@yemi33/minions 0.1.2370 → 0.1.2372

package/engine.js

@@ -35,10 +35,11 @@ const { exec, execAsync, execSilent, runFile, ts, ENGINE_DEFAULTS,
   WI_STATUS, DONE_STATUSES, WORK_TYPE, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, REVIEW_STATUS, DISPATCH_RESULT, AGENT_STATUS,
   FAILURE_CLASS, resolvePollFlag } = shared;
 const { resolveRuntime } = require('./engine/runtimes');
-const { assertStaleHeadOk, preApproveWorkspaceMcps, computeAddDirs } = require('./engine/spawn-agent');
+const { assertStaleHeadOk, preApproveWorkspaceMcps } = require('./engine/spawn-agent');
 const adoGitAuth = require('./engine/ado-git-auth');
 const queries = require('./engine/queries');
 const dispatchEvents = require('./engine/dispatch-events');
+const prdStore = require('./engine/prd-store');
 
 // ─── Paths ──────────────────────────────────────────────────────────────────
 
@@ -441,7 +442,6 @@ function _buildAgentSpawnFlags(runtime, opts = {}) {
   if (caps.fallbackModel && opts.fallbackModel) flags.push('--fallback-model', String(opts.fallbackModel));
   if (opts.stream != null && opts.stream !== '') flags.push('--stream', String(opts.stream));
   if (opts.disableBuiltinMcps === true) flags.push('--disable-builtin-mcps');
-  if (opts.suppressAgentsMd === true) flags.push('--no-custom-instructions');
   if (opts.reasoningSummaries === true) flags.push('--enable-reasoning-summaries');
 
   return flags;
@@ -1033,36 +1033,50 @@ async function runWorktreeAdd(rootDir, worktreePath, addArgs, gitOpts, worktreeC
 // probe failure against a branch that genuinely exists on origin (e.g. a
 // PR-author's real branch) silently took the fresh-branch fallback and
 // forked a divergent local branch under the same name instead of retrying.
-// We retry once with a short backoff (mirroring `_fetchWithTransientRetry`);
-// if the retry still doesn't cleanly resolve to "not found", we throw so the
-// caller does NOT treat this as a confirmed absence.
+// We retry with EXPONENTIAL backoff (mirroring `_fetchWithTransientRetry`'s
+// transient-recovery intent): 3 total attempts with ~1.5s then ~4s backoff.
+// A single flat 1.5s retry (the pre-W-mrdwcpzn shape) landed inside the same
+// brief ADO ls-remote flaky window often enough to hard-fail worktree creation
+// twice within an hour against office/iss/fluid-client-framework — live repro
+// confirmed the command succeeds reliably when retried a few seconds later, so
+// the deeper/backed-off retry closes that gap. If NONE of the attempts cleanly
+// resolve to "not found", we throw so the caller does NOT treat this as a
+// confirmed absence.
+const _PROBE_BRANCH_BACKOFFS_MS = [1500, 4000]; // delays BEFORE attempts 2 and 3 (3 total attempts)
 async function probeBranchOnRemote(rootDir, branchName, gitOpts) {
   if (!branchName || !rootDir) return false;
   const _attemptProbe = () => shared.shellSafeGit(
     ['ls-remote', '--exit-code', '--heads', 'origin', branchName],
     { ...gitOpts, cwd: rootDir, timeout: 10000 },
   );
-  try {
-    await _attemptProbe();
-    return true;
-  } catch (e) {
-    if (e && e.code === 2) return false; // clean, authoritative "not found"
-    const firstErrMsg = adoGitAuth.redactBearer(String(e?.message || e)).split('\n')[0].slice(0, 200);
-    log('warn', `probeBranchOnRemote: ls-remote --heads origin ${branchName} failed (${firstErrMsg}) — retrying once after 1.5s before giving up`);
-    await new Promise(r => setTimeout(r, 1500));
+  const totalAttempts = _PROBE_BRANCH_BACKOFFS_MS.length + 1;
+  let lastErr = null;
+  for (let attempt = 1; attempt <= totalAttempts; attempt++) {
     try {
       await _attemptProbe();
+      if (attempt > 1) log('info', `probeBranchOnRemote: ls-remote --heads origin ${branchName} succeeded on attempt ${attempt}/${totalAttempts}`);
       return true;
-    } catch (e2) {
-      if (e2 && e2.code === 2) return false; // clean, authoritative "not found" on retry
-      const retryErrMsg = adoGitAuth.redactBearer(String(e2?.message || e2)).split('\n')[0].slice(0, 200);
-      log('warn', `probeBranchOnRemote: ls-remote --heads origin ${branchName} retry also failed (${retryErrMsg}) — cannot confirm branch absence, surfacing error`);
-      const probeErr = new Error(`probeBranchOnRemote: could not determine whether origin has ${branchName} after retry: ${retryErrMsg}`);
-      probeErr._probeFailed = true;
-      probeErr._cause = e2;
-      throw probeErr;
+    } catch (e) {
+      // exit code 2 = clean, authoritative "not found". This short-circuits
+      // immediately on ANY attempt with no further retry/backoff — a confirmed
+      // absence is authoritative and must stay fast (no #767 regression).
+      if (e && e.code === 2) return false;
+      lastErr = e;
+      const errMsg = adoGitAuth.redactBearer(String(e?.message || e)).split('\n')[0].slice(0, 200);
+      const backoffMs = _PROBE_BRANCH_BACKOFFS_MS[attempt - 1];
+      if (backoffMs != null) {
+        log('warn', `probeBranchOnRemote: ls-remote --heads origin ${branchName} failed on attempt ${attempt}/${totalAttempts} (${errMsg}) — retrying after ${backoffMs}ms`);
+        await new Promise(r => setTimeout(r, backoffMs));
+      } else {
+        log('warn', `probeBranchOnRemote: ls-remote --heads origin ${branchName} failed on final attempt ${attempt}/${totalAttempts} (${errMsg}) — cannot confirm branch absence, surfacing error`);
+      }
     }
   }
+  const finalErrMsg = adoGitAuth.redactBearer(String(lastErr?.message || lastErr)).split('\n')[0].slice(0, 200);
+  const probeErr = new Error(`probeBranchOnRemote: could not determine whether origin has ${branchName} after ${totalAttempts} attempts: ${finalErrMsg}`);
+  probeErr._probeFailed = true;
+  probeErr._cause = lastErr;
+  throw probeErr;
 }
 
