@yemi33/minions 0.1.2054 → 0.1.2055

package/engine/lifecycle.js

@@ -2067,6 +2067,90 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
       delete next.fixedAt;
       target.minionsReview = next;
     };
+    // W-mpoeirqx0007712a — Build-fix push verification. The agent may report
+    // SUCCESS while the git push silently failed to advance the remote head
+    // (stale-worktree push rejected non-fast-forward, agent ignores non-zero
+    // `git push` exit, etc). detectPrFixBranchChange falls back to
+    // local-head / worktree-diff evidence in those scenarios and returns
+    // `changed: true` even though origin/<branch> never moved. Without a
+    // guard here, the optimistic stamp + 10-min buildFixGracePeriod
+    // suppresses re-dispatch against a still-failing build that was never
+    // actually fixed (live repro: opg-microsoft/minions PR #57).
+    //
+    // Only `evidence: 'remote-head'` proves the push landed. For
+    // BUILD_FAILURE with changed=true AND evidence explicitly set to one of
+    // the unverified types, increment `_buildFixPushFailedCount`, write an
+    // inbox alert, route through recordPrNoOpFixAttempt so the cause stays
+    // unhandled, and never write `_buildFixPushedAt`. When the counter
+    // reaches `engine.maxBuildFixRetries`, flip `_buildFixNeedsHumanRebase`
+    // so the engine stops retrying.
+    //
+    // Note: callers that omit `branchChange.evidence` (legacy / tests
+    // predating evidence plumbing) still hit the trusted-push path below to
+    // preserve backward compatibility — only the explicitly unverified
+    // evidence kinds trigger this guard.
+    const _unverifiedPushEvidence = new Set(['local-head', 'worktree-diff']);
+    if (cause === shared.PR_FIX_CAUSE.BUILD_FAILURE
+        && explicitlyChangedBranch
+        && options.branchChange?.changed === true
+        && _unverifiedPushEvidence.has(options.branchChange?.evidence)) {
+      const maxRetries = options.config?.engine?.maxBuildFixRetries
+        ?? ENGINE_DEFAULTS.maxBuildFixRetries;
+      target._buildFixPushFailedCount = (Number(target._buildFixPushFailedCount) || 0) + 1;
+      const reachedCap = target._buildFixPushFailedCount >= maxRetries;
+      if (reachedCap) {
+        target._buildFixNeedsHumanRebase = ts();
+      }
+      const beforeHeadStr = String(options.branchChange?.beforeHead || '').slice(0, 40);
+      const afterHeadStr = String(options.branchChange?.afterHead || '').slice(0, 40);
+      const evidenceStr = String(options.branchChange?.evidence || 'unknown');
+      try {
+        const wiId = options.dispatchItem?.meta?.item?.id || null;
+        const noteBody = `# Build-fix push not verified for ${pr.id}\n\n`
+          + `**PR:** ${pr.url || pr.id}\n`
+          + `**Branch:** ${pr.branch || '(unknown)'}\n`
+          + `**Cause:** build-failure\n`
+          + `**Pre-dispatch head:** ${beforeHeadStr || '(unknown)'}\n`
+          + `**Post-completion head (live):** ${afterHeadStr || '(unknown)'}\n`
+          + `**Branch-change evidence:** ${evidenceStr}\n`
+          + `**Attempt:** ${target._buildFixPushFailedCount}/${maxRetries}\n\n`
+          + (reachedCap
+              ? `⚠️ **Reached \`engine.maxBuildFixRetries\` (${maxRetries}).** PR flagged \`_buildFixNeedsHumanRebase\` — engine will stop auto-retrying. Likely root cause: worktree stale vs origin/master, push rejected non-fast-forward, or branch protection blocks the engine identity.\n`
+              : `_Engine will re-dispatch on the next \`discoverFromPrs\` pass (counter < cap)._\n`)
+          + `\nThe agent reported SUCCESS but the remote head did not advance — the optimistic \`_buildFixPushedAt\` stamp was suppressed to avoid the ${(ENGINE_DEFAULTS.buildFixGracePeriod / 60000) | 0}-minute grace-period blackout.\n`;
+        shared.writeToInbox(
+          'engine',
+          `build-fix-push-unverified-${pr.prNumber || pr.id}`,
+          noteBody,
+          null,
+          { wi: wiId, pr: pr.id, cause: shared.PR_FIX_CAUSE.BUILD_FAILURE }
+        );
+      } catch (err) {
+        log('warn', `build-fix push-verify inbox alert for ${pr.id}: ${err.message}`);
+      }
+      // Route through the noop path so the cause stays unhandled, the noop
+      // counter advances symmetrically with the genuine-noop case, and the
+      // existing `delete target._buildFixPushedAt` cleanup (line ~2016) runs.
+      const verifyBranchChange = {
+        changed: false,
+        beforeHead: options.branchChange?.beforeHead,
+        afterHead: options.branchChange?.afterHead,
+        evidence: 'push-unverified',
+      };
+      const noopReason = `build-fix push unverified (evidence: ${evidenceStr}); attempt ${target._buildFixPushFailedCount}/${maxRetries}${reachedCap ? ' — needs-human-rebase' : ''}`;
+      const record = recordPrNoOpFixAttempt(target, cause, source, options.dispatchItem, verifyBranchChange, options.config, noopReason);
+      result = {
+        noOp: true,
+        cause,
+        paused: !!record.paused,
+        count: record.count,
+        pushUnverified: true,
+        pushFailedCount: target._buildFixPushFailedCount,
+        needsHumanRebase: reachedCap,
+      };
+      log('warn', `Updated ${pr.id} → build-fix push unverified (${target._buildFixPushFailedCount}/${maxRetries}, evidence=${evidenceStr})${reachedCap ? ' [needs-human-rebase]' : ''}; remote head ${beforeHeadStr.slice(0, 8)} did not advance — inbox alert written, cause left unhandled for re-dispatch`);
+      return prs;
+    }
     if (explicitlyChangedBranch && options.branchChange?.changed === false) {
       const record = recordPrNoOpFixAttempt(target, cause, source, options.dispatchItem, options.branchChange, options.config, options.noopReason);
       result = { noOp: true, cause, paused: !!record.paused, count: record.count };
@@ -2086,6 +2170,19 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
       return prs;
     }
     clearPrNoOpFixAttempt(target, cause);
+    // W-mpoeirqx0007712a — verified-push stamping for BUILD_FAILURE. Reaching
+    // this point with explicitlyChangedBranch=true means the unverified-push
+    // guard above did NOT trigger, so either evidence === 'remote-head'
+    // (live remote refs prove the branch advanced) OR no branchChange info
+    // was supplied (legacy callers that didn't pass branchChange — keep
+    // existing behavior of trusting the agent's branchChanged claim).
+    // Clear the push-failure counter on confirmed success so future
+    // regressions start fresh.
+    if (cause === shared.PR_FIX_CAUSE.BUILD_FAILURE && explicitlyChangedBranch) {
+      target._buildFixPushedAt = ts();
+      delete target._buildFixPushFailedCount;
+      delete target._buildFixNeedsHumanRebase;
+    }
     if (source === 'pr-human-feedback') {
       const clearPendingFix = shouldClearHumanFeedbackPendingFix(target, pr, automationCauseKey);
       if (target.humanFeedback && clearPendingFix) target.humanFeedback.pendingFix = false;

