agent-control-plane 0.1.8 → 0.1.12

package/tools/bin/agent-project-publish-issue-pr

@@ -24,8 +24,10 @@ base_branch="main"
 remote_name="origin"
 dry_run="false"
 keep_open_label=""
+meta_file_from_archive="no"
 shared_agent_home="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 scope_guard_script="${shared_agent_home}/tools/bin/issue-publish-scope-guard.sh"
+localization_guard_script="${shared_agent_home}/tools/bin/issue-publish-localization-guard.sh"
 verification_guard_script="${shared_agent_home}/tools/bin/branch-verification-guard.sh"
 
 while [[ $# -gt 0 ]]; do
@@ -51,11 +53,16 @@ fi
 find_archived_session_dir() {
   local root="${1:-}"
   local target_session="${2:-}"
+  local latest=""
   [[ -n "$root" && -d "$root" && -n "$target_session" ]] || return 1
 
-  find "$root" -mindepth 1 -maxdepth 1 -type d -name "${target_session}-*" ! -name "${target_session}-stale-*" 2>/dev/null \
-    | sort -r \
-    | head -n 1
+  latest="$(
+    command find "$root" -mindepth 1 -maxdepth 1 -type d -name "${target_session}-*" ! -name "${target_session}-stale-*" 2>/dev/null \
+      | LC_ALL=C sort -r \
+      | sed -n '1p'
+  )"
+  [[ -n "$latest" ]] || return 1
+  printf '%s\n' "$latest"
 }
 
 find_existing_worktree_for_branch() {
@@ -88,6 +95,64 @@ find_existing_worktree_for_branch() {
   return 1
 }
 
+worktree_is_git_repo() {
+  local worktree_path="${1:-}"
+  [[ -n "$worktree_path" && -d "$worktree_path" ]] || return 1
+  git -C "$worktree_path" rev-parse --is-inside-work-tree >/dev/null 2>&1
+}
+
+worktree_matches_publish_target() {
+  local worktree_path="${1:-}"
+  local current_branch=""
+  local current_head=""
+
+  worktree_is_git_repo "$worktree_path" || return 1
+
+  current_head="$(git -C "$worktree_path" rev-parse HEAD 2>/dev/null || true)"
+  current_branch="$(git -C "$worktree_path" symbolic-ref --quiet --short HEAD 2>/dev/null || true)"
+
+  if [[ -n "${FINAL_HEAD:-}" && -n "$current_head" && "$current_head" == "$FINAL_HEAD" ]]; then
+    return 0
+  fi
+
+  if [[ -n "${BRANCH:-}" && -n "$current_branch" && "$current_branch" == "$BRANCH" ]]; then
+    return 0
+  fi
+
+  return 1
+}
+
+recover_worktree_from_remote_branch() {
+  local repo_root="${1:-}"
+  local worktree_root="${2:-}"
+  local branch_name="${3:-}"
+  local remote="${4:-}"
+  local remote_ref=""
+  local fallback_worktree=""
+
+  [[ -n "$repo_root" && -d "$repo_root" && -n "$worktree_root" && -n "$branch_name" && -n "$remote" ]] || return 1
+
+  remote_ref="refs/remotes/${remote}/${branch_name}"
+  git -C "$repo_root" fetch "$remote" "$branch_name" >/dev/null 2>&1 || true
+  git -C "$repo_root" rev-parse --verify "$remote_ref" >/dev/null 2>&1 || return 1
+
+  fallback_worktree="$(mktemp -d "${worktree_root}/recovery-XXXXXX")"
+  git -C "$repo_root" worktree add --detach "$fallback_worktree" "$remote_ref" >/dev/null 2>&1 || {
+    rm -rf "$fallback_worktree" 2>/dev/null || true
+    return 1
+  }
+  worktree_is_git_repo "$fallback_worktree" || {
+    rm -rf "$fallback_worktree" 2>/dev/null || true
+    return 1
+  }
+  git -C "$fallback_worktree" checkout -B "$branch_name" "$remote_ref" >/dev/null 2>&1 || {
+    rm -rf "$fallback_worktree" 2>/dev/null || true
+    return 1
+  }
+  git -C "$fallback_worktree" branch --set-upstream-to "${remote}/${branch_name}" "$branch_name" >/dev/null 2>&1 || true
+  printf '%s\n' "$fallback_worktree"
+}
+
 status_out="$(
   "${shared_agent_home}/tools/bin/agent-project-worker-status" \
     --runs-root "$runs_root" \
@@ -98,6 +163,7 @@ if [[ -z "$meta_file" || ! -f "$meta_file" ]]; then
   archived_run_dir="$(find_archived_session_dir "$history_root" "$session" || true)"
   if [[ -n "$archived_run_dir" && -f "${archived_run_dir}/run.env" ]]; then
     meta_file="${archived_run_dir}/run.env"
+    meta_file_from_archive="yes"
   fi
 fi
 if [[ -z "$meta_file" || ! -f "$meta_file" ]]; then
@@ -117,10 +183,34 @@ if [[ -z "${ISSUE_ID:-}" || -z "${BRANCH:-}" ]]; then
   exit 1
 fi
 
