@yemi33/minions 0.1.2370 → 0.1.2371

package/docs/named-agents.md

@@ -43,7 +43,6 @@ The full per-agent config shape supported under `config.agents.<id>`:
 | `model` | string | Per-agent model override (omitted → runtime picks its own default). |
 | `maxBudgetUsd` | number | Per-spawn USD cap. **`0` is a valid cap** (read-only / dry-run agents), not "unlimited". |
 | `bareMode` | boolean | Run Claude in `--bare` mode (Claude-runtime knob). |
-| `hermeticHarness` | boolean | Strip user-scope skill/command/MCP roots from the worktree; `--add-dir` resolves to `[minionsDir]` only. |
 | `workspace_manifest` | object | Optional permission scoping — see below. |
 
 ### Three-tier resolution chain
@@ -57,7 +56,6 @@ The resolver helpers live in [`engine/shared.js`](../engine/shared.js):
 | `resolveAgentModel(agent, engine)` | `agent.model` → `engine.defaultModel` → `undefined` (adapter omits `--model`, CLI uses its own default). |
 | `resolveAgentMaxBudget(agent, engine)` | `agent.maxBudgetUsd` → `engine.maxBudgetUsd` → `undefined` (no cap). Nullish-coalesced so `0` is honored. |
 | `resolveAgentBareMode(agent, engine)` | `agent.bareMode` → `engine.claudeBareMode` → `false`. Strict null check so a per-agent `false` overrides an engine `true`. |
-| `resolveAgentHermeticHarness(agent, engine)` | `agent.hermeticHarness` → `engine.hermeticHarness` → `false`. Same strict-override semantics. |
 
 Empty string / `null` / `undefined` all count as "unset" for the string knobs, so an agent
 inherits the fleet default rather than blanking the value.

package/docs/plan-lifecycle.md

@@ -116,18 +116,18 @@ The verify agent and the user can then build and run from these paths.
 
 ## Manual Archive Lifecycle
 
-Archiving is a deliberate dashboard action, not a post-verify side effect. When a PRD completes, `checkPlanCompletion()` writes the completion summary, persists `status: "completed"` plus `_completionNotified`, and creates the verify work item. The PRD remains in `prd/` and its source plan remains in `plans/` so humans can review the guide, inspect the final state, resume stale work, or reopen items before hiding the plan from active views.
+Archiving is a deliberate dashboard action, not a post-verify side effect. When a PRD completes, `checkPlanCompletion()` writes the completion summary, persists `status: "completed"` plus `_completionNotified` in SQL, and creates the verify work item. The PRD remains active and its source plan remains in `plans/` so humans can review the guide, inspect the final state, resume stale work, or reopen items before hiding the plan from active views.
 
 The verify agent does not call `archivePlan()`. After the testing guide and any follow-up PR work are satisfactory, use the dashboard archive action, which calls `POST /api/plans/archive` with the active PRD or plan filename.
 
 Manual archive behavior:
 
-1. For PRD JSON files, the dashboard archives them **in-place** in `prd/` — the file is not moved. The JSON is stamped with `archived: true`, `status: "archived"`, and `archivedAt` (Phase 10 step 4.2b). **No `.backup` sidecar is written or restored for any `prd/*.json`** — Phase 10 step 4.3 dropped the PRD backup/restore lifecycle entirely (root-level PRDs used to get one to survive the now-retired rename race; SQL is canonical, so a stale `.backup` is pure resurrection fuel, not a safety net).
+1. The dashboard updates the SQL PRD row with `archived: true`, `status: "archived"`, and `archivedAt`.
 2. If the PRD has `source_plan`, the matching `plans/<source>.md` is moved to `plans/archive/<source>.md`.
 3. Pending or queued work items linked to the archived PRD are cancelled with `_cancelledBy: "plan-archived"`; completed work items remain as history.
 4. Plan worktrees are cleaned up by the archive handler/lifecycle cleanup path.
 
-Use unarchive only when the archived PRD/plan should reappear in active views. Reopening completed work should happen before archive, or after unarchive, so the materializer can see the active PRD file.
+Use unarchive only when the archived PRD/plan should reappear in active views. Reopening completed work should happen before archive, or after unarchive, so the materializer can see the active SQL PRD.
 
