refused, never folded in. */

package/dist/extension/pipeline/headlessGo.js

@@ -8,7 +8,7 @@
  * session instead of the product's staged pipeline. This module closes it:
  *
  *   yagni go --headless --ticket-file <p> [--plan-file <p>] [--memo-file <p>]
- *            [--run-id <id>] [--cwd <p>] [--json]
+ *            [--continue-file <p>] [--run-id <id>] [--cwd <p>] [--json]
  *
  * It is the SAME `runPipeline` path the interactive command drives (no forked
  * driver) with the interactive-only machinery left out: no worktree, no run
@@ -24,6 +24,13 @@
  * run ends at the reviewed candidate and never commits, pushes, opens a PR, or
  * reports one. The mission's own prHandoff owns all of that.
  *
+ * CONTINUATION (`--continue-file`, mission mode only): the run continues an
+ * earlier attempt whose change is already in the tree as uncommitted edits. The
+ * build baselines the clean base, and an attempt that stopped in review, fix or
+ * verify re-enters the review loop at its next round (see continuation.ts). An
+ * unreadable or unknown continue file is reported on stderr and the run goes on
+ * as a normal mission.
+ *
  * Output contract:
  *  - `--json`: one NDJSON line per event on stdout. Child events are the pi
  *    `--mode json` objects VERBATIM plus an additive `yagni` attribution key
@@ -51,6 +58,7 @@
  * cannot finish, rather than being killed partway through one (see budget.ts).
  */
 import { readFileSync } from "node:fs";
+import { continuationResumePlan, parseContinuation } from "./continuation.js";
 import { resolveFanoutMode } from "./fanout.js";
 import { makeFanoutBeats } from "./fanoutBeats.js";
 import { normalizeMission } from "./mission.js";
@@ -61,7 +69,7 @@ import { codeStateHome } from "../stateHome.js";
 import { parseTierCap, TIER_CAP_ENV } from "./tierCap.js";
 import { DEFAULT_RUN_BUDGET, parsePipelineTimeLeft, PIPELINE_TIME_LEFT_ENV } from "./budget.js";
 /** One-line usage copy, shared by every argument error. */
-export const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
+export const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--continue-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
 /**
  * Exit codes. `verified` is deliberately narrow: only a `clean` stop means the
  * run produced a reviewed candidate, so a round_cap / no_changes / failed run
@@ -72,6 +80,7 @@ const VALUE_FLAGS = {
     "--ticket-file": "ticketFile",
     "--plan-file": "planFile",
     "--memo-file": "memoFile",
+    "--continue-file": "continueFile",
     "--run-id": "runId",
     "--cwd": "cwd",
 };
@@ -284,6 +293,26 @@ export async function runHeadlessGo(argv, deps = {}) {
     // A blank plan or memo file is NOT mission context: it must never read as an
     // approved plan (which would skip the pipeline's planning on nothing at all).
     const mission = normalizeMission({ plan: files.plan, memo: files.memo });
+    // The continue file fails soft on every path: a continuation the run cannot
+    // read still has the saved change in its tree, and a normal mission on it beats
+    // no run at all.
+    let continuation;
+    if (args.continueFile && !mission) {
+        writeErr(`Ignoring --continue-file ${args.continueFile}: a continuation needs a mission (--plan-file or --memo-file).`);
+    }
+    else if (args.continueFile) {
+        const raw = read(args.continueFile, "continue file");
+        const parsed = typeof raw === "string" ? parseContinuation(raw) : undefined;
+        if (parsed?.ok)
+            continuation = parsed.value;
+        else if (typeof raw !== "string")
+            writeErr(`${raw.error}. Running as a normal mission.`);
+        else if (parsed)
+            writeErr(`Ignoring --continue-file ${args.continueFile}: ${parsed.reason}. Running as a normal mission.`);
+    }
+    const resumeFrom = continuation
+        ? continuationResumePlan(continuation, { ticket: files.ticket, ...(args.runId ? { runId: args.runId } : {}), ...(mission ? { mission } : {}) })
+        : undefined;
     // The implement diamond's recording thread, per RUN. The beats ride the
     // NDJSON stream as `pipeline_fanout` records, and the mission collector
     // folds them onto the Run.
@@ -305,6 +334,8 @@ export async function runHeadlessGo(argv, deps = {}) {
         ...(deps.stages ? { stages: deps.stages } : {}),
         grounded: deps.grounded ?? grounding,
         ...(mission ? { mission } : {}),
+        ...(continuation ? { continuation: { stageAtStop: continuation.stageAtStop } } : {}),
+        ...(resumeFrom ? { resumeFrom } : {}),
         onEvent: (ev, tag) => {
             deps.onEvent?.(ev, tag);
             if (stream)
@@ -323,10 +354,12 @@ export async function runHeadlessGo(argv, deps = {}) {
         },
         onStage: (s) => {
             // `output` carries the plan stage's full text; the stream reports the
-            // boundary, never the body.
+            // boundary, never the body. `at` is when the boundary happened, so a
+            // host that reads the line later (a reattach replays the log) still
+            // dates it right.
             const { output: _output, ...boundary } = s;
             if (stream)
-                emit({ type: "pipeline_stage", ...boundary });
+                emit({ type: "pipeline_stage", ...boundary, at: Date.now() });
         },
         logger: (event, data) => {
             deps.logger?.(event, data);