+resolve_actor_login() {
+  local login=""
+
+  flow_export_github_cli_auth_env "${repo_slug}"
+  login="$(gh api user --jq .login 2>/dev/null || true)"
+  if [[ -z "${login}" ]]; then
+    login="$(
+      gh auth status 2>/dev/null \
+        | sed -n 's/^  ✓ Logged in to github.com account \([^ ]*\) (.*/\1/p' \
+        | head -n 1
+    )"
+  fi
+  if [[ -z "${login}" ]]; then
+    login="${USER:-}"
+  fi
+  printf '%s\n' "${login}"
+}
+
 issue_json="$(flow_github_issue_view_json "$repo_slug" "$ISSUE_ID")"
 issue_title="$(jq -r '.title' <<<"$issue_json")"
 issue_url="$(jq -r '.url' <<<"$issue_json")"
-actor_login="${GITHUB_ACTOR:-$(gh api user --jq .login)}"
+if [[ -z "${issue_title}" || "${issue_title}" == "null" ]]; then
+  issue_title="Issue #${ISSUE_ID}"
+fi
+if [[ -z "${issue_url}" || "${issue_url}" == "null" ]]; then
+  issue_url="${ISSUE_URL:-}"
+fi
+actor_login="${GITHUB_ACTOR:-$(resolve_actor_login)}"
 issue_keep_open="no"
 if [[ -n "$keep_open_label" ]] && jq -e --arg label "$keep_open_label" 'any(.labels[]?; .name == $label)' >/dev/null <<<"$issue_json"; then
   issue_keep_open="yes"
@@ -206,73 +296,93 @@ if [[ -n "$pr_json" ]]; then
   pr_number="$(jq -r '.number' <<<"$pr_json")"
   pr_url="$(jq -r '.url' <<<"$pr_json")"
 else
-  if [[ -z "${WORKTREE:-}" || ! -d "${WORKTREE:-}" ]]; then
-    # Worktree was cleaned up before publish — try branch fallback
-    fallback_worktree=""
-    if [[ -n "${BRANCH:-}" ]]; then
-      # Resolve the baseline repo from the git common dir of the (now missing) worktree
-      local_repo_root="$(flow_resolve_agent_repo_root "${CONFIG_YAML}")"
-      local_worktree_root="$(flow_resolve_worktree_root "${CONFIG_YAML}")"
-
-      recover_branch_from_final_head() {
-        [[ -n "${FINAL_HEAD:-}" ]] || return 1
-        git -C "$local_repo_root" cat-file -e "${FINAL_HEAD}^{commit}" >/dev/null 2>&1 || return 1
-        git -C "$local_repo_root" branch "$BRANCH" "$FINAL_HEAD" >/dev/null 2>&1 || return 1
+  local_repo_root="$(flow_resolve_agent_repo_root "${CONFIG_YAML}")"
+  local_worktree_root="$(flow_resolve_worktree_root "${CONFIG_YAML}")"
+  remote_branch_ref="refs/remotes/${remote_name}/${BRANCH}"
+  existing_worktree=""
+  fallback_worktree=""
+  remote_head=""
+  current_head=""
+
+  if [[ "${meta_file_from_archive}" == "yes" && -n "${WORKTREE:-}" ]]; then
+    printf 'WORKTREE_RECOVERY=ignored-archived-pointer\n' >&2
+    printf 'RECOVERY_WORKTREE=%s\n' "${WORKTREE}" >&2
+    WORKTREE=""
+  fi
+
+  if [[ -n "${WORKTREE:-}" ]] && ! worktree_matches_publish_target "${WORKTREE}"; then
+    printf 'WORKTREE_RECOVERY=ignored-stale\n' >&2
+    printf 'RECOVERY_WORKTREE=%s\n' "${WORKTREE}" >&2
+    WORKTREE=""
+  fi
+
+  git -C "$local_repo_root" worktree prune >/dev/null 2>&1 || true
+
+  if [[ -z "${WORKTREE:-}" ]]; then
+    existing_worktree="$(find_existing_worktree_for_branch "$local_repo_root" "$BRANCH" || true)"
+    if [[ -n "$existing_worktree" ]] && worktree_matches_publish_target "$existing_worktree"; then
+      WORKTREE="$existing_worktree"
+      printf 'WORKTREE_RECOVERY=reused-existing\n' >&2
+      printf 'RECOVERY_WORKTREE=%s\n' "$existing_worktree" >&2
+    fi
+  fi
+
+  if [[ -z "${WORKTREE:-}" && "${meta_file_from_archive}" == "yes" ]]; then
+    fallback_worktree="$(recover_worktree_from_remote_branch "$local_repo_root" "$local_worktree_root" "$BRANCH" "$remote_name" || true)"
+    if [[ -n "$fallback_worktree" ]]; then
+      WORKTREE="$fallback_worktree"
+      printf 'WORKTREE_RECOVERY=from-remote\n' >&2
+      printf 'RECOVERY_WORKTREE=%s\n' "$fallback_worktree" >&2
+    fi
+  fi
+
+  if [[ -z "${WORKTREE:-}" ]]; then
+    if ! git -C "$local_repo_root" rev-parse --verify "${BRANCH}" >/dev/null 2>&1; then
+      if [[ -n "${FINAL_HEAD:-}" ]] && git -C "$local_repo_root" cat-file -e "${FINAL_HEAD}^{commit}" >/dev/null 2>&1; then
