@yemi33/minions 0.1.2382 → 0.1.2384

package/engine/github.js

@@ -282,10 +282,10 @@ async function _resolveViewerLogin(slug) {
 // `_isMinionsAuthoredComment` cannot tell minions posts apart from human
 // posts (the `viewerDidAuthor` gate stays false for everything), so the
 // comment classifier reclassifies every minions comment as human and
-// queues a spurious fix dispatch on every poll cycle. The downstream
-// `check-self-authored-review-comment` skill no-ops the dispatch, so this
-// is a slot/token tax rather than state corruption — but the frequency
-// data is worth tracking so future audits can prioritize a deeper fix
+// queues a spurious fix dispatch on every poll cycle. Review-fix completion
+// now rejects shared-identity-only no-ops, so failing closed here prevents
+// both duplicate traffic and false completion retries. The frequency
+// data is still worth tracking so future audits can prioritize a deeper fix
 // (e.g. a credentialed re-probe of the gh CLI). Global counter under
 // `_engine.viewerLoginResolutionFailures`; surfaced through the existing
 // engine metrics aggregation (`getMetrics()` in `engine/queries.js`).
@@ -1241,9 +1241,8 @@ async function pollPrHumanComments(config) {
     // `c.viewerDidAuthor === true`, and `_backfillViewerDidAuthor` is a
     // no-op when viewerLogin is null. Running the classifier without a
     // login mass-misclassifies every minions comment as human and queues
-    // a redundant fix dispatch on every poll cycle (the downstream
-    // `check-self-authored-review-comment` skill no-ops them, so this is
-    // a slot/token tax — see audit OQ-Y, HIGH not CRITICAL). Skip the
+    // a redundant fix dispatch on every poll cycle. Shared identity is not
+    // valid review-fix no-op evidence, so skip the
     // entire round instead. One log + one counter increment per affected
     // PR per cycle (no per-comment fanout).
     if (!viewerLogin) {

package/engine/keep-process-sweep.js

@@ -81,6 +81,20 @@ function validateKeepPidsRecord(parsed, opts) {
   if (typeof parsed.cwd === 'string' && parsed.cwd.length > 500) {
     return { ok: false, reason: 'cwd-too-long' };
   }
+  if (opts.allowedCwdRoot) {
+    if (typeof parsed.cwd !== 'string' || parsed.cwd.length === 0) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-required-for-dispatch-confinement' };
+    }
+    try {
+      const cwdReal = shared.realPathForComparison(parsed.cwd);
+      const rootReal = shared.realPathForComparison(opts.allowedCwdRoot);
+      if (!shared.isPathInsideOrEqual(cwdReal, rootReal)) {
+        return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-outside-dispatch-worktree' };
+      }
+    } catch (err) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-containment-check-failed (' + err.message + ')' };
+    }
+  }
   // W-mp6k7ywi000fa33c — when the engine requires a real git workdir
   // (default true; per-WI override via `meta.keep_processes_skip_workdir_check`),
   // verify the recorded `cwd` looks like a real worktree. Empty/missing
@@ -110,22 +124,105 @@ function validateKeepPidsRecord(parsed, opts) {
   if (parsed.wi_id != null && typeof parsed.wi_id !== 'string') {
     return { ok: false, reason: 'wi_id-not-string' };
   }
+  for (const field of ['project', 'work_type', 'checkout_mode', 'dispatch_root']) {
+    if (parsed[field] != null && typeof parsed[field] !== 'string') {
+      return { ok: false, reason: field + '-not-string' };
+    }
+  }
+
+  let canonicalCwd = typeof parsed.cwd === 'string' ? parsed.cwd : '';
+  if (canonicalCwd) {
+    try { canonicalCwd = shared.realPathForComparison(canonicalCwd); }
+    catch (err) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-canonicalization-failed (' + err.message + ')' };
+    }
+  }
+  let canonicalDispatchRoot = typeof parsed.dispatch_root === 'string' ? parsed.dispatch_root : '';
+  if (canonicalDispatchRoot) {
+    try { canonicalDispatchRoot = shared.realPathForComparison(canonicalDispatchRoot); }
+    catch (err) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'dispatch-root-canonicalization-failed (' + err.message + ')' };
+    }
+  }
 