package/dist/extension/pipeline/mission.d.ts

@@ -52,4 +52,11 @@ export declare function missionSkippedStages(mission: MissionInputs | undefined)
  * still runs and the memo is its repo map.
  */
 export declare function missionSeed(mission: MissionInputs | undefined): string | undefined;
+/** Heading of the design context pinned onto every review and fix handoff. */
+export declare const PINNED_DESIGN_MARKER = "## Pinned design context";
+/**
+ * The approved plan, pinned onto the review and fix handoffs so a prototype
+ * reference survives every round. Undefined when the mission carries no plan.
+ */
+export declare function missionDesignContext(mission: MissionInputs | undefined): string | undefined;
 //# sourceMappingURL=mission.d.ts.map

package/dist/extension/pipeline/mission.js

@@ -67,4 +67,14 @@ export function missionSeed(mission) {
         return normalized.plan;
     return `${normalized.plan}\n\n${REPO_CONTEXT_HEADING}\n\n${REPO_CONTEXT_NOTE}\n\n${normalized.memo}`;
 }
+/** Heading of the design context pinned onto every review and fix handoff. */
+export const PINNED_DESIGN_MARKER = "## Pinned design context";
+/**
+ * The approved plan, pinned onto the review and fix handoffs so a prototype
+ * reference survives every round. Undefined when the mission carries no plan.
+ */
+export function missionDesignContext(mission) {
+    const plan = normalizeMission(mission)?.plan;
+    return plan ? `${PINNED_DESIGN_MARKER}\nApproved mission plan (preserve exact prototype references):\n${plan}` : undefined;
+}
 //# sourceMappingURL=mission.js.map