+        git -C "$local_repo_root" branch -f "$BRANCH" "$FINAL_HEAD" >/dev/null 2>&1 || true
         printf 'BRANCH_RECOVERY=from-final-head\n' >&2
         printf 'RECOVERY_HEAD=%s\n' "$FINAL_HEAD" >&2
-      }
-
-      # Check if the branch exists in the baseline repo
-      if ! git -C "$local_repo_root" rev-parse --verify "${BRANCH}" >/dev/null 2>&1; then
-        recover_branch_from_final_head || true
       fi
-      if git -C "$local_repo_root" rev-parse --verify "${BRANCH}" >/dev/null 2>&1; then
-        git -C "$local_repo_root" worktree prune >/dev/null 2>&1 || true
-        existing_worktree="$(find_existing_worktree_for_branch "$local_repo_root" "$BRANCH" || true)"
-        if [[ -n "$existing_worktree" && ( -f "$existing_worktree/.git" || -d "$existing_worktree/.git" ) ]]; then
-          WORKTREE="$existing_worktree"
-          fallback_worktree="$existing_worktree"
-          printf 'WORKTREE_RECOVERY=reused-existing\n' >&2
-          printf 'RECOVERY_WORKTREE=%s\n' "$existing_worktree" >&2
+    fi
+
+    existing_worktree="$(find_existing_worktree_for_branch "$local_repo_root" "$BRANCH" || true)"
+    if [[ -n "$existing_worktree" ]] && worktree_is_git_repo "$existing_worktree"; then
+      WORKTREE="$existing_worktree"
+      printf 'WORKTREE_RECOVERY=reused-existing\n' >&2
+      printf 'RECOVERY_WORKTREE=%s\n' "$existing_worktree" >&2
+    else
+      fallback_worktree="$(mktemp -d "${local_worktree_root}/recovery-XXXXXX")"
+      if git -C "$local_repo_root" worktree add "$fallback_worktree" "$BRANCH" >/dev/null 2>&1 \
+        || git -C "$local_repo_root" worktree add "$fallback_worktree" "$remote_branch_ref" >/dev/null 2>&1; then
+        if worktree_is_git_repo "$fallback_worktree"; then
+          WORKTREE="$fallback_worktree"
+          printf 'WORKTREE_RECOVERY=created\n' >&2
+          printf 'RECOVERY_WORKTREE=%s\n' "$fallback_worktree" >&2
         else
-          fallback_worktree="$(mktemp -d "${local_worktree_root}/recovery-XXXXXX")"
-          git -C "$local_repo_root" worktree add "$fallback_worktree" "$BRANCH" 2>/dev/null || true
-          # Validate the worktree is a real git repo, not just an empty directory
-          if [[ -f "$fallback_worktree/.git" || -d "$fallback_worktree/.git" ]]; then
-            WORKTREE="$fallback_worktree"
-            printf 'WORKTREE_RECOVERY=created\n' >&2
-            printf 'RECOVERY_WORKTREE=%s\n' "$fallback_worktree" >&2
-          else
-            rm -rf "$fallback_worktree" 2>/dev/null || true
-            fallback_worktree=""
-          fi
-        fi
-      fi
-      # Check if branch exists on remote
-      if [[ -z "${fallback_worktree}" ]]; then
-        git -C "$local_repo_root" fetch "$remote_name" 2>/dev/null || true
-        if git -C "$local_repo_root" rev-parse --verify "refs/remotes/${remote_name}/${BRANCH}" >/dev/null 2>&1; then
-          fallback_worktree="$(mktemp -d "${local_worktree_root}/recovery-XXXXXX")"
-          git -C "$local_repo_root" worktree add "$fallback_worktree" "refs/remotes/${remote_name}/${BRANCH}" 2>/dev/null || true
-          # Validate the worktree is a real git repo, not just an empty directory
-          if [[ -f "$fallback_worktree/.git" || -d "$fallback_worktree/.git" ]]; then
-            WORKTREE="$fallback_worktree"
-            printf 'WORKTREE_RECOVERY=from-remote\n' >&2
-            printf 'RECOVERY_WORKTREE=%s\n' "$fallback_worktree" >&2
-          else
-            rm -rf "$fallback_worktree" 2>/dev/null || true
-            fallback_worktree=""
-          fi
+          rm -rf "$fallback_worktree" 2>/dev/null || true
         fi
+      else
+        rm -rf "$fallback_worktree" 2>/dev/null || true
       fi
     fi
-    if [[ -z "${WORKTREE:-}" || ! -d "${WORKTREE:-}" ]]; then
-      echo "session $session is missing a publishable worktree (branch ${BRANCH:-unknown} not found locally or on remote ${remote_name})" >&2
-      exit 1
-    fi
   fi
 