 ## Human Feedback on PRs
 
@@ -151,10 +151,9 @@ After PRs are created, humans can leave comments containing `@minions` to trigge
 | File | Purpose |
 |------|---------|
 | `plans/*.md` | Source plans awaiting review or linked to active PRDs |
-| `prd/*.json` | Active PRDs with materializable items |
+| SQL `prds` + `prd_items` | Active and archived PRDs with materializable items |
 | `plans/archive/` | Manually archived plan Markdown files |
-| `prd/*.json` (with `archived: true`) | PRDs archived in-place (Phase 10 step 4.2b — not moved; flag + `archivedAt` stamped on the file) |
-| `prd/archive/` | Legacy: PRDs archived before Phase 10 (still scanned for filename-collision detection) |
+| `prd/` | Legacy upgrade input only; migration 018 imports and retires these files |
 | `playbooks/verify.md` | Verification task playbook |
 | `playbooks/implement.md` | Implementation playbook |
 | `playbooks/plan-to-prd.md` | Plan → PRD conversion playbook |

package/docs/qa-runbook-lifecycle.md

@@ -17,7 +17,7 @@ engine-assigned `id`). `target` is a name from `/api/managed-processes` or
 
 ## Run-record path
 
-`qa-runs.json` (newest-first, capped). Each run:
+The SQL `qa_runs` table stores newest-first, capped run records. Each run:
 `{ id, runbookId, runbookName, target, status, startedAt, completedAt, workItemId, agentId, artifacts }`.
 `status` ∈ `pending|dispatched|running|passed|failed|error`. Created by
 `POST /api/qa/runbooks/run` (`{ id }`), which dispatches a `qa-validate`
@@ -27,29 +27,14 @@ and clears the interval on page navigation via the `switchPage` wrapper in
 `dashboard/js/qa.js` (matches `_stopPlanPoll`/`_stopMeetingPoll` pattern in
 `dashboard/js/state.js`).
 
-### Persistence (Phase 8: SQLite source of truth)
-
-Since the Phase 8 migration (`migrate-qa-state-to-sqlite`), both
-`qa-runs.json` and `qa-sessions.json` are dual-written sidecars and SQLite
-(`engine/state.db`, tables `qa_runs` + `qa_sessions`) is the source of
-truth. Every mutation goes through `shared.mutateQaRuns` /
-`shared.mutateQaSessions`, which apply inside a SQLite transaction
-(`BEGIN IMMEDIATE`) then best-effort mirror to JSON under a `withFileLock`
-on the sidecar path so cross-process writers serialize. Reads go through
-`small-state-store.readQaRuns` / `readQaSessions`, which compare the SQL
-content-hash to the JSON sidecar and rehydrate SQL from JSON when an
-external editor (operator hand-edit, manual rollback) has diverged.
-
-The JSON mirror is gated by `engine.qaDualWriteJson` (default true). Once
-operators trust SQL as the source of truth and have migrated external
-tooling off the JSON files, flip it false via Dashboard → Settings →
-Advanced → "QA: dual-write JSON sidecars" to halve write I/O. With the
-toggle off, `qa-runs.json` / `qa-sessions.json` stop receiving updates
-(stale snapshot at the moment of the flip), so don't disable until any
-external readers have moved to the SQL tables or the dashboard `/api/qa/*`
-endpoints. The qa-runs cap (`QA_RUNS_MAX_RECORDS=2000`) and qa-sessions
-cap (`QA_SESSIONS_MAX_RECORDS=500`) still apply, enforced in-memory at
-createRun/createSession time.
+### Persistence
+
+SQLite (`engine/state.db`, tables `qa_runs` and `qa_sessions`) is the sole
+source of truth. Every mutation goes through `shared.mutateQaRuns` or
+`shared.mutateQaSessions` inside a transaction. Legacy JSON is imported only
+during upgrade or through the explicit offline recovery command. The qa-runs
+cap (`QA_RUNS_MAX_RECORDS=2000`) and qa-sessions cap
+(`QA_SESSIONS_MAX_RECORDS=500`) remain enforced at creation time.
 
