agent-dealer 0.2.0 → 1.0.0

package/bundle/shared/dist/issues.test.js

@@ -0,0 +1,72 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { canTransitionIssue, CreateIssueInput, Issue } from "./issues.js";
+test("issue transitions: ready to developing is allowed", () => {
+    assert.equal(canTransitionIssue("ready", "developing"), true);
+});
+test("issue transitions: done is terminal", () => {
+    assert.equal(canTransitionIssue("done", "developing"), false);
+    assert.equal(canTransitionIssue("done", "closed"), false);
+});
+test("issue transitions: cannot skip straight from ready to final_review", () => {
+    assert.equal(canTransitionIssue("ready", "final_review"), false);
+});
+test("issue transitions: final_review can send back to repairing", () => {
+    assert.equal(canTransitionIssue("final_review", "repairing"), true);
+});
+test("issue transitions: reviewing can self-loop (stale-review retry at a fresh head)", () => {
+    assert.equal(canTransitionIssue("reviewing", "reviewing"), true);
+});
+test("Issue schema parses a well-formed issue", () => {
+    const issue = {
+        id: "11111111-1111-1111-1111-111111111111",
+        source: "manual",
+        externalId: null,
+        externalLabel: null,
+        externalUrl: null,
+        title: "Fix login bug",
+        description: null,
+        acceptanceCriteria: null,
+        repo: "acme/app",
+        baseBranch: "main",
+        status: "ready",
+        currentOwner: "system",
+        currentIntent: null,
+        developerAgentId: "22222222-2222-2222-2222-222222222222",
+        reviewerAgentId: "33333333-3333-3333-3333-333333333333",
+        maxReviewRounds: 3,
+        currentRound: 1,
+        maxInfraAttempts: 3,
+        infraAttempts: 0,
+        branch: null,
+        baseSha: null,
+        headSha: null,
+        prNumber: null,
+        prUrl: null,
+        autoMerge: false,
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString()
+    };
+    assert.deepStrictEqual(Issue.parse(issue), issue);
+});
+test("CreateIssueInput defaults baseBranch to main and maxReviewRounds to 3", () => {
+    const parsed = CreateIssueInput.parse({
+        title: "Fix login bug",
+        repo: "acme/app",
+        developerAgentId: "22222222-2222-2222-2222-222222222222",
+        reviewerAgentId: "33333333-3333-3333-3333-333333333333"
+    });
+    assert.equal(parsed.baseBranch, "main");
+    assert.equal(parsed.maxReviewRounds, 3);
+    assert.equal(parsed.source, "manual");
+    assert.equal(parsed.autoMerge, false);
+    assert.equal(parsed.repo, "github.com/acme/app");
+});
+test("CreateIssueInput rejects local filesystem paths (NOT-149)", () => {
+    assert.throws(() => CreateIssueInput.parse({
+        title: "Local",
+        repo: "/repo",
+        developerAgentId: "22222222-2222-2222-2222-222222222222",
+        reviewerAgentId: "33333333-3333-3333-3333-333333333333",
+    }), /Local filesystem|Invalid/);
+});

package/bundle/shared/dist/outbound-draft.d.ts

@@ -132,6 +132,10 @@ export declare const OutboundDraftContent: z.ZodObject<{
     sentAt: z.ZodOptional<z.ZodString>;
     rejectedAt: z.ZodOptional<z.ZodString>;
     bodyMismatch: z.ZodOptional<z.ZodBoolean>;
+    /** Count of real delivery attempts made for this draft (NOT-95) — feeds the execution
+     * authority idempotency key (`${draftArtifactId}:${deliveryAttempts}`) so a retry after
+     * INTERACTION_REQUIRED mints a genuinely distinct authority rather than reusing one. */
+    deliveryAttempts: z.ZodDefault<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     status: "pending" | "sent" | "rejected";
     draft: {
@@ -146,6 +150,7 @@ export declare const OutboundDraftContent: z.ZodObject<{
             arguments: Record<string, unknown>;
         };
     };
+    deliveryAttempts: number;
     sentAt?: string | undefined;
     rejectedAt?: string | undefined;
     bodyMismatch?: boolean | undefined;
@@ -166,6 +171,7 @@ export declare const OutboundDraftContent: z.ZodObject<{
     sentAt?: string | undefined;
     rejectedAt?: string | undefined;
     bodyMismatch?: boolean | undefined;
+    deliveryAttempts?: number | undefined;
 }>;
 export type OutboundDraftContent = z.infer<typeof OutboundDraftContent>;
 /** send_receipt artifact contentJson (PRD §7.3). */