package/dist/extension/pipeline/orchestrator.d.ts

@@ -25,12 +25,23 @@
  * findings — i.e. a false "reviewed and clean").
  */
 import { type RunBudget } from "./budget.js";
+import type { ContinuationStage } from "./continuation.js";
 import { type MissionInputs } from "./mission.js";
 import { type ResilienceAttemptRecord, type RunStageFn } from "./resilience.js";
 import { runStage as defaultRunStage } from "./runner.js";
 import { type VerifyOutcome, type WorkstreamCheckResult, type WorkstreamCheckTarget } from "./verify.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
-import { type CheckpointStore, type FanoutBudgetVerdict, type FanoutMode, type PipelineStage, type JsonEvent, type PipelineProgress, type PipelineResult, type ResiliencePolicy, type ResumePlan, type StageId, type StageResult, type StageTag } from "./types.js";
+import { type CheckpointStore, type FanoutBudgetVerdict, type FanoutMode, type Finding, type PipelineStage, type JsonEvent, type PipelineProgress, type PipelineResult, type ResiliencePolicy, type ResumePlan, type StageId, type StageResult, type StageTag } from "./types.js";
+/** Each review round's findings as the host stores them: bounded, messages clipped. */
+export declare const MAX_ROUND_ITEMS = 20;
+export interface RoundFindingItem {
+    severity: Finding["severity"];
+    lens: Finding["lens"];
+    message: string;
+    file?: string;
+    line?: number;
+}
+export declare function roundFindingItems(findings: readonly Finding[]): RoundFindingItem[];
 export interface RunPipelineDeps {
     /** Bounded external design preparation; never runs inside the read-only planner or approved missions. */
     prepareDesign?: (input: {
@@ -112,6 +123,10 @@ export interface RunPipelineDeps {
      * `output` carries a stage's `finalOutput` ONLY on the plan FINISH boundary, so
      * /go can record the plan onto the work item without streaming every stage's
      * full text. It is absent on every other boundary.
+     *
+     * `items` carries each review round's own findings on the review FINISH
+     * boundary (at most {@link MAX_ROUND_ITEMS}, messages clipped), so the host
+     * keeps every round and not only the last one.
      */
     onStage?: (s: {
         stage: StageId;
@@ -119,6 +134,7 @@ export interface RunPipelineDeps {
         round?: number;
         findings?: number;
         output?: string;
+        items?: RoundFindingItem[];
     }) => void;
     /**
      * Optional, fail-soft durable journal seam (spec: 2026-06-29-go-resilience).
@@ -146,6 +162,19 @@ export interface RunPipelineDeps {
      * The stage-skipping and seeding rules are pure and live in `mission.ts`.
      */
     mission?: MissionInputs;
+    /**
+     * Set when this run continues an earlier attempt (the headless entry's
+     * `--continue-file`): the working tree already holds that attempt's change as
+     * uncommitted edits on top of HEAD. The build baseline is then the CLEAN base,
+     * so the saved change counts as this run's own: an implement that only
+     * confirms finished work is not `no_changes`, and the verify gate and the
+     * fan-out's change list keep the saved change's files in scope. Re-entering
+     * the review loop is `resumeFrom`'s job (see continuation.ts). Absent on every
+     * other run, which is byte-identical to before.
+     */
+    continuation?: {
+        stageAtStop: ContinuationStage | null;
+    };
     /**
      * `go.fanout` (spec decision 8). `auto` (the default) runs the partitioner and
      * lets its conservative verdict stand; `always` pins the diamond for benchmark

