@yemi33/minions 0.1.2292 → 0.1.2294

package/dashboard/js/settings.js

@@ -289,32 +289,6 @@ async function openSettings() {
           '⚠ Live mode: dispatches run directly in this repo\'s checkout. Only one mutating dispatch runs at a time. Dirty working trees block dispatch — commit or stash before running.' +
         '</div>' +
       '</div>';
-    // M006 — liveValidation section (per-project hybrid mode config).
-    // Controls: type (work item type that stays serialized in live checkout)
-    // and autoDispatch (auto-create validation WI after coding WI completes).
-    // Section is rendered with reduced opacity + pointer-events:none when
-    // checkoutMode is not 'live' — it only applies in hybrid mode.
-    var lvType = (p.liveValidation && p.liveValidation.type) ? p.liveValidation.type : '';
-    var lvAutoDispatch = !!(p.liveValidation && p.liveValidation.autoDispatch);
-    var lvDisabled = (currentWtMode !== 'live');
-    var lvSectionStyle = lvDisabled
-      ? 'opacity:0.45;pointer-events:none;margin-bottom:6px'
-      : 'margin-bottom:6px';
-    var liveValidationBlock =
-      '<div data-live-validation-section="' + escHtml(p.name) + '" data-search="live validation deferred build test auto dispatch worktree" style="' + lvSectionStyle + '">' +
-        '<label style="font-size:var(--text-sm);color:var(--muted);display:block;margin-bottom:2px">Live validation (deferred build/test)' +
-          (lvDisabled ? ' <span style="font-size:var(--text-xs);opacity:0.7">(requires Live checkout)</span>' : '') +
-        '</label>' +
-        '<div style="font-size:var(--text-xs);color:var(--muted);margin-bottom:4px;line-height:1.4">' +
-          'For checkoutMode: live projects — coding agents run in worktrees; a separate dispatch validates in live checkout.' +
-        '</div>' +
-        '<input id="set-liveValidationType-' + escHtml(p.name) + '" value="' + escHtml(lvType) + '" placeholder="e.g. build-and-test" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:var(--text-md);margin-bottom:4px">' +
-        '<div style="font-size:var(--text-xs);color:var(--muted);margin-bottom:4px">Validation work item type (e.g. <code>build-and-test</code>, <code>test</code>, <code>verify</code>). Leave blank to disable.</div>' +
-        '<div style="display:flex;align-items:center;gap:8px;padding:2px 0">' +
-          '<input type="checkbox" id="set-liveValidationAutoDispatch-' + escHtml(p.name) + '"' + (lvAutoDispatch ? ' checked' : '') + ' style="accent-color:var(--blue);width:16px;height:16px;cursor:pointer">' +
-          '<label for="set-liveValidationAutoDispatch-' + escHtml(p.name) + '" style="font-size:var(--text-md);color:var(--text);cursor:pointer">Auto-dispatch validation WI after coding WI completes</label>' +
-        '</div>' +
-      '</div>';
     return '<div data-settings-project="' + escHtml(p.name) + '" data-search="project ' + escHtml(p.name.toLowerCase()) + '" style="border:1px solid var(--border);border-radius:6px;padding:10px 12px;margin-bottom:12px">' +
       '<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:8px">' +
         '<div style="font-size:var(--text-md);font-weight:600">' + escHtml(p.name) + '</div>' +
@@ -323,7 +297,6 @@ async function openSettings() {
       pathRow +
       branchGrid +
       worktreeModeBlock +
-      liveValidationBlock +
       driftNote +
       '<div style="display:flex;flex-direction:column;gap:6px;margin-top:8px">' +
       settingsToggle('Discover from PRs', 'set-ws-prs-' + p.name, p.workSources.pullRequests.enabled, 'Discovery gate: scan repo for open PRs and surface them as review tasks. Independent of ADO/GitHub polling — does not affect already-tracked PRs.') +
@@ -729,14 +702,6 @@ async function openSettings() {
       const chip = document.querySelector('[data-checkout-mode-chip="' + (window.CSS && CSS.escape ? CSS.escape(projName) : projName) + '"]');
       if (!chip) return;
       chip.style.display = (sel.value === 'live') ? '' : 'none';
-      // M006 — also toggle the liveValidation section opacity/pointer-events
-      // reactively: disabled when checkoutMode is not 'live'.
-      const lvSection = document.querySelector('[data-live-validation-section="' + (window.CSS && CSS.escape ? CSS.escape(projName) : projName) + '"]');
-      if (lvSection) {
-        const isLive = (sel.value === 'live');
-        lvSection.style.opacity = isLive ? '' : '0.45';
-        lvSection.style.pointerEvents = isLive ? '' : 'none';
-      }
     });
   });
 }
@@ -1181,20 +1146,10 @@ async function saveSettings() {
       // values.
       const wtModeInput = document.getElementById('set-checkoutMode-' + p.name);
       const wtModeValue = (wtModeInput && wtModeInput.value === 'live') ? 'live' : 'worktree';
-      // M006 — liveValidation: read type text input and autoDispatch checkbox.
-      // Empty type → send null so the server clears the field.
-      const lvTypeInput = document.getElementById('set-liveValidationType-' + p.name);
-      const lvAutoDispatchInput = document.getElementById('set-liveValidationAutoDispatch-' + p.name);
-      const lvTypeValue = lvTypeInput ? lvTypeInput.value.trim() : '';
-      const lvAutoDispatchValue = lvAutoDispatchInput ? !!lvAutoDispatchInput.checked : false;
-      const liveValidationValue = lvTypeValue
-        ? { type: lvTypeValue, autoDispatch: lvAutoDispatchValue }
-        : null;
       return {
         name: p.name,
         mainBranch: mainBranchValue || null,
         checkoutMode: wtModeValue,
-        liveValidation: liveValidationValue,
         workSources: {
           pullRequests: { enabled: document.getElementById('set-ws-prs-' + p.name)?.checked ?? true },
           workItems: { enabled: document.getElementById('set-ws-wi-' + p.name)?.checked ?? true }