package/bundle/shared/dist/outbound-draft.js

@@ -23,6 +23,10 @@ export const OutboundDraftContent = z.object({
     sentAt: z.string().optional(),
     rejectedAt: z.string().optional(),
     bodyMismatch: z.boolean().optional(),
+    /** Count of real delivery attempts made for this draft (NOT-95) — feeds the execution
+     * authority idempotency key (`${draftArtifactId}:${deliveryAttempts}`) so a retry after
+     * INTERACTION_REQUIRED mints a genuinely distinct authority rather than reusing one. */
+    deliveryAttempts: z.number().int().min(0).default(0),
 });
 /** send_receipt artifact contentJson (PRD §7.3). */
 export const SendReceiptContent = z.object({

package/bundle/shared/dist/plan-triage.d.ts

@@ -74,8 +74,8 @@ export declare const PlanTriageBlock: z.ZodEffects<z.ZodObject<{
         question: string;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
-    verdict: "trivial" | "needs_review";
     rationale: string;
+    verdict: "trivial" | "needs_review";
     questions: {
         options: {
             label: string;
@@ -85,8 +85,8 @@ export declare const PlanTriageBlock: z.ZodEffects<z.ZodObject<{
         question: string;
     }[];
 }, {
-    verdict: "trivial" | "needs_review";
     rationale: string;
+    verdict: "trivial" | "needs_review";
     questions?: {
         options: {
             label: string;
@@ -96,8 +96,8 @@ export declare const PlanTriageBlock: z.ZodEffects<z.ZodObject<{
         question: string;
     }[] | undefined;
 }>, {
-    verdict: "trivial" | "needs_review";
     rationale: string;
+    verdict: "trivial" | "needs_review";
     questions: {
         options: {
             label: string;
@@ -107,8 +107,8 @@ export declare const PlanTriageBlock: z.ZodEffects<z.ZodObject<{
         question: string;
     }[];
 }, {
-    verdict: "trivial" | "needs_review";
     rationale: string;
+    verdict: "trivial" | "needs_review";
     questions?: {
         options: {
             label: string;
@@ -155,8 +155,8 @@ export declare const PlanTriageContent: z.ZodObject<{
     parseFallback: z.ZodBoolean;
     consumed: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    verdict: "trivial" | "needs_review";
     rationale: string;
+    verdict: "trivial" | "needs_review";
     questions: {
         options: {
             label: string;
@@ -169,8 +169,8 @@ export declare const PlanTriageContent: z.ZodObject<{
     consumed: boolean;
     sessionId?: string | undefined;
 }, {
-    verdict: "trivial" | "needs_review";
     rationale: string;
+    verdict: "trivial" | "needs_review";
     questions: {
         options: {
             label: string;