 // Detect and remove worktree registrations whose backing directory is missing
@@ -2080,38 +2094,6 @@ async function recoverPartialWorktree(rootDir, worktreePath, branchName, gitOpts
   }
 }
 
-// P-f52d81ba — persist the dispatch's detected monorepo sub-project (+ any per-surface
-// skill-discovery truncations the render surfaced) onto the dispatch record so
-// later grounding/observability can see which sub-project scoped discovery + harness
-// propagation. Best-effort: mutation failures must never block the spawn. Only
-// writes fields that carry a value so unset sub-projects leave the record untouched.
-function _recordDispatchDiscoveryDiagnostics(id, dispatchItem, subproject, diagnostics) {
-  try {
-    const dominantSubproject = (typeof subproject === 'string' && subproject) ? subproject : undefined;
-    const truncations = diagnostics && Array.isArray(diagnostics.truncations) && diagnostics.truncations.length
-      ? diagnostics.truncations
-      : undefined;
-    if (dominantSubproject === undefined && truncations === undefined) return;
-    mutateDispatch((dispatch) => {
-      for (const queue of ['pending', 'active', 'completed']) {
-        const arr = Array.isArray(dispatch?.[queue]) ? dispatch[queue] : null;
-        if (!arr) continue;
-        const found = arr.find(d => d && d.id === id);
-        if (!found) continue;
-        if (dominantSubproject !== undefined) found._dominantSubproject = dominantSubproject;
-        if (truncations !== undefined) found._skillDiscoveryTruncations = truncations;
-      }
-      return dispatch;
-    });
-    if (dispatchItem) {
-      if (dominantSubproject !== undefined) dispatchItem._dominantSubproject = dominantSubproject;
-      if (truncations !== undefined) dispatchItem._skillDiscoveryTruncations = truncations;
-    }
-  } catch (e) {
-    log('warn', `record discovery diagnostics failed for ${id} (non-fatal): ${e.message}`);
-  }
-}
-
 // Seed a spawned agent's COPILOT_HOME mcp-config as a copy of the operator's
 // `~/.copilot/mcp-config.json` MINUS the servers in
 // `engine.copilotAgentDisabledMcpServers`, then point COPILOT_HOME at it.
@@ -2119,11 +2101,8 @@ function _recordDispatchDiscoveryDiagnostics(id, dispatchItem, subproject, diagn
 // Why config-filtering and not `--disable-mcp-server`: copilot SPAWNS every
 // server in its config on startup and authenticates it; `--disable-mcp-server
 // <name>` only hides that server's TOOLS from the model, it does NOT stop the
-// server process. So any auth-requiring server (azure-kusto/azmcp, DevBox,
-// workiq, loop, teams…) pops a Microsoft sign-in window on EVERY agent spawn —
-// an unbounded popup storm at minions' spawn cadence. A server simply ABSENT
-// from the config can't be spawned, so filtering the config is the only real
-// disable lever.
+// server process (PR #321 — verified live: agents spawned azmcp.exe/workiq.exe
+// despite those servers being in `copilotAgentDisabledMcpServers`).
 //
 // Default disabled list `[]` => agents inherit ALL of the operator's MCP servers
 // (non-breaking; matches interactive copilot). Add a name to disable it for
@@ -3300,7 +3279,7 @@ async function spawnAgent(dispatchItem, config) {
     // the dispatch-end auto-restore (P-d9e6b2c4) can return the tree to where the
     // operator started — even after an engine restart + re-attach, where the
     // spawnAgent closure is gone and only the persisted dispatch record survives
-    // (same pattern as resolveHarnessPropagated at engine/lifecycle.js:3576).
+    // even after an engine restart + re-attach.
     if (_liveResult.originalRef) {
       dispatchItem.originalRef = _liveResult.originalRef;
       dispatchItem.originalRefType = _liveResult.originalRefType || 'branch';
@@ -4365,45 +4344,6 @@ async function spawnAgent(dispatchItem, config) {
 
   updateAgentStatus(id, AGENT_STATUS.READY, 'Worktree ready, preparing to spawn process');
 