-  git -C "$WORKTREE" fetch "$remote_name" "$base_branch" --prune >/dev/null
+  if [[ -z "${WORKTREE:-}" || ! -d "${WORKTREE:-}" ]]; then
+    echo "session $session is missing a publishable worktree (branch ${BRANCH:-unknown} not found locally or on remote ${remote_name})" >&2
+    exit 1
+  fi
+
+  git -C "$WORKTREE" fetch "$remote_name" "$base_branch" "$BRANCH" --prune >/dev/null 2>&1 || git -C "$WORKTREE" fetch "$remote_name" "$base_branch" --prune >/dev/null 2>&1 || true
+  if git -C "$local_repo_root" rev-parse --verify "${remote_branch_ref}" >/dev/null 2>&1; then
+    remote_head="$(git -C "$local_repo_root" rev-parse "${remote_branch_ref}" 2>/dev/null || true)"
+    current_head="$(git -C "$WORKTREE" rev-parse HEAD 2>/dev/null || true)"
+    if [[ -n "${remote_head}" && "${current_head}" != "${remote_head}" ]]; then
+      git -C "$WORKTREE" checkout -B "$BRANCH" "${remote_branch_ref}" >/dev/null 2>&1 || true
+      git -C "$WORKTREE" branch --set-upstream-to "${remote_name}/${BRANCH}" "$BRANCH" >/dev/null 2>&1 || true
+      printf 'WORKTREE_RECOVERY=aligned-remote\n' >&2
+      printf 'RECOVERY_HEAD=%s\n' "${remote_head}" >&2
+    fi
+  fi
 