package/dashboard.js

@@ -430,21 +430,6 @@ function mergeSettingsConfigUpdate(current, candidate, body, patch = {}) {
       // `worktreeMode`. Drop any stale legacy key on every settings save so a
       // migrated project never carries both fields.
       delete currentProject.worktreeMode;
-      // M006 — mirror liveValidation: check both candidateProject (modified
-      // in-memory config) and the original body update. When handleSettingsUpdate
-      // deletes the field (null or empty type sent), candidateProject won't have
-      // it but the body update will — mirror the deletion to disk.
-      if (Object.prototype.hasOwnProperty.call(candidateProject, 'liveValidation')) {
-        if (candidateProject.liveValidation && typeof candidateProject.liveValidation === 'object' && candidateProject.liveValidation.type) {
-          currentProject.liveValidation = candidateProject.liveValidation;
-        } else {
-          delete currentProject.liveValidation;
-        }
-      } else if (Object.prototype.hasOwnProperty.call(update, 'liveValidation')) {
-        // Body sent liveValidation key but handleSettingsUpdate deleted it from
-        // the in-memory config (null / empty type) — propagate to disk.
-        delete currentProject.liveValidation;
-      }
     }
   }
   shared.pruneDefaultClaudeConfig(current);
@@ -10921,11 +10906,6 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           // the per-project dropdown. resolveCheckoutMode honors the legacy
           // worktreeMode field; 'worktree' (default) or 'live'.
           checkoutMode: shared.resolveCheckoutMode(p),
-          // M006 — surface liveValidation so the Settings UI can pre-fill
-          // the type input and autoDispatch toggle. Null when not configured.
-          liveValidation: (p.liveValidation && typeof p.liveValidation === 'object' && p.liveValidation.type)
-            ? { type: p.liveValidation.type, autoDispatch: !!p.liveValidation.autoDispatch }
-            : null,
           workSources: {
             pullRequests: { enabled: p.workSources?.pullRequests?.enabled !== false, cooldownMinutes: p.workSources?.pullRequests?.cooldownMinutes ?? 30 },
             workItems: { enabled: p.workSources?.workItems?.enabled !== false, cooldownMinutes: p.workSources?.workItems?.cooldownMinutes ?? 0 }
@@ -11350,19 +11330,10 @@ What would you like to discuss or change? When you're happy, say "approve" and I
             // Drop the legacy field so a migrated project never carries both.
             delete proj.worktreeMode;
           }
-          // M006 — per-project liveValidation: { type, autoDispatch }.
-          // Only meaningful when checkoutMode is 'live'. Null / missing type
-          // clears the field; explicit object with a non-empty type persists it.
-          if (Object.prototype.hasOwnProperty.call(update, 'liveValidation')) {
-            const lv = update.liveValidation;
-            if (!lv || typeof lv !== 'object' || !lv.type || typeof lv.type !== 'string' || !lv.type.trim()) {
-              delete proj.liveValidation;
-            } else {
-              proj.liveValidation = { type: lv.type.trim(), autoDispatch: !!lv.autoDispatch };
-            }
-          }
         }
       }
+
+      shared.pruneDefaultClaudeConfig(config);
       mutateDashboardConfig(current => mergeSettingsConfigUpdate(current, config, body, _configPatch));
       // Refresh in-memory CONFIG so subsequent reads see the update
       reloadConfig();
@@ -13427,7 +13398,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     // /api/prd/regenerate removed — use /api/plans/approve which does diff-aware update
 