package/dist/extension/pipeline/orchestrator.js

@@ -28,13 +28,27 @@ import { addRunUsage, aggregateRunUsage, DEFAULT_RUN_BUDGET, DEFAULT_STAGE_ESTIM
 import { attributeFindings, checkerFindings, composeFixNote, composeResidue, composeSynthesizerInput, mergeFindings, parseOpenFindings, renderFindings, stripOpenFindings, } from "./checker.js";
 import { auditClaims, parsePartition } from "./fanout.js";
 import { extractFindingsBlock, hasBlockingFindings, parseFindings, shouldStop, unionFindings } from "./findings.js";
-import { missionSeed, missionSkippedStages, normalizeMission } from "./mission.js";
+import { missionDesignContext, missionSeed, missionSkippedStages, normalizeMission, PINNED_DESIGN_MARKER, } from "./mission.js";
 import { withResilience } from "./resilience.js";
 import { runStage as defaultRunStage } from "./runner.js";
 import { makeRunVerify, makeWorkstreamCheck, parseChangedPaths, } from "./verify.js";
 import { builderStage, fixerStage, orchestratorStage, partitionReaskStage, PARTITION_CALLER_LABEL, REQUIRED_LENSES, REVIEW_LENSES, reaskStage, reviewStage, selectStages, synthesizerFixStage, synthesizerStage, SYNTHESIZER_CALLER_LABEL, workstreamCallerLabel, } from "./stages.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace, workspaceChanged } from "./workspace.js";
 import { DEFAULT_RESILIENCE_POLICY, MAX_CONCURRENCY, MAX_FANOUT_CONCURRENCY, MAX_FANOUT_CONCURRENCY_ULTRA, MAX_FIX_TURNS, MIN_TOOL_CALLS_FOR_HEALTH, TOOL_ERROR_FAIL_RATE, } from "./types.js";
+/** Each review round's findings as the host stores them: bounded, messages clipped. */
+export const MAX_ROUND_ITEMS = 20;
+const MAX_ROUND_ITEM_MESSAGE = 300;
+export function roundFindingItems(findings) {
+    return findings.slice(0, MAX_ROUND_ITEMS).map((finding) => ({
+        severity: finding.severity,
+        lens: finding.lens,
+        message: finding.message.length > MAX_ROUND_ITEM_MESSAGE
+            ? `${finding.message.slice(0, MAX_ROUND_ITEM_MESSAGE - 1)}…`
+            : finding.message,
+        ...(finding.file ? { file: finding.file } : {}),
+        ...(finding.line !== undefined ? { line: finding.line } : {}),
+    }));
+}
 /** Error thrown when a build stage fails; carries the partial run for the caller. */
 export class PipelineStageError extends Error {
     stageId;
@@ -335,11 +349,9 @@ export async function runPipeline(ticket, deps) {
     const rounds = resume ? [...resume.priorRounds] : [];
     let round = resume ? resume.round : 1;
     let reviewInput = resume ? resume.reviewInput : "";
-    const designMarker = "## Pinned design context";
+    const designMarker = PINNED_DESIGN_MARKER;
     const resumedDesignOffset = reviewInput.indexOf(designMarker);
-    let designContext = mission?.plan
-        ? `${designMarker}\nApproved mission plan (preserve exact prototype references):\n${mission.plan}`
-        : resumedDesignOffset >= 0 ? reviewInput.slice(resumedDesignOffset) : undefined;
+    let designContext = missionDesignContext(mission) ?? (resumedDesignOffset >= 0 ? reviewInput.slice(resumedDesignOffset) : undefined);
     let stopReason = "clean";
     // P4: honest note carried out when the verify gate could not give a verdict on
     // the final round (no command / unrunnable), so /go never claims a build it did
@@ -364,6 +376,9 @@ export async function runPipeline(ticket, deps) {
     // through by the harness leaves a half-edited tree and no verdict at all.
     const observedMs = {};
     const wontFit = (kind) => stageWontFit(budget, kind, observedMs[kind] ?? DEFAULT_STAGE_ESTIMATE_MS[kind], clock());
+    if (deps.continuation) {
+        log("continuation", { stageAtStop: deps.continuation.stageAtStop, resumedAtRound: resume ? resume.round : null });
+    }
     // The map stage's brief, kept for the partitioner's repo context. Absent on a
     // mission run (map is skipped there — the injected memo stands in) and on any
     // run whose map stage did not produce one; the partition contract is explicit
@@ -748,7 +763,10 @@ export async function runPipeline(ticket, deps) {
         // Baseline the working tree BEFORE the (read-only) recon stages so the no-op
         // guard below can attribute any change to the build half. A git-less / non-repo
         // cwd yields an untracked snapshot and the guard fails open (see workspace.ts).
-        const beforeBuild = await snapshotFn(deps.cwd, deps.signal);
+        // A continuation baselines the clean base instead: the earlier attempt's saved
+        // edits are this run's change, not pre-run dirt.
+        const liveBaseline = await snapshotFn(deps.cwd, deps.signal);
+        const beforeBuild = deps.continuation && liveBaseline.tracked ? { ...liveBaseline, status: "" } : liveBaseline;
         writeCheckpoint(mkRecord("run_start", { snapshot: beforeBuild }));
         // Record the pre-run dirt so the verify gate scopes to this run's OWN diff.
         baselinePaths = parseChangedPaths(beforeBuild.status);
@@ -1026,7 +1044,7 @@ export async function runPipeline(ticket, deps) {
             ...(degradedLenses ? { degradedLenses } : {}),
         });
         progress({ kind: "findings", round, total: findings.length, blocking: blockingCount(findings) });
-        stageEvent("review", "finish", { round, findings: findings.length });
+        stageEvent("review", "finish", { round, findings: findings.length, items: roundFindingItems(findings) });
         // Honest health check BEFORE trusting the verdict: an aborted or crashed
         // review must NOT be read as a clean review (empty output → [] findings →
         // would otherwise stop 'clean'). Mirrors the build half's isFailed guard.