   return {
     ok: true,
     value: {
       pids: pids,
       purpose: typeof parsed.purpose === 'string' ? parsed.purpose : '',
-      cwd: typeof parsed.cwd === 'string' ? parsed.cwd : '',
+      cwd: canonicalCwd,
       ports: Array.isArray(parsed.ports) ? parsed.ports.map(Number) : [],
       expires_at: parsed.expires_at,
       expiresAtMs: expiresAtMs,
       written_by: typeof parsed.written_by === 'string' ? parsed.written_by : '',
       wi_id: typeof parsed.wi_id === 'string' ? parsed.wi_id : '',
+      project: typeof parsed.project === 'string' ? parsed.project : '',
+      work_type: typeof parsed.work_type === 'string' ? parsed.work_type : '',
+      checkout_mode: typeof parsed.checkout_mode === 'string' ? parsed.checkout_mode : '',
+      dispatch_root: canonicalDispatchRoot,
     },
   };
 }
 
+function validateKeepProcessExecutionContext(record, opts) {
+  opts = opts || {};
+  if (!record) return { ok: false, reason: 'record-missing' };
+  if (!record.cwd) {
+    return record.checkout_mode || record.dispatch_root
+      ? { ok: false, reason: 'cwd-missing' }
+      : { ok: true, legacy: true };
+  }
+  let projects;
+  try {
+    projects = Array.isArray(opts.projects) ? opts.projects : shared.getProjects(opts.config);
+  } catch {
+    return { ok: false, reason: 'project-config-unavailable' };
+  }
+
+  for (const project of projects) {
+    if (!project?.localPath) continue;
+    const mode = shared.resolveCheckoutMode(
+      project,
+      record.work_type || shared.WORK_TYPE.IMPLEMENT,
+    );
+    if (mode !== shared.CHECKOUT_MODES.WORKTREE) continue;
+    try {
+      if (shared.pathsOverlap(record.cwd, project.localPath)) {
+        return { ok: false, reason: 'cwd-overlaps-worktree-mode-operator-checkout' };
+      }
+    } catch {
+      return { ok: false, reason: 'cwd-overlap-check-failed' };
+    }
+  }
+
+  const project = record.project ? shared.findProjectByName(projects, record.project) : null;
+  if (project && shared.resolveCheckoutMode(project, record.work_type || shared.WORK_TYPE.IMPLEMENT) === shared.CHECKOUT_MODES.LIVE) {
+    try {
+      if (!shared.isPathInsideOrEqual(record.cwd, project.localPath)) {
+        return { ok: false, reason: 'live-cwd-outside-project' };
+      }
+    } catch {
+      return { ok: false, reason: 'live-cwd-unavailable' };
+    }
+    return { ok: true };
+  }
+
+  if (!record.dispatch_root) {
+    return record.checkout_mode
+      ? { ok: false, reason: 'dispatch-root-missing' }
+      : { ok: true, legacy: true };
+  }
+  try {
+    shared.assertWorktreeOutsideProjects(record.dispatch_root, projects);
+    if (!shared.isPathInsideOrEqual(record.cwd, record.dispatch_root)) {
+      return { ok: false, reason: 'cwd-outside-dispatch-root' };
+    }
+  } catch {
+    return { ok: false, reason: 'dispatch-root-overlaps-operator-checkout' };
+  }
+  return { ok: true };
+}
+
 function readKeepPidsFile(agentId, opts) {
   opts = opts || {};
   const filePath = path.join(_agentsDir(), agentId, KEEP_PIDS_FILENAME);
@@ -198,6 +295,16 @@ function sweepKeepProcesses(opts) {
     const value = rec.value;
     const filePath = rec.filePath;
     const agentId = rec.agentId;
+    const executionContext = validateKeepProcessExecutionContext(value, opts);
+    if (!executionContext.ok) {
+      for (const pid of value.pids) {
+        if (killOne(pid)) stats.killedPids++;
+        _audit('unsafe-context-kill', { agentId, pid, reason: executionContext.reason, wi_id: value.wi_id });
+      }
+      try { fs.unlinkSync(filePath); } catch {}
+      log('warn', 'keep-processes: removed unsafe execution context for ' + agentId + ' — ' + executionContext.reason);
+      continue;
+    }
     if (value.expiresAtMs < now) {
       let killed = 0;
       for (const pid of value.pids) {
@@ -227,6 +334,7 @@ function getActiveAnchorPids(opts) {
   for (const rec of listAllKeepPidsFiles({ now: now })) {
     if (!rec.valid) continue;
     if (rec.value.expiresAtMs < now) continue;
+    if (!validateKeepProcessExecutionContext(rec.value, opts).ok) continue;
     for (const pid of rec.value.pids) out.add(pid);
   }
   return out;
@@ -237,13 +345,7 @@ function getActiveAnchorPidsForAgent(agentId, opts) {
   const now = Number.isFinite(opts.now) ? opts.now : Date.now();
   const out = new Set();
   if (!agentId) return { pids: out, record: null };
-  // W-mp6k7ywi000fa33c — forward `requireGitWorkdir` (and any future opts)
-  // so the per-WI override path can disable workdir validation. Earlier
-  // implementation only forwarded `now`, which silently ignored opts.
-  const readOpts = { now: now };
-  if (Object.prototype.hasOwnProperty.call(opts, 'requireGitWorkdir')) {
-    readOpts.requireGitWorkdir = opts.requireGitWorkdir;
-  }
+  const readOpts = { ...opts, now };
   const rec = readKeepPidsFile(String(agentId), readOpts);
   if (!rec) return { pids: out, record: null };
   if (!rec.valid) {
@@ -251,10 +353,26 @@ function getActiveAnchorPidsForAgent(agentId, opts) {
     return { pids: out, record: null, reason: rec.reason };
   }
   if (rec.value.expiresAtMs < now) return { pids: out, record: rec.value, reason: 'expired' };
+  const executionContext = validateKeepProcessExecutionContext(rec.value, opts);
+  if (!executionContext.ok) return { pids: out, record: rec.value, reason: executionContext.reason };
   for (const pid of rec.value.pids) out.add(pid);
   return { pids: out, record: rec.value };
 }
 