     // Agents
-    { method: 'POST', path: '/api/pull-requests/link', desc: 'Manually link an external PR for tracking', params: 'url, title?, project?, contextOnly?, context?, workItemId?', handler: async (req, res) => {
+    { method: 'POST', path: '/api/pull-requests/link', desc: 'Manually link an external PR for tracking', params: 'url, title?, project?, contextOnly?, autoObserve? (deprecated alias for !contextOnly), context?, workItemId?', handler: async (req, res) => {
       const body = await readBody(req);
       const { url } = body;
       if (!url) return jsonReply(res, 400, { error: 'url required' });

package/docs/deprecated.json

@@ -52,6 +52,7 @@
       "LEGACY_NEEDS_REVIEW_STATUS"
     ],
     "reason": "Read-side tolerance: cleanup sweep auto-migrates four obsolete work-item / PRD status strings ('in-pr', 'implemented', 'complete', 'needs-human-review') to the canonical 'done' / 'failed' values. The aliases are no longer written anywhere in the engine; the constants exist only to repair stale on-disk values from old engine versions.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Keep indefinitely until telemetry / a sweep log shows zero migrations performed for 30 consecutive days across all known projects (work-items.json + prd/*.json). At that point the constants and both _migrateLegacyItem branches in engine/cleanup.js (definitions at :1165-1166; usage at :1168-1183 for work items and :1269-1272 for PRD missing_features) can be deleted. Total cost on disk today: 4 strings."
   },
@@ -76,6 +77,7 @@
       }
     ],
     "removalGate": "Telemetry: the `deprecated-config-claude` warning emitted at engine/shared.js:2492-2495 must report zero hits across all known engines for >=30 consecutive days, AND a sweep of every persisted config.json must show no `config.claude.binary` value that diverges from DEFAULT_CLAUDE.binary. Only then is the override branch in resolveBinary() (engine/runtimes/claude.js:82-86) removable, along with the `_deprecatedConfigClaudeFields` membership for `binary` and the warning emitter at engine/shared.js:2482-2496.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — removal must be signal-gated, not calendar-gated. This entry is paired with `prune-default-claude-config`: the prune strips DEFAULT-matching values but intentionally preserves user overrides, which is precisely why the override branch in claude.js stays reachable. Removing the override before the prune entry's gate clears would silently break installs that still rely on a custom binary path."
   },
@@ -120,6 +122,7 @@
       }
     ],
     "removalGate": "Telemetry: the once-per-boot deprecation log line emitted by applyLegacyCcModelMigration (via the injected logger at engine/shared.js:2407) must show zero promotion events across all known engines for >=30 consecutive days, AND a sweep of every persisted config.json must confirm no `engine.ccModel` field remains. Once both conditions hold, removal deletes the function + _resetLegacyCcModelMigrationFlag export at engine/shared.js:4977, the boot call at engine/cli.js:477, the CLAUDE.md:316 paragraph and docs/slim-ux/concepts.md:671 reference, and the tests at runtime-fleet-helpers.test.js:209-254 + :500-505 + unit.test.js:19801.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — gating is signal-based. The function is silent on no-op (returns false without logging), so the meaningful telemetry signal is the absence of the promotion log line over the sweep window, NOT the absence of function invocations (cli.js calls it every boot regardless)."
   },
@@ -162,6 +165,7 @@
       }
     ],
     "removalGate": "All direct-readers of the mirror JSON files must be confirmed routed through their respective SQL store's read helper. Specifically: (a) grep the codebase for `safeJson`, `safeJsonArr`, `safeJsonObj`, `readFileSync(...work-items.json|pull-requests.json|metrics.json|watches.json|schedule-runs.json|pipeline-runs.json|managed-processes.json|worktree-pool.json|log.json|dispatch.json...)` and confirm every hit is either (i) a test fixture that can move to the SQL helper, or (ii) intentionally documented as bypassing SQL. (b) Run the full test suite with each store's _mirrorJsonFromSql temporarily neutered (returning early before safeWrite) and confirm 0 failures — that proves no production code path depends on the mirror. Once both conditions hold, removal deletes each store's _mirrorJsonFromSql call site in shared.js (mutateWorkItems/mutatePullRequests/etc.), the corresponding _readJsonArrayFallback paths, and the JSON file gitignore entries. CLAUDE.md update can ship independently as soon as someone has bandwidth.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — gating is signal-based, not calendar-based. The mirror writes are cheap (a few KB per write, sub-ms) so there is no production cost to keeping them indefinitely; the only reason to remove them is to simplify the codebase and lock in SQL-as-the-single-source-of-truth. Order matters: when retiring a specific store's mirror, retire the corresponding CLAUDE.md mention in the same PR so the docs never claim SQL-only while a mirror still writes."
   },
@@ -216,6 +220,7 @@
       }
     ],
     "removalGate": "Telemetry: pruneDefaultClaudeConfig must return false (no mutation) for every call across all known engines for >=30 consecutive days (add an `_engine.pruneDefaultClaudeConfigStrips` counter if needed to observe this), AND the parent `config-claude-binary-override` entry must have already cleared its own gate. The dependency is strict: removing the prune while users still rely on the override branch would surface the `deprecated-config-claude` warning on every stale generated default. Once both conditions hold, removal is the function definition (engine/shared.js:3126), the export at :5673, all 5 call sites (dashboard.js:202, :9116, :9331, :9450; minions.js:385), and the tests at unit.test.js:2260-2303 + runtime-fleet-helpers.test.js:546.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — gating is signal-based AND ordered. This entry MUST NOT be removed before `config-claude-binary-override` clears its gate, otherwise installs with stale defaults will flood the deprecation channel until their next config save. The 5 call sites form a complete coverage net: load (dashboard.js:202 + minions.js:385) + save (dashboard.js:9116/9331/9450), so any code path that touches config.json runs the sanitizer."
   },
@@ -281,6 +286,7 @@
       }
     ],
     "deprecated": "2026-06-08",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "targetRemovalDate intentionally null — unlike the record-field aliases (`_contextOnly`, `_autoObserve`, `_manual`) which carry a 7-day clock, the `observe` body param is documented as a longer-lived back-compat alias. Set targetRemovalDate to a concrete future date once the dashboard UI + any client scripts are confirmed to POST `contextOnly` exclusively. Removal scope when the date is set: drop the `body.observe` fallback in dashboard.js, drop `observe` from the route registry params, and update any client still POSTing `observe`."
   },