 ### Deleting runs
 
@@ -253,7 +238,7 @@ errors are mapped to HTTP via `_qaSessionsErrorToStatus`:
   DRAFT agent. Path is sandboxed by `_isSafeSessionId` (kebab-case ≤ 64
   chars, no `..`, no separators) before every read/write that maps id →
   path. Gitignored.
-- **Managed-spawn**: `engine/managed-processes.json` entry with
+- **Managed-spawn**: SQL managed-process entry with
   `name='qa-session-<sessionId>'`. Cleaned up by `/kill` or by the
   session's `cancelSession` if the operator opts for the cancel-without-
   spawn-kill path.

package/docs/shared-lifecycle-module-map.md

@@ -105,7 +105,6 @@ because either is a bug:
 |---|---|---|
 | minions root pointer | `readMinionsRootPointer`, `saveMinionsRootPointer` | shared.js |
 | dashboard port file | `readDashboardPortFile`, `writeDashboardPortFile` | shared.js |
-| agent Copilot home dir | `resolveAgentCopilotHome`, `ensureAgentCopilotHome` | shared.js |
 | canonical PR id | `parseCanonicalPrId`, `getCanonicalPrId` | shared.js |
 | PR record | `findPrRecord`, `normalizePrRecord` | shared.js |
 | worktree owner marker | `writeWorktreeOwnerMarker`, `hasWorktreeOwnerMarker` | shared.js |
@@ -214,7 +213,7 @@ means zero such files were found), **Proposed target module**.
 | `redactPromptDescription` | 447-458 | Redactor applied to WI description text before it is injected into an agent // prompt. Applies the standard log redactor (_redactString) first, then catches // any remaining Authorization: Bearer header — including alrea | yes | `engine.js` | engine/shared.js (keep) |
 | `log` | 459-531 | Log. | yes | `engine/abandoned-pr-reconciliation.js`, `engine/ado-git-auth.js`, `engine/ado-status.js`, `engine/ado.js`, `engine/cc-worker-pool.js`, `engine/check-status.js` +72 more | engine/shared.js (keep) — logging/timestamp primitives |
 | `_currentLogPath` | 532-547 | Resolve the log file path at write time, not at module load time. `LOG_PATH` is captured eagerly when shared.js first loads. In production this is fine — there's a single shared.js instance per process. In tests the requ | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
-| `_currentLogDbPath` | 548-559 | Resolve the SQL state.db path at write time — same isolation contract // as _currentLogPath. MINIONS_LOG_PATH only redirects the JSON sidecar; // the SQL store stays attached to MINIONS_TEST_DIR / MINIONS_HOME because // | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
+| `_currentLogDbPath` | 548-559 | Resolve the SQL state.db path at write time with test/home isolation. | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `resolveEngineCacheDir` | 560-593 | MINIONS_TEST_DIR-aware engine dir for cache files (runtime caps, models, // spawn-debug.log). Returns `<MINIONS_TEST_DIR>/engine` under tests; otherwise // the caller's source-adjacent fallback (typically `__dirname`-der | yes | `engine/runtimes/claude.js`, `engine/runtimes/codex.js`, `engine/runtimes/copilot.js` | engine/shared.js (keep) |
 | `openUrlInBrowser` | 594-645 | Cross-platform URL opener. Uses execSync so failures fall through the // try/catch and the caller sees them. Dashboard self-open and `minions dash` // / `minions restart` post-health open all funnel through here. // // E | yes | `test/unit/dashboard-port-resolution.test.js`, `dashboard.js`, `engine.js` | engine/shared.js (keep) |
 | `_bumpBrowserOpenMetric` | 646-662 | Bump per-reason counter under metrics._engine.browserOpens. Best-effort — // metrics.json writes must never throw out of openUrlInBrowser. Schema: // _engine.browserOpens.<reason> = { count, suppressedCount, lastAt } | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
@@ -324,7 +323,6 @@ means zero such files were found), **Proposed target module**.
 | `resolveAgentBareMode` | 3974-3991 | Resolve whether this agent should run in Claude `--bare` mode. Priority: 1. `agent.bareMode` — per-agent override (boolean) 2. `engine.claudeBareMode` — fleet default 3. `false` — hardcoded fallback Strict undefined/null | yes | `test/unit.test.js`, `engine.js` | engine/shared.js (keep) |
 | `_normalizeMcpServerList` | 3992-4005 | P-mcp-storm — Resolve the list of MCP server names to disable for spawned // Copilot agents. The engine FILTERS these out of the agent's seeded // COPILOT_HOME mcp-config (engine.js `_applyAgentCopilotHome`) — a server a | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `resolveCopilotAgentDisabledMcpServers` | 4006-4030 | Resolve copilot agent disabled mcp servers. | yes | `test/unit/agent-copilot-home.test.js` | engine/shared.js (keep) |
-| `resolveAgentHermeticHarness` | 4031-4062 | P-49e1c8b7 — Resolve whether this agent should run with a hermetic harness. Priority (mirrors `resolveAgentBareMode`): 1. `agent.hermeticHarness` — per-agent override (boolean) 2. `engine.hermeticHarness` — fleet default | yes | `engine/spawn-agent.js`, `engine.js` | engine/shared.js (keep) |
 | `applyLegacyCcModelMigration` | 4063-4082 | If `config.engine.ccModel` is set but `config.engine.defaultModel` is unset, mutate the in-memory `config.engine` so `defaultModel` mirrors `ccModel` and log a one-time deprecation notice. Does NOT write to disk. Returns | yes | `engine/cli.js`, `test/unit.test.js` | engine/shared.js (keep) |