-  // ── P-f52d81ba — derive the effective monorepo sub-project for this dispatch ──────
-  // Feeds BOTH project-skill discovery (scopeSubproject → sub-project's skills lead the
-  // rendered project_skills_block) and project-local harness propagation
-  // (workdir clip → only the sub-project's --project-harness-dir roots are surfaced).
-  // Precedence:
-  //   1. Explicit meta.workdir wins — effective sub-project = its first segment. No
-  //      diff work (the operator already declared the target sub-package).
-  //   2. Else best-effort from the CURRENT dispatch's diff: `git diff
-  //      --name-only <main>...HEAD` in this worktree → detectDominantSubproject.
-  //   3. Else '' (flat discovery / unclipped harness — today's behavior).
-  // Contract: never blocks dispatch, never changes agent cwd (only an explicit
-  // meta.workdir moves cwd, applied separately below), and degrades to '' on
-  // any failure. Derived from THIS worktree's HEAD so a follow-up/parent's
-  // stale diff can't leak in (AC: current-dispatch diff only).
-  let _effectiveSubproject = '';
-  try {
-    if (validatedWorkdir) {
-      _effectiveSubproject = String(validatedWorkdir).replace(/\\/g, '/').replace(/^\/+/, '').split('/')[0] || '';
-    } else if (worktreePath && fs.existsSync(worktreePath) && project?.localPath) {
-      let _subprojectChangedPaths = [];
-      try {
-        const _subprojectBase = sanitizeBranch(shared.resolveMainBranch(rootDir, project.mainBranch));
-        const _subprojectDiff = await execAsync(`git diff --name-only ${_subprojectBase}...HEAD`, { ..._gitOpts, cwd: worktreePath, timeout: 10000 });
-        _subprojectChangedPaths = (_subprojectDiff.stdout || '').split('\n').map(s => s.trim()).filter(Boolean);
-      } catch (e) {
-        log('debug', `subproject-detect: git diff failed for ${id} (flat discovery): ${e.message}`);
-      }
-      if (_subprojectChangedPaths.length) {
-        const { detectDominantSubproject } = require('./engine/discover-project-skills')._internal;
-        const _det = detectDominantSubproject({ projectPath: project.localPath, changedPaths: _subprojectChangedPaths });
-        if (_det && _det.confident && _det.subproject) _effectiveSubproject = _det.subproject;
-      }
-    }
-  } catch (e) {
-    log('warn', `subproject-detect failed for ${id} (non-fatal, flat discovery): ${e.message}`);
-    _effectiveSubproject = '';
-  }
-
-  let _refreshedDiscoveryDiagnostics = null;
   if (worktreePath && meta?.source === 'work-item' && meta?.item?.branchStrategy === 'shared-branch') {
     const refreshed = renderProjectWorkItemPromptForAgent(
       meta.item,
@@ -4413,21 +4353,15 @@ async function spawnAgent(dispatchItem, config) {
       project,
       rootDir,
       branchName,
-      { worktreePath, dominantSubproject: _effectiveSubproject }
+      { worktreePath }
     );
     if (refreshed.prompt) {
       taskPrompt = refreshed.prompt;
       fullTaskPrompt = buildFullTaskPrompt(taskPrompt);
       safeWrite(promptPath, fullTaskPrompt);
-      log('info', `Refreshed shared-branch prompt for ${id} with worktree ${worktreePath}${_effectiveSubproject ? ` (subproject=${_effectiveSubproject})` : ''}`);
+      log('info', `Refreshed shared-branch prompt for ${id} with worktree ${worktreePath}`);
     }
-    _refreshedDiscoveryDiagnostics = refreshed.discoveryDiagnostics || null;
   }
-  // Record the detected sub-project (+ any per-surface skill-discovery truncations the
-  // shared-branch re-render surfaced) onto the dispatch record for later
-  // grounding/observability. Sub-project-only for non-re-render dispatches (their
-  // prompt was rendered at dispatch-build time; truncations are logged there).
-  _recordDispatchDiscoveryDiagnostics(id, dispatchItem, _effectiveSubproject, _refreshedDiscoveryDiagnostics);
 
   // Inject dirty file list when worktree has uncommitted changes (e.g., max_turns retry)
   // This signals to the respawned agent that prior work exists in the worktree (#960)
@@ -4524,15 +4458,6 @@ async function spawnAgent(dispatchItem, config) {
   const resolvedModel = runtime.resolveModel(shared.resolveAgentModel(agentConfig, engineConfig));
   const resolvedMaxBudget = shared.resolveAgentMaxBudget(agentConfig, engineConfig);
   const resolvedBare = shared.resolveAgentBareMode(agentConfig, engineConfig);
-  // P-49e1c8b7 — hermetic harness opt-out (per-agent override allowed).
-  // When true, this dispatch:
-  //   - skips Claude workspace .mcp.json pre-approval (preApproveWorkspaceMcps),
-  //   - skips project-local-on-main `--project-harness-dir` propagation,
-  //   - forwards `--hermetic-harness` to spawn-agent.js so computeAddDirs
-  //     returns [minionsDir] only (user-asset dirs stripped from --add-dir).
-  // Independent of copilotDisableBuiltinMcps and copilotSuppressAgentsMd,
-  // which retain their existing semantics.
-  const resolvedHermetic = shared.resolveAgentHermeticHarness(agentConfig, engineConfig);
 