package/docs/live-checkout-mode.md

@@ -173,60 +173,6 @@ git for-each-ref --format '%(refname:short) %(upstream:track)' refs/heads \
 
 The engine has no opinion about local branches; this hygiene is the operator's responsibility in live mode.
 
-## Hybrid mode / deferred validation
-
-> **Requires `checkoutMode: 'live'`** — `liveValidation` is ignored when `checkoutMode` is `'worktree'` (the default).
-
-Hybrid mode lets you run *coding* work items (implement, fix, docs, …) in isolated worktrees while keeping *validation* work items (build-and-test, test, verify, …) serialized in live checkout — the setup where build caches, native toolchains, and test infrastructure only exist in one canonical checkout.
-
-### Full flow
-
-1. **Coding WI dispatched** — because `liveValidation.type` is set and this WI's type is *not* the validation type, `resolveCheckoutMode(project, workItem.type)` returns `'worktree'`. The engine creates an isolated worktree as normal, runs the agent, and pushes a PR branch.
-2. **Coding WI completes** — if `liveValidation.autoDispatch: true`, the lifecycle hook (`engine/lifecycle.js`) auto-creates a validation WI of type `liveValidation.type` targeting the same PR branch.
-3. **Validation WI dispatched** — `resolveCheckoutMode(project, 'build-and-test')` returns `'live'` (matches `liveValidation.type`). The engine runs `prepareLiveCheckout` in the operator's canonical checkout, which checks out the coding WI's branch in-place and runs the validation agent.
-4. **Validation WI completes** — `restoreLiveCheckoutAtDispatchEnd` checks the operator's tree back to the original ref.
-
-### Config snippet
-
-```jsonc
-{
-  "projects": [{
-    "name": "android-aosp",
-    "localPath": "/home/yemi/aosp",
-    "checkoutMode": "live",
-    "liveValidation": {
-      "type": "build-and-test",
-      "autoDispatch": true
-    }
-  }]
-}
-```
-
-Configure via Dashboard → Settings → Projects → **Live validation (deferred build/test)** section. The section is greyed-out when `checkoutMode` is not `'live'`.
-
-### Agent behavior contract
-
-When a coding agent is dispatched on a project with `liveValidation.autoDispatch: true`, the agent's playbook includes a note that inline build/test runs are not required:
-
-> Skip inline build and test verification steps — a separate validation dispatch will run these in the live checkout after this coding WI completes. Push the branch and report success; the validation WI handles build/test confirmation.
-
-This prevents coding agents (running in isolated worktrees) from attempting builds that may fail due to missing native toolchains, caches, or environment variables only present in the canonical checkout.
-
-### Migration guidance
-
-If your project is on `checkoutMode: live` and you want parallel coding WIs, add:
-
-```jsonc
-"liveValidation": { "type": "build-and-test", "autoDispatch": true }
-```
-
-No other config changes needed. The engine automatically:
-- Dispatches coding WIs into isolated worktrees (escaping the live-checkout cap of 1)
-- Dispatches validation WIs serially in live checkout (preserving your build environment)
-- Auto-creates validation WIs after each coding WI's PR is pushed
-
-To opt back out, clear `liveValidation` from the project config (or set to `null` via Dashboard → Settings).
-
 ## Non-goals
 