+function getActiveKeepProcessCwds(opts) {
+  opts = opts || {};
+  const now = Number.isFinite(opts.now) ? opts.now : Date.now();
+  const out = [];
+  for (const rec of listAllKeepPidsFiles({ now })) {
+    if (!rec.valid || rec.value.expiresAtMs < now || !rec.value.cwd) continue;
+    if (!validateKeepProcessExecutionContext(rec.value, opts).ok) continue;
+    if (alivePids(rec.value.pids, opts).length === 0) continue;
+    try { out.push(shared.realPathForComparison(rec.value.cwd)); }
+    catch { /* malformed/unreachable cwd contributes no anchor */ }
+  }
+  return out;
+}
+
 function computeReapPlan(descendants, agentId, opts) {
   opts = opts || {};
   const list = (Array.isArray(descendants) ? descendants : []).map(Number)
@@ -311,6 +429,7 @@ function evaluateKeepPidsAcceptance(agentId, opts) {
       record: rec.value,
       recordedCwd: rec.value.cwd || null,
       filePath: rec.filePath,
+      parsedRaw: rec.parsed || null,
     };
   }
   const reason = rec.reason || 'unknown';
@@ -368,7 +487,7 @@ function buildKeepProcessesHint(opts) {
     '{',
     '  "pids": [12345, 12346],',
     '  "purpose": "bun run dev (Constellation server + dashboard)",',
-    '  "cwd": "D:/repos/constellation",',
+    '  "cwd": "<absolute path at or below MINIONS_AGENT_CWD>",',
     '  "ports": [3001, 5173],',
     '  "expires_at": "<ISO-8601 timestamp <= ' + ttl + ' minutes from now>",',
     '  "written_by": "' + agentId + '",',
@@ -377,6 +496,7 @@ function buildKeepProcessesHint(opts) {
     '```',
     '',
     'Caps the engine enforces: max ' + maxPids + ' PIDs, TTL <= ' + maxTtl + ' minutes, `purpose`/`cwd` <= 500 chars, <= 20 ports. Files outside the cap are dropped (engine reaps as normal) and a warning is logged.',
+    '`cwd` MUST resolve at or below the current dispatch root from `MINIONS_AGENT_CWD`. The operator checkout is rejected for worktree-mode dispatches, even when it is a valid Git checkout.',
     '',
     'If you do NOT write the file, the engine will kill ALL of your descendant processes when you exit (today\'s default). Do not write the file unless you are intentionally leaving a process behind for the human or follow-up work.',
     '',
@@ -452,6 +572,8 @@ module.exports = {
   sweepKeepProcesses: sweepKeepProcesses,
   getActiveAnchorPids: getActiveAnchorPids,
   getActiveAnchorPidsForAgent: getActiveAnchorPidsForAgent,
+  getActiveKeepProcessCwds: getActiveKeepProcessCwds,
+  validateKeepProcessExecutionContext: validateKeepProcessExecutionContext,
   computeReapPlan: computeReapPlan,
   buildKeepProcessesHint: buildKeepProcessesHint,
   evaluateKeepPidsAcceptance: evaluateKeepPidsAcceptance,