 | `_resetLegacyCcModelMigrationFlag` | 4083-4113 | Test helper: reset the dedup flag so repeated tests can re-trigger the log. | yes | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `runtimeConfigWarnings` | 4114-4194 | Inspect runtime fleet config and return warning entries for misconfiguration. Warnings emitted: - Unknown CLI: any `cli` value (per-agent, ccCli, defaultCli) not in `registeredRuntimes`. Each unknown value produces one e | yes | `engine/preflight.js` | engine/process-utils.js (new) — process spawn/pid/tmp-dir lifecycle helpers |
@@ -337,13 +335,11 @@ means zero such files were found), **Proposed target module**.
 | `_qaDualWriteEnabled` | 4673-4681 | Phase 8 — QA state mutators. Both qa-runs and qa-sessions are top-level JSON arrays (mutator receives the array; mutates in place or returns a replacement). The store diffs by `id`. Falls back to mutateJsonFileLocked on  | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `_qaMutator` | 4682-4720 | Qa mutator. | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `mutateWatches` | 4721-4741 | Route a watches mutation through the SQL store. Same shape as mutateWorkItems / mutatePullRequests: mutator receives the watches array, mutates in place or returns a replacement, and the store diffs by id. SQL-canonical  | yes | `engine/watches.js` | engine/shared.js (keep) |
-| `mutateMetrics` | 4742-4763 | Route a metrics mutation through the SQL store with a JSON dual-write mirror. Same shape as mutateWorkItems / mutatePullRequests: mutator receives the full legacy-shape metrics object, mutates in place or returns a repla | yes | `engine/cleanup.js`, `engine/llm.js`, `test/unit/auto-recovery.test.js`, `engine.js` | engine/shared.js (keep) |
+| `mutateMetrics` | 4742-4763 | Route a metrics mutation through the SQL store. | yes | `engine/cleanup.js`, `engine/llm.js`, `test/unit/auto-recovery.test.js`, `engine.js` | engine/shared.js (keep) |
 | `trackReviewMetric` | 4764-4784 | Update per-agent review metrics (prsApproved/prsRejected). Only writes for configured agents. | yes | `engine/ado.js`, `engine/github.js`, `engine/queries.js`, `test/unit.test.js` | engine/shared.js (keep) |
 | `queuePlanToPrd` | 4785-4822 | Queue a plan-to-prd work item with dedup check inside lock. Returns { queued, alreadyQueued, id, item } so callers (e.g. POST /api/plans/execute) can surface the new or existing work item id back to the dashboard. Return | yes | `test/unit.test.js`, `dashboard.js` | engine/shared.js (keep) |
 | `extractPlanDeclaredProject` | 4823-4845 | Extract plan declared project. | yes | `dashboard.js`, `engine.js` | engine/shared.js (keep) |
 | `extractPlanTargetProjects` | 4846-4974 | P-7a3f1c08: Parse a cross-repo plan's list of target projects. // Primary signal: `<!-- minions:targetProjects=a, b, c -->` HTML comment. // Fallback (human): ` Projects: a, b \| c` markdown line in the first 80 lines. // | yes | `dashboard.js`, `engine.js` | engine/shared.js (keep) |
-| `normalizeHarnessUsed` | 4975-5027 | normalizeHarnessUsed(raw) — validate/clamp an untrusted harnessUsed-shaped // object into the canonical { skills, mcpServers, commands, docs } form. // Drops malformed entries (non-objects, or missing the kind's required | yes | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
-| `groundHarnessUsed` | 5028-5099 | groundHarnessUsed(harnessUsed, propagated) — Stage 2 grounding cross-check // (P-c6f5e8b3). Normalizes an agent's self-reported `harnessUsed` and annotates // every surviving entry with a strict-boolean `grounded` field  | yes | `engine/cli.js` | engine/shared.js (keep) |
 | `_bumpPruneDefaultClaudeStrip` | 5100-5114 | Bump rolling-daily strip counter for docs/deprecated.json#prune-default-claude-config // removal gate (>=30 consecutive days of zero strips). Best-effort; mirrors // engine/cleanup.js:1200-1213 _engine.legacyStatusMigrat | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `pruneDefaultClaudeConfig` | 5115-5185 | Prune default claude config. | yes | `test/unit.test.js`, `dashboard.js`, `minions.js` | engine/shared.js (keep) |
 | `_isStringArrayOrNull` | 5186-5202 | Is string array or null. | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
@@ -398,14 +394,11 @@ means zero such files were found), **Proposed target module**.
 | `parseWorktreePorcelain` | 6139-6169 | Parse `git worktree list --porcelain` output. Pure — callers run the subprocess (sync `execSilent` or async `execAsync`) and feed stdout in. Returns `[{path, head, branch, bare, detached, locked, prunable}]`. `branch` st | yes | `engine/cleanup.js`, `engine/worktree-gc.js`, `test/unit.test.js`, `engine.js` | engine/worktree-utils.js (new) — general worktree path/branch/owner-marker helpers (worktree-pool.js/worktree-gc.js already own pool sizing + GC sweep; this new module would take the shared low-level helpers those two currently import from shared.js) |
 | `assertWorktreeOutsideProject` | 6170-6203 | Throws when `worktreePath` would land inside (or equal) `projectRoot`. Called by the engine spawn path before `git worktree add`, and by the cleanup sweep that audits already-registered worktrees per linked project. The  | yes | `test/unit.test.js`, `dashboard.js`, `engine.js` | engine/worktree-utils.js (new) — general worktree path/branch/owner-marker helpers (worktree-pool.js/worktree-gc.js already own pool sizing + GC sweep; this new module would take the shared low-level helpers those two currently import from shared.js) |