 Live-checkout mode is deliberately small. These are NOT supported and will not be added:

package/docs/named-agents.md

@@ -86,7 +86,7 @@ defaults (`WORKSPACE_MANIFEST_DEFAULTS` in `engine/shared.js`):
 
 Enforcement helpers (also in `engine/shared.js`): `validateWorkspaceManifest`,
 `resolveAgentManifest`, `agentCanUseRepo`, `agentCanUseTool`, `agentCanFetchUrl`,
-`agentMemoryScope`, `mergeManifestAllowedTools`. Today the engine actively enforces (a) the
+`mergeManifestAllowedTools`. Today the engine actively enforces (a) the
 **repo gate** at dispatch time in `engine.js spawnAgent`
 (`FAILURE_CLASS.WORKSPACE_MANIFEST_REPO`, non-retryable) and (b) the **tool merge** into the
 runtime `--allowedTools` flag at spawn time. Defaults are permissive — an agent with no

package/docs/workspace-manifests.md

@@ -31,7 +31,7 @@ A manifest lives on each agent definition under `workspace_manifest`. All fields
 | `allowed_tools` | `string[]` \| `null` | `null` (permissive) | Canonical tool-name whitelist (e.g. `Edit`, `Read`, `Bash`). Empty array = deny all. Case-sensitive. Merged into the runtime adapter's `--allowedTools` flag at spawn time. |
 | `allowed_repos` | `string[]` \| `null` | `null` (permissive) | Canonical PR-scope (`github:owner/repo`, `ado:org/proj/repo`) or bare `owner/repo`. Empty array = deny all. Case-insensitive. Enforced at dispatch time — out-of-scope dispatch fails with `failure_class: 'workspace-manifest-repo-forbidden'`. |
 | `allowed_external_urls` | `string[]` \| `null` | `null` (permissive) | Host allow-list for `web_fetch` / `web_search`. Bare host (`github.com`) = exact match; `*.example.com` = wildcard subdomain **and** apex. Empty array = deny all. Currently advisory — see "Enforcement points" below. |
-| `memory_scope` | `'private'` \| `'shared'` \| `'read-only-shared'` | `'shared'` | What slice of team knowledge the agent can read/write. Currently exposed via `shared.agentMemoryScope(agent)` for callers that want to gate inbox writes; full enforcement at the consolidation layer is future work. |
+| `memory_scope` | `'private'` \| `'shared'` \| `'read-only-shared'` | `'shared'` | What slice of team knowledge the agent can read/write. Full enforcement at the consolidation layer is future work. |
 
 ## Default behaviour & backward compatibility
 
@@ -57,21 +57,20 @@ A config that never mentions `workspace_manifest` produces the exact same dispat
 | **Spawn — tool merge** | `engine.js spawnAgent()` → `_buildAgentSpawnFlags(..., allowedTools)` | `shared.mergeManifestAllowedTools(claudeConfig.allowedTools, manifest.allowed_tools)` produces the intersection of the runtime baseline and the manifest list. Result is passed as `--allowedTools <csv>` to Claude / Copilot / Codex, so the CLI itself enforces the narrowed surface. Empty manifest list (`[]`) = deny-all. Same merge runs on the steering-resume codepath. |
 | **Agent context** | Future work (playbook.js) | Manifest can be surfaced into the agent prompt so the agent sees its declared scope. Today, `shared.resolveAgentManifest(agent)` returns the resolved struct any caller can read. |
 | **URL fetch** | Advisory today | `allowed_external_urls` is validated at config load. No runtime helper function — a future runtime adapter hook can wire URL-fetch intercepts against the manifest. |
-| **Memory scope** | Advisory today | `shared.agentMemoryScope(agent)` is available for consolidation / playbook / inbox callers. Semantics: `private` = agent only sees its own `knowledge/agents/<id>.md`; `shared` = full team knowledge (current default); `read-only-shared` = reads shared memory but should not write inbox/notes. |
+| **Memory scope** | Advisory today | `memory_scope` field is stored in the manifest (`private` = agent only sees its own `knowledge/agents/<id>.md`; `shared` = full team knowledge (current default); `read-only-shared` = reads shared memory but should not write inbox/notes). No runtime enforcement helper — full enforcement at the consolidation layer is future work. |
 
 ## Helpers (in `engine/shared.js`)
 
 ```js
 const { MEMORY_SCOPES, WORKSPACE_MANIFEST_DEFAULTS,
         validateWorkspaceManifest, resolveAgentManifest,
-        agentCanUseRepo, agentMemoryScope,
+        agentCanUseRepo,
         mergeManifestAllowedTools, formatManifestRejection } = require('./engine/shared');
 ```
 
