@yagni-app/code-staging 1.2.3-staging.1659.1 → 1.2.3-staging.1686.1

package/dist/extension/pipeline/budget.d.ts

@@ -10,8 +10,8 @@
  *
  * The turn cap is enforced here via aggregated `usage.turns` (not a pi --max-turns
  * flag, which is unverified in the pi flag set; that is on the upstream-pi
- * wishlist). Ceilings are generous safety bounds, not tight budgets, so a normal
- * run never trips them.
+ * wishlist). Ceilings are generous safety bounds, not tight budgets: they catch
+ * a runaway, not a normal run.
  */
 import type { ReviewRound, StageResult } from "./types.js";
 /** Aggregated usage across a whole run. */
@@ -39,11 +39,21 @@ export interface RunBudget {
     deadlineMs?: number;
 }
 /**
- * Generous default ceilings: a 3-round /go fans out review across 3 lenses on top
- * of the build half, so dozens of turns and millions of tokens are normal; these
- * only catch a runaway. Tunable per lane.
+ * Generous default ceilings for interactive /go: review fans out across 3 lenses
+ * on top of the build half, so hundreds of turns and millions of tokens are
+ * normal; these only catch a runaway. Tunable per lane.
  */
 export declare const DEFAULT_RUN_BUDGET: RunBudget;
+/**
+ * The sandbox lane's ceilings (a run with a deadline). A sandbox build runs
+ * unattended through build, review, fix and review again, and production builds
+ * took up to 532 turns on that normal path (2026-10), so 400 stopped them before
+ * their last review. 1,200 is over twice the worst seen. Cost and tokens keep the
+ * default ceilings, and the build's window and its model capability's request
+ * limit still bound the run; the turn ceiling stays a hard stop for a model that
+ * loops.
+ */
+export declare const SANDBOX_RUN_BUDGET: RunBudget;
 export declare const EMPTY_RUN_USAGE: RunUsage;
 export declare function addRunUsage(a: RunUsage, b: RunUsage): RunUsage;
 /** Sum usage across the build/fix stages AND every review lens result. */
@@ -84,12 +94,17 @@ export declare function stageWontFit(budget: RunBudget, kind: TimedStageKind, ex
  * than the time actually left, since the host stops the run at the deadline.
  */
 export declare const STAGE_WALL_FLOOR_MS: number;
-/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
+/**
+ * Time the verify gate is allowed after the last write, on top of the stage
+ * estimates: the verify run's own ceiling (`VERIFY_TIMEOUT_MS`, twenty
+ * minutes). Five until 2026-10-09, when verify could run ten, so a long stage
+ * could leave the gate less time than it may take.
+ */
 export declare const VERIFY_ALLOWANCE_MS: number;
 /**
  * What must still run after a stage stops: a review round, one fix, and the
- * verify gate. Held back from the stage's wall clock so a long stage still
- * leaves the run time to review what it wrote.
+ * verify gate (4 + 6 + 20 = 30 minutes). Held back from the stage's wall clock
+ * so a long stage still leaves the run time to review and verify what it wrote.
  */
 export declare const STAGE_WALL_RESERVE_MS: number;
 /**