 | `resolveProjectRootDir` | 6204-6259 | Resolve the project root directory used as the parent for git worktree paths during dispatch. Centralizes the fallback that engine spawnAgent used to do inline (`project.localPath ? path.resolve(project.localPath) : path | yes | `engine/create-pr-worktree.js`, `test/unit.test.js`, `engine.js` | engine/shared.js (keep) |
-| `resolveAgentCopilotHome` | 6260-6286 | Resolve a stable, repo-EXTERNAL COPILOT_HOME for spawned copilot agents. Copilot loads `$COPILOT_HOME/mcp-config.json` and SPAWNS every server in it on every process start. `--disable-mcp-server <name>` only hides a serv | yes | `test/unit/agent-copilot-home.test.js`, `engine.js` | engine/shared.js (keep) |
 | `resolveAgentTempBaseDir` | 6287-6308 | Derive a scratch/temp base dir on the same volume agent work already lives on — the configured worktree location (engine.worktreeRoot, default `../worktrees`). Agents (copilot/node/git + JVM-based MCP servers) write heav | yes | `test/unit/agent-temp-dir.test.js`, `engine.js` | engine/shared.js (keep) |
-| `ensureAgentCopilotHome` | 6309-6412 | Seed the agent COPILOT_HOME's mcp-config (copy of `~/.copilot/mcp-config.json` // MINUS `engine.copilotAgentDisabledMcpServers`) and return the home path. This // is the single source of truth for "what MCP servers may a | yes | `test/unit/agent-copilot-home.test.js`, `dashboard.js`, `engine.js` | engine/shared.js (keep) |
 | `resolveSpawnPaths` | 6413-6505 | Resolve the agent's working directory and (when needed) the parent dir for git worktree placement. Decouples the two concerns that spawnAgent used to conflate (W-mp73x32w000l143d): 1. cwd — where the agent process actual | yes | `engine/live-checkout.js`, `test/unit.test.js`, `engine.js` | engine/shared.js (keep) |
 | `_applyWorkdirOrThrow` | 6506-6518 | ── meta.workdir helpers (P-714ef144) // // Per-WI `meta.workdir` is a relative POSIX subpath under the spawn base // (project.localPath for read-only / live; worktree root for mutating). // When set, the engine lands the | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `validateWorkItemWorkdir` | 6519-6561 | Validate work item workdir. | yes | `dashboard.js`, `engine.js` | engine/shared.js (keep) |
 | `applyWorkdir` | 6562-6586 | Apply workdir. | yes | `engine.js` | engine/shared.js (keep) |
-| `filterProjectHarnessDirsForWorkdir` | 6587-6650 | Filter project harness dirs for workdir. | yes | `engine.js` | engine/shared.js (keep) |
 | `isAllowedOrigin` | 6651-6686 | Returns true if the origin-like header value (either an `Origin` header value such as `http://localhost:7331` or a full `Referer` URL) belongs to the local dashboard allowlist. Port-agnostic. Returns false for null/undef | yes | `test/unit.test.js`, `dashboard.js` | engine/shared.js (keep) |
 | `isAllowedDashboardOrigin` | 6687-6705 | Returns true if the given `Origin` header value should receive an `Access-Control-Allow-Origin` echo on GET/HEAD responses. STRICTER than `isAllowedOrigin` — that helper is the mutating-request gate (allows any localhost | yes | `test/unit.test.js`, `dashboard.js` | engine/shared.js (keep) |
 | `buildSecurityHeaders` | 6706-6721 | Returns the baseline set of security response headers to apply on every HTTP response from the dashboard. Values match OWASP defaults for a same-origin SPA served from 127.0.0.1. The HTML entry-point response intentional | yes | `test/unit.test.js`, `dashboard.js` | engine/shared.js (keep) |
@@ -609,7 +602,6 @@ Same columns as above, relative to `lifecycle.js`.
 | `parseAgentOutput` | 4020-4024 | Agent Output Parsing | yes | `engine/timeout.js`, `test/unit.test.js`, `engine.js` | engine/lifecycle.js (keep) |
 | `hasActionableFailureClass` | 4025-4047 | Has actionable failure class. | no | _internal-only (no callers found outside lifecycle.js)_ | engine/lifecycle.js (keep) |
 | `handleInjectionFlag` | 4048-4134 | F5 (W-mpeklod3000we69c): handle agent-reported injection attempts. The agent set `securityFlags.injectionAttempt: true` in its completion report after spotting attacker-controlled instructions inside an `<UNTRUSTED-INPUT | no | _internal-only (no callers found outside lifecycle.js)_ | engine/lifecycle.js (keep) |
-| `resolveHarnessPropagated` | 4135-4149 | resolveHarnessPropagated(dispatchItem) — P-c6f5e8b3. Locate the spawn-time // `_harnessPropagated` manifest for a dispatch. The in-memory dispatchItem // (spawnAgent's closure object) normally carries it directly; after  | yes | `engine.js` | engine/lifecycle.js (keep) |
 | `parseCompletionReportFile` | 4150-4172 | Parse completion report file. | yes | `engine/timeout.js`, `test/unit.test.js` | engine/lifecycle.js (keep) |
 | `normalizeCompletionArtifacts` | 4173-4198 | Normalize completion artifacts. | yes | _internal-only (no callers found outside lifecycle.js)_ | engine/lifecycle.js (keep) |
 | `normalizeArtifactPath` | 4199-4212 | Normalize artifact path. | no | _internal-only (no callers found outside lifecycle.js)_ | engine/lifecycle.js (keep) |