 - `validateWorkspaceManifest(manifest)` → `{ ok, errors }`. `null`/`undefined` is valid (uses defaults).
 - `resolveAgentManifest(agent, config?)` → fresh copy of `WORKSPACE_MANIFEST_DEFAULTS` overlaid with the agent's `workspace_manifest`. Malformed manifest silently falls back to defaults; surface the error via `validateWorkspaceManifest` at config-load time.
 - `agentCanUseRepo(agent, projectOrString)` → `bool`. Accepts a project object or a string identifier (`github:owner/repo`, `ado:org/proj/repo`, or bare `owner/repo`). Case-insensitive.
-- `agentMemoryScope(agent)` → one of `MEMORY_SCOPES`. Unknown values fall back to `'shared'`.
 - `mergeManifestAllowedTools(baselineCsv, manifestArray)` → merged CSV. Intersection semantics: `null` manifest = baseline unchanged; empty array = deny-all; empty baseline + manifest = manifest as ceiling.
 - `formatManifestRejection({ agentId, kind, target, allowed })` → structured human-readable rejection string used by the dispatch repo gate.
 

package/engine/cli.js

@@ -624,6 +624,19 @@ const commands = {
       }
     } catch (err) { e.log('warn', `note-link backfill failed: ${err.message}`); }
 
+    // Backfill work_items.prd_item_id (the WI↔PRD-item FK) for rows that predate
+    // the dual-write stamp (#546) or that a JSON re-hydrate transiently zeroed.
+    // Set-based, only touches NULL FKs, no-op once everything is linked — safe on
+    // every boot. Lets the Phase-10 render join move off the feature-id string.
+    try {
+      const fk = require('./prd-store').backfillWorkItemPrdItemIds();
+      const filled = (fk.byWorkItemId || 0) + (fk.bySourcePlan || 0);
+      if (fk.ok && filled > 0) {
+        e.log('info', `Backfilled prd_item_id on ${filled} work item(s) (${fk.byWorkItemId} by workItemId, ${fk.bySourcePlan} by sourcePlan)`);
+        console.log(`  Linked ${filled} work item(s) to their PRD item.`);
+      }
+    } catch (err) { e.log('warn', `prd_item_id backfill failed: ${err.message}`); }
+
     // Auto-heal projects missing workSources (cloned-repo / hand-rolled-config
     // footgun): without this block, discoverFromWorkItems / discoverFromPrs
     // bail silently and the engine looks healthy but never dispatches. The

package/engine/features.js

@@ -77,19 +77,22 @@ const FEATURES = {
     default: true,
     addedIn: '0.1.1916',
     requiredCcRuntime: 'copilot',
+    expires: '2026-09-01',
   },
-  // prdReadsFromSql — Phase 10 step 3 read-flip. When ON, getPrdInfo sources its
-  // PRD list (existingPrds / verifyPrsByPlan / allPrdItems) from the SQL mirror
-  // (prds/prd_items/prd_verify_prs) after reconciling it from disk, instead of
-  // scanning prd/*.json directly. JSON stays canonical and the dual-write keeps
-  // SQL in sync; reconciliation catches PRDs written outside the chokepoint. The
-  // two code paths are proven output-equivalent by db-phase10-read-flip.test.js.
-  // Reversible: set `features.prdReadsFromSql: false` to fall back to the file
-  // scan instantly. Temporary migration gate — remove once the read-flip soaks.
-  'prdReadsFromSql': {
-    description: 'Source the dashboard PRD/plan read (getPrdInfo) from the SQL mirror instead of scanning prd/*.json. Reversible; the two paths are output-equivalent (Phase 10 step 3).',
+  // prdJoinFromFk — Phase 10 step 4.3 render-join flip. When ON, getPrdInfo
+  // resolves each PRD item to its work item via the stable SQL FK
+  // (work_items.prd_item_id → prd_items.id) instead of the fragile feature-id
+  // string match (work_item.id === feature.id), which bleeds when a live and an
+  // archived PRD share a feature id (footgun #7). PURELY ADDITIVE: the FK lookup
+  // is tried first and falls back to the exact legacy id match for any row not
+  // yet stamped, when the flag is OFF, or when SQL is unavailable — so flipping
+  // it off (or a NULL FK) reproduces current behavior byte-for-byte. The FK
+  // lives only in SQL (unconditional read source since Phase 10 step 3 was
+  // completed). Temporary migration gate.
+  'prdJoinFromFk': {
+    description: 'Resolve the dashboard WI↔PRD-item join via the SQL FK (work_items.prd_item_id) instead of the feature-id string match. Additive with a string-match fallback; reversible (Phase 10 step 4.3).',
     default: true,
-    addedIn: '0.1.2090',
+    addedIn: '0.1.2232',
     expires: '2026-12-01',
   },
 };