   head_sha="$(git -C "$WORKTREE" rev-parse HEAD)"
   ahead_count="$(git -C "$WORKTREE" rev-list --count "${remote_name}/${base_branch}"..HEAD)"
@@ -286,6 +396,12 @@ else
     --base-ref "${remote_name}/${base_branch}" \
     --issue-id "$ISSUE_ID"
 
+  if [[ -x "${localization_guard_script}" ]]; then
+    "${localization_guard_script}" \
+      --worktree "$WORKTREE" \
+      --base-ref "${remote_name}/${base_branch}"
+  fi
+
   "${verification_guard_script}" \
     --worktree "$WORKTREE" \
     --base-ref "${remote_name}/${base_branch}" \

package/tools/bin/agent-project-reconcile-issue-session

@@ -202,6 +202,8 @@ set +a
 
 result_outcome=""
 result_action=""
+run_started_at="${STARTED_AT:-}"
+expected_run_started_at="${ACP_EXPECTED_RUN_STARTED_AT:-${F_LOSNING_EXPECTED_RUN_STARTED_AT:-}}"
 result_file_candidate="${run_dir}/result.env"
 if [[ ! -f "$result_file_candidate" && -n "${RESULT_FILE:-}" && -f "${RESULT_FILE:-}" ]]; then
   result_file_candidate="${RESULT_FILE}"
@@ -215,6 +217,14 @@ if [[ -f "$result_file_candidate" ]]; then
   result_action="${ACTION:-}"
 fi
 
+if [[ -n "${expected_run_started_at}" && "${expected_run_started_at}" != "${run_started_at}" ]]; then
+  printf 'STATUS=STALE-RUN-SKIPPED\n'
+  printf 'SESSION=%s\n' "$session"
+  printf 'EXPECTED_STARTED_AT=%s\n' "${expected_run_started_at}"
+  printf 'ACTUAL_STARTED_AT=%s\n' "${run_started_at}"
+  exit 0
+fi
+
 issue_summary_outcome=""
 issue_summary_action=""
 issue_summary_failure_reason=""
@@ -295,7 +305,7 @@ provider_cooldown_script="${shared_tools_dir}/provider-cooldown-state.sh"
 
 schedule_provider_quota_cooldown() {
   local reason="${1:-provider-quota-limit}"
-  [[ "${failure_reason:-}" == "provider-quota-limit" ]] || return 0
+  [[ "${reason}" == "provider-quota-limit" ]] || return 0
   [[ -x "${provider_cooldown_script}" ]] || return 0
 
   "${provider_cooldown_script}" schedule "${reason}" >/dev/null || true
@@ -307,6 +317,54 @@ clear_provider_quota_cooldown() {
   "${provider_cooldown_script}" clear >/dev/null || true
 }
 