package/dist/extension/pipeline/personas.d.ts

@@ -7,7 +7,8 @@
  *   - scout / planner: call `ask_yagni` before inferring a convention,
  *   - worker: call `record_decision` only for a consequential product-intent or architecture call,
  *   - reviewer (business-fit lens): call `review_business_match` and treat a
- *     conflict with a recorded decision as at least High.
+ *     conflict with a recorded decision as at least High, and a disagreement
+ *     with the plan the person approved as needs_person.
  *
  * The implement diamond adds two more roles: `orchestrator` (the read-only
  * partitioner, carrying the ```partition output contract `parsePartition` reads)

package/dist/extension/pipeline/personas.js

@@ -7,7 +7,8 @@
  *   - scout / planner: call `ask_yagni` before inferring a convention,
  *   - worker: call `record_decision` only for a consequential product-intent or architecture call,
  *   - reviewer (business-fit lens): call `review_business_match` and treat a
- *     conflict with a recorded decision as at least High.
+ *     conflict with a recorded decision as at least High, and a disagreement
+ *     with the plan the person approved as needs_person.
  *
  * The implement diamond adds two more roles: `orchestrator` (the read-only
  * partitioner, carrying the ```partition output contract `parsePartition` reads)
@@ -331,9 +332,9 @@ export const BLIND_PERSONA_BODIES = {
 };
 /** The lens-specific clause appended to the reviewer body, one per review angle. */
 const LENS_CLAUSES = {
-    correctness: "Lens: CORRECTNESS. Hunt bugs, broken logic, unhandled edge cases, race conditions, and incorrect error handling. A real defect that can ship is at least High.",
-    business_fit: "Lens: BUSINESS-FIT. This is the only-YAGNI lens. Call review_business_match and consult the decision corpus: does this change match the recorded decisions, conventions, and current priorities of this company? Right code doing the wrong thing is exactly the failure you exist to catch. A conflict with a recorded decision is at least High.",
-    does_it_hold: "Lens: DOES-IT-HOLD. Does the change actually accomplish the ticket, and does it build/test as far as read-only bash lets you verify? Missing tests for new behavior, or a change that does not do the task, is at least High.",
+    correctness: "Lens: CORRECTNESS. Hunt bugs, broken logic, unhandled edge cases, race conditions, and incorrect error handling. A defect that breaks behavior or data at runtime is at least High. Copy, naming, dead code, and style are Medium or Low.",
+    business_fit: "Lens: BUSINESS-FIT. This is the only-YAGNI lens. Call review_business_match and consult the decision corpus: does this change match the recorded decisions, conventions, and current priorities of this company? Right code doing the wrong thing is exactly the failure you exist to catch. A conflict with a recorded decision is at least High. A disagreement with the plan the person approved is needs_person: the person decided it, so only the person can change it.",
+    does_it_hold: "Lens: DOES-IT-HOLD. Does the change actually accomplish the ticket, and does it build/test as far as read-only bash lets you verify? A change that does not do the task, or new behavior with no test at all, is at least High. Something only a person can do (a named sign-off, an account, a credential, a step outside the repository) is needs_person, never High.",
 };
 /**
  * The machine-readable findings contract every reviewer must emit so the
@@ -346,7 +347,7 @@ End your review with a fenced block in EXACTLY this form, one line per finding:
 SEVERITY | file:line | message
 \`\`\`
 
-SEVERITY is one of: critical, high, medium, low. Use \`file:line\` when you can point to a location; otherwise give a short location or omit it. Put one finding per line and nothing else inside the block. If you found no problems, emit an empty \`\`\`findings block. Only critical and high findings block the change.
+SEVERITY is one of: critical, high, medium, low, needs_person. needs_person means only a person can do it (a named sign-off, an account, a credential, a call outside the code); it does not block, and the person sees it on the pull request. Use \`file:line\` when you can point to a location; otherwise give a short location or omit it. Put one finding per line and nothing else inside the block. If you found no problems, emit an empty \`\`\`findings block. Only critical and high findings block the change.
 