package/dist/extension/pipeline/budget.js

@@ -10,19 +10,32 @@
  *
  * The turn cap is enforced here via aggregated `usage.turns` (not a pi --max-turns
  * flag, which is unverified in the pi flag set; that is on the upstream-pi
- * wishlist). Ceilings are generous safety bounds, not tight budgets, so a normal
- * run never trips them.
+ * wishlist). Ceilings are generous safety bounds, not tight budgets: they catch
+ * a runaway, not a normal run.
  */
 /**
- * Generous default ceilings: a 3-round /go fans out review across 3 lenses on top
- * of the build half, so dozens of turns and millions of tokens are normal; these
- * only catch a runaway. Tunable per lane.
+ * Generous default ceilings for interactive /go: review fans out across 3 lenses
+ * on top of the build half, so hundreds of turns and millions of tokens are
+ * normal; these only catch a runaway. Tunable per lane.
  */
 export const DEFAULT_RUN_BUDGET = {
     maxTurns: 400,
     maxCost: 50,
     maxTokens: 8_000_000,
 };
+/**
+ * The sandbox lane's ceilings (a run with a deadline). A sandbox build runs
+ * unattended through build, review, fix and review again, and production builds
+ * took up to 532 turns on that normal path (2026-10), so 400 stopped them before
+ * their last review. 1,200 is over twice the worst seen. Cost and tokens keep the
+ * default ceilings, and the build's window and its model capability's request
+ * limit still bound the run; the turn ceiling stays a hard stop for a model that
+ * loops.
+ */
+export const SANDBOX_RUN_BUDGET = {
+    ...DEFAULT_RUN_BUDGET,
+    maxTurns: 1_200,
+};
 export const EMPTY_RUN_USAGE = { turns: 0, cost: 0, input: 0, output: 0 };
 export function addRunUsage(a, b) {
     return {
@@ -113,12 +126,17 @@ export function stageWontFit(budget, kind, expectedMs, nowMs = Date.now()) {
  * than the time actually left, since the host stops the run at the deadline.
  */
 export const STAGE_WALL_FLOOR_MS = 20 * 60_000;
-/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
-export const VERIFY_ALLOWANCE_MS = 5 * 60_000;
+/**
+ * Time the verify gate is allowed after the last write, on top of the stage
+ * estimates: the verify run's own ceiling (`VERIFY_TIMEOUT_MS`, twenty
+ * minutes). Five until 2026-10-09, when verify could run ten, so a long stage
+ * could leave the gate less time than it may take.
+ */
+export const VERIFY_ALLOWANCE_MS = 20 * 60_000;
 /**
  * What must still run after a stage stops: a review round, one fix, and the
- * verify gate. Held back from the stage's wall clock so a long stage still
- * leaves the run time to review what it wrote.
+ * verify gate (4 + 6 + 20 = 30 minutes). Held back from the stage's wall clock
+ * so a long stage still leaves the run time to review and verify what it wrote.
  */
 export const STAGE_WALL_RESERVE_MS = DEFAULT_STAGE_ESTIMATE_MS.review + DEFAULT_STAGE_ESTIMATE_MS.fix + VERIFY_ALLOWANCE_MS;
 /**

package/dist/extension/pipeline/headlessGo.d.ts

@@ -55,7 +55,8 @@
  * way and pins the implement diamond for a benchmark lane (see fanout.ts).
  * `YAGNI_PIPELINE_TIME_LEFT_MS` (the sandbox host) is the run's time left,
  * anchored to this process's clock at start: the run then stops `budget_exceeded` before a review round or fix it
- * cannot finish, rather than being killed partway through one (see budget.ts).
+ * cannot finish, rather than being killed partway through one (see budget.ts). Such a run gets the sandbox lane's
+ * ceilings (`SANDBOX_RUN_BUDGET`), not interactive /go's.
  */
 import { type TreeSnapshotDeps } from "./treeSnapshot.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";