+normalize_issue_failure_reason() {
+  local current_reason="${1:-}"
+
+  case "${current_reason}" in
+    usage-limit|quota-switch-deferred|quota-switch-attempt-limit)
+      if [[ "${CODING_WORKER:-}" == "codex" ]]; then
+        printf 'provider-quota-limit\n'
+        return 0
+      fi
+      ;;
+  esac
+
+  printf '%s\n' "${current_reason}"
+}
+
+issue_runtime_log_file() {
+  if [[ -f "${run_dir}/${session}.log" ]]; then
+    printf '%s\n' "${run_dir}/${session}.log"
+    return 0
+  fi
+
+  find "${run_dir}" -maxdepth 1 -type f -name '*.log' 2>/dev/null | LC_ALL=C sort | tail -n 1
+}
+
+infer_issue_runtime_failure_from_log() {
+  local log_file=""
+
+  log_file="$(issue_runtime_log_file)"
+  [[ -n "${log_file}" && -f "${log_file}" ]] || return 1
+
+  if grep -Eiq 'stale-run no-codex-output-before-stall-threshold|no-codex-output-before-stall-threshold' "${log_file}" 2>/dev/null; then
+    printf 'no-codex-output-before-stall-threshold\n'
+    return 0
+  fi
+
+  if grep -Eiq 'stale-run no-codex-progress-before-stall-threshold|no-codex-progress-before-stall-threshold' "${log_file}" 2>/dev/null; then
+    printf 'no-codex-progress-before-stall-threshold\n'
+    return 0
+  fi
+
+  if grep -Eiq 'Ignoring invalid cwd .* No such file or directory|/tmp is absolute|Custom tool call output is missing' "${log_file}" 2>/dev/null; then
+    printf 'worker-environment-blocked\n'
+    return 0
+  fi
+
+  return 1
+}
+
 normalize_issue_result_contract() {
   [[ "$status" == "SUCCEEDED" ]] || return 0
 
@@ -681,6 +739,11 @@ classify_issue_publish_blocker() {
     return 0
   fi
 
+  if grep -Fq 'Localization guard blocked branch publication.' <<<"$publish_out"; then
+    printf 'localization-guard-blocked\n'
+    return 0
+  fi
+
   if grep -Fq 'has no commits ahead of' <<<"$publish_out"; then
     printf 'no-publishable-commits\n'
     return 0
@@ -778,6 +841,23 @@ Why it was blocked:
 - the verification guard could not confirm the expected checks for this change
 - recurring issue publication should stop rather than open an unverifiable PR
 
+\`\`\`text
+${publish_out}
+\`\`\`
+EOF
+    return 0
+  fi
+
+  if [[ "${blocker_reason}" == "localization-guard-blocked" ]]; then
+    cat <<EOF
+# Blocker: Localization requirements were not satisfied
+
+Host publication stopped this cycle because the branch updated locale resources but still left obvious hardcoded user-facing strings in the touched UI files.
+
+Why it was blocked:
+- the localization guard found remaining literals that should move behind translation keys
+- recurring issue publication should stop rather than open a partially localized UI change
+
 \`\`\`text
 ${publish_out}
 \`\`\`
@@ -800,6 +880,21 @@ build_issue_runtime_blocker_comment() {
 
   case "${runtime_reason}" in
     provider-quota-limit)
+      if [[ "${worker_name}" == "codex" ]]; then
+        cat <<EOF
+# Blocker: Provider quota is currently exhausted
+
+This recurring run stopped before implementation because the configured ${worker_name} account hit a provider-side usage limit.
+
+Why it was blocked:
+- the worker reached the current Codex usage cap for the active account
+- ACP records the quota hit, attempts safe account rotation when available, and then waits for the configured cooldown instead of looping indefinitely
+
+Next step:
+- wait for the current quota window to reset, or make another Codex account available to this profile
+EOF
+        return 0
+      fi
       cat <<EOF
 # Blocker: Provider quota is currently exhausted
 
@@ -811,6 +906,21 @@ Why it was blocked:
 
 Next step:
 - wait for the current quota window to reset, or switch this profile to another available provider/account
+EOF
+      return 0
+      ;;
+    worker-environment-blocked)
+      cat <<EOF
+# Blocker: Worker environment failed before a valid result contract was written
+
+This recurring run did not produce a usable ACP result file because the ${worker_name} execution environment failed mid-run.
+
+Why it was blocked:
+- the worker hit a sandbox/worktree runtime failure before it could write \`result.env\`
+- ACP detected the runtime signature from the session log and converted the missing contract into a concrete blocker instead of retrying with a generic \`invalid-result-contract\`
+
+Next step:
+- refresh the worker runtime/worktree and rerun this cycle after the host-side environment issue is resolved
 EOF
       return 0
       ;;
@@ -829,6 +939,79 @@ Next step:
 EOF
 }
 