package/engine/github.js

@@ -1935,6 +1935,9 @@ module.exports = {
   // Exported for testing
   isGitHub,
   getRepoSlug,
+  getConfiguredGitHubAuthorLogins, // exported for testing (W-mqyn73pa000333c4)
+  _commentKey, // exported for testing (W-mqyn73pa000333c4)
+  _entryCommentKey, // exported for testing (W-mqyn73pa000333c4)
   isSlugInBackoff,
   recordSlugFailure,
   resetSlugBackoff,

package/engine/lifecycle.js

@@ -74,9 +74,15 @@ function checkPlanCompletion(meta, config) {
 
   // Check 2: every feature must be in a terminal state (done, failed, or cancelled).
   // Failed/cancelled items are unrecoverable — waiting on them blocks the plan indefinitely.
+  // P-a2b4c6d8: when a work item EXISTS, use ONLY the work item's status — do NOT fall
+  // through to the PRD item's own status field as a shortcut. If syncPrdItemStatus stamped
+  // the PRD item 'done' ahead of the actual WI completing (race / premature write), the old
+  // fallback incorrectly passed the gate and triggered early verify WI creation. The PRD item
+  // status is only a valid fallback when NO work item has been materialized for that feature
+  // (externally-resolved items that were never dispatched).
   const notTerminal = [...planFeatureIds].filter(id => {
     const w = workItemById[id];
-    if (w && PLAN_TERMINAL_STATUSES.has(w.status)) return false;
+    if (w) return !PLAN_TERMINAL_STATUSES.has(w.status); // WI exists: trust WI status only
     const prdItem = (plan.missing_features || []).find(f => f.id === id);
     return !(prdItem && PLAN_TERMINAL_STATUSES.has(prdItem.status));
   });
@@ -815,6 +821,22 @@ function stampPrdItemWorkItemId(itemId, sourcePlan) {
   } catch (err) { log('warn', `stampPrdItemWorkItemId: ${err.message}`); }
 }
 
+function stampPrdItemPrUrl(itemId, sourcePlan, prUrl) {
+  if (!itemId || !sourcePlan || !prUrl) return;
+  try {
+    const fpath = path.join(PRD_DIR, sourcePlan);
+    if (!fs.existsSync(fpath)) return;
+    const plan = safeJsonNoRestore(fpath);
+    const feature = plan?.missing_features?.find(f => f.id === itemId);
+    if (!feature || feature.pr_url === prUrl) return;
+    mutateJsonFileLocked(fpath, (fresh) => {
+      const f = fresh?.missing_features?.find(x => x.id === itemId);
+      if (f && f.pr_url !== prUrl) f.pr_url = prUrl;
+      return fresh;
+    }, { skipWriteIfUnchanged: true });
+  } catch (err) { log('warn', `stampPrdItemPrUrl: ${err?.message || err}`); }
+}
+
 // ─── PRD Backward-Scan Reconciliation (#929, #984) ─────────────────────────
 // Proactive counterpart to syncPrdItemStatus. Scans all active PRDs and:
 // 1. Promotes "missing" items to "updated" when a done work item already exists (#929)
@@ -1088,6 +1110,7 @@ function syncPrsFromOutput(output, agentId, meta, config, opts = {}) {
       url: prUrl,
       prdItems: meta?.item?.id ? [meta.item.id] : [],
       sourcePlan: meta?.item?.sourcePlan || '',
+      prdItemId: meta?.item?.id || '',
       itemType: meta?.item?.itemType || '',
       contextOnly: shouldSyncPrAsContextOnly(meta),
     };
@@ -2496,7 +2519,7 @@ function fixCompletionChangedBranch(structuredCompletion) {
 }
 
 function normalizePrFixBranchName(branch) {
-  return String(branch || '').trim().replace(/^refs\/heads\//, '');
+  return String(branch || '').trim().replace(/^refs\/heads\//i, '');
 }
 
 function getPrFixBaselineHead(pr) {
@@ -5834,6 +5857,25 @@ function syncPrdFromPrs(config) {
     if (totalReconciled > 0) {
       log('info', `PR sync: reconciled ${totalReconciled} work item(s) to done`);
     }
+
+    // Stamp pr_url onto PRD items for every PR that has prdItems[] + a URL (P-b3c2d4e5).
+    // This is separate from the done-reconcile loop above — we stamp pr_url as soon as
+    // we know the PR exists, regardless of merged/open status.
+    for (const pr of allPrs) {
+      if (!pr?.url || !Array.isArray(pr.prdItems) || pr.prdItems.length === 0) continue;
+      for (const itemId of pr.prdItems) {
+        if (!itemId) continue;
+        let sourcePlan = pr.sourcePlan;
+        if (!sourcePlan) {
+          for (const project of allProjects) {
+            const items = safeJsonArr(shared.projectWorkItemsPath(project));
+            const wi = items.find(w => w.id === itemId);
+            if (wi?.sourcePlan) { sourcePlan = wi.sourcePlan; break; }
+          }
+        }
+        if (sourcePlan) stampPrdItemPrUrl(itemId, sourcePlan, pr.url);
+      }
+    }
   } catch (err) {
     // Non-fatal — log and continue
     try { log('warn', `syncPrdFromPrs error: ${err?.message || err}`); } catch { /* engine not available */ }
@@ -6156,6 +6198,44 @@ function pruneScopeMismatchDuplicatePrs(config) {
   return { pruned, scanned };
 }
 