package/engine/ado-comment.js

@@ -2,8 +2,7 @@
  * engine/ado-comment.js — Azure DevOps mirror of engine/gh-comment.js.
  *
  * Posts a minions PR-comment thread to ADO with the same hidden marker, the
- * same collapsible "Harnesses used" section, and the same deterministic brand
- * link as the GitHub path — because all three are produced by the ONE neutral
+ * same deterministic brand link as the GitHub path — because both are produced by the ONE neutral
  * builder `engine/comment-format.js#buildMinionsCommentBody`. This module owns
  * only the ADO transport (REST `…/threads` POST) and ADO-specific input
  * validation (orgBase / project / repositoryId / prNumber).
@@ -13,7 +12,7 @@
  * unlinked on ADO (the GitHub backstop in buildMinionsCommentBody never ran).
  * Routing ADO comments through this poster gives ADO the same guarantees as
  * GitHub: marker present (so pollers classify the comment as agent-authored),
- * harness section folded in, brand trailer hyperlinked.
+ * brand trailer hyperlinked.
  *
  * Auth: a bearer token from `az account get-access-token` (via
  * engine/ado-token.js#acquireAdoToken), threaded as `Authorization: Bearer`.
@@ -34,7 +33,7 @@
  * changes) stay `active` so they block/notify the author.
  */
 
