@yemi33/minions 0.1.2444 → 0.1.2445

package/engine/dispatch.js

@@ -36,8 +36,10 @@ const MINIONS_DIR = shared.MINIONS_DIR;
 // against context-only PRs because casting a review vote, posting a
 // comment, asking a question, or running a read-only explore never mutates the
 // PR's source branch. Auto-discovery (engine.js#discoverFromPrs) is still
-// gated on `contextOnly` separately — only explicit WIs (dashboard, watches,
-// CC) can target a context-only PR, and only via these types.
+// gated on `contextOnly` separately. Mutating types are not universally barred
+// from a context-only PR either — they survive when the work item carries
+// explicit human/API provenance (see getStalePrDispatchReason's context-only
+// gate and shared.isExplicitlyRequestedPrDispatch).
 const NON_MUTATING_DISPATCH_TYPES = new Set([
   WORK_TYPE.REVIEW,
   WORK_TYPE.ASK,
@@ -594,18 +596,29 @@ function getStalePrDispatchReason(entry, config) {
   const prLabel = entry.meta.pr?.id || entry.meta.pr?.url || entry.id;
   if (!tracked) return `PR ${prLabel} is no longer tracked`;
   if (tracked.status !== PR_STATUS.ACTIVE) return `PR ${tracked.id || prLabel} is ${tracked.status || 'missing status'}`;
-  // Combined gate (W-mq5v612m001g1545 + #3126):
-  //   1. `entry.meta?.source !== 'work-item'` — blocks any non-work-item dispatch
-  //      (e.g. legacy `pr`/`pr-human-feedback` discovery paths) from running
-  //      against a context-only PR. Auto-discovery in engine.js#discoverFromPrs
-  //      already skips context-only PRs at the source, so this is defense-in-depth.
-  //   2. `!NON_MUTATING_DISPATCH_TYPES.has(entry.type)` — even an explicit
-  //      work-item dispatch is dropped if it's a mutating type (fix, implement,
-  //      test, verify, decompose, docs). Only review/ask/explore — which never
-  //      push to the PR's source branch — are allowed through.
-  if (shared.isContextOnlyPrRecord(tracked)
-      && (entry.meta?.source !== 'work-item' || !NON_MUTATING_DISPATCH_TYPES.has(entry.type))) {
-    return `PR ${tracked.id || prLabel} is context-only`;
+  // Context-only gate (W-mq5v612m001g1545 + #3126, corrected by
+  // W-ms5sr82s00ze0af8-c). `contextOnly` suppresses AUTOMATIC PR discovery and
+  // auto-management only — it must not cancel PR-targeted work a human or API
+  // caller explicitly created. A dispatch survives a context-only PR when
+  // either leg holds:
+  //   1. It is a work-item dispatch of a non-mutating type (review/ask/explore)
+  //      — casting a vote, commenting, or reading never pushes to the PR's
+  //      source branch, so intent doesn't need to be established.
+  //   2. `shared.isExplicitlyRequestedPrDispatch(entry, wi)` — the dispatch
+  //      came from an explicit work item (`meta.source === 'work-item'`) whose
+  //      structured provenance (`_originAgent` / `_originWi` from the
+  //      `X-Minions-Agent` / `X-Minions-Origin-Wi` headers, or an explicit
+  //      `createdBy` root such as `dashboard`) proves a human or API caller
+  //      asked for it. This is what un-breaks operator-authored `fix` work
+  //      items, which fail leg 1 purely because `fix` is a mutating type.
+  // Auto-discovered dispatches (`source: 'pr'`, `'pr-human-feedback'`) satisfy
+  // neither leg and are still pruned exactly as before. The work item is only
+  // resolved when both cheap checks have already failed.
+  if (shared.isContextOnlyPrRecord(tracked)) {
+    const allowed = entry.meta?.source === 'work-item'
+      && (NON_MUTATING_DISPATCH_TYPES.has(entry.type)
+        || shared.isExplicitlyRequestedPrDispatch(entry, _resolveWorkItemForPrunedEntry(entry)));
+    if (!allowed) return `PR ${tracked.id || prLabel} is context-only`;
   }
 
   const queuedBranch = entry.meta.branch || entry.meta.pr?.branch || '';
@@ -655,7 +668,9 @@ function cancelSourceWorkItemForPrunedDispatch(entry, reason) {
 
 /**
  * W-mr9jo2n2000667ad (bug B) — best-effort resolution of the work item behind
- * a pending dispatch entry, used only by the scope-overlap gate below.
+ * a pending dispatch entry, used by the scope-overlap gate below and by the
+ * context-only provenance gate in getStalePrDispatchReason (which needs the
+ * persisted `_originAgent` / `createdBy` fields, not just the queued snapshot).
  */
 function _resolveWorkItemForPrunedEntry(entry) {
   const itemId = entry?.meta?.item?.id;

package/engine/shared.js

@@ -7697,6 +7697,85 @@ function isAutoManagedPrRecord(pr) {
   return !!pr && typeof pr === 'object' && !isContextOnlyPrRecord(pr);
 }
 