package/engine/lifecycle.js

@@ -17,6 +17,7 @@ const harness = require('./harness');
 const smallStateStore = require('./small-state-store');
 const prdStore = require('./prd-store');
 const { isBranchActive } = require('./cooldown');
+const { resolveExecutionModel } = require('./execution-model');
 const { worktreeMatchesBranch, getWorktreeBranch, cleanupMergedPrLocalBranch } = require('./cleanup');
 const { getConfig, getInboxFiles, getNotes, getPrs, getDispatch,
   MINIONS_DIR, ENGINE_DIR, PLANS_DIR, INBOX_DIR, AGENTS_DIR } = queries;
@@ -2319,7 +2320,7 @@ function resolveReviewPrContext(pr, project, config, structuredCompletion = null
     : null;
 }
 
-async function updatePrAfterReview(agentId, pr, project, config, resultSummary, structuredCompletion = null, dispatchItem = null) {
+async function updatePrAfterReview(agentId, pr, project, config, resultSummary, structuredCompletion = null, dispatchItem = null, executionMetadata = null) {
 
   if (!config) config = getConfig();
   const completionStatus = normalizeCompletionStatus(structuredCompletion?.status);
@@ -2338,6 +2339,11 @@ async function updatePrAfterReview(agentId, pr, project, config, resultSummary,
   const reviewProject = reviewContext.project;
   const prScope = reviewContext.scope;
   const reviewerName = config.agents?.[agentId]?.name || agentId;
+  const reviewExecutionModel = resolveExecutionModel({
+    reportedModel: executionMetadata?.reportedModel,
+    capturedModel: dispatchItem?.executionModel,
+    requestedModel: dispatchItem?.requestedModel,
+  });
 
   // Check actual review status from the platform (agent may have approved or requested changes)
   // If platform hasn't propagated the vote yet (returns 'pending'), keep current status unchanged.
@@ -2549,6 +2555,7 @@ async function updatePrAfterReview(agentId, pr, project, config, resultSummary,
       reviewer: reviewerName,
       reviewedAt: ts(),
       note: reviewNote,
+      model: reviewExecutionModel.model,
       dispatchId: dispatchItem?.id || structuredCompletion?.dispatchId || null,
       sourceItem: dispatchItem?.meta?.item?.id || null,
       ...(reviewThreads.length > 0 ? { threads: reviewThreads } : {}),
@@ -3134,7 +3141,6 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
   if (!options || typeof options !== 'object' || Array.isArray(options)) {
     options = { automationCauseKey: options, dispatchId: legacyDispatchId };
   }
-  const explicitlyChangedBranch = options.branchChanged !== false;
   const prScope = project || 'central';
   const automationCauseKey = options.automationCauseKey || options.dispatchItem?.meta?.automationCauseKey || '';
   const fixDispatchId = options.dispatchItem?.id || options.dispatchId || legacyDispatchId || '';
@@ -3143,6 +3149,15 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
     source,
     task: options.dispatchItem?.task,
   });
+  const evidenceOnlyReviewResolution = cause === shared.PR_FIX_CAUSE.REVIEW_FEEDBACK
+    && options.reviewFindingResolution;
+  // Review-fix completion is governed by the live branch probe. Preserve the
+  // legacy files_changed behavior for unrelated fix causes.
+  let explicitlyChangedBranch = options.branchChanged !== false;
+  if (cause === shared.PR_FIX_CAUSE.REVIEW_FEEDBACK && options.branchChange) {
+    explicitlyChangedBranch = true;
+  }
+  if (evidenceOnlyReviewResolution) explicitlyChangedBranch = false;
   let result = null;
   shared.mutatePullRequests(prScope, (prs) => {
     if (!Array.isArray(prs)) return prs;
@@ -3486,7 +3501,7 @@ async function rebaseBranchOntoMain(pr, project, config) {
   // and produce mirror writes. Misconfigured engine.worktreeRoot is the only
   // way this lands inside root; the assert throws so the caller can recover.
   try {
-    shared.assertWorktreeOutsideProject(tmpWt, root);
+    shared.assertWorktreeOutsideProjects(tmpWt, shared.getProjects(config));
   } catch (err) {
     log('warn', `Post-merge rebase: refusing nested worktree path — ${err.message}`);
     return { success: false, error: err.message };
@@ -4569,8 +4584,8 @@ function parseCompletionBoolean(value) {
 }
 