   // W-mpg6isvy000xca4d — On retry after FAILURE_CLASS.MODEL_UNAVAILABLE, swap
   // to the runtime-appropriate fallback model. Two paths gated on
@@ -4585,7 +4510,6 @@ async function spawnAgent(dispatchItem, config) {
     fallbackModel: engineConfig.claudeFallbackModel,
     stream: engineConfig.copilotStreamMode,
     disableBuiltinMcps: engineConfig.copilotDisableBuiltinMcps,
-    suppressAgentsMd: engineConfig.copilotSuppressAgentsMd,
     reasoningSummaries: engineConfig.copilotReasoningSummaries,
   });
 
@@ -4600,28 +4524,21 @@ async function spawnAgent(dispatchItem, config) {
   // and when engine.claudePreApproveWorkspaceMcps is false (no runtime.name
   // check at this call site, per CLAUDE.md rule). Best-effort: NEVER block dispatch.
   //
-  // P-49e1c8b7 — Skipped entirely when resolvedHermetic is true: a hermetic
-  // dispatch wants a known-empty harness surface, so the workspace .mcp.json
-  // approval must not be written.
-  if (resolvedHermetic) {
-    log('debug', `Hermetic harness: skipping workspace MCP pre-approval for ${id}`);
-  } else {
-    try {
-      const result = preApproveWorkspaceMcps({
-        runtimeName,
-        worktreePath,
-        homeDir: os.homedir(),
-        engineConfig,
-        mutateJsonFileLocked: shared.mutateJsonFileLocked,
-      });
-      if (result.wrote) {
-        log('info', `Pre-approved ${result.servers.length} workspace MCP server(s) in ~/.claude.json for ${worktreePath}: ${result.servers.join(', ')}`);
-      } else if (result.reason !== 'no-workspace-mcp' && result.reason !== 'not-claude' && result.reason !== 'no-worktree') {
-        log('debug', `Skipped workspace MCP pre-approval for ${id} (reason=${result.reason})`);
-      }
-    } catch (err) {
-      log('warn', `Workspace MCP pre-approval failed for ${id} (non-fatal): ${err.message}`);
+  try {
+    const result = preApproveWorkspaceMcps({
+      runtimeName,
+      worktreePath,
+      homeDir: os.homedir(),
+      engineConfig,
+      mutateJsonFileLocked: shared.mutateJsonFileLocked,
+    });
+    if (result.wrote) {
+      log('info', `Pre-approved ${result.servers.length} workspace MCP server(s) in ~/.claude.json for ${worktreePath}: ${result.servers.join(', ')}`);
+    } else if (result.reason !== 'no-workspace-mcp' && result.reason !== 'not-claude' && result.reason !== 'no-worktree') {
+      log('debug', `Skipped workspace MCP pre-approval for ${id} (reason=${result.reason})`);
     }
+  } catch (err) {
+    log('warn', `Workspace MCP pre-approval failed for ${id} (non-fatal): ${err.message}`);
   }
 
   _phaseT.afterRuntime = Date.now();
@@ -4696,123 +4613,7 @@ async function spawnAgent(dispatchItem, config) {
   // spawn-agent.js handles CLAUDECODE env cleanup and claude binary resolution
   const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
 