package/dist/extension/pipeline/headlessGo.js

@@ -55,7 +55,8 @@
  * way and pins the implement diamond for a benchmark lane (see fanout.ts).
  * `YAGNI_PIPELINE_TIME_LEFT_MS` (the sandbox host) is the run's time left,
  * anchored to this process's clock at start: the run then stops `budget_exceeded` before a review round or fix it
- * cannot finish, rather than being killed partway through one (see budget.ts).
+ * cannot finish, rather than being killed partway through one (see budget.ts). Such a run gets the sandbox lane's
+ * ceilings (`SANDBOX_RUN_BUDGET`), not interactive /go's.
  */
 import { readFileSync } from "node:fs";
 import { continuationResumePlan, parseContinuation } from "./continuation.js";
@@ -67,7 +68,7 @@ import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { loadGroundingEnabled } from "../grounding.js";
 import { codeStateHome } from "../stateHome.js";
 import { parseTierCap, TIER_CAP_ENV } from "./tierCap.js";
-import { DEFAULT_RUN_BUDGET, parsePipelineTimeLeft, PIPELINE_TIME_LEFT_ENV } from "./budget.js";
+import { parsePipelineTimeLeft, PIPELINE_TIME_LEFT_ENV, SANDBOX_RUN_BUDGET } from "./budget.js";
 /** One-line usage copy, shared by every argument error. */
 export const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--continue-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
 /**
@@ -272,8 +273,9 @@ export async function runHeadlessGo(argv, deps = {}) {
         writeErr(`Ignoring ${TIER_CAP_ENV}="${rawCap}": not a tier (peak, advanced, standard, efficient). Running uncapped.`);
     }
     // The sandbox host's time left for this run, anchored to THIS process's clock
-    // (the host's may be skewed from the VM's). Absent (every local run, and a
-    // host that predates it) leaves the budget exactly as it was.
+    // (the host's may be skewed from the VM's). Its presence is what makes this a
+    // sandbox run, so it also brings the sandbox lane's ceilings. Absent (every
+    // local run, and a host that predates it) leaves the budget exactly as it was.
     const rawTimeLeft = env[PIPELINE_TIME_LEFT_ENV];
     const timeLeftMs = parsePipelineTimeLeft(rawTimeLeft);
     if (rawTimeLeft?.trim() && timeLeftMs === undefined) {
@@ -282,7 +284,7 @@ export async function runHeadlessGo(argv, deps = {}) {
     const deadlineMs = timeLeftMs === undefined ? undefined : (deps.now ?? Date.now)() + timeLeftMs;
     const budget = deadlineMs === undefined
         ? deps.budget
-        : { ...(deps.budget ?? DEFAULT_RUN_BUDGET), deadlineMs: deps.budget?.deadlineMs ?? deadlineMs };
+        : { ...(deps.budget ?? SANDBOX_RUN_BUDGET), deadlineMs: deps.budget?.deadlineMs ?? deadlineMs };
     const cwd = args.cwd ?? deps.cwd ?? process.cwd();
     const emit = (obj) => write(JSON.stringify(obj));
     const stream = args.json;

package/dist/extension/pipeline/orchestrator.js

@@ -1081,6 +1081,13 @@ export async function runPipeline(ticket, deps) {
             log("review_degraded", { round, degradedLenses });
         progress({ kind: "stage_done", stageId: "review", round });
         observedMs.review = clock() - reviewStartedAt;
+        // The verdict first: a clean review is clean and a capped one is capped, even
+        // past a ceiling, since neither spends anything more.
+        const decision = shouldStop(findings, round);
+        if (decision.stop && decision.reason) {
+            stopReason = decision.reason;
+            break;
+        }
         // R3-b: stop honestly if the review fan-out pushed the run over budget, before
         // spending another fix + round. The round's findings are already recorded.
         const overAfterReview = overBudget();
@@ -1089,11 +1096,6 @@ export async function runPipeline(ticket, deps) {
             log("pipeline_stop", { reason: "budget_exceeded", phase: "review", round, detail: overAfterReview });
             break;
         }
-        const decision = shouldStop(findings, round);
-        if (decision.stop && decision.reason) {
-            stopReason = decision.reason;
-            break;
-        }
         // The review's findings are recorded; a fix that cannot finish in time would
         // only leave them half-applied.
         const fixWontFit = wontFit("fix");
@@ -1144,13 +1146,10 @@ export async function runPipeline(ticket, deps) {
         }
         progress({ kind: "stage_done", stageId: "fix", round });
         stageEvent("fix", "finish", { round });
-        // R3-b: stop honestly if this round crossed the budget, before the next round.
-        const overAfterFix = overBudget();
-        if (overAfterFix) {
-            stopReason = "budget_exceeded";
-            log("pipeline_stop", { reason: "budget_exceeded", phase: "fix", round, detail: overAfterFix });
-            break;
-        }
+        // No usage check here: a fix always gets its review, or the run would hand
+        // over a change no review saw. The bound holds anyway: past a ceiling, that
+        // review is the last stage, since the check after it stops the loop (and the
+        // review's own time is still checked at the top of the loop).
         // This whole round (review + fix) completed and the loop will continue, so a
         // crash now can resume at the NEXT round against this fix's output. Snapshot
         // the post-fix tree as the resume consistency key.