+/**
+ * Work-item `createdBy` roots that represent an EXPLICIT request: a human
+ * operator acting through the dashboard, an external caller on
+ * `POST /api/work-items`, or an operator-authored automation definition
+ * (watch rule, schedule, pipeline, QA session). All of these are work a
+ * person deliberately declared.
+ *
+ * Deliberately NOT listed: engine-derived origins (`engine:*`,
+ * `decomposition`, `lifecycle:*`, `harness:iterate`). Those are the engine
+ * auto-managing a PR on its own initiative, which is exactly what a
+ * `contextOnly` PR is flagged to suppress.
+ *
+ * Fails CLOSED — an unlisted `createdBy` is treated as non-explicit, so a new
+ * engine-automatic creator can never accidentally inherit explicit status. A
+ * new human/API-facing creator must register its root here.
+ */
+const EXPLICIT_WORK_ITEM_ORIGIN_ROOTS = new Set([
+  'dashboard',      // dashboard UI + POST /api/work-items, incl. CC/agent API callers
+                    // (dashboard.js hard-codes createdBy:'dashboard'; also
+                    // dashboard:execute, dashboard:revision, dashboard:promotion:…)
+  'human',          // engine/meeting.js
+  'operator',
+  'watch',          // operator-authored watch rule (watch:<watchId>)
+  'scheduler',      // operator-authored schedule (scheduler, scheduler:harness)
+  'pipeline',       // operator-authored pipeline definition (pipeline:<pipelineId>)
+  'qa-dispatch',    // operator-started QA session
+  'qa-session',
+]);
+
+/**
+ * Normalize a work item's `createdBy` to its namespace root so the allowlist
+ * above stays short. Creators namespace themselves as `<root>:<detail>`
+ * (`dashboard:execute`, `pipeline:<id>`, `watch:<id>`, `scheduler:harness`);
+ * `qa-session-<phase>` (engine/qa-sessions.js) uses a hyphen instead.
+ */
+function workItemOriginRoot(createdBy) {
+  const raw = typeof createdBy === 'string' ? createdBy.trim().toLowerCase() : '';
+  if (!raw) return '';
+  const root = raw.split(':')[0];
+  return root.startsWith('qa-session-') ? 'qa-session' : root;
+}
+
+/**
+ * W-ms5sr82s00ze0af8-c — provenance gate for PR-targeted dispatches against a
+ * `contextOnly` PR.
+ *
+ * `contextOnly` suppresses AUTOMATIC PR discovery and auto-management; it must
+ * never cancel PR-targeted work a human or API caller explicitly created (the
+ * defect that cancelled the operator-authored `fix` work items for opg PRs
+ * #1066 / #1067 with `_lastDispatchResult: 'pruned-stale-pr-dispatch'`).
+ *
+ * Explicit provenance is read from structured fields only — never from title
+ * or description text:
+ *   1. `entry.meta.source === 'work-item'` is mandatory. Auto-discovery
+ *      (`source: 'pr'`, `'pr-human-feedback'`) never qualifies, whatever work
+ *      item it happens to resolve to.
+ *   2. The backing work item must carry either the `_originAgent` /
+ *      `_originWi` audit fields persisted by `POST /api/work-items` from the
+ *      `X-Minions-Agent` / `X-Minions-Origin-Wi` headers, or a `createdBy`
+ *      whose root is in EXPLICIT_WORK_ITEM_ORIGIN_ROOTS.
+ *
+ * @param {object} entry - pending dispatch entry
+ * @param {object} [workItem] - the resolved source work item; falls back to
+ *   the `entry.meta.item` snapshot the dispatch was queued with.
+ * @returns {boolean}
+ */
+function isExplicitlyRequestedPrDispatch(entry, workItem = null) {
+  if (!entry || typeof entry !== 'object') return false;
+  if (entry.meta?.source !== 'work-item') return false;
+  const item = (workItem && typeof workItem === 'object')
+    ? workItem
+    : (entry.meta?.item && typeof entry.meta.item === 'object' ? entry.meta.item : null);
+  if (!item) return false;
+  const originAgent = typeof item._originAgent === 'string' ? item._originAgent.trim() : '';
+  const originWi = typeof item._originWi === 'string' ? item._originWi.trim() : '';
+  if (originAgent || originWi) return true;
+  return EXPLICIT_WORK_ITEM_ORIGIN_ROOTS.has(workItemOriginRoot(item.createdBy));
+}
+
 function mergePrLinkItems(links, prId, itemIds) {
   if (!prId) return;
   const merged = new Set([...(links[prId] || []), ...normalizePrLinkItems(itemIds)]);
@@ -9568,6 +9647,9 @@ module.exports = {
   upsertPullRequestRecord,
   collapseDuplicatePrRecords, // P-e9f0a2b4 — one-time repair helper
   isAutoManagedPrRecord, // W-mq5s5ttx000j7ab8-a — exported for engine + watch-plugin gate consolidation
+  isExplicitlyRequestedPrDispatch, // W-ms5sr82s00ze0af8-c — provenance gate shared by both stale-PR-dispatch pruners
+  workItemOriginRoot, // exported for testing
+  EXPLICIT_WORK_ITEM_ORIGIN_ROOTS,
   autoEnrollPrFromWorkItem,
   autoEnrollPrFromFixWorkItem,
   deriveUrlForPrRef, // exported for testing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2444",
+  "version": "0.1.2445",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"