package/bundle/shared/dist/profile-snapshot.d.ts

@@ -0,0 +1,154 @@
+import { z } from "zod";
+import { WorkerSessionRole } from "./worker-sessions.js";
+/**
+ * The effective capabilities a worker session may exercise at the runtime boundary
+ * (ADR 0003 §Role permissions). Resolved once when the session is created and frozen
+ * into `worker_sessions.profile_snapshot_json` — a later profile edit never changes a
+ * queued or running session.
+ *
+ * Every field here is backed by a control this codebase can actually enforce from
+ * outside the worker process — a CLI tool-permission grant (`--allowedTools` /
+ * `-s read-only`) or a config-loading boundary (`--ignore-user-config`) — never a
+ * denylist over arguments to a capability (e.g. Bash) the worker already holds
+ * unrestricted, which a review round proved bypassable (absolute paths, `-C`, wrapper
+ * commands, or — for `push` — simply editing the very git config meant to restrict it,
+ * since that config lives inside the worktree the same process can already write).
+ * `push` / `openPr` are NOT modeled here for that reason: real enforcement needs those
+ * credentialed effects to move to a call the worker never makes itself (the coordinator,
+ * which already owns "the only component that publishes" for reviews) — developer→PR
+ * handoff scope (NOT-61+), not a profile toggle this ticket can honestly ship.
+ *
+ * Role defaults are the ceiling: a profile's `permissionPolicy` override may only
+ * *tighten* a capability (turn it off), never grant one the role does not have.
+ */
+export declare const PermissionPolicy: z.ZodObject<{
+    /** developer only: read/write files in its own worktree — CLI tool-grant enforced. */
+    worktreeWrite: z.ZodBoolean;
+    /** never true in v1 — the coordinator, not the reviewer, publishes the review. */
+    publishReview: z.ZodBoolean;
+    /** call outbound-mutation deck tools (`call_service_tool`). Off for both roles in v1. */
+    outboundMutation: z.ZodBoolean;
+    /** resolve human actions / edit workflow topology. Always off for workers. */
+    resolveHumanAction: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    worktreeWrite: boolean;
+    publishReview: boolean;
+    outboundMutation: boolean;
+    resolveHumanAction: boolean;
+}, {
+    worktreeWrite: boolean;
+    publishReview: boolean;
+    outboundMutation: boolean;
+    resolveHumanAction: boolean;
+}>;
+export type PermissionPolicy = z.infer<typeof PermissionPolicy>;
+/** The subset of a policy a profile may pin off. Absent field = use the role default. */
+export declare const PermissionPolicyOverride: z.ZodObject<{
+    worktreeWrite: z.ZodOptional<z.ZodBoolean>;
+    outboundMutation: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    worktreeWrite?: boolean | undefined;
+    outboundMutation?: boolean | undefined;
+}, {
+    worktreeWrite?: boolean | undefined;
+    outboundMutation?: boolean | undefined;
+}>;
+export type PermissionPolicyOverride = z.infer<typeof PermissionPolicyOverride>;
+export declare const DEVELOPER_ROLE_CEILING: PermissionPolicy;
+export declare const REVIEWER_ROLE_CEILING: PermissionPolicy;
+export declare function roleCeiling(role: z.infer<typeof WorkerSessionRole>): PermissionPolicy;
+/**
+ * Tiered reasoning / thinking effort for CLIs that expose it (Codex
+ * `model_reasoning_effort`, Claude Code `--effort`). Cursor has no separate flag —
+ * effort is only expressible inside a parameterized model id.
+ */
+export declare const ReasoningEffort: z.ZodEnum<["low", "medium", "high"]>;
+export type ReasoningEffort = z.infer<typeof ReasoningEffort>;
+/**
+ * The immutable execution contract snapshotted onto every `worker_session` at creation
+ * (design §`agents` / §"Immutable execution-profile snapshot"). Transcripts, findings,
+ * and usage stay owned by the issue/session — completing work never writes anything back
+ * into the profile.
+ */
+export declare const ProfileSnapshot: z.ZodObject<{
+    /** Schema version so an in-flight session stays reconstructable across format changes. */
+    version: z.ZodLiteral<1>;
+    agentId: z.ZodNullable<z.ZodString>;
+    role: z.ZodEnum<["developer", "reviewer", "legacy"]>;
+    runtime: z.ZodNullable<z.ZodEnum<["claude_code", "cursor_local", "codex_local"]>>;
+    model: z.ZodNullable<z.ZodString>;
+    /**
+     * Reasoning effort frozen with the session (NOT-81). `.default(null)` so snapshots
+     * written before this field still parse instead of invalidating the whole contract.
+     */
+    effort: z.ZodDefault<z.ZodNullable<z.ZodEnum<["low", "medium", "high"]>>>;
+    /** Serialized PhaseBudget; null = runtime default (no CLI caps). */
+    budgetJson: z.ZodNullable<z.ZodString>;
+    permissionPolicy: z.ZodObject<{
+        /** developer only: read/write files in its own worktree — CLI tool-grant enforced. */
+        worktreeWrite: z.ZodBoolean;
+        /** never true in v1 — the coordinator, not the reviewer, publishes the review. */
+        publishReview: z.ZodBoolean;
+        /** call outbound-mutation deck tools (`call_service_tool`). Off for both roles in v1. */
+        outboundMutation: z.ZodBoolean;
+        /** resolve human actions / edit workflow topology. Always off for workers. */
+        resolveHumanAction: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        worktreeWrite: boolean;
+        publishReview: boolean;
+        outboundMutation: boolean;
+        resolveHumanAction: boolean;
+    }, {
+        worktreeWrite: boolean;
+        publishReview: boolean;
+        outboundMutation: boolean;
+        resolveHumanAction: boolean;
+    }>;
+    /** Launch-selected Deck — required for new sessions; null only on legacy in-flight rows. */
+    deckId: z.ZodNullable<z.ZodString>;
+    purpose: z.ZodNullable<z.ZodString>;
+    capturedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    role: "developer" | "reviewer" | "legacy";
+    agentId: string | null;
+    runtime: "claude_code" | "cursor_local" | "codex_local" | null;
+    model: string | null;
+    budgetJson: string | null;
+    version: 1;
+    effort: "low" | "medium" | "high" | null;
+    permissionPolicy: {
+        worktreeWrite: boolean;
+        publishReview: boolean;
+        outboundMutation: boolean;
+        resolveHumanAction: boolean;
+    };
+    deckId: string | null;
+    purpose: string | null;
+    capturedAt: string;
+}, {
+    role: "developer" | "reviewer" | "legacy";
+    agentId: string | null;
+    runtime: "claude_code" | "cursor_local" | "codex_local" | null;
+    model: string | null;
+    budgetJson: string | null;
+    version: 1;
+    permissionPolicy: {
+        worktreeWrite: boolean;
+        publishReview: boolean;
+        outboundMutation: boolean;
+        resolveHumanAction: boolean;
+    };
+    deckId: string | null;
+    purpose: string | null;
+    capturedAt: string;
+    effort?: "low" | "medium" | "high" | null | undefined;
+}>;
+export type ProfileSnapshot = z.infer<typeof ProfileSnapshot>;
+export declare function parseProfileSnapshot(json: string | null | undefined): ProfileSnapshot | null;
+/** Serialized `string[]` helpers for the profile list columns. */
+export declare function serializeStringList(list: readonly string[] | null | undefined): string | null;
+export declare function parseStringList(json: string | null | undefined): string[];
+export declare function serializePermissionPolicyOverride(override: PermissionPolicyOverride | null | undefined): string | null;
+export declare function parsePermissionPolicyOverride(json: string | null | undefined): PermissionPolicyOverride | null;
+/** Apply a profile override to a role ceiling. Override can only turn capabilities off. */
+export declare function resolvePermissionPolicy(role: z.infer<typeof WorkerSessionRole>, override: PermissionPolicyOverride | null | undefined): PermissionPolicy;

package/bundle/shared/dist/profile-snapshot.js

@@ -0,0 +1,145 @@
+import { z } from "zod";
+import { Runtime } from "./runtime.js";
+import { WorkerSessionRole } from "./worker-sessions.js";
+/**
+ * The effective capabilities a worker session may exercise at the runtime boundary
+ * (ADR 0003 §Role permissions). Resolved once when the session is created and frozen
+ * into `worker_sessions.profile_snapshot_json` — a later profile edit never changes a
+ * queued or running session.
+ *
+ * Every field here is backed by a control this codebase can actually enforce from
+ * outside the worker process — a CLI tool-permission grant (`--allowedTools` /
+ * `-s read-only`) or a config-loading boundary (`--ignore-user-config`) — never a
+ * denylist over arguments to a capability (e.g. Bash) the worker already holds
+ * unrestricted, which a review round proved bypassable (absolute paths, `-C`, wrapper
+ * commands, or — for `push` — simply editing the very git config meant to restrict it,
+ * since that config lives inside the worktree the same process can already write).
+ * `push` / `openPr` are NOT modeled here for that reason: real enforcement needs those
+ * credentialed effects to move to a call the worker never makes itself (the coordinator,
+ * which already owns "the only component that publishes" for reviews) — developer→PR
+ * handoff scope (NOT-61+), not a profile toggle this ticket can honestly ship.
+ *
+ * Role defaults are the ceiling: a profile's `permissionPolicy` override may only
+ * *tighten* a capability (turn it off), never grant one the role does not have.
+ */
+export const PermissionPolicy = z.object({
+    /** developer only: read/write files in its own worktree — CLI tool-grant enforced. */
+    worktreeWrite: z.boolean(),
+    /** never true in v1 — the coordinator, not the reviewer, publishes the review. */
+    publishReview: z.boolean(),
+    /** call outbound-mutation deck tools (`call_service_tool`). Off for both roles in v1. */
+    outboundMutation: z.boolean(),
+    /** resolve human actions / edit workflow topology. Always off for workers. */
+    resolveHumanAction: z.boolean(),
+});
+/** The subset of a policy a profile may pin off. Absent field = use the role default. */
+export const PermissionPolicyOverride = z
+    .object({
+    worktreeWrite: z.boolean().optional(),
+    outboundMutation: z.boolean().optional(),
+})
+    .strict();
+export const DEVELOPER_ROLE_CEILING = {
+    worktreeWrite: true,
+    publishReview: false,
+    outboundMutation: false,
+    resolveHumanAction: false,
+};
+export const REVIEWER_ROLE_CEILING = {
+    worktreeWrite: false,
+    publishReview: false,
+    outboundMutation: false,
+    resolveHumanAction: false,
+};
+export function roleCeiling(role) {
+    return role === "developer" ? DEVELOPER_ROLE_CEILING : REVIEWER_ROLE_CEILING;
+}
+/**
+ * Tiered reasoning / thinking effort for CLIs that expose it (Codex
+ * `model_reasoning_effort`, Claude Code `--effort`). Cursor has no separate flag —
+ * effort is only expressible inside a parameterized model id.
+ */
+export const ReasoningEffort = z.enum(["low", "medium", "high"]);
+/**
+ * The immutable execution contract snapshotted onto every `worker_session` at creation
+ * (design §`agents` / §"Immutable execution-profile snapshot"). Transcripts, findings,
+ * and usage stay owned by the issue/session — completing work never writes anything back
+ * into the profile.
+ */
+export const ProfileSnapshot = z.object({
+    /** Schema version so an in-flight session stays reconstructable across format changes. */
+    version: z.literal(1),
+    agentId: z.string().nullable(),
+    role: WorkerSessionRole,
+    runtime: Runtime.nullable(),
+    model: z.string().nullable(),
+    /**
+     * Reasoning effort frozen with the session (NOT-81). `.default(null)` so snapshots
+     * written before this field still parse instead of invalidating the whole contract.
+     */
+    effort: ReasoningEffort.nullable().default(null),
+    /** Serialized PhaseBudget; null = runtime default (no CLI caps). */
+    budgetJson: z.string().nullable(),
+    permissionPolicy: PermissionPolicy,
+    /** Launch-selected Deck — required for new sessions; null only on legacy in-flight rows. */
+    deckId: z.string().nullable(),
+    purpose: z.string().nullable(),
+    capturedAt: z.string(),
+});
+export function parseProfileSnapshot(json) {
+    if (!json?.trim())
+        return null;
+    try {
+        return ProfileSnapshot.parse(JSON.parse(json));
+    }
+    catch {
+        return null;
+    }
+}
+/** Serialized `string[]` helpers for the profile list columns. */
+export function serializeStringList(list) {
+    if (!list)
+        return null;
+    const cleaned = list.map((s) => s.trim()).filter(Boolean);
+    return cleaned.length ? JSON.stringify(cleaned) : null;
+}
+export function parseStringList(json) {
+    if (!json?.trim())
+        return [];
+    try {
+        const parsed = JSON.parse(json);
+        return z.array(z.string()).parse(parsed);
+    }
+    catch {
+        return [];
+    }
+}
+export function serializePermissionPolicyOverride(override) {
+    if (!override)
+        return null;
+    const entries = Object.entries(override).filter(([, v]) => v !== undefined);
+    return entries.length ? JSON.stringify(Object.fromEntries(entries)) : null;
+}
+export function parsePermissionPolicyOverride(json) {
+    if (!json?.trim())
+        return null;
+    try {
+        return PermissionPolicyOverride.parse(JSON.parse(json));
+    }
+    catch {
+        return null;
+    }
+}
+/** Apply a profile override to a role ceiling. Override can only turn capabilities off. */
+export function resolvePermissionPolicy(role, override) {
+    const ceiling = roleCeiling(role);
+    if (!override)
+        return { ...ceiling };
+    const resolved = { ...ceiling };
+    for (const key of ["worktreeWrite", "outboundMutation"]) {
+        if (override[key] === false)
+            resolved[key] = false;
+        // override[key] === true can never raise the ceiling — ignored.
+    }
+    return resolved;
+}

package/bundle/shared/dist/profile-snapshot.test.d.ts

@@ -0,0 +1 @@
+export {};

package/bundle/shared/dist/profile-snapshot.test.js

@@ -0,0 +1,67 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { parsePermissionPolicyOverride, parseProfileSnapshot, parseStringList, resolvePermissionPolicy, serializePermissionPolicyOverride, serializeStringList, } from "./profile-snapshot.js";
+test("serializeStringList trims, drops blanks, and returns null when empty", () => {
+    assert.equal(serializeStringList(["  a ", "", "b"]), JSON.stringify(["a", "b"]));
+    assert.equal(serializeStringList([]), null);
+    assert.equal(serializeStringList(null), null);
+    assert.deepEqual(parseStringList(serializeStringList(["x", "y"])), ["x", "y"]);
+    assert.deepEqual(parseStringList("not json"), []);
+});
+test("resolvePermissionPolicy: override only tightens, never loosens", () => {
+    assert.equal(resolvePermissionPolicy("developer", { outboundMutation: false }).outboundMutation, false);
+    assert.equal(resolvePermissionPolicy("developer", { outboundMutation: false }).worktreeWrite, true);
+    assert.equal(resolvePermissionPolicy("reviewer", { worktreeWrite: true }).worktreeWrite, false);
+});
+test("permission-policy override serialization round-trips; parse rejects unknown keys", () => {
+    assert.equal(serializePermissionPolicyOverride({ worktreeWrite: false }), JSON.stringify({ worktreeWrite: false }));
+    assert.equal(serializePermissionPolicyOverride(null), null);
+    assert.deepEqual(parsePermissionPolicyOverride(JSON.stringify({ worktreeWrite: false })), {
+        worktreeWrite: false,
+    });
+    // push/openPr are not a recognized override key (never modeled — see PermissionPolicy
+    // doc comment) and resolveHumanAction is not overridable either; both are rejected.
+    assert.equal(parsePermissionPolicyOverride(JSON.stringify({ push: false })), null);
+    assert.equal(parsePermissionPolicyOverride(JSON.stringify({ resolveHumanAction: true })), null);
+});
+test("parseProfileSnapshot round-trips a valid snapshot and rejects junk", () => {
+    const snap = {
+        version: 1,
+        agentId: "a1",
+        role: "reviewer",
+        runtime: "claude_code",
+        model: null,
+        effort: "medium",
+        budgetJson: null,
+        permissionPolicy: resolvePermissionPolicy("reviewer", null),
+        deckId: "00000000-0000-4000-a000-000000000099",
+        purpose: null,
+        capturedAt: new Date().toISOString(),
+    };
+    assert.deepEqual(parseProfileSnapshot(JSON.stringify(snap)), snap);
+    assert.equal(parseProfileSnapshot("{}"), null);
+    assert.equal(parseProfileSnapshot(null), null);
+});
+test("parseProfileSnapshot strips legacy workspace/playbook/memory fields (NOT-149)", () => {
+    const legacy = {
+        version: 1,
+        agentId: "a1",
+        role: "developer",
+        runtime: "codex_local",
+        model: "gpt-5",
+        budgetJson: null,
+        permissionPolicy: resolvePermissionPolicy("developer", null),
+        deckId: null,
+        workspaceRoot: "/repo",
+        playbookIds: ["pb_x"],
+        externalMemoryRefs: ["vault://x"],
+        purpose: null,
+        capturedAt: new Date().toISOString(),
+    };
+    const parsed = parseProfileSnapshot(JSON.stringify(legacy));
+    assert.ok(parsed);
+    assert.equal(parsed.effort, null);
+    assert.equal("workspaceRoot" in parsed, false);
+    assert.equal("playbookIds" in parsed, false);
+    assert.equal("externalMemoryRefs" in parsed, false);
+});

package/bundle/shared/dist/queue-entries.d.ts

@@ -0,0 +1,89 @@
+import { z } from "zod";
+import type { WorkflowInstance } from "./workflow.js";
+export declare const QueueEntryState: z.ZodEnum<["queued", "admitted", "removed"]>;
+export type QueueEntryState = z.infer<typeof QueueEntryState>;
+export declare const QueueEntry: z.ZodObject<{
+    id: z.ZodString;
+    issueId: z.ZodString;
+    position: z.ZodNumber;
+    enqueuedAt: z.ZodString;
+    state: z.ZodEnum<["queued", "admitted", "removed"]>;
+    waitReason: z.ZodNullable<z.ZodString>;
+    waitReasonAt: z.ZodNullable<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    issueId: string;
+    position: number;
+    enqueuedAt: string;
+    state: "queued" | "admitted" | "removed";
+    waitReason: string | null;
+    waitReasonAt: string | null;
+}, {
+    id: string;
+    issueId: string;
+    position: number;
+    enqueuedAt: string;
+    state: "queued" | "admitted" | "removed";
+    waitReason: string | null;
+    waitReasonAt: string | null;
+}>;
+export type QueueEntry = z.infer<typeof QueueEntry>;
+/** Enriched row for GET /api/queue — includes issue title for UI/CLI. */
+export declare const QueueEntryView: z.ZodObject<{
+    id: z.ZodString;
+    issueId: z.ZodString;
+    position: z.ZodNumber;
+    enqueuedAt: z.ZodString;
+    state: z.ZodEnum<["queued", "admitted", "removed"]>;
+    waitReason: z.ZodNullable<z.ZodString>;
+    waitReasonAt: z.ZodNullable<z.ZodString>;
+} & {
+    title: z.ZodOptional<z.ZodString>;
+    issueStatus: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    issueId: string;
+    position: number;
+    enqueuedAt: string;
+    state: "queued" | "admitted" | "removed";
+    waitReason: string | null;
+    waitReasonAt: string | null;
+    title?: string | undefined;
+    issueStatus?: string | undefined;
+}, {
+    id: string;
+    issueId: string;
+    position: number;
+    enqueuedAt: string;
+    state: "queued" | "admitted" | "removed";
+    waitReason: string | null;
+    waitReasonAt: string | null;
+    title?: string | undefined;
+    issueStatus?: string | undefined;
+}>;
+export type QueueEntryView = z.infer<typeof QueueEntryView>;
+export declare const EnqueueIssueInput: z.ZodObject<{
+    issueId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    issueId: string;
+}, {
+    issueId: string;
+}>;
+export type EnqueueIssueInput = z.infer<typeof EnqueueIssueInput>;
+/**
+ * NOT-118 `POST /api/issues/:id/start` response. Start has no queue bypass: it moves the
+ * issue to the front and admits it when a slot is free, otherwise it waits at the top with
+ * a reason. `workItem` is the round-1 developer item the admitted start enqueued.
+ */
+export type StartIssueResponse = {
+    state: "admitted";
+    instance: WorkflowInstance;
+    workItem: {
+        id: string;
+        kind: string;
+    };
+} | {
+    state: "queued";
+    position: number;
+    waitReason: string | null;
+};

package/bundle/shared/dist/queue-entries.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+export const QueueEntryState = z.enum(["queued", "admitted", "removed"]);
+export const QueueEntry = z.object({
+    id: z.string().uuid(),
+    issueId: z.string().uuid(),
+    position: z.number().int(),
+    enqueuedAt: z.string(),
+    state: QueueEntryState,
+    waitReason: z.string().nullable(),
+    waitReasonAt: z.string().nullable(),
+});
+/** Enriched row for GET /api/queue — includes issue title for UI/CLI. */
+export const QueueEntryView = QueueEntry.extend({
+    title: z.string().optional(),
+    issueStatus: z.string().optional(),
+});
+export const EnqueueIssueInput = z.object({
+    issueId: z.string().uuid(),
+});

package/bundle/shared/dist/result-qa.d.ts

@@ -13,7 +13,7 @@ export declare const ResultQaContent: z.ZodObject<{
     answeredAt: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    status: "pending" | "answered" | "failed";
+    status: "failed" | "pending" | "answered";
     question: string;
     exchangeId: string;
     sessionResumed: boolean;
@@ -22,7 +22,7 @@ export declare const ResultQaContent: z.ZodObject<{
     answer?: string | undefined;
     error?: string | undefined;
 }, {
-    status: "pending" | "answered" | "failed";
+    status: "failed" | "pending" | "answered";
     question: string;
     exchangeId: string;
     sessionResumed: boolean;