package/dist/extension/pipeline/types.d.ts

@@ -544,9 +544,10 @@ export interface ResiliencePolicy {
 }
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed: the idle window (well under the 5-min run heartbeat) is
- * the check for a stuck model, and the wall window only bounds a runaway that
- * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * stage is never killed: the idle window is the check for a stuck model (four
+ * minutes until 2026-10-09; fifteen now, since a long test run or a slow
+ * model turn emits nothing for minutes and is not stuck), and the wall window
+ * only bounds a runaway that keeps emitting events. The wall is 60 minutes for an interactive /go, where a
  * person can abort; a run with a deadline replaces it per stage with the time
  * left (budget.ts#stageWall). Three attempts with short, jittered
  * backoff so a single transient blip across the up-to-8 child spawns no longer

package/dist/extension/pipeline/types.js

@@ -21,16 +21,17 @@ export const MAX_REVIEW_ROUNDS = 2;
 export const MAX_FIX_TURNS = 3;
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed: the idle window (well under the 5-min run heartbeat) is
- * the check for a stuck model, and the wall window only bounds a runaway that
- * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * stage is never killed: the idle window is the check for a stuck model (four
+ * minutes until 2026-10-09; fifteen now, since a long test run or a slow
+ * model turn emits nothing for minutes and is not stuck), and the wall window
+ * only bounds a runaway that keeps emitting events. The wall is 60 minutes for an interactive /go, where a
  * person can abort; a run with a deadline replaces it per stage with the time
  * left (budget.ts#stageWall). Three attempts with short, jittered
  * backoff so a single transient blip across the up-to-8 child spawns no longer
  * terminates the whole run.
  */
 export const DEFAULT_RESILIENCE_POLICY = {
-    idleTimeoutMs: 4 * 60_000,
+    idleTimeoutMs: 15 * 60_000,
     wallTimeoutMs: 60 * 60_000,
     maxAttempts: 3,
     backoffBaseMs: 1_000,

package/dist/extension/pipeline/verify.d.ts

@@ -47,9 +47,13 @@
  * findings, handoffs, or run records (§0.9).
  */
 import type { Finding } from "./types.js";
-/** Total wall-clock budget for a single verify run before it is abandoned (fail-open). */
+/**
+ * Total wall-clock budget for a single verify run before it is abandoned
+ * (fail-open). Ten minutes until 2026-10-09; twenty now, matching the run
+ * budget's `VERIFY_ALLOWANCE_MS`.
+ */
 export declare const VERIFY_TIMEOUT_MS: number;
-/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. */
+/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. Ten minutes until 2026-10-09. */
 export declare const VERIFY_TEST_TIMEOUT_MS: number;
 /** A resolved verify command plus how it was found. */
 export interface VerifyCommand {

package/dist/extension/pipeline/verify.js

@@ -59,10 +59,14 @@ import { claimCovers } from "./fanout.js";
 import { composeAbortSignal } from "./resilience.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { snapshotWorkspace } from "./workspace.js";
-/** Total wall-clock budget for a single verify run before it is abandoned (fail-open). */
-export const VERIFY_TIMEOUT_MS = 10 * 60_000;
-/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. */
-export const VERIFY_TEST_TIMEOUT_MS = 10 * 60_000;
+/**
+ * Total wall-clock budget for a single verify run before it is abandoned
+ * (fail-open). Ten minutes until 2026-10-09; twenty now, matching the run
+ * budget's `VERIFY_ALLOWANCE_MS`.
+ */
+export const VERIFY_TIMEOUT_MS = 20 * 60_000;
+/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. Ten minutes until 2026-10-09. */
+export const VERIFY_TEST_TIMEOUT_MS = 20 * 60_000;
 /** Cap on located findings parsed from one failing run, and on the opaque-tail message. */
 const MAX_LOCATED_FINDINGS = 25;
 const MAX_TAIL_CHARS = 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.3-staging.1659.1",
+  "version": "1.2.3-staging.1686.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "b384d042526710ecc56fb3c2bbb2dc4bd83925e3"
+  "yagniSourceSha": "44055f7635d957d2f2f19a547cb945a6e942de62"
 }