package/engine/shared.js

@@ -1800,7 +1800,15 @@ const ENGINE_DEFAULTS = {
   logBufferSize: 50, // flush immediately when buffer exceeds this many entries
   lockRetries: 0, // no retries — single 5s timeout window with 25ms polling (200 attempts) is sufficient; stale lock recovery at 60s handles crashes
   lockRetryBackoffMs: 500, // base backoff between lock retries (doubles each attempt: 500ms, 1s, 2s, ...)
-  buildFixGracePeriod: 600000, // 10min — wait for CI to run after build fix before re-dispatching
+  buildFixGracePeriod: 600000, // 10min — wait for CI to run after a verified build-fix push before re-dispatching
+  // W-mpoeirqx0007712a: cap re-dispatch attempts when build-fix pushes
+  // silently fail to advance the remote head (stale-worktree push rejected,
+  // agent ignores non-zero git push exit and reports SUCCESS, etc).
+  // updatePrAfterFix increments `_buildFixPushFailedCount` whenever the
+  // post-completion branchChange has non-remote-head evidence; when the
+  // counter reaches this cap, the PR is flagged `_buildFixNeedsHumanRebase`
+  // so the dispatcher stops auto-retrying and a human can rescue the branch.
+  maxBuildFixRetries: 3,
   adoPollEnabled: true, // poll ADO PR status, comments, and reconciliation on each tick cycle
   ghPollEnabled: true, // poll GitHub PR status, comments, and reconciliation on each tick cycle
   prPollStatusEvery: 12,   // poll PR build/review/merge status every N ticks for both ADO and GitHub (~12 min at default interval)

package/engine.js

@@ -4929,15 +4929,16 @@ async function discoverFromPrs(config, project) {
       }, `Fix build failure on ${pr.id}: ${pr.title || ''}`, { dispatchKey: key, cooldownKey: key, automationCauseKey: buildCauseKey, source: 'pr', pr, branch: prBranch, project: projMeta });
       if (item) {
         newWork.push(item); fixDispatched = true;
-        try {
-          const prPath = projectPrPath(project);
-          mutatePullRequests(prPath, prs => {
-            const target = shared.findPrRecord(prs, pr, project);
-            if (target) {
-              target._buildFixPushedAt = ts();
-            }
-          });
-        } catch (e) { log('warn', 'mark build fix dispatched: ' + e.message); }
+        // W-mpoeirqx0007712a — DO NOT stamp `_buildFixPushedAt` at dispatch
+        // time. The optimistic stamp here used to suppress re-dispatch for
+        // the buildFixGracePeriod window even when the agent never pushed
+        // (stale-worktree push silently rejected, agent reported SUCCESS
+        // anyway). `_buildFixPushedAt` is now written only by
+        // lifecycle.updatePrAfterFix after the post-completion branchChange
+        // confirms the remote head actually advanced (evidence ===
+        // 'remote-head'). In-flight dispatches are already deduplicated by
+        // `isPrAutomationCausePending` + `isAlreadyDispatched` above, so no
+        // race window opens by removing the optimistic stamp.
       }
 
       if (pr.agent && !pr._buildFailNotified) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2054",
+  "version": "0.1.2055",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"