-const { buildMinionsCommentBody, buildSkippedSkillSection } = require('./comment-format');
+const { buildMinionsCommentBody } = require('./comment-format');
 const { acquireAdoToken } = require('./ado-token');
 
 const ADO_API_VERSION = '7.1';
@@ -95,7 +94,7 @@ async function _defaultAcquireToken() {
 /**
  * Post a minions PR comment to an Azure DevOps pull request.
  *
- * Mirrors engine/gh-comment.js#postPrComment: builds the marked + harness +
+ * Mirrors engine/gh-comment.js#postPrComment: builds the marked +
  * brand-linked body via the shared builder, then POSTs a new active thread.
  *
  * @param {object} args
@@ -107,8 +106,6 @@ async function _defaultAcquireToken() {
  * @param {string} args.agentId        minions agent id (marker)
  * @param {string} args.kind           comment kind (marker)
  * @param {string} [args.workItemId]   originating work-item id (marker)
- * @param {object} [args.harnessUsed]  grounded harnessUsed record (folded into body)
- * @param {object} [args.skillSkipped] skipped-project-skill record `{name, reason}` (folded into body, visible)
  * @param {number} [args.timeoutMs=30000]
  * @param {Function} [args.acquireToken]  () => Promise<string> — injectable token source
  * @param {Function} [args.fetchImpl=fetch] injectable fetch
@@ -123,8 +120,6 @@ async function postAdoPrComment({
   agentId,
   kind,
   workItemId,
-  harnessUsed,
-  skillSkipped,
   resolved = false,
   timeoutMs = 30000,
   acquireToken = _defaultAcquireToken,
@@ -136,7 +131,7 @@ async function postAdoPrComment({
   _validatePrNumber(prNumber);
 
   // buildMinionsCommentBody validates marker fields and throws on bad input.
-  const finalBody = buildMinionsCommentBody({ agentId, kind, workItemId, body, harnessUsed, skillSkipped });
+  const finalBody = buildMinionsCommentBody({ agentId, kind, workItemId, body });
 
   const token = await acquireToken();
   if (!token || typeof token !== 'string') {
@@ -186,7 +181,6 @@ module.exports = {
   // Re-export the neutral builder so ADO callers have a single import surface,
   // mirroring engine/gh-comment.js.
   buildMinionsCommentBody,
-  buildSkippedSkillSection,
   // Internal validators exported for tests.
   _validateOrgBase,
   _validateProject,

package/engine/ado.js

@@ -409,11 +409,13 @@ function applyAdoPrMetadata(pr, prData) {
     updated = true;
   }
 
-  // W-mpej044m00076d63: backfill `pr.created` from ADO's real creation
-  // timestamp. lifecycle.js attach paths omit `created` so this poll is the
-  // single source of truth for fresh records, and historical records missing
-  // `created` get backfilled the next time they're polled. Idempotent.
-  if (!pr.created && prData.creationDate) {
+  // W-mpej044m00076d63 / W-mrezh0yb0007f733: keep `pr.created` aligned with
+  // ADO's real creationDate. The platform is authoritative for when a PR was
+  // opened, so adopt its value whenever the stored one is missing, a legacy
+  // date-only stamp, or a link/attach-time `now()` default (the bug where
+  // manually-linked PRs showed a "created today" date). `shouldAdoptPlatformCreated`
+  // compares instants so equivalent representations don't churn. Idempotent.
+  if (shared.shouldAdoptPlatformCreated(pr.created, prData.creationDate)) {
     pr.created = prData.creationDate;
     updated = true;
   }
@@ -2606,6 +2608,9 @@ async function fetchAdoPrMetadata(prNum, adoOrg, adoProj, adoRepo, project) {
     description: pr.description || '',
     branch: stripRefsHeads(pr.sourceRefName),
     author: pr.createdBy?.displayName || '',
+    // W-mrezh0yb0007f733 — surface ADO's real creationDate so manual-link paths
+    // can seed `pr.created` with the true value instead of link-time now().
+    created: pr.creationDate || '',
   };
 }
 