 // Detect a deliberate no-op completion — the agent correctly declined to make
-// changes (work was already shipped, dispatch premise was wrong, self-authored
-// review with no actionable feedback, etc.) and should NOT be flagged as a
+// changes (work was already shipped, dispatch premise was wrong, or a finding
+// was proven resolved/invalid with current-code evidence) and should NOT be flagged as a
 // silent failure for missing a PR. Honored signals:
 //   - completion.noop === true (canonical, primary)
 //   - completion.result === 'noop'  OR  completion.result.type === 'noop'
@@ -4651,6 +4666,39 @@ function classifyBenignZeroTargetOutcome(dispatchItem, completion, resultSummary
   return noMutation ? evidence : null;
 }
 
+function validateReviewFixCompletion({ type, meta, branchChange, structuredCompletion } = {}) {
+  if (!shared.isFixLikeWorkType(type)) return { valid: true };
+  const cause = shared.getPrFixAutomationCause({
+    dispatchKey: meta?.dispatchKey,
+    source: meta?.source,
+    task: meta?.item?.title,
+  });
+  if (cause !== shared.PR_FIX_CAUSE.REVIEW_FEEDBACK
+      || (branchChange?.changed === true && branchChange.evidence === 'remote-head')) {
+    return { valid: true };
+  }
+
+  const findingId = shared.prReviewFindingIdentity(meta?.pr);
+  const resolution = structuredCompletion?.reviewFindingResolution;
+  const disposition = String(resolution?.disposition || '').trim().toLowerCase();
+  const reportedFindingId = String(resolution?.findingId || '').trim();
+  const currentCodeEvidence = String(resolution?.currentCodeEvidence || '').trim();
+  const hasCurrentCodeReference = /(?:[a-z]:[\\/])?[\w./\\-]+\.[a-z0-9]+:\d+\b/i.test(currentCodeEvidence)
+    || /\bcommit\s+[0-9a-f]{7,40}\b/i.test(currentCodeEvidence);
+  const validDisposition = disposition === 'already-resolved' || disposition === 'invalid';
+  const explicitNoop = !!parseCompletionNoop(structuredCompletion);
+
+  if (explicitNoop && validDisposition && reportedFindingId === findingId && hasCurrentCodeReference) {
+    return { valid: true, findingId, resolution };
+  }
+
+  return {
+    valid: false,
+    findingId,
+    reason: `Review-fix completion did not advance the PR branch and must explicitly prove the exact finding is already resolved or invalid with current-code evidence. Expected reviewFindingResolution.findingId="${findingId}", disposition "already-resolved" or "invalid", and a file:line or commit reference. Shared platform ownership, viewerDidAuthor, or reviewer/fixer agent equality is not evidence.`,
+  };
+}
+
 function normalizeReviewVerdict(verdict) {
   const value = String(verdict || '').trim().toLowerCase().replace(/[\s-]+/g, '_');
   if (value === 'approve' || value === 'approved') return REVIEW_STATUS.APPROVED;
@@ -5807,13 +5855,70 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
   }
 