+infer_issue_blocked_failure_reason() {
+  local comment_file="${run_dir}/issue-comment.md"
+  local current_reason="${1:-}"
+
+  if [[ -n "${current_reason:-}" && "${current_reason}" != "issue-worker-blocked" ]]; then
+    printf '%s\n' "${current_reason}"
+    return 0
+  fi
+
+  [[ -s "${comment_file}" ]] || {
+    printf 'issue-worker-blocked\n'
+    return 0
+  }
+
+  ISSUE_COMMENT_FILE="${comment_file}" node <<'EOF'
+const fs = require('fs');
+
+const path = process.env.ISSUE_COMMENT_FILE || '';
+const body = path ? fs.readFileSync(path, 'utf8') : '';
+let reason = '';
+
+const explicitFailureReason = body.match(/Failure reason:\s*[\r\n]+-\s*`([^`]+)`/i);
+if (explicitFailureReason) {
+  reason = explicitFailureReason[1];
+} else if (/^# Blocker: Verification requirements were not satisfied$/im.test(body)) {
+  reason = 'verification-guard-blocked';
+} else if (/^# Blocker: Localization requirements were not satisfied$/im.test(body)) {
+  reason = 'localization-guard-blocked';
+} else if (
+  /required (?:issue-contract )?verification does not currently pass/i.test(body) ||
+  /Because the required `pnpm typecheck` did not pass/i.test(body) ||
+  /- BLOCKED `pnpm typecheck`/i.test(body) ||
+  /pnpm typecheck(?:`)? fails in unrelated existing file/i.test(body) ||
+  /Blocked on required root verification/i.test(body) ||
+  /required root (?:verification command|`pnpm test`)/i.test(body) ||
+  /pnpm test` is currently failing outside this/i.test(body) ||
+  /The required root test command failed/i.test(body) ||
+  /did not commit because the issue contract requires verification to pass/i.test(body)
+) {
+  reason = 'verification-guard-blocked';
+} else if (/^# Blocker: (All checklist items already completed|Worker produced no publishable delta)$/im.test(body)) {
+  reason = 'no-publishable-commits';
+} else if (/^# Blocker: Change scope was too broad$/im.test(body)) {
+  reason = 'scope-guard-blocked';
+} else if (/^# Blocker: Provider quota is currently exhausted$/im.test(body)) {
+  reason = 'provider-quota-limit';
+} else if (
+  /blocked on external network access/i.test(body) ||
+  /could not perform a safe offline bump/i.test(body) ||
+  /failed to reach `api\.github\.com`/i.test(body) ||
+  /failed with `ENOTFOUND`/i.test(body)
+) {
+  reason = 'external-network-access-blocked';
+} else if (
+  /I’m blocked on the environment, not the issue scope/i.test(body) ||
+  /Every local execution path I need for this cycle is failing immediately with `aborted`/i.test(body) ||
+  /outside this session['’]s writable sandbox/i.test(body) ||
+  /could not write to the host-required `\$ACP_RUN_DIR`/i.test(body) ||
+  /cannot access local infrastructure from this sandbox/i.test(body) ||
+  /sandbox socket connection errors/i.test(body) ||
+  /connect EPERM 127\.0\.0\.1:6379/i.test(body) ||
+  /local Postgres\/Redis services/i.test(body) ||
+  /worker can(?:not|'t) connect to the local test Postgres and Redis services/i.test(body)
+) {
+  reason = 'worker-environment-blocked';
+} else if (/^# Blocker:/im.test(body)) {
+  reason = 'issue-worker-blocked';
+}
+
+process.stdout.write(`${reason || 'issue-worker-blocked'}\n`);
+EOF
+}
+
 extract_recovery_worktree_from_publish_output() {
   local publish_out="${1:-}"
   awk -F= '/^RECOVERY_WORKTREE=/{print $2}' <<<"$publish_out" | tail -n 1
@@ -844,8 +1027,15 @@ require_transition() {
 }
 
 mark_reconciled() {
+  local reconciled_at tmp_file
   if [[ -d "$run_dir" ]]; then
-    touch "${run_dir}/reconciled.ok"
+    reconciled_at="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+    tmp_file="${run_dir}/reconciled.ok.tmp.$$"
+    {
+      printf 'STARTED_AT=%s\n' "${run_started_at}"
+      printf 'RECONCILED_AT=%s\n' "${reconciled_at}"
+    } >"${tmp_file}"
+    mv "${tmp_file}" "${run_dir}/reconciled.ok"
   fi
 }
 