package/engine/cleanup.js

@@ -1388,23 +1388,13 @@ async function runCleanup(config, verbose = false) {
   }
   // PRD items (missing_features[].status)
   try {
-    let prdDirEntries;
-    try {
-      prdDirEntries = fs.readdirSync(PRD_DIR);
-    } catch (e) {
-      log('warn', `migrate PRD statuses: failed to read ${PRD_DIR} — ${e.message}`);
-      prdDirEntries = [];
-    }
-    const prdFiles = prdDirEntries.filter(f => f.endsWith('.json'));
+    const prdStore = require('./prd-store');
+    const prdFiles = prdStore.listPrdRows().filter(row => !row.archived).map(row => row.filename);
     for (const pf of prdFiles) {
       const prdPath = path.join(PRD_DIR, pf);
+      const prd = prdStore.readPrd(prdPath);
       let migrated = 0;
-      shared.withFileLock(`${prdPath}.lock`, () => {
-        // safeJsonNoRestore: PRDs are terminal artifacts. If the active PRD
-        // was archived but a stale .backup sidecar remains, never resurrect
-        // it during a routine migration sweep (W-mouptdh1000h9f39).
-        const prd = safeJsonNoRestore(prdPath);
-        if (!prd?.missing_features) return;
+      if (prd?.missing_features) {
         for (const feat of prd.missing_features) {
           if (LEGACY_DONE_ALIASES.has(feat.status)) {
             feat.status = shared.WI_STATUS.DONE;
@@ -1414,8 +1404,8 @@ async function runCleanup(config, verbose = false) {
             migrated++;
           }
         }
-        if (migrated > 0) safeWrite(prdPath, prd);
-      });
+      }
+      if (migrated > 0) prdStore.writePrd(prdPath, prd);
       if (migrated > 0) {
         log('info', `Migrated ${migrated} legacy PRD item status(es) in ${pf}`);
       }
@@ -1425,36 +1415,27 @@ async function runCleanup(config, verbose = false) {
   // Reset orphaned PRD item statuses — dispatched/failed with no matching work item (#779)
   cleaned.orphanedPrdStatuses = 0;
   try {
-    const wiIds = new Set();
-    for (const project of projects) {
-      const items = safeJsonArr(projectWorkItemsPath(project));
-      for (const wi of items) { if (wi?.id) wiIds.add(wi.id); }
-    }
-    try {
-      const centralWi = safeJsonArr(path.join(MINIONS_DIR, 'work-items.json'));
-      for (const wi of centralWi) { if (wi?.id) wiIds.add(wi.id); }
-    } catch { /* optional */ }
+    const wiIds = new Set(
+      queries.getWorkItems(config, { enrich: false }).map(wi => wi?.id).filter(Boolean)
+    );
 
-    let orphanPrdEntries;
-    try { orphanPrdEntries = fs.readdirSync(PRD_DIR).filter(f => f.endsWith('.json')); }
-    catch { orphanPrdEntries = []; }
+    const prdStore = require('./prd-store');
+    const orphanPrdEntries = prdStore.listPrdRows().filter(row => !row.archived).map(row => row.filename);
     for (const pf of orphanPrdEntries) {
       const prdPath = path.join(PRD_DIR, pf);
-      // safeJsonNoRestore — peek must not auto-restore archived PRDs
-      // from a stale .backup sidecar (W-mouptdh1000h9f39).
-      const peek = safeJsonNoRestore(prdPath);
+      const peek = prdStore.readPrd(prdPath);
       if (!peek?.missing_features) continue;
       let reset = 0;
-      mutateJsonFileLocked(prdPath, (prd) => {
-        if (!prd?.missing_features) return prd;
+      const prd = peek;
+      if (prd?.missing_features) {
         for (const feat of prd.missing_features) {
           if ((feat.status === shared.WI_STATUS.DISPATCHED || feat.status === shared.WI_STATUS.FAILED) && !wiIds.has(feat.id)) {
             feat.status = shared.WI_STATUS.PENDING;
             reset++;
           }
         }
-        return prd;
-      }, { skipWriteIfUnchanged: true });
+      }
+      if (reset > 0) prdStore.writePrd(prdPath, prd);
       if (reset > 0) {
         log('info', `Reset ${reset} orphaned PRD item status(es) → pending in ${pf}`);
         cleaned.orphanedPrdStatuses += reset;
@@ -1669,7 +1650,6 @@ async function runCleanup(config, verbose = false) {
  *  that were written before that guard existed. */
 function scrubStaleMetrics() {
   const metricsPath = path.join(ENGINE_DIR, 'metrics.json');
-  if (!fs.existsSync(metricsPath)) return;
   mutateJsonFileLocked(metricsPath, metrics => {
     for (const key of Object.keys(metrics)) {
       if (key.startsWith('temp-') || key === 'agent1' || key.startsWith('_test')) {