+// Repair helper: collapse prNumber duplicates across all project-scoped and
+// the central pull-requests file.  Called once per reconcile cycle alongside
+// pruneScopeMismatchDuplicatePrs so accumulated duplicates are cleaned up
+// without requiring a one-off migration.
+function collapseAllDuplicatePrRecords(config) {
+  config = config || getConfig();
+  const projects = shared.getProjects(config) || [];
+  let collapsed = 0;
+  let scanned = 0;
+
+  for (const project of projects) {
+    if (!project || !project.name) continue;
+    const prPath = projectPrPath(project);
+    try {
+      const result = shared.collapseDuplicatePrRecords(prPath, { project });
+      collapsed += result.collapsed || 0;
+      scanned++;
+    } catch (err) {
+      log('warn', `collapseAllDuplicatePrRecords: failed for project=${project.name}: ${err?.message || err}`);
+    }
+  }
+
+  // Central file (no project context — normalization uses URL-only scope).
+  const centralPath = path.join(MINIONS_DIR, 'pull-requests.json');
+  try {
+    const result = shared.collapseDuplicatePrRecords(centralPath, {});
+    collapsed += result.collapsed || 0;
+    scanned++;
+  } catch (err) {
+    log('warn', `collapseAllDuplicatePrRecords: failed for central file: ${err?.message || err}`);
+  }
+
+  if (collapsed > 0) {
+    log('info', `[pull-requests] collapseAllDuplicatePrRecords: collapsed ${collapsed} duplicate(s) across ${scanned} scope(s)`);
+  }
+  return { collapsed, scanned };
+}
+
 // M003 — After a coding WI completes successfully, auto-dispatch a live-validation
 // WI when project.liveValidation.autoDispatch === true and the completed item is
 // a coding WI (not the validation type itself). Skips if the coding WI has no PR.
@@ -6237,6 +6317,7 @@ module.exports = {
   reconcilePrdStatuses,
   syncPrsFromOutput,
   pruneScopeMismatchDuplicatePrs,
+  collapseAllDuplicatePrRecords,
   updatePrAfterReview,
   updatePrAfterFix,
   updatePrAfterFixError,
@@ -6300,8 +6381,11 @@ module.exports = {
   enrollPrFromCanonicalId,
   _setEnrollmentGhRunnerForTest,
   // W-mqtplpk6001oe6d5 — stamp PR ref + workItemId onto WI and PRD item at completion time.
+  // W-mqvwzgi500259361 — exported for unit testing case-insensitive refs/heads/ stripping.
+  normalizePrFixBranchName,
   stampWiPrRef,
   stampPrdItemWorkItemId,
+  stampPrdItemPrUrl,
   // M003 — auto-dispatch live-validation WI after coding WI completion.
   autoDispatchLiveValidationWi,
 };

package/engine/playbook.js

@@ -394,6 +394,11 @@ const PLAYBOOK_OPTIONAL_VARS = new Set([
   // Both are optional; playbooks that don't reference them receive empty strings.
   'from_agent',
   'from_conclusion',
+  // P-mqyp0008v022w3x4 (SHERLOC) — prior explore WI resultSummary injected into
+  // fix dispatches when a completed explore WI references the fix WI. Empty string
+  // when no prior explore WI exists; the {{#prior_explore_context}} conditional
+  // in fix.md renders the section only when non-empty.
+  'prior_explore_context',
 ]);
 
 const PLAYBOOK_REQUIRED_VARS = {
@@ -1011,11 +1016,11 @@ function renderPlaybook(type, vars) {
 // ─── Playbook Section Validator ──────────────────────────────────────────────
 
 // Required structural section patterns — warn (do not throw) when absent.
-// NOTE: '## Tools' / '## Constraints' are NOT included because none of the
-// production playbooks use those headers. Only '## Your Task' is universally
-// present — it is injected by renderPlaybook via the playbook template.
+// Pluralisation: /^## Tools?\b/m matches both '## Tool' and '## Tools'.
 const _REQUIRED_PROMPT_SECTIONS = [
-  { pattern: /^## Your Task\b/m, label: '## Your Task' },
+  { pattern: /^## Your Task\b/m,   label: '## Your Task' },
+  { pattern: /^## Tools?\b/m,      label: '## Tools' },
+  { pattern: /^## Constraints\b/m, label: '## Constraints' },
 ];
 
 /**