 Be terse. Do not narrate your process, restate the diff, or quote code back at length — spend your output on the findings themselves, at most a few short paragraphs before the block. Cap the block at the 12 most important findings, most severe first; a review cut off by its own length limit helps nobody.`;
 /**
@@ -357,7 +358,7 @@ Be terse. Do not narrate your process, restate the diff, or quote code back at l
  */
 const BLIND_LENS_CLAUSES = {
     correctness: LENS_CLAUSES.correctness,
-    business_fit: "Lens: BUSINESS-FIT. Does this change match the apparent product intent and the conventions visible in the code? Right code doing the wrong thing is exactly the failure you exist to catch. A clear mismatch is at least High.",
+    business_fit: "Lens: BUSINESS-FIT. Does this change match the apparent product intent and the conventions visible in the code? Right code doing the wrong thing is exactly the failure you exist to catch. A clear mismatch is at least High. A disagreement with the plan the person approved is needs_person.",
     does_it_hold: LENS_CLAUSES.does_it_hold,
 };
 /**

package/dist/extension/pipeline/types.d.ts

@@ -35,8 +35,13 @@ export type StageId = "map" | "plan" | "implement" | "review" | "fix";
 export type FeedStageId = StageId | "finish";
 /** The three adversarial review angles (spec §3). */
 export type ReviewLens = "correctness" | "business_fit" | "does_it_hold";
-/** Finding severities; only `critical` + `high` block the review→fix loop. */
-export type Severity = "critical" | "high" | "medium" | "low";
+/**
+ * Finding severities; only `critical` + `high` block the review→fix loop.
+ * `needs_person` is something only a person can do (a named sign-off, an
+ * account, a credential, a call outside the code): the reviewer assigns it,
+ * the fix stage never sees it, and it rides the pull request for the person.
+ */
+export type Severity = "critical" | "high" | "medium" | "low" | "needs_person";
 /**
  * One declarative stage. `model` + `tools` are the tuning surface; `taskTemplate`
  * carries `{ticket}` / `{previous}` placeholders the invocation builder fills.
@@ -496,8 +501,12 @@ export type PipelineProgress = {
     kind: "done";
     stopReason: StopReason;
 };
-/** Stop the review→fix loop after at most this many rounds (spec §7.3). */
-export declare const MAX_REVIEW_ROUNDS = 3;
+/**
+ * Stop the review→fix loop after at most this many rounds (spec §7.3). A third
+ * round never helped: every build that reached it ended with as many findings
+ * or more, and hit the cap anyway.
+ */
+export declare const MAX_REVIEW_ROUNDS = 2;
 /**
  * Hard cap on the implement diamond's fix turns (spec decision 7). Verification
  * may re-engage the builders that broke the tree, but only this many times: past

package/dist/extension/pipeline/types.js

@@ -6,8 +6,12 @@
  * scattered string literals. The stage list is a declarative contract (spec
  * §7.2) so future complexity-lanes select a subset, never a rewrite.
  */
-/** Stop the review→fix loop after at most this many rounds (spec §7.3). */
-export const MAX_REVIEW_ROUNDS = 3;
+/**
+ * Stop the review→fix loop after at most this many rounds (spec §7.3). A third
+ * round never helped: every build that reached it ended with as many findings
+ * or more, and hit the cap anyway.
+ */
+export const MAX_REVIEW_ROUNDS = 2;
 /**
  * Hard cap on the implement diamond's fix turns (spec decision 7). Verification
  * may re-engage the builders that broke the tree, but only this many times: past

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.3-staging.1621.1",
+  "version": "1.2.3-staging.1632.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "7d2396135b54ce5b4461bd57dcdb99292eb52115"
+  "yagniSourceSha": "3275eb7ef2a6e502e47bd2e835aa38bd4fb28b37"
 }