   // No-op signal: agent declared the work was correctly NOT done (already
-  // shipped, dispatch premise wrong, self-authored review, etc.). Skip the PR
+  // shipped, dispatch premise wrong, evidence-backed resolved finding, etc.). Skip the PR
   // attachment contract — a missing PR is intentional, not a silent failure.
-  const noopRationale = (effectiveSuccess && meta?.item?.id && !skipDoneStatus)
+  let prFixBranchChange = null;
+  let prFixBuildStillFailing = null;
+  if (shared.isFixLikeWorkType(type) && effectiveSuccess && meta?.pr?.id) {
+    try {
+      prFixBranchChange = await detectPrFixBranchChange(meta, config);
+    } catch (err) {
+      log('warn', `PR fix no-op detection for ${meta.pr.id}: ${err.message}`);
+      prFixBranchChange = { changed: null, reason: err.message };
+    }
+    if (prFixBranchChange?.changed === false) {
+      const fixCause = shared.getPrFixAutomationCause({
+        dispatchKey: dispatchItem?.meta?.dispatchKey,
+        source: meta?.source,
+        task: dispatchItem?.task,
+      });
+      if (fixCause === shared.PR_FIX_CAUSE.BUILD_FAILURE) {
+        try {
+          const liveStatus = await checkBuildStillFailingLive(meta.pr, meta.project);
+          if (liveStatus === shared.BUILD_STATUS.FAILING) {
+            prFixBuildStillFailing = liveStatus;
+          }
+        } catch (err) {
+          log('warn', `Live build re-check for ${meta.pr.id}: ${err.message}`);
+        }
+      }
+    }
+  }
+  let noopRationale = (effectiveSuccess && !skipDoneStatus)
     ? (parseCompletionNoop(structuredCompletion) || benignNoop)
     : null;
+  let reviewFixResolution = null;
+  if (effectiveSuccess && !skipDoneStatus) {
+    const reviewFixValidation = validateReviewFixCompletion({
+      type,
+      meta,
+      branchChange: prFixBranchChange,
+      structuredCompletion,
+    });
+    if (!reviewFixValidation.valid) {
+      skipDoneStatus = true;
+      meta._agentId = agentId;
+      const detection = {
+        phrase: 'review-fix-resolution-evidence-missing',
+        reason: reviewFixValidation.reason,
+      };
+      const reason = meta?.item?.id
+        ? deferNonTerminalCompletion(meta, detection)
+        : detection.reason;
+      completionContractFailure = {
+        reason,
+        itemId: meta?.item?.id || dispatchItem.id,
+        nonTerminal: true,
+        processWorkItemFailure: false,
+      };
+      noopRationale = null;
+      log('warn', `Review-fix completion rejected for ${meta?.item?.id || dispatchItem.id}: ${reviewFixValidation.reason}`);
+    } else {
+      reviewFixResolution = reviewFixValidation.resolution || null;
+    }
+  }
   if (noopRationale) {
-    log('info', `No-op completion for ${meta.item.id}: ${noopRationale.slice(0, 200)}`);
+    log('info', `No-op completion for ${meta?.item?.id || dispatchItem.id}: ${noopRationale.slice(0, 200)}`);
   }
 
   if (effectiveSuccess && meta?.item?.id && !skipDoneStatus && !noopRationale) {
@@ -6051,41 +6156,6 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
 