@@ -941,6 +1131,34 @@ case "$status" in
   SUCCEEDED)
     clear_provider_quota_cooldown
     if ! normalize_issue_result_contract; then
+      inferred_failure_reason="$(infer_issue_runtime_failure_from_log || true)"
+      if [[ -n "${inferred_failure_reason}" ]]; then
+        status="FAILED"
+        failure_reason="$(normalize_issue_failure_reason "${inferred_failure_reason}")"
+        issue_result_contract_note="missing-worker-result-recovered-${failure_reason}"
+        result_outcome="blocked"
+        result_action="host-comment-blocker"
+        normalize_issue_runner_state "failed" "${LAST_EXIT_CODE:-}" "${failure_reason}"
+        if [[ ! -s "${run_dir}/issue-comment.md" ]]; then
+          write_issue_comment_artifact "$(build_issue_runtime_blocker_comment "${failure_reason}")" || true
+        fi
+        post_issue_comment_if_present
+        require_transition "issue_schedule_retry" issue_schedule_retry "$failure_reason"
+        require_transition "issue_mark_ready" issue_mark_ready
+        issue_set_reconcile_summary "$status" "$result_outcome" "$result_action" "$failure_reason"
+        cleanup_issue_session
+        notify_issue_reconciled
+        mark_reconciled
+        printf 'STATUS=%s\n' "$status"
+        printf 'ISSUE_ID=%s\n' "$issue_id"
+        printf 'PR_NUMBER=%s\n' "$pr_number"
+        printf 'OUTCOME=%s\n' "$result_outcome"
+        printf 'ACTION=%s\n' "$result_action"
+        printf 'FAILURE_REASON=%s\n' "$failure_reason"
+        printf 'RESULT_CONTRACT_NOTE=%s\n' "$issue_result_contract_note"
+        exit 0
+      fi
+
       status="FAILED"
       failure_reason="invalid-result-contract"
       issue_result_contract_note="invalid-result-contract"
@@ -984,7 +1202,7 @@ case "$status" in
         printf 'ACTION=%s\n' "$result_action"
         exit 0
       fi
-      failure_reason="issue-worker-blocked"
+      failure_reason="$(infer_issue_blocked_failure_reason "${failure_reason:-}")"
       normalize_issue_runner_state "succeeded" "0" ""
       require_transition "issue_schedule_retry" issue_schedule_retry "$failure_reason"
       require_transition "issue_mark_blocked" issue_mark_blocked
@@ -1138,10 +1356,17 @@ case "$status" in
     notify_issue_reconciled
     ;;
   FAILED)
-    failure_reason="${failure_reason:-worker-exit-failed}"
+    failure_reason="$(normalize_issue_failure_reason "${failure_reason:-worker-exit-failed}")"
     schedule_provider_quota_cooldown "${failure_reason}"
     normalize_issue_runner_state "failed" "${LAST_EXIT_CODE:-}" "${failure_reason}"
-    if [[ "${result_outcome:-}" == "blocked" && "${result_action:-}" == "host-comment-blocker" ]]; then
+    if [[ "${result_outcome:-}" == "blocked" && "${result_action:-}" == "host-comment-blocker" ]] \
+      || [[ "${failure_reason}" == "provider-quota-limit" ]]; then
+      if [[ -z "${result_outcome:-}" ]]; then
+        result_outcome="blocked"
+      fi
+      if [[ -z "${result_action:-}" ]]; then
+        result_action="host-comment-blocker"
+      fi
       if [[ ! -s "${run_dir}/issue-comment.md" ]]; then
         write_issue_comment_artifact "$(build_issue_runtime_blocker_comment "${failure_reason}")" || true
       fi