-  // ── P-08b62d49 — project-local-on-main harness propagation ──────────────
-  // The worktree-uncommitted footgun (docs/harness-propagation.md): when a
-  // mutating dispatch runs in a fresh `git worktree add` (worktreePath !==
-  // project.localPath), uncommitted `<repo>/.claude/skills/foo/SKILL.md` etc.
-  // on the operator's main checkout are invisible to the runtime CLI because
-  // its native discovery is rooted at cwd. Union the project-scope harness
-  // dirs (skills + commands) that exist under `project.localPath` but NOT
-  // under `worktreePath`, and forward them to spawn-agent as
-  // `--project-harness-dir <dir>` so `computeAddDirs` surfaces them via
-  // `--add-dir`. Gated by engine.harnessPropagateProjectLocal (default true).
-  // No-op for live-checkout mode (worktreePath === null) and read-only types
-  // (also worktreePath === null per resolveSpawnPaths).
-  //
-  // P-49e1c8b7 — Also skipped entirely when resolvedHermetic is true: hermetic
-  // dispatches want a known-empty harness surface so neither user-asset dirs
-  // (filtered inside computeAddDirs) nor project-local-on-main dirs (filtered
-  // here) reach the agent. We skip the queries.getProjectHarnesses(...) call
-  // too — saves the fs scan when the result will be discarded.
-  //
-  // P-714ef144 — when meta.workdir is set, the filter helper clips both the
-  // project-side and worktree-side anchors to <base>/<workdir>, so a
-  // `packages/foo` dispatch never sees harness dirs from sibling packages.
-  // The clipping is purely additive on top of the existing project-vs-worktree
-  // disjoint filter; when workdir is null the helper produces the same result
-  // as the legacy inline loop.
-  const projectHarnessArgs = [];
-  const propagatedProjectHarnessDirs = [];
-  if (!resolvedHermetic
-      && engineConfig.harnessPropagateProjectLocal !== false
-      && worktreePath
-      && project?.localPath
-      && path.resolve(worktreePath) !== path.resolve(project.localPath)) {
-    try {
-      const harnesses = queries.getProjectHarnesses(project);
-      const candidateDirs = [
-        ...(harnesses.skills || []),
-        ...(harnesses.commands || []),
-      ]
-        .map((entry) => entry?.dir)
-        .filter((d) => typeof d === 'string' && d);
-      const filteredDirs = shared.filterProjectHarnessDirsForWorkdir(candidateDirs, {
-        projectLocalPath: project.localPath,
-        worktreePath,
-        // P-f52d81ba — clip to the effective sub-project. Explicit meta.workdir wins
-        // (validatedWorkdir, possibly multi-segment); otherwise use the
-        // auto-derived dominant sub-project (single first-level segment) so an
-        // ocm/-dominant diff surfaces only ocm/'s --project-harness-dir roots.
-        // Empty ⇒ no clip (today's whole-project harness surface).
-        workdir: validatedWorkdir || _effectiveSubproject || null,
-      });
-      for (const abs of filteredDirs) {
-        if (!fs.existsSync(abs)) continue;
-        projectHarnessArgs.push('--project-harness-dir', abs);
-        propagatedProjectHarnessDirs.push(abs);
-      }
-      if (projectHarnessArgs.length) {
-        log('debug', `Project-local harness propagation: ${projectHarnessArgs.length / 2} dir(s) for ${id} (${worktreePath}${validatedWorkdir ? ', workdir=' + validatedWorkdir : (_effectiveSubproject ? ', subproject=' + _effectiveSubproject : '')})`);
-      }
-    } catch (err) {
-      log('warn', `Project-local harness propagation failed for ${id} (non-fatal): ${err.message}`);
-    }
-  }
-
-  // ── P-a8f3c2d1 — harness grounding manifest (pure capture) ──────────────
-  // Snapshot the skills / MCP servers / commands the engine exposed to this
-  // agent — BOTH user-scope (queries.getUserHarnesses) and project-scope
-  // (queries.getProjectHarnesses) — plus the resolved `--add-dir` set
-  // (engine/spawn-agent.js#computeAddDirs, called with the exact same inputs
-  // spawn-agent uses). Persisted onto the dispatch record as `_harnessPropagated`
-  // so the completion-report grounding cross-check (P-c6f5e8b3) can mark each
-  // self-reported entry grounded:true|false. CRITICAL: include user-scope
-  // harnesses or legitimate ~/.agents / ~/.claude skill usage is wrongly
-  // flagged grounded:false downstream. This is observability only — it does NOT
-  // change which dirs are propagated at spawn time. Best-effort: any failure
-  // here must never block the spawn.
-  try {
-    const homeDir = os.homedir();
-    const userHarnesses = queries.getUserHarnesses(homeDir);
-    const projectHarnesses = project?.localPath
-      ? queries.getProjectHarnesses(project)
-      : { skills: [], commands: [], mcps: [] };
-    let addDirs = [];
-    try {
-      addDirs = computeAddDirs({
-        runtime,
-        minionsDir: MINIONS_DIR,
-        homeDir,
-        projectHarnessDirs: propagatedProjectHarnessDirs,
-        hermetic: resolvedHermetic,
-      });
-    } catch { addDirs = []; }
-    const harnessManifest = queries.buildHarnessPropagatedManifest({
-      userHarnesses,
-      projectHarnesses,
-      addDirs,
-    });
-    mutateDispatch((dispatch) => {
-      for (const queue of ['pending', 'active', 'completed']) {
-        const arr = Array.isArray(dispatch?.[queue]) ? dispatch[queue] : null;
-        if (!arr) continue;
-        const found = arr.find(d => d && d.id === id);
-        if (found) found._harnessPropagated = harnessManifest;
-      }
-      return dispatch;
-    });
-    dispatchItem._harnessPropagated = harnessManifest;
-  } catch (err) {
-    log('warn', `Harness grounding manifest capture failed for ${id} (non-fatal): ${err.message}`);
-  }
-
-  // P-49e1c8b7 — hermetic harness opt-out forwarded to spawn-agent.js so
-  // computeAddDirs returns [minionsDir] only (user-asset dirs stripped).
-  // Append BEFORE projectHarnessArgs (which will be empty when hermetic, but
-  // ordering keeps the intent explicit in process listings).
-  const hermeticArgs = resolvedHermetic ? ['--hermetic-harness'] : [];
-
-  const spawnArgs = [spawnScript, promptPath, sysPromptPath, ...args, ...hermeticArgs, ...projectHarnessArgs];
+  const spawnArgs = [spawnScript, promptPath, sysPromptPath, ...args];
 
   // Live output file — stamped BEFORE child process is spawned (#W-mo248lkjwgsu).
   // Writing the stub pre-spawn lets the orphan detector distinguish three failure modes
@@ -5158,7 +4959,6 @@ async function spawnAgent(dispatchItem, config) {
         fallbackModel: engineConfig?.claudeFallbackModel,
         stream: engineConfig?.copilotStreamMode,
         disableBuiltinMcps: engineConfig?.copilotDisableBuiltinMcps,
-        suppressAgentsMd: engineConfig?.copilotSuppressAgentsMd,
         reasoningSummaries: engineConfig?.copilotReasoningSummaries,
       });
       if (!resumeArgs.includes('--resume')) {
@@ -5223,12 +5023,7 @@ async function spawnAgent(dispatchItem, config) {
       let resumeProc;
       try {
         // detached so the resumed steering session also survives engine death (matches initial spawn)
-        // P-08b62d49 — also include projectHarnessArgs so the resumed runtime
-        // can still reach uncommitted project-local harness dirs (the runtime
-        // CLI re-indexes asset dirs on every spawn, including this resume).
-        // P-49e1c8b7 — same for --hermetic-harness so the resumed dispatch
-        // keeps the known-empty harness contract.
-        resumeProc = runFile(process.execPath, [spawnScript, steerPromptPath, sysPromptPath, ...resumeArgs, ...hermeticArgs, ...projectHarnessArgs], {
+        resumeProc = runFile(process.execPath, [spawnScript, steerPromptPath, sysPromptPath, ...resumeArgs], {
           cwd,
           stdio: ['pipe', 'pipe', 'pipe'],
           env: childEnv,
@@ -6708,8 +6503,9 @@ function materializePlansAsWorkItems(config) {
     }
   }
 
-  let planFiles;
-  try { planFiles = fs.readdirSync(PRD_DIR).filter(f => f.endsWith('.json')); } catch { return; }
+  const planFiles = prdStore.listPrdRows()
+    .filter(row => !row.archived)
+    .map(row => row.filename);
 
   // Regex for detecting sequential PRD item IDs (P-001, M001, M-001, WI-001, …) — hoisted outside loop.
   // Covers all patterns where an alphabetic prefix is followed by an optional dash and pure digits,
@@ -6937,11 +6733,11 @@ function materializePlansAsWorkItems(config) {
 
     let totalCreated = 0;
     for (const [projName, { project, items: projItems }] of itemsByProject) {
-      // Re-read PRD status from disk to guard against mid-tick status changes (P-f1a3b5c7).
+      // Re-read authoritative PRD status to guard against mid-tick status changes (P-f1a3b5c7).
       // A pause/reject/awaiting-approval signal may arrive between the outer-loop initial
       // read and this point (e.g. operator pauses via dashboard while the tick is running).
       // Re-reading here prevents phantom WI creation on a paused, rejected, or unapproved plan.
-      const freshPrd = safeJsonNoRestore(path.join(PRD_DIR, file));
+      const freshPrd = prdStore.readPrd(path.join(PRD_DIR, file));
       const freshStatus = (freshPrd || {}).status || ((freshPrd || {}).requires_approval ? 'awaiting-approval' : null);
       if (freshStatus === PLAN_STATUS.PAUSED || freshStatus === PLAN_STATUS.REJECTED || freshStatus === 'awaiting-approval') {
         log('warn', `PRD ${file}: status changed to '${freshStatus}' mid-tick — skipping WI batch for ${projName} (P-f1a3b5c7)`);
@@ -8364,30 +8160,6 @@ function _buildRunnerBriefVars(item, project) {
   }
 }
 
-// P-f52d81ba — sync effective-sub-project derivation for the build-time prompt render
-// (renderProjectWorkItemPromptForAgent runs synchronously, so no git diff).
-// Explicit meta.workdir wins (first segment). Otherwise best-effort from the
-// work item's references[*].path via detectDominantSubproject. Returns '' (flat
-// discovery) on anything unresolved. spawnAgent's async re-render overrides
-// this with a git-diff-derived sub-project via options.dominantSubproject.
-function _deriveDominantSubprojectSync(item, project) {
-  try {
-    const wd = item && item.meta && item.meta.workdir;
-    if (typeof wd === 'string' && wd.trim()) {
-      return wd.replace(/\\/g, '/').replace(/^\/+/, '').split('/')[0] || '';
-    }
-    const projectPath = project && project.localPath;
-    if (!projectPath) return '';
-    const paths = (item && Array.isArray(item.references))
-      ? item.references.map(r => (r && typeof r.path === 'string') ? r.path : '').filter(Boolean)
-      : [];
-    if (paths.length === 0) return '';
-    const { detectDominantSubproject } = require('./engine/discover-project-skills')._internal;
-    const det = detectDominantSubproject({ projectPath, changedPaths: paths });
-    return (det && det.confident && det.subproject) ? det.subproject : '';
-  } catch { return ''; }
-}
-
 /**
  * Scan work-items.json for manually queued tasks
  */
@@ -8469,12 +8241,6 @@ function renderProjectWorkItemPromptForAgent(item, workType, agentId, config, pr
     qa_artifacts_dir: item.meta && item.meta.qaRunId
       ? path.posix.join('engine', 'qa-artifacts', String(item.meta.qaRunId))
       : '',
-    // W-mq16xtdx001a347e — escape hatch for review dispatches that should NOT
-    // be steered toward project-local review skills (e.g. when the diff
-    // under review IS that skill, so a meta-review needs first-principles).
-    // Default OFF — the new "Project review skills" block is the whole point
-    // of W-mq16xtdx and should surface on every review by default.
-    skip_project_review_skills: !!(item.meta && item.meta.skipProjectReviewSkills),
     // P-e6b3c2d8 — QA Session template vars. The qa-sessions chain helpers
     // (engine/qa-sessions.js#_baseWorkItem) stamp meta.sessionId,
     // meta.sessionPhase, and meta.qaSession.{target,flowsRaw,mode,capture,runner}
@@ -8550,26 +8316,6 @@ function renderProjectWorkItemPromptForAgent(item, workType, agentId, config, pr
     // failure via the qa-session-draft-failed / qa-session-execute-failed
     // path. (See playbooks/qa-session-draft.md → "Failure path" section.)
     ..._buildRunnerBriefVars(item, project),
-    // W-mq16xtdx001a347e + W-mq1cczi90006b21f — escape hatches for dispatches
-    // that should NOT be steered toward project-local skills (e.g. when the
-    // diff under review IS that skill, so a meta-review needs first-principles).
-    // Default OFF — the project skills block is the whole point of these WIs
-    // and should surface on every applicable dispatch by default.
-    //
-    // Both meta names are honored:
-    //   - meta.skipProjectReviewSkills (PR-82 alias, review-only suppression)
-    //   - meta.skipProjectSkills       (W-mq1cczi90006b21f, generic suppression)
-    // Either flag suppresses both blocks on the dispatch.
-    skip_project_review_skills: !!(item.meta && item.meta.skipProjectReviewSkills),
-    skip_project_skills: !!(item.meta && (item.meta.skipProjectSkills || item.meta.skipProjectReviewSkills)),
-    // P-f52d81ba — effective monorepo sub-project for scoped skill discovery. When the
-    // async caller (spawnAgent) supplies a git-diff-derived sub-project it wins (even
-    // ''); otherwise derive best-effort from explicit meta.workdir /
-    // references[*].path. Empty ⇒ flat discovery. playbook.js reads this as the
-    // discovery scopeSubproject.
-    dominant_subproject: (typeof options.dominantSubproject === 'string')
-      ? options.dominantSubproject
-      : _deriveDominantSubprojectSync(item, project),
     // M006 — typed handoff envelope. Set on follow-up dispatch metas by
     // lifecycle.js when queuing an item after a completing agent. The
     // renderPlaybook path injects a "Handoff Context" section when truthy
@@ -8594,11 +8340,6 @@ function renderProjectWorkItemPromptForAgent(item, workType, agentId, config, pr
     needsReview: false,
     checkpointCount: cpResult.checkpointCount,
     prompt,
-    // P-f52d81ba — surface the discovery diagnostics renderPlaybook stashed on
-    // the vars object (detected sub-project + per-surface truncations) so spawnAgent
-    // can record them onto the dispatch record. null when no playbook render
-    // ran (item.prompt short-circuit) or discovery was skipped.
-    discoveryDiagnostics: vars._discoveryDiagnostics || null,
   };
 }
 
@@ -8690,19 +8431,34 @@ function refreshDeferredReviewPrompt(item, config) {
   if (!pr) return;
   const project = projectFromDispatchMeta(item.meta?.project, config);
   if (!project) return;
-  const prBranch = item.meta.branch || pr.branch || '';
-  const prNumber = shared.getPrNumber(pr);
+  // W-mrewhflh000k1acd: meta.reviewHeadSha (and meta.pr) were snapshotted at
+  // DEFER time — when no non-author reviewer was available. If the PR head
+  // advances while the review sits pending reassignment, reusing that stale
+  // snapshot means lifecycle.js#updatePrAfterReview stamps reviewedHeadSha
+  // against the OLD head once this review actually completes, so
+  // isPrReviewCurrent() wrongly judges freshness against the true current
+  // head — producing spurious re-review dispatch loops (or false
+  // "already reviewed" skips). Re-fetch the live PR record and recompute the
+  // head SHA before rebuilding the prompt.
+  let livePr = pr;
+  try {
+    const prs = safeJsonArr(projectPrPath(project));
+    const found = shared.findPrRecord(prs, pr, project);
+    if (found) livePr = found;
+  } catch (e) { log('warn', `refreshDeferredReviewPrompt: live PR lookup for ${pr.id} failed: ${e.message}`); }
+  const prBranch = item.meta.branch || livePr.branch || '';
+  const prNumber = shared.getPrNumber(livePr);
   const extraVars = {
-    pr_id: pr.id,
+    pr_id: livePr.id,
     pr_number: prNumber,
-    pr_title: pr.title || '',
+    pr_title: livePr.title || '',
     pr_branch: prBranch,
-    pr_author: pr.agent || '',
-    pr_url: pr.url || '',
+    pr_author: livePr.agent || '',
+    pr_url: livePr.url || '',
   };
   const rebuilt = buildPrDispatch(
-    item.agent, config, project, pr, WORK_TYPE.REVIEW,
-    extraVars, `Review ${pr.id}: ${pr.title || ''}`, item.meta
+    item.agent, config, project, livePr, WORK_TYPE.REVIEW,
+    extraVars, `Review ${livePr.id}: ${livePr.title || ''}`, item.meta
   );
   if (rebuilt && rebuilt.prompt) {
     item.prompt = rebuilt.prompt;
@@ -8710,6 +8466,8 @@ function refreshDeferredReviewPrompt(item, config) {
     if (rebuilt.agentName) item.agentName = rebuilt.agentName;
     if (rebuilt.agentRole) item.agentRole = rebuilt.agentRole;
   }
+  item.meta.pr = livePr;
+  item.meta.reviewHeadSha = getPrCauseHead(livePr);
   item.meta.deferReviewerResolution = false;
 }
 
@@ -9837,12 +9595,13 @@ function discoverCentralWorkItems(config) {
         // PRD's source_plan can't fork a duplicate PRD (#415 class).
         let prdFilename = null;
         const planKey = path.basename(String(item.planFile || ''));
-        const prdFiles = safeReadDir(PRD_DIR).filter(f => f.endsWith('.json'));
+        const prdRows = prdStore.listPrdRows();
+        const prdFiles = prdRows.filter(row => !row.archived).map(row => row.filename);
         for (const pf of prdFiles) {
-          const prd = safeJson(path.join(PRD_DIR, pf));
+          const prd = prdStore.readPrd(path.join(PRD_DIR, pf));
           if (planKey && prd && !shared.isPrdArchived(prd) && shared.prdMatchesSourcePlan(prd.source_plan, planKey)) {
             prdFilename = pf;
-            try { vars.existing_prd_json = fs.readFileSync(path.join(PRD_DIR, pf), 'utf8'); } catch (_) { /* ignore */ }
+            vars.existing_prd_json = JSON.stringify(prd, null, 2);
             log('info', `plan-to-prd: reusing existing PRD "${pf}" for plan "${item.planFile}" (#884)`);
             break;
           }
@@ -9882,7 +9641,7 @@ function discoverCentralWorkItems(config) {
           shared.sanitizePath(prdFilename, PRD_DIR);
           const prdExisting = new Set([
             ...prdFiles,
-            ...safeReadDir(path.join(PRD_DIR, 'archive')).filter(f => f.endsWith('.json')),
+            ...prdRows.filter(row => row.archived).map(row => row.filename),
           ]);
           for (const otherItem of items) {
             if (!otherItem || otherItem.id === item.id) continue;
@@ -10245,7 +10004,7 @@ async function discoverWork(config) {
         // basename. The plan-completion scan does the same purge safely (identity-
         // checked + neutralize); here the isDefunctPrd guard below already skips
         // archived/defunct PRDs, so this loop never re-runs completion on a ghost.)
-        for (const f of fs.readdirSync(prdDir).filter(f => f.endsWith('.json'))) {
+        for (const f of prdStore.listPrdRows().filter(row => !row.archived).map(row => row.filename)) {
           if (completedPlanCache.has(f)) continue;
           // safeJsonNoRestore — defense in depth: if the file vanished between
           // readdir and read (e.g. concurrent archive), do not resurrect it
@@ -10819,7 +10578,7 @@ async function tickInner() {
     try { persistVerifyPrsToPrd(config); } catch (err) { log('warn', `PRD verify-PR persist error: ${err?.message || err}`); }
     // Check if any plans can be marked completed (all features done/in-pr)
     try {
-      const prdFiles = safeReadDir(PRD_DIR).filter(f => f.endsWith('.json'));
+      const prdFiles = prdStore.listPrdRows().filter(row => !row.archived).map(row => row.filename);
       for (const file of prdFiles) {
         if (completedPlanCache.has(file)) continue;
         if (fs.existsSync(path.join(PRD_DIR, 'archive', file))) {
@@ -10978,6 +10737,14 @@ async function tickInner() {
                   // Only retry if something depends on this item
                   const isBlocking = items.some(w => w.status === WI_STATUS.PENDING && (w.depends_on || []).includes(item.id));
                   if (!isBlocking) continue;
+                  // W-mrdykpv60005d50d: don't resurrect items whose failure class is explicitly
+                  // non-retryable (AUTH, INJECTION_FLAGGED, PRE_DISPATCH_EVAL_STUCK, etc.) — mirrors
+                  // the same isRetryableFailureReason() gate used by the dispatch-completion retry path
+                  // (engine/dispatch.js:764) and the quarantine auto-recovery block above (engine.js:8804-8811).
+                  if (!isRetryableFailureReason(item.failReason, item._failureClass)) {
+                    log('info', `Stall recovery: skipping ${item.id} — failure class '${item._failureClass || 'unknown'}' is non-retryable`);
+                    continue;
+                  }
 
                   log('info', `Stall recovery: auto-retrying ${item.id} (blocking ${pendingWithBlockedDeps.filter(w => (w.depends_on || []).includes(item.id)).length} items)`);
                   item.status = WI_STATUS.PENDING;
@@ -11753,6 +11520,7 @@ module.exports = {
   normalizePrBranch, resolvePrBranch, prCausePart, getPrCauseHead, getPrCauseBase, getPrAutomationCauseKey, getPrAutomationDispatchKey, // exported for testing
   isPrReviewCurrent, isPrFixedAfterReview, // exported for testing (W-mrej8p740006b0bf — SHA-based review freshness)
   ensurePrBranchForDispatch, isWithinLinkGraceWindow, PR_LINK_GRACE_WINDOW_MS, // exported for testing (W-mphm0kt0000cebc3)
+  refreshDeferredReviewPrompt, // exported for testing (W-mrewhflh000k1acd — stale reviewHeadSha on reassignment)
 
   // Playbooks
   renderPlaybook, validatePlaybookVars, PLAYBOOK_REQUIRED_VARS, buildWorkItemDispatchVars,