   // Archive is manual — user archives plans from the dashboard when ready
 
-  let prFixBranchChange = null;
-  let prFixBuildStillFailing = null;
-  if (shared.isFixLikeWorkType(type) && effectiveSuccess && meta?.pr?.id) {
-    try {
-      prFixBranchChange = await detectPrFixBranchChange(meta, config);
-    } catch (err) {
-      log('warn', `PR fix no-op detection for ${meta.pr.id}: ${err.message}`);
-      prFixBranchChange = { changed: null, reason: err.message };
-    }
-    // #639 — a BUILD_FAILURE fix that didn't change the branch is not
-    // necessarily a genuine no-op: the agent may have found its own (or a
-    // prior dispatch's) fix commit already present and concluded "nothing to
-    // change" without checking whether CI actually turned green on that
-    // commit. Re-poll live CI for the head before letting updatePrAfterFix
-    // accept the no-op — if it's still failing, flag it so the no-op path
-    // records a distinct fixIneffective signal instead of a clean no-op.
-    if (prFixBranchChange?.changed === false) {
-      const fixCause = shared.getPrFixAutomationCause({
-        dispatchKey: dispatchItem?.meta?.dispatchKey,
-        source: meta?.source,
-        task: dispatchItem?.task,
-      });
-      if (fixCause === shared.PR_FIX_CAUSE.BUILD_FAILURE) {
-        try {
-          const liveStatus = await checkBuildStillFailingLive(meta.pr, meta.project);
-          if (liveStatus === shared.BUILD_STATUS.FAILING) {
-            prFixBuildStillFailing = liveStatus;
-          }
-        } catch (err) {
-          log('warn', `Live build re-check for ${meta.pr.id}: ${err.message}`);
-        }
-      }
-    }
-  }
-
   // Scheduled task back-reference: update SQL state and write a linked inbox note.
   if (meta?.item?._scheduleId) {
     try {
@@ -6191,11 +6261,20 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
     || completionContractFailure?.nonTerminal === true;
   const finalResult = hardContractFail ? DISPATCH_RESULT.ERROR : (effectiveSuccess ? DISPATCH_RESULT.SUCCESS : DISPATCH_RESULT.ERROR);
   if (type === WORK_TYPE.REVIEW && finalResult === DISPATCH_RESULT.SUCCESS && !skipDoneStatus && !benignNoop) {
-    await updatePrAfterReview(agentId, meta?.pr, meta?.project, config, resultSummary, structuredCompletion, dispatchItem);
+    await updatePrAfterReview(
+      agentId,
+      meta?.pr,
+      meta?.project,
+      config,
+      resultSummary,
+      structuredCompletion,
+      dispatchItem,
+      { reportedModel: model },
+    );
   } else if (type === WORK_TYPE.REVIEW) {
     log('warn', `Skipping PR review metadata update for ${meta?.pr?.id || meta?.pr?.url || '(unknown PR)'} because review dispatch ${dispatchItem.id} did not complete cleanly`);
   }
-  if (shared.isFixLikeWorkType(type) && effectiveSuccess) {
+  if (shared.isFixLikeWorkType(type) && effectiveSuccess && !skipDoneStatus) {
     updatePrAfterFix(meta?.pr, meta?.project, meta?.source, {
       branchChanged: fixCompletionChangedBranch(structuredCompletion),
       automationCauseKey: meta?.automationCauseKey,
@@ -6204,6 +6283,7 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
       buildStillFailing: prFixBuildStillFailing,
       config,
       noopReason: noopRationale || meta?._noopReason || '',
+      reviewFindingResolution: reviewFixResolution,
     });
     // W-mpg58wv3 — closure-loop dispatch. When the completed fix WI was spawned
     // to address a minion REQUEST_CHANGES (its meta carries
@@ -7044,6 +7124,7 @@ module.exports = {
   isReviewBailout,
   parseCompletionNoop,
   classifyBenignZeroTargetOutcome, // exported for testing
+  validateReviewFixCompletion,
   detectNonTerminalResultSummary,
   deferNonTerminalCompletion,
   deferPhantomCompletion,

package/engine/live-checkout.js

@@ -2034,6 +2034,7 @@ async function applyLiveCheckoutAutoStash(opts = {}) {
  *
  * @param {object} opts
  * @param {object} opts.item                 persisted dispatch record (has id, originalRef, meta.branch, meta.project.{localPath,name})
+ * @param {object} [opts.config]              current config; worktree mode makes this helper fail closed
  * @param {boolean} [opts.isTerminalFailure]  true on error/timeout/crash
  * @param {string}  [opts.resultLabel]        short status word for the alert body
  * @param {function} [opts.log]               (level, msg) => void
@@ -2043,8 +2044,9 @@ async function applyLiveCheckoutAutoStash(opts = {}) {
  * @returns {Promise<object>} restore result (or { skipped:true } for a non-live record)
  */
 async function maybeRestoreLiveCheckoutFromRecord(opts = {}) {
-  const { item, isTerminalFailure, resultLabel, log, writeInboxAlert, gitOpts, _git } = opts;
-  if (!item || !item.originalRef || !item.meta?.branch || !item.meta?.project?.localPath) {
+  const { item, config, isTerminalFailure, resultLabel, log, writeInboxAlert, gitOpts, _git } = opts;
+  if (!shared.isLiveCheckoutDispatchRecord(item, config)
+      || !item.originalRef || !item.meta?.branch || !item.meta?.project?.localPath) {
     return { restored: false, reason: 'not-live-record', skipped: